WIA - Introduction to web application penetration testing
•
2 likes•225 views
This presentation has been created for the global Women in AppSec community, and walks you through the identification of attack vectors and web penetration testing phases. At the end, I've left a couple of personal tips and tools for you to start your own penetration testing environment.
More Related Content
What's hot
What's hot (20)
Similar to WIA - Introduction to web application penetration testing
Similar to WIA - Introduction to web application penetration testing (20)
More from Katherine Cancelado
Recently uploaded
Recently uploaded (20)
WIA - Introduction to web application penetration testing
- 1. Introduction to Web Application Penetration Testing Katherine Cancelado Media Relations Coordinator WIA
- 2. Agenda: ➔ Web Application Attack Surface ➔ Penetration Testing Phases ➔ OWASP Application Security Verification Standard ➔ Tips & Tools
- 3. Web Application Attack Surface … beyond the URL
- 4. Web Application Attack Surface “The attack surface of a software environment is the sum of the different points (the "attack vectors") where an unauthorized user (the "attacker") can try to enter data to or extract data from an environment” [1]
- 5. Web Application Attack Surface - URL “The attack surface of a software environment is the sum of the different points (the "attack vectors") where an unauthorized user (the "attacker") can try to enter data to or extract data from an environment” [1] Uniform Resource Locator (URL): Also known as the “link” or address of a web resource. URLs can be used to get resources based on a series of conditions, that aren’t meant to be manually specified by the user but the underlying application.
- 6. Web Application Attack Surface - Form Inputs “The attack surface of a software environment is the sum of the different points (the "attack vectors") where an unauthorized user (the "attacker") can try to enter data to or extract data from an environment” [1] Form inputs: Text areas that are meant to enable the user to interact with the web application. This could be to submit information, modify the users’ view and to authenticate the user when required.
- 7. Web Application Attack Surface - HTTP Headers “The attack surface of a software environment is the sum of the different points (the "attack vectors") where an unauthorized user (the "attacker") can try to enter data to or extract data from an environment” [1] HTTP Headers: Core set of fields that are sent as part of every requests and response in the client-server communication. HTTP Headers set the parameters of every HTTP communication.
- 8. Web Application Attack Surface - Cookies “The attack surface of a software environment is the sum of the different points (the "attack vectors") where an unauthorized user (the "attacker") can try to enter data to or extract data from an environment” [1] Cookies: variable - value combination of data, that it’s assigned to a user while surfing a web application. It’s normally use to identify where/ whom the requests belong to by keeping users’ sessions and their preferences.
- 9. Penetration Testing Phases Plan - do - check - act (?)
- 10. Penetration Testing Phases Planning & Profiling Vulnerability Analysis Information Gathering Reporting Exploitation A penetration test is performed in order to identify vulnerabilities and possible attack vectors in a specific system. These kinds of tests are legally covered by a contract/ authorisation that allows the pen tester to attack the in-scope system. Of course, you can pen test your own systems, and that’s a good exercise when wanting to “skill up”.
- 11. OWASP Application Security Verification Standard (ASVS) Do it once, do it right!
- 12. The ASVS Project “The primary aim of the OWASP Application Security Verification Standard (ASVS) Project is to normalize the range in the coverage and level of rigor available in the market when it comes to performing Web application security verification using a commercially-workable open standard. The standard provides a basis for testing application technical security controls, as well as any technical security controls in the environment, that are relied on to protect against vulnerabilities such as Cross-Site Scripting (XSS)and SQL injection.” [2]
- 13. ASVS Checklist 1. Architecture, design and threat modelling 2. Authentication Verification Requirements 3. Session Management Verification Requirements 4. Access Control Verification Requirements 5. Malicious input handling verification requirements 6. Cryptography at rest verification requirements 7. Error handling and logging verification requirements 8. Data protection verification requirements 9. Communications security verification requirements 10. HTTP security configuration verification requirements 11. Malicious controls verification requirements 12. Business logic verification requirements 13. Files and resources verification requirements 14. Web services verification requirements 15. Configuration
- 14. Tips & Tools
- 15. Tips 1. Know your target 2. Take notes 3. Read everything you find 4. Use search engines 5. Keep learning Testing environments: ● bWAPP (Buggy Web Application) ● Multilidae ● Damn Vulnerable Web App (DVWA) Tools: ● Burp ● OWASP ZAP ● Nikto ● Browser developer tools ● Kali (OS) Tools
- 16. Thanks!