1. 1. How to start in web-application penetration testing
2. 2. Max Dzhalamaga How to start in web-application penetration testing
3. 3. What I need for start? Skin-deep knowledge: Web technologies Http protocol Html JavaScript Web vulnerabilities
4. 4. Tools: Web proxies: Fiddler Burp Suite Web spiders: Burp Suite WebScarab What I need for start?
5. 5. Workflow Information gathering Test authentication Test session management Test authorization Fuzz parameters File Uploads Denial of Service
6. 6. Information gathering Manual surfing Robots.txt Spidering Search in public sources User-Directed Spidering
7. 7. Information gathering Hidden content Comments Logical names Brute-Force HTTP headers Vulnerability in third-party components Answers from server (Server header, custom headers, html templates) Default content (Wikto) Identify all entry points
8. 8. Test authentication Determine the type of authentication mechanism HTML forms-based authentication HTTP basic and digest authentication Client SSL certificates and/or smartcards Check the required password complexity Review the rules Try to register accounts Try to change password Very short or blank Common dictionary words or names The same as the username Still set to a default value Administrative passwords may in fact be weaker than the password policy allows. password website name 12345678 qwerty abc123 111111 monkey 12345 Login name
9. 9. Test authentication Test for delay after login with wrong credentials Duration of the lockout Number of failed attempts The way, how server detects it Test the error handle mechanism Difference between messages text Minor differences in responses Different time of response
10. 10. Test authentication Test change password functionality Verbose error message if invalid username Brute-force of password Username enumeration Test password recovery functionality Simple questions Brute-force of answer easier than password
11. 11. Test authentication Test remember me functionality Simple persistent cookie: Remember=username; Identifier of user: Remember=475; Brute-Force credentials
12. 12. Test session management Investigate session Token Try to decrypt Try changing the tokens value one byte at a time Brute-Force token value Session termination and Log out functionality
13. 13. Test session management Ways of stealing token XSS Session fixation Cookies parameters Path restriction Domain restriction Secure HttpOnly
14. 14. To add text To add Title