Before we dive into penetration testing I think it's super important to talk about the loss.
Top 10 and to provide this checklist with a watch that we're gonna be using.
And first of all let's just talk about a loss.
So a loss stands for the open web application security project.
This is the web app reference.
1 0 1.
I have no better way to put it.
This is the go to place when it comes to web application penetration testing.
It's a loss.
And you're going to hear this all over the place especially when it comes to web application penetration
testing and you're going to hear interview questions and all kinds of stuff related to this.
So what I want you to do is I just want you to go out to Google and you know go to the lost Web site
explore around see what's interesting here.
The one thing I do want to point out is there is the top 10 and this is great.
Right here we could open this a new tab.
They also have this cheat cheat series that they're starting so you can go into here and say you're
looking for specific cheat sheets you can look for cheat cheats on unlike say cross site scripting which
we haven't gotten to any of this but it'll tell you hey like here's all the different ways that you
can test for cross-eyed scripting here's different payloads.
Here's how to attack.
And it's really nice and they give you all different kinds of of ways to attack and you know we're going
to be covering the top 10 in this course which here's the top 10 the top 10 being the what they consider
the top 10 most popular weaknesses in a web application and what a any company or organization should
be aware of.
So these change from year to year right now there are in the 2017 version of it and you could just click
on this here and kind of get an idea of what some of the top 10 are.
Now there are at least over 100 different ways to exploit a Web site.
Probably way way above that.
OK.
And there's all different kinds of vulnerabilities that you could check for the top 10 are considered
the most critical.
Now these are what your employer.
Potential employer are probably going to interview you on these 10 topics.
And it's important to know what they are.
You don't have to like know specifically one through ten have it memorized.
It doesn't hurt.
Sometimes like in an interview I've been asked OK.
You know what is the number one on the top 10.
And you should know it's injection.
But I couldn't tell you that security in this configuration was number six for example.
But you know you might have some of those trivia questions but more than likely what they're going to
ask you is what is an X AML external entity.
How would you go about exploiting that.
OK.
You've exploited it.
Now how would you go about defending that.
How could you instruct a client to defend against this.
And in my experience being able to talk to developers is one of the hardest things especially if you're
not a developer.
Previously I was not a developer I don't come from a development background.
So when you're doing a web app assessment you have to imagine the situation that you're in you are attacking
a Web site or web application that has been developed by people and then you have to go face to face
of those people and tell them what's wrong with their Web site or what's wrong with their web application
and they can become defensive.
And it's very easy to you know you're beating up their baby it's it's their pride and joy of.
And they nobody wants to be told that they've left flaws in an application or anything.
So sometimes it can get combative not to scare anybody away but just to prepare you for those situations.
So having a good understanding of what you are exploiting and why it's vulnerable and also how to fix
it is super important because that way you can relay that to the dev and the better that you are talking
about it the more respect you're going to get in a room and the less likely that there's going to be
combativeness because you're gonna be able to hold your own against people that are developers.
So with that being all of the way we're going to be covering these top 10 here and if you want you can
scroll through this and just read through the different top 10 it has them here and how it's changed
between you know 2013 2017 and come right through and it gives you a high level overview of all the
different types of flaws and you can come right to injection here and it talks about the different types
of injection how to prevent it you know is it vulnerable.
And then it gives you all different kinds of references.
Here's all the different types of cheat sheets that are available to you.
And just these CW ease as well which are just another thing to look at Port swingers another thing to
look at as well.
There's all different kinds of things here.
Example scenarios.
So this is very very well laid out and it's just a fantastic resource for anybody looking to get into
web application testing web apps are overwhelming.
But the more you read up the more you study the more you just keep into the times the better off you're
going to be.
So with that all being said let's go to Google one more time or two more times here and what I want
you to download is this a last checklist.
So go just google a last checklist.
Get hub and this tan profit in here.
This first one that comes up.
You can just click on this and you should be looking for an Excel sheet.
And let me bring that up on my end.
So this excel sheet I have witnessed firsthand hand save an assessment and I'll explain that here in
a second but here you have a checklist.
And if you scroll through it there are one hundred and twenty four different things to test for.
And this is what they consider you know you need to test for when you're testing a web application and
what's nice is it says Hey what are you doing.
Well we know where we start with information gathering.
So we're going to conduct search engine discovery right.
Going way back to what we were doing with information gathering in the beginning of this series.
That makes sense.
And it says Hey Google hacking you can use tools like site Digger show dad etc. and then you have a
checklist you could say yeah I did this it has no issues or it has issues or not applicable.
And it tells you a description.
That's great.
Part two of this.
That's actually fantastic.
Two is if you come over and you go to Google one more time and you say a last checklist PDA f the first
thing that comes up is this a last testing guy and I'll provide links to both of these in the description
are the references section but if you click on this and you see here I was chasing guy 4.0.
Now you can scroll through this and it might take just a little bit.
I'm going to try to cheat a little bit and scroll down and what happens is eventually you're gonna come
run into the same checklist area so you're going to run into info dash 0 0 1.
I believe it starts starts at three.
Chapter Three here.
So it covers the framework or actually chapter four.
I apologize.
And you come through here and you have t 0 0 1 and this is on page 30 so 0 0 0 1.
If we go back to our excel you could see OTB 0 0 1.
OK.
And what's nice about the PD F is it says hey here's what you're looking for.
Here's the test objectives here's how you test it and it gives you all different tools examples etc.
what you can be looking for in here.
And then it goes into 0 0 2 and goes right through it.
When I first started out pen testing against web apps and still to this day I used a little bit less.
I still use it.
I use this PPF like you know I went literally line by line on this.
I use the PD F and I tested for every single thing in here so I left no stone unturned and that's kind
of the story time I want to get into your quick and why having a checklist is important and then we'll
wrap up the video.
So this checklist one time I was sitting with a very much senior web app Tester a brilliant guy you
know I would trust him to test a web app and what had happened is we had been testing this Web site
this whole time and testing this Web site and we weren't really finding anything you know but we weren't
also we weren't using a checklist.
We're just kind of going off methodology from his head and you know just testing the application as
he saw it and he was like you know the last thing I do in an assessment is I go back and I go through
the checklist and I check the boxes and I say yes I do this.
No I didn't.
And while we were scrolling through the list and then there came up something about you know checking
on the account creation parameters or assigning parameters and there was something I was going to use
this to type in here.
There was something when you were creating an account that said admin equals false.
So what if you were intercept your requests and change it to add on equals true.
Well guess what.
It made the account an admin when you registered.
Now had he not checked the checklist he would have just let this mentally lapse it didn't mean that
he didn't know how to test for this or what he was looking for.
It just means that the testing here is overwhelming again is one hundred and twenty something of these
to look for you know you're bound to forget about one or two.
It's just human nature.
You know most people are not really capable of memorizing this.
So please utilize a checklist in your testing.
It's it's so useful you have all these resources available to you and you should take advantage of them
fully.
So that's my spiel on this.
Again I use this.
I give this to a client every time I have my notes in here and I'll I'll make the notation that way
when we go back we can reference anything or any questions they might have when it comes down to what
I looked at and what I saw and what I didn't see.
So from here we're gonna go ahead and do some installs to get our setup ready and we're going to start
talking about birth sleep more in depth after that and start working through the top 10.
So let's go ahead and move on to the next video.