1. INFOSECGIRLS
TRAINING IN
COLLABORATION
WITH
HACKCUMMINS

2. $WHOIS INFOSECGIRLS
• Community for women in Information Security.
Website
Twitter
Facebook
Linkedin
YouTube
Mailing List

3. WHY INFOSECGIRLS?
• We aim is to bring in more women in security and help them to grow in the
area.

4. TRAINERS
• Ishaq Mohammed, Appsec @ Qualys
• Shrutirupa Banerjiee, @WAF Research @ Qualys
• Komal Armarkar, Spotlight Engineer @Crowdstrike

5. AGENDA:
Basics of Web Application
Architecture
Client Server Communication
HTTP/S
HTTP Methods
Status Codes
The WHY factor
Test Cases
Vulnerabilities
Demo

6. WEB
APPLICATION

7. ARCHITECTU
RE

8. HTTP/HTTPS
• HyperText Transfer Protocol (Secure)
• used by the World Wide Web
• defines how messages are formatted and transmitted
• what actions Web servers and browsers should take in response to various
commands

9. METHODS
• GET
• POST
• PUT
• OPTIONS
• AND MANY MORE…

10. STATUS CODES
• 1xx - informational
• 2xx - success
• 3xx - redirection
• 4xx - client error
• 5xx - server error

11. HTTP HEADERS

14. COOKIE

15. HOW DO WE VIEW
THE SOURCE
CODE??

16. View-source Inspect element

17. VIEW-SOURCE

18. INSPECT ELEMENT

20. THE WHY FACTOR
WHY ARE WE TALKING
ABOUT IT???

22. VULNERABILIT
IES TO BE
COVERED
TODAY
File inclusion
File upload
Xss reflected
Xss stored
SQL Injection

23. DEMO

25. FILE INCLUSION
• Local File Inclusion
• Remote File Inclusion

26. FILE UPLOAD
• Uploading a malicious file
• Can lead to Remote Code Execution

27. XSS REFLECTED
• malicious script bounces off of another website to the victim's browser
• You can trick a user to click on a malicious link to steal user’s cookies

28. XSS STORED
• malicious script is injected directly into a vulnerable web application
• The script is stored in the web application

29. SQL INJECTION
• Executing malicious SQL statements in the web application
• To gain unauthorized access to the sensitive data in the database

30. COMMAND INJECTION
• Attacker can execute commands directly
• Can lead to remote code execution, hence, getting the shell of the server

31. LETS DEEP
DIVE A BIT
MORE!!!

32. WHAT IS PROXY??

33. BURPSUITE

34. INITIAL SETUP
AND
CONFIGURATIO
N

35. SPIDER

36. SCANNER

37. REPEATER

38. INTRUDER

39. DECODER

40. LET’S EXPLOIT SOME VULNERABILITIES
USING BURP!!!

41. FILE UPLOAD –
MEDIUM
CSRF – LOW

42. FILE UPLOAD
• Let’s bypass the mitigations

43. CSRF
• Cross Site Request Forgery
• Aims at authenticated users to make them execute unwanted actions

45. REFERENCES:
• Damn Vulnerable Web Application (DVWA)
• HTTP
• Learn web development

46. RESOURCES
• So, you want to work in security?
• Roadmap for Application Security
• Getting Started in Offensive Security
• BREAKING INTO INFOSEC: A BEGINNERS CURRICULUM
• OWASP Foundation
• OWASP Top 10 – 2017
• CodePath Web Security Guides
• Awesome-Hacking
• High-Level Approaches for Finding Vulnerabilities

47. TRAINER CONTACT
• Shrutirupa Banerjiee - https://twitter.com/freak_crypt
• Komal Armarkar - https://twitter.com/n0th1n3_00X
• Ishaq Mohammed - https://twitter.com/security_prince