Web Application Penetration Testing - 101

1. Web App Pentesting 101 Andrea Hauser

2. $ whoami •Andrea Hauser ( 1 @aha_181) •Security Consultant + 2 3 4 5

3. $ whoami 1) Me @Twitter: https://twitter.com/aha_181 2) DC4131: https://www.defcon-switzerland.org/ 3) WoSEC: https://wearetechwomen.com/wosec-women-of-security/ 4) Blackhoodie: https://www.blackhoodie.re/HackLu_schedule/ 5) Bsides Zurich: https://bsideszh.ch/call-for-papers/

4. Hints •PDF of slides exists (with more text and links) • Ask me afterwards or hit me up on twitter •A blog post will be published on Thursday • https://scip.ch/en/?labs.20191024 +

5. Outline •Security Consulting •Web App Pentesting Introduction • Demos

6. Security Consulting Customer Service Testing (Pentesting, Red Teaming, Reviews, …) Reporting Research

8. Web App Pentesting Preparations

9. Setup Prepare reporting method1 and 2 Set up tools Review scope3 and 4

10. Setup 1) Reporting definition: http://www.pentest- standard.org/index.php/Reporting 2) Reporting examples: https://github.com/juliocesarfort/public-pentesting- reports 3) Scoping definition: http://www.pentest-standard.org/index.php/Pre- engagement 4) How to get the most from your penetration test (includes scoping): https://www.ncsc.gov.uk/guidance/penetration-testing

11. Reporting

12. Tools •Kali LinuxVM1 •Favourite Browser •Proxy ( BurpSuite2 or OWASP ZAP3) •nmap4

13. Tools 1) Kali LinuxVM: https://www.kali.org/downloads/ 2) BurpSuite: https://portswigger.net/burp 3) OWASP ZAP: https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project 4) nmap: https://nmap.org/

14. Scoping Define targets Define goals Define methods

15. Scoping What? Where? Why? Who? How? When?

16. Methodology •Reconnaissance •Automated Testing1 •Manual Testing2, 3 and 4

17. Methodology 1) BurpSuite extensions: https://portswigger.net/bappstore 2) OWASP Top 10 Project: https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project 3) OWASP Testing Guide: https://www.owasp.org/index.php/OWASP_Testing_Project 4) OWASP Cheat Sheet Series: https://cheatsheetseries.owasp.org/

19. Web App Pentesting Technical

20. OWASP Top 10 •Open Web Application Security Project1 •List of top 10 vulnerabilities2

21. OWASP Top 10 1) OWASP: https://www.owasp.org/index.php/Main_Page 2) OWASP Top 10 Project: https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project

22. Injection •Payload SQL Injection1: •OWASP Top 10 - A12 •User input executed without validation ‘ OR 1=1--

23. Injection 1) SQL Injection Tutorial: https://portswigger.net/web-security/sql-injection 2) OWASP Top 10 - A1: https://www.owasp.org/index.php/Top_10-2017_A1- Injection

24. Injection The example is a web shop with a category filter which is vulnerable to SQL Injection Initial normal Request →

25. Injection Initial normal Response

26. Injection Normal Request with filter

27. Injection Attack with Payload: ‘ OR 1=1--

28. Injection Successful attack with more results

29. Injection Vulnerable Code "SELECT * FROM products WHERE cat=‘"+req.getParam("category")+"‘ AND released = 1";

30. Injection URL: /filter?category=Accessories "SELECT * FROM products WHERE cat=‘Accessories‘ AND released = 1";

31. Injection URL: /filter?category=‘ OR 1=1-- "SELECT * FROM products WHERE cat=‘’ OR 1=1--‘ AND released = 1";

32. Injection Fixed Code String q = "SELECT * FROM products WHERE cat= ? AND released = 1"; PreparedStatement p = con.prepareStat(q); p.setString(1, req.getParam("category"));

33. Injection •Injection Prevention Cheat Sheet (OWASP)1, 2 and 3

34. Injection 1) OWASP Cheat Sheet Series: https://cheatsheetseries.owasp.org/ 2) Injection Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Che at_Sheet.html 3) Query Parameterization Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Query_Parameterization_ Cheat_Sheet.html

35. Broken Authentication •OWASP Top 10 - A21 •Everything regarding authentication weaknesses

36. Broken Authentication 1) OWASP Top 10 - A2: https://www.owasp.org/index.php/Top_10-2017_A2- Broken_Authentication

38. Creation of a new user

39. in default settings username and password are saved in plaintext

40. Broken Authentication

41. Broken Authentication What happened? fancyUserName fancyPassword

42. Broken Authentication What should have happened?1, 2 and 3 fancyUserName 102b04394cedfeac6abe02dd94 007eb076bc4cba13a0e9bd965b96cb8f696f52125 Ce189eca166d7176d3e8a2be068b5209bbca07ad8 6440d36a36695599247c

43. Broken Authentication 1) Password hashing: https://medium.com/@mpreziuso/password-hashing- pbkdf2-scrypt-bcrypt-and-argon2-e25aaf41598e 2) scrypt: http://www.tarsnap.com/scrypt.html 3) Argon2: https://password-hashing.net/

44. Broken Authentication •Hashing Algorithm not usually inWeb App Pentest

45. First run of session id harvesting Second run of session id harvesting The session ids are the same between the two runs

46. Broken Authentication First run Token: _j_Shs8ujMHRPgR Token: __ESsW9SfUHbPIR Token: _EhsWu_QfUHbPIR Token: _hsSuS-JfUHbPIR Token: _sWTSQAxfUHbPIR Token: _WuTQJBxfUHbPIR Second run Token: _j_9hsNu3uQQGFR Token: __E9sWOS02QaGuR Token: _Eh9WuPQ02QaGuR Token: _hs9uSQJ02QaGuR Token: _sW9SQRx02QaGuR Token: _Wu9QJSx02QaGuR

51. Broken Authentication •ID not random •Known characters in red x _ _ _ _ _ x _ x x x x x x x •Brute force: 6 chars

52. Broken Authentication What happened? ID: 1 Token: 123456789 ID: 2 Token: 1abcde789 ID: 3 Token: 1zyxwv879

53. Broken Authentication What should have happened? ID: 83 Token: 509d3sz3c ID: 1764 Token: 00r839scc ID: 454 Token: nlzca1b10

54. Broken Authentication •Authentication Cheat Sheet1 •Credential Stuffing Cheat Sheet2 •Forgot Password Cheat Sheet3 •Session Management Cheat Sheet4

55. Broken Authentication 1) Authentication Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sh eet.html 2) Credential Stuffing Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Credential_Stuffing_Preve ntion_Cheat_Sheet.html 3) Forgot Password Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Forgot_Password_Cheat_ Sheet.html

56. Broken Authentication 4) Session Management Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Che at_Sheet.html

57. Sensitive Data Exposure •OWASP Top 10 - A31 •Weak encryption/hashing of data

58. Sensitive Data Exposure 1) OWASP Top 10 - A3: https://www.owasp.org/index.php/Top_10-2017_A3- Sensitive_Data_Exposure

59. Sensitive Data Exposure •Passwords saved in plaintext •Default setup: not HTTPS

60. Cross Site Scripting (XSS) •Payload: •OWASP Top 10 - A71 •User input returned without validation2 and 3 <script>alert(“XSS”)</script>

61. Cross Site Scripting (XSS) 1) OWASP Top 10 - A7: https://www.owasp.org/index.php/Top_10-2017_A7- Cross-Site_Scripting_(XSS) 2) Description: https://www.owasp.org/index.php/Cross-site_Scripting_(XSS) 3) Tutorial: https://portswigger.net/web-security/cross-site-scripting

62. Cross Site Scripting (XSS) Final Payload: <script>alert(“XSS”)</script>

63. Cross Site Scripting (XSS)

64. Cross Site Scripting (XSS) What happened? <p id=“username”> < script> alert(“XSS”)< /script> </p>

65. Cross Site Scripting (XSS) What should have happened?1 <p id=“username”> <script>alert(“XSS”)</script> </p>

66. Cross Site Scripting (XSS) 1) Prevention: https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Cr oss_Site_Scripting_Prevention_Cheat_Sheet.md

67. Cross Site Request Forgery (CSRF) •OWASP Top 10 2013 - A81 •Forging requests, triggering every action a logged in user can do2

68. 1) OWASP Top 10 2013 - A8: https://www.owasp.org/index.php/Top_10_2013-A8-Cross- Site_Request_Forgery_(CSRF) 2) Tutorial: https://portswigger.net/web-security/csrf Cross Site Request Forgery (CSRF)

69. Login as an administrative user

70. Triggering the Cross Site Request Forgery Requests in the background

71. The top 3 Requests are the triggered Cross Site Request Forgery Requests

72. Newly added batch script

73. Resulting Requests sent to a malicious server containing username/password of every user that logs in and triggers the maliciously created batch script

74. What happened? POST /triggering/action Cookie: Token Well known content Cross Site Request Forgery (CSRF)

75. What should have happened?1 and 2 Cross Site Request Forgery (CSRF) POST /triggering/action Cookie: Token Well known content & RANDOM value

76. 1) CSRF Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Cross- Site_Request_Forgery_Prevention_Cheat_Sheet.html 2) SameSite Cookie preventing CSRF: https://portswigger.net/web- security/csrf/samesite-cookies Cross Site Request Forgery (CSRF)

77. Tutorials •PortSwiggerWeb Security Academy1 •OWASP Juice Shop2 •https://www.root-me.org •https://shellterlabs.com

78. 1) PortSwiggerWeb Security Academy: https://portswigger.net/web-security 2) OWASP Juice Shop: https://www2.owasp.org/www-project-juice-shop/ Tutorials

79. Questions?

80. References

81. $ whoami 1) Me @Twitter: https://twitter.com/aha_181 2) DC4131: https://www.defcon-switzerland.org/ 3) WoSEC: https://wearetechwomen.com/wosec-women-of-security/ 4) Blackhoodie: https://www.blackhoodie.re/HackLu_schedule/ 5) Bsides Zurich: https://bsideszh.ch/call-for-papers/

82. Setup 1) Reporting definition: http://www.pentest- standard.org/index.php/Reporting 2) Reporting examples: https://github.com/juliocesarfort/public-pentesting- reports 3) Scoping definition: http://www.pentest-standard.org/index.php/Pre- engagement 4) How to get the most from your penetration test (includes scoping): https://www.ncsc.gov.uk/guidance/penetration-testing

83. Tools 1) Kali LinuxVM: https://www.kali.org/downloads/ 2) BurpSuite: https://portswigger.net/burp 3) OWASP ZAP: https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project 4) nmap: https://nmap.org/

84. Methodology 1) BurpSuite extensions: https://portswigger.net/bappstore 2) OWASP Top 10 Project: https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project 3) OWASP Testing Guide: https://www.owasp.org/index.php/OWASP_Testing_Project 4) OWASP Cheat Sheet Series: https://cheatsheetseries.owasp.org/

85. OWASP Top 10 1) OWASP: https://www.owasp.org/index.php/Main_Page 2) OWASP Top 10 Project: https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project

86. Injection 1) SQL Injection Tutorial: https://portswigger.net/web-security/sql-injection 2) OWASP Top 10 - A1: https://www.owasp.org/index.php/Top_10-2017_A1- Injection

87. Injection 1) OWASP Cheat Sheet Series: https://cheatsheetseries.owasp.org/ 2) Injection Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Che at_Sheet.html 3) Query Parameterization Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Query_Parameterization_ Cheat_Sheet.html

88. Broken Authentication 1) OWASP Top 10 - A2: https://www.owasp.org/index.php/Top_10-2017_A2- Broken_Authentication

89. Broken Authentication 1) Password hashing: https://medium.com/@mpreziuso/password-hashing- pbkdf2-scrypt-bcrypt-and-argon2-e25aaf41598e 2) scrypt: http://www.tarsnap.com/scrypt.html 3) Argon2: https://password-hashing.net/

90. Broken Authentication 1) Authentication Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sh eet.html 2) Credential Stuffing Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Credential_Stuffing_Preve ntion_Cheat_Sheet.html 3) Forgot Password Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Forgot_Password_Cheat_ Sheet.html

91. Broken Authentication 4) Session Management Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Che at_Sheet.html

92. Sensitive Data Exposure 1) OWASP Top 10 - A3: https://www.owasp.org/index.php/Top_10-2017_A3- Sensitive_Data_Exposure

93. Cross Site Scripting (XSS) 1) OWASP Top 10 - A7: https://www.owasp.org/index.php/Top_10-2017_A7- Cross-Site_Scripting_(XSS) 2) Description: https://www.owasp.org/index.php/Cross-site_Scripting_(XSS) 3) Tutorial: https://portswigger.net/web-security/cross-site-scripting

94. Cross Site Scripting (XSS) 1) Prevention: https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Cr oss_Site_Scripting_Prevention_Cheat_Sheet.md

95. 1) OWASP Top 10 2013 - A8: https://www.owasp.org/index.php/Top_10_2013-A8-Cross- Site_Request_Forgery_(CSRF) 2) Tutorial: https://portswigger.net/web-security/csrf Cross Site Request Forgery (CSRF)

96. 1) CSRF Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Cross- Site_Request_Forgery_Prevention_Cheat_Sheet.html 2) SameSite Cookie preventing CSRF: https://portswigger.net/web- security/csrf/samesite-cookies Cross Site Request Forgery (CSRF)

97. 1) PortSwiggerWeb Security Academy: https://portswigger.net/web-security 2) OWASP Juice Shop: https://www2.owasp.org/www-project-juice-shop/ Tutorials

98. Thank you!

Web Application Penetration Testing - 101

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Web Application Penetration Testing - 101

Similar to Web Application Penetration Testing - 101 (20)

Recently uploaded

Recently uploaded (20)

Web Application Penetration Testing - 101