Saturday, December 2, 2023

Web Application Penetration Testing Checklist – A Detailed Cheat Sheet

Web Application Pentesting is a method of identifying, analyzing, and Report the vulnerabilities which are existing in the Web application including buffer overflow, input validation, code Execution, Bypass Authentication, SQL Injection, CSRF, and Cross-site scripting in the target web Application which is given for Penetration Testing.

Repeatable Testing and Conduct a Serious Method One of the Best Methods conduct Web Application Penetration Testing for all kinds of web application vulnerabilities.

Table of Contents

Web Application Penetration Testing Checklist
Information Gathering
Authentication Testing
Authorization Testing
Configuration  Management Testing
Session Management Testing
Data Validation Testing
Denial of Service Testing

Web Application Penetration Testing Checklist

Information Gathering

1. Retrieve and Analyze the robot.txt files by using a tool called GNU Wget.

2. Examine the version of the software. database Details, the error technical component, and bugs by the error codes by requesting invalid pages.

3. Implement techniques such as DNS inverse queries, DNS zone Transfers, and web-based DNS Searches.

4. Perform Directory style Searching and vulnerability scanning and probe for URLs, using tools such as NMAP and Nessus.

5. Identify the Entry point of the application using Burp Proxy, OWSAP ZAP, TemperIE, and WebscarabTemper Data.

6. By using traditional Fingerprint Tools such as Nmap, and Amap, perform TCP/ICMP and service Fingerprinting.

7. By Requesting Common File Extension such as.ASP, EXE, .HTML, .PHP, Test for recognized file types/Extensions/Directories.

8. Examine the Source code From the Accessing Pages of the Application front end.

web app

Authentication Testing

1. Check if it is possible to “reuse” the session after logging out. also, check if the application automatically logs out if a user has been idle for a certain amount of time.

2. Check whether any sensitive information Remains Stored stored in the browser cache.

3. Check and try to Reset the password, by social engineering cracking secretive questions, and guessing.

4. check if the “Remember my password” Mechanism is implemented by checking the HTML code of the login page.

5. Check if the hardware devices directly communicate and independently with authentication infrastructure using an additional communication channel.

6. Test CAPTCHA for authentication vulnerabilities presented or not.

7. Check whether any weak security questions/Answers are presented.

8. A successful SQL injection could lead to the loss of customer trust and attackers can steal phone numbers, addresses, and credit card details. Placing a web application firewall can filter out malicious SQL queries in the traffic.

Authorization Testing

1. Test the Role and Privilege Manipulation to Access the Resources.

2. Test For Path Traversal by Performing input Vector Enumeration and analyze the input validation functions presented in the web application.

3. Test for cookie and parameter Tampering using web spider tools.

4. Test for HTTP Request Tempering and check whether to gain illegal access to reserved resources.

Configuration  Management Testing

1. Check the directory and File Enumeration review server and application Documentation. also, check the infrastructure and application admin interfaces.

2. Analyze the Web server banner and Perform network scanning.

3. Check and verify the presence of old Documentation and Backup and referenced files such as source codes, passwords, and installation paths.

4. check and identify the ports associated with the SSL/TLS services using NMAP and NESSUS.

5. Review OPTIONS HTTP method using Netcat and Telnet.

6. Test for HTTP methods and XST for credentials of legitimate users.

7. Perform application configuration management test to review the information of the source code, log files, and default Error Codes.

Session Management Testing

1. Check the URLs in the Restricted area to Test for cross-site Request Forgery.

2. Test for Exposed Session variables by inspecting Encryption and reuse of session token, Proxies, and caching, GET&POST.

3. Collect a sufficient number of cookie samples analyze the cookie sample algorithm and forge a valid Cookie in order to perform an Attack.

4. Test the cookie attribute using intercept proxies such as Burp Proxy, OWASP ZAP, or traffic intercept proxies such as Temper Data.

5. Test the session Fixation, to avoid sealing the user session. (session Hijacking )

Data Validation Testing

1. Performing Source code Analysis for javascript Coding Errors.

2. Perform Union Query SQL injection testing, standard SQL injection Testing, and blind SQL query Testing, using tools such as sqlninja, sqldumper, sql power injector etc.

3. Analyze the HTML Code, Test for stored XSS, and leverage stored XSS, using tools such as XSS proxy, Backframe, Burp Proxy, OWASP, ZAP, and XSS Assistant.

4. Perform LDAP injection testing for sensitive information about users and hosts.

5. Perform IMAP/SMTP injection Testing to Access the Backend Mail server.

6. Perform XPATH Injection Testing for Accessing the confidential information

7. Perform XML injection testing to know information about XML Structure.

8. Perform Code injection testing to identify input validation Errors.

9. Perform Buffer Overflow testing for Stack and heap memory information and application control flow.

10. Test for HTTP Splitting and smuggling for cookies and HTTP redirect information.

Denial of Service Testing

1. Send Any Large number of Requests that perform database operations and observe any Slowdown and  New Error Messages.

2. Perform manual source code analysis and submit a range of input varying lengths to the applications

3. Test for SQL wildcard attacks for application information testing. Enterprise Networks should choose the best DDoS Attack prevention services to ensure DDoS attack protection and prevent their network

4. Test for User specifies object allocation whether a maximum number of objects that the application can handle.

5. Enter an extremely large number of the input fields used by the application as a Loop counter. Protect your website from future attacks Also Check your Company’s DDOS Attack Downtime Cost.

6. Use a script to automatically submit an extremely long value so the server can log the request.

Also Read:


Latest articles

Active Attacks Targeting Google Chrome & ownCloud Flaws: CISA Warns

The CISA announced two known exploited vulnerabilities active attacks targeting Google Chrome & own...

Cactus Ransomware Exploiting Qlik Sense code execution Vulnerability

A new Cactus Ransomware was exploited in the code execution vulnerability to Qlik Sense...

Hackers Bypass Antivirus with ScrubCrypt Tool to Install RedLine Malware

The ScrubCrypt obfuscation tool has been discovered to be utilized in attacks to disseminate the RedLine Stealer...

Hotel’s Hacked Logins Let Attacker Steal Guest Credit Cards

According to a recent report by Secureworks, a well-planned and advanced phishing attack was...

Critical Zoom Vulnerability Let Attackers Take Over Meetings

Zoom, the most widely used video conferencing platform has been discovered with a critical...

Hackers Using Weaponized Invoice to Deliver LUMMA Malware

Hackers use weaponized invoices to exploit trust in financial transactions, embedding malware or malicious...

US-Seized Crypto Currency Mixer Used by North Korean Lazarus Hackers

The U.S. Treasury Department sanctioned the famous cryptocurrency mixer Sinbad after it was claimed...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles