Attackers gain unauthorized access to default accounts, read unused pages, exploit unpatched flaws, and read or write unprotected files and directories, etc. by using misconfiguration vulnerabilities. Server misconfiguration can take place at any level of an application attack, including the following: Platform Web server Application server Framework Custom code The following are server configuration problems: Server software flaws Enabling unnecessary services Improper authentication Unpatched security flaws Injection flaws Injection flaws are the vulnerabilities where a foreign agent illegally uses a sub-system. They are the vulnerability holes that can be used to attack applications. It is the most common technique of attacking a database. Injection occurs when user-supplied data is sent to an interpreter as part of a command or query. The attacker's hostile data tricks the interpreter into executing involuntary commands or changing data. Injection flaws include XSS (HTML Injection) and SQL Injection. In SQL injection, malicious SQL queries are injected into user input methods. In command injection, malicious code is injected via a Web application. In LDAP injection, malicious LDAP statements are injected. The following are countermeasures against injection flaws attacks: Avoid accessing external interpreters wherever possible and use library API's. Use prepared statement or stored procedures to overcome the SQL injection attack. Ensure that the Web application runs only with minimum privileges. Validate data while making calls to backend databases. SQL injection attacks SQL injection attacks use a series of malicious SQL queries for direct manipulation of the database. To bypass normal security measures and access the valuable data, an attacker can use a vulnerable Web application. SQL injection attacks are generally executed from the address bar, from within application fields, and via queries and searches. Command injection attacks
JSESSIONID: Java ASPSESSIONID: IIS server ASP.NET_SessionId: ASP.NET PHPSESSIS: PHP Identify server-side functionality Page source and URLs are examined and an educated guess is made in order to determine the internal structure and functionality of Web applications. Tools such as Wget, Teleport Pro, and BlackWidow are used to identify server-side functionality. Attack authentication mechanism Design and implementation flaws in Web applications can be exploited by attackers to bypass authentication mechanisms. A failure to check password strength or insecure transportation of credentials can exploit design and implementation flaws in Web applications. Username enumeration The trial-and-error method can be used to guess the users of the application if login error states the part of the username and password that is incorrect. There are some applications that automatically produce account usernames depending on a sequence such as username211, username212, username213, etc. and attackers can find the sequence and enumerate valid usernames. Password attacks Password changing: Spider the application or create a login account to determine password change functionality within the application. In order to identify vulnerabilities in password change functionality, try random strings for "Old Password", "New Password", and "Confirm the New Password" fields and analyze errors. Password recovery: For password recovery, an attacker can use social engineering to guess the password if the number of attempts is not limited. Applications may also send a unique recovery URL or existing password to email the address specified by the attacker. "Remember Me" exploit: A simple persistent cookie, such as RememberUser=mark or a persistent session identifier, such as RememberUser=ABY15982010 can be used to implement "Remember Me" functions. Attackers can bypass the authentication mechanism by using an enumerated username or predicting the session identifier. In password guessing, attackers use most commonly used passwords, footprinting target, and social engineering techniques to create a list of possible passwords, and try each password until the correct password is found. Attackers can use tools such as Dictionary Maker to create dictionary of all possible passwords. This helps them to perform dictionary attacks. Password guessing can be carried out manually or using automated tools such as WebCracker, Brutus, Burp Insider, and THC-Hydra, etc.
bypassing authentication, and code execution. Conducting a series of methodical and repeatable tests and going through all the different application vulnerabilities is the best way to perform penetration testing. Web application pen testing is required due to the following reasons: Identification of ports: The ports are scanned in order to identify the associated running services and perform automated or manual tests to analyze the services and find weaknesses. Verification of vulnerabilities: The issue is tested and fixed to exploit the vulnerability. Remediation of vulnerabilities: The solution is retested against vulnerability to ensure that it is completely secure. ACL Access control list (ACL) is a rule list containing access control entries. It is used to allow or deny access to network resources. ACL can be implemented on network users and network devices such as routers and firewalls. Routers and firewalls use ACL to determine which packets should be forwarded or dropped. Steps in Web application testing In Web application penetration testing, a Penetration Tester needs to take the following steps: Information gathering testing Analyzing the robots.txt file Performing search engine reconnaissance Identifying application entry points Identifying Web applications Analyzing the output from head and options http requests Implementing techniques such as DNS zone transfers, DNS inverse queries, DNS searches, and querying search engines Analyzing error codes Testing for recognized file types/extensions/directories Examining source of available pages TCP/ICMP and service fingerprint Authentication testing Testing for vulnerable remember pw and pw reset Testing for logout and browser cache management Testing for captcha Testing for multiple factors authentication Testing for race conditions Session management testing Testing for session management using cookie tampering that results in hijacking the sessions of legitimate users Testing for cookie attributes to hijack sessions using tools such as Webscarab, Burp, Paros, and Tamper