Let us conclude this section by saying the Web application penetration testing methodology, like we
have seen different types of attacks, but how to carry out and what steps should we use these attacks
to perform a proper penetration test?
Now, Web application and testing is used to identify, analyze and report vulnerabilities such as input
validation, buffer overflow, good injection, bypassing authentication, code execution in a given
application.
The best way to conduct a penetration test is to perform a series of methodical and repeatable tests
and to work through all the different application vulnerabilities.
The obvious question is why do we need the application penetration testing?
First, identification of ports.
Second, remediation of vulnerabilities.
And third, verification of vulnerabilities.
Now we will see the workflow of the application penetration testing.
The first is to define an object.
You should define the objective and scope of your penetration test.
The next is information gathering fields when you get information related to the target domain website.
Then this configuration management testing, authentication testing or authorization testing.
Session management testing.
Denial-of-service testing, data validation testing, business logic testing, lipservice testing,
Ajax's testing.
And then finally, you have to document all these findings and to prepare a report.
Now, let us see how to perform information gathering, penetration testing.
First, analyze the Roubaud not to file, which means allowed and disallowed directories, now retrieve
and analyze Roubaud file using tools such as Jianyu WGL, then use the advanced site search operator
and then click cached to perform InGen recognisance, use different types of search engines like Shodan,
Doctor, Google and etc and others to perform the footprinting of the application.
The next is identified application entry points identify application entry points using tools such as
the grab BOPE suite or apps.
Zap temporary or tamper data for Firefox then is to identify the web applications.
That is true before you are allowed to do dictionary style searching both on vulnerability scanning,
using tools such as and map analysis.
Implement techniques such as a DNS zone, transpose DNS inverse queries, Web based DNS searches, Google
Dorking and etc. analyze error codes by requesting invalid pages and utilize alternate request methods
in order to collect confidential information from the server.
Examine the source code from the accessible pages of the application frontin.
Test for recognized file types, extension directories by requesting common file extensions such as
dot, ASV, dot, html, dot, BHP, Dot EXI and watch for any unusual output of error codes.
Perform PXP ICMP unserviced fingerprinting using traditional fingerprinting tools such as in.
Use information gathering tools like tree track harvester Oystein, defraying, multicore together Ashmore's
as information possible.
Next is to find out the server side technology that is being deployed by the Web application using built
with Web Archive and others.
Then you can find domains in subdomains using the oil and the tools or DNS dumpster.
Do not forget to document all these findings after the information gathering phase.
Next comes authentication testing in this try to reset passwords by getting social engineering or cracking
secret questions, check.
If I remember, my password mechanism is implemented by checking the HTML call of the login page.
Check if it is possible to reuse a session after log out.
Also, check if the application automatically logs out of a user, then that user has been idle for
a certain amount of time and that no sensitive data remains stored in the browser cache.
Identify all the parameters that are sent in addition to the decoded capture value from the client to
the server, and then try to send an all decoded capture value with an all capture ID of an all session
idee.
Check if users hold a hardware device of some kind, in addition to the password, check of the hardware
device communicates directly and independently with the authentication infrastructure using an additional
communication channel.
And finally, I turn to, for a race condition, make multiple simultaneous requests while observing
the outcome for unexpected behavior, both on the court review and then finally document all the findings.
Next is session management testing.
Collect sufficient number of cookie samples, analyze the cookie generation algorithm and forge a valid
cookie in order to perform the attack.
Test for cookie attributes using intercepting proxies such as whips, crab bulbs, sweet or upset or
traffic intercepting browsers.
To test for Session's fixation, make a request to the site to be tested and then analyze vulnerabilities
using the Web scrap tool.
Test for exposed session labels by inspecting encryption and reuse of Session Tolkan and Proxy's and
Gashing.
Examine the world in the restricted area to test for cross site request forgery, that is Kiselev.
Finally, do not forget to document all the findings.
The next is authorization testing here test for patha travel by performing the input that enumeration
and analyzing the input validation functions to present in the application.
Test for bypassing passing authorization schema by examining the admin functionalities to gain access
to the resource assigned to a different rule check if attacker can gain privileges by using privileges,
escalation tools and attacks, and also check for parameter tampering when their abilities finally do
not forget.
Document all the findings.
So this was the perfect method to how to carry out a penetration test, if you are more interested in
knowing I have attached a book for a Web application, you can refer that it is really a long book of,
I guess, 800 or 900 pages, but it really covers the Web application penetration testing in very detail.
And most other security experts refer to that book.
So do not forget to write a review for our cause if you are really liking our course.
Please do not forget to leave a review as it will really help us to create more courses and add different
lectures to this interesting ethical ethical hacking course.
So do not forget to like the video and please share a review and please share your experience through
the review option.
I will see you in the next lecture where we are going to discuss the preventive measures that we can
take to prevent a Web application from facing an attack.