Web Application Penetration Testing

Welcome to our comprehensive guide on Web Application Penetration Testing (WAPT). In this, I added labs methodologies used to identify vulnerabilities in web ap

All labs | Web Security AcademyWebSecAcademy

Checklist

Information Gathering

• Manually explore the site

• Spider/crawl for missed or hidden content

• Check for files that expose content, such as robots.txt, sitemap.xml, .DS_Store, js files

• Check for differences in content based on User Agent (eg, Mobile sites, access as a Search engine Crawler)

• Identify user roles

• Identify application entry points

• Identify co-hosted and subdomains

Configuration Management

• Check for commonly used administrative URLs

• Check for old, backup and unreferenced files

• Check HTTP methods supported

• Check for sensitive data in client-side code (e.g. API keys, credentials)

Authentication

• Test for user enumeration

• Test for authentication bypass

• Test for brute force protection

• Test password quality rules

• Test password reset and/or recovery

• Test password change process

• Test CAPTCHA

• Test multi factor authentication

• Test for default logins

• Test for known vulnerabilities and configuration issues on Web Server and Web Application

• Test for default or guessable password

Session Management

• Check session termination after logout

• Test session cookies for randomness

• Confirm that new session tokens are issued on login, role change and logout

• Test for consistent session management across applications with shared session management

• Test for CSRF

Authorization

• Test for path traversal

• Test for bypassing authorization schema

• Test for vertical Access control problems (a.k.a. Privilege Escalation)

• Test for horizontal Access control problems (between two users at the same privilege level)

• Test for missing authorization

Injection Vulnerabilities

• Test for Reflected Cross Site Scripting

• Test for Stored Cross Site Scripting

• Test for DOM based Cross Site Scripting

• Test for HTML Injection

• Test for SQL Injection

• Test for LDAP Injection

• Test for XXE Injection

• Test for Code Injection

• Test for Command Injection

• Test for HTTP Smuggling

• Test for Open Redirection

• Test for Local File Inclusion

• Test for Remote File Inclusion

• Test for NoSQL injection

• Test for HTTP parameter pollution

• Test for Mass Assignment

• Test for NULL/Invalid Session Cookie

Business Logic

• Test for feature misuse

• Test for user roles (adding/removing)

File Uploads

• Test that acceptable file types are whitelisted

• Test that file size limits, upload frequency and total file counts are defined and are enforced

• Test that file contents match the defined file type

• Test that all file uploads have Anti-Virus scanning in-place.

• Test that unsafe filenames are sanitized

• Test that uploaded files are not directly accessible within the web root

• Test that uploaded files are not served on the same hostname/port

• Test that files and other media are integrated with the authentication and authorization schemas