Web Application Cheatsheet

• February 25, 2021
• cybersecurity  
• cheatsheet  

Web application penetration testing is a critical security practice designed to identify and exploit vulnerabilities in web applications, simulating real-world attacks to assess their resilience against cyber threats. This method involves a thorough examination of the application’s architecture, from the user interface to the underlying codebase, to uncover potential security gaps that could be exploited by malicious actors. By mimicking the tactics, techniques, and procedures (TTPs) used by hackers, penetration testers provide actionable insights into an application’s security posture, helping organizations strengthen their defenses and comply with industry standards like PCI-DSS. This proactive approach not only enhances security but also reduces the risk of data breaches and financial losses, ensuring that sensitive data remains protected.

Checklist:

• Client-side validation — Checks may not be replicated on the server
• Database interaction — SQL injection
• File uploading and downloading — Path traversal vulnerabilities, stored cross-site scripting
• Display of user-supplied data — Cross-site scripting
• Dynamic redirects — Redirection and header injection attacks
• Social networking features — username enumeration, stored cross-site scripting
• Login — Username enumeration, weak passwords, ability to use brute force
• Multistage login — Logic flaws
• Session state — Predictable tokens, insecure handling of tokens
• Access controls — Horizontal and vertical privilege escalation
• User impersonation functions — Privilege escalation
• Use of cleartext communications — Session hijacking, capture of credentials and other sensitive data
• Off-site links — Leakage of query string parameters in the Referer header
• Interfaces to external systems — Shortcuts in the handling of sessions and/or access controls
• Error messages — Information leakage
• E-mail interaction — E-mail and/or command injection
• Native code components or interaction — Buffer overflows
• Use of third-party application components — Known vulnerabilities
• Identifiable web server software — Common configuration weaknesses, known software bugs

For cloud pentesting check Pacu tool.

Enumeration

with raw HTTP request from BURP repeater:

POST /login.php HTTP/1.1
Host: target.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 27

username=admin&password=FUZZ

save it into req.txt and perform the login bruteforce:

ffuf -request req.txt -w /path/to/passwords.txt

To fuzz multiple parameters in the request, you can use multiple FUZZ keywords and specify the corresponding wordlists with the -w option. For example, if you want to fuzz both the username and password parameters, you can use the following command:

ffuf -request req.txt -w usernames.txt:UFUZZ -w passwords.txt:PFUZZ -fs 4242

This will use the usernames.txt wordlist for the UFUZZ keyword and the passwords.txt wordlist for the PFUZZ keyword.

How to filter:

-mc 200 match HTTP 200

-fs 4242 filter content size 4242

-fr “invalid” filter by responses matching regex “invalid”

-r Follow redirects, default to false

Spidering through BURP in 8080:

ffuf.exe -request .\req.txt -w .\directories.txt -x http://127.0.0.1:8080

Different modes (like in BURP Intruder)

ffuf.exe -request .\req.txt -request-proto http -w bytes.txt:BFUZZ -w passwords.txt:PFUZZ -mode pitchfork

Multi-wordlist operation mode. Available modes: clusterbomb, pitchfork, sniper (default: clusterbomb)

Ffuf

Wordlists

Misc

HTTP

HTTP Verb Tampering

HTTP Method

• HEAD
• PUT
• DELETE
• OPTIONS
• PATCH

IDOR

Identify IDORS

• In URL parameters & APIs
• In AJAX Calls
• By understanding reference hashing/encoding
• By comparing user roles

XXE

SQLi

MySQL

MySQL Operator Precedence

• Division (/), Multiplication (*), and Modulus (%)
• Addition (+) and Subtraction (-)
• Comparison (=, >, <, <=, >=, !=, LIKE)
• NOT (!)
• AND (&&)
• OR (||)

SQL Injection

SQLMAP

XSS

Path traversal

Local File Inclusion

Remote Code Execution

Misc

File Inclusion Functions

File Upload

Web Shells

Bypasses

Limited Uploads