Web application penetration testing: Tools and Techniques for web security auditing



Every pentester has it's own tool and technique for web app security auditing, Some time it depend on the type of website  we are pentesting. We are gonna see some common tool and technique that can help us to audit our web application security.


Detecting web application firewall and other services

You can start with by detecting is there any web application firewall in use? Later we can see if there's any way to bypass it. 

Recommend tool : 

fofa.so It is a cyberspace search engine launched by White Hat. It can help researchers or enterprises quickly match network assets by performing cyberspace mapping, for example, analyzing the scope of vulnerability. 

 shodan.io It is most poplar search engine among pentester for finding various online vulnerable IoT devices, online open ports from various web servers.

wafw00f  This tool allow you to detect and identify what Web Application is in use that is protecting the website. 

Bypassing Cloudflare

Many website uses CloudFlare for CDN and mitigation DDoS Attack , it is necessary to get the real IP of the website so that further exploitation can be carry on which could be hidden behind CloudFlare.

Recommend tool:  
cloud-buster This tool will help you to resolve CloudFlare and you can get the IP address of the website behind the firewall. 

CloudFail Similar to cloud-buster this tool will check for DNS misconfiguration and old database record to help you find hidden IP behind the CloudFlare network. 

Whois Record,Reverse IP lookup and DNS enumeration 

Whois record can help you to find you info about the target website like database information that stores registered users information. These type of info can be useful for Social Engineering Attack.

Recommend Tools : https://www.whois.com/whois

Next step should getting DNS related information like mail exchange server, name server , getting zone transfer info that can help us to find misconfiguration and gather information about topology of their network and to determine which machine is accessible. 

Recommend Tools: 
Online resource: 
https://securitytrails.com This website will help you to get almost all DNS related information about the website like DNS records, Historical data , A records , MX records etc.


DNSdumpster  It's a free domain research tool to find that can discover hosts related to a domain. Finding visible hosts from the attackers perspective is an important part of the security assessment process.

CLI tools :  
amass : In-Depth DNS Enumeration and Network Mapping
 
dnsrecon This is dns enumeration tool to discover various dns related information
Dig , dnsenum, nslookup ( for windows) . 

 Reverse IP lookup is a technique to find if there's any other website is hosted on the same server, this will help us to find if the website is using any shared hosting or not.  

Recommend tools: 
Yougetsignals This website contain lot of online resource like reverse IP lookup, Reverse E-mail lookup etc. 

https://hackertarget.com/reverse-ip-lookup Similar to yougetsignal will perform reverse IP lookup

Web Technology Detection 

These days websites are using various web technologies like some content management framework ,various JavaScript plugins etc. Knowledge of what web technologies are the target website using can make it easy to find vulnerability on the website by finding security holes on one of those web technologies that the site is using. 

Recommend tools: 
Wappalyzer It is a cross platform tool which can help you to identify technologies that the websites are using. It come in both Firefox and chrome extension.   

builtwith.com Similar to wappalyzer this website can help you to identify various running technology on a website .
Information gathering about the organization  
During pentesitng geting as much information about the organization is very important like information of the website owner, who are their employee, getting information about their employee is also important and LinkedIn is a good source for getting information about the organization so that we can make our social engineering attack infallible. 

Recommend Tools:

Raven raven is a Linkedin information gathering tool that can be used by pentesters to gather information about an organization employees using LinkedIn. 

ScrapedIn This tool will help you to scrape LinkedIn without API restrictions for data reconnaissance.

theHarvester This is very popular OSINT tool for gathering names, emails, subdomains, virtual hosts, open ports/banners, and employee names from different public sources of an organization.
 
 Scanning Hidden directory 
Scanning web directory could be a good way to find admin panels of a website if you have got password using some social engineering attack. This can also help you to get some hidden directories.

Recommend tools: 
DIRB  It is a fast web content scanner tool, it can help a pentester to find hidden directory of a website.It works by launching dictionary attack against the target website .

 dirsearch Another fast web path scanner which work based on dictionary attack. 
Subdomain Enumeration 

Subdomain enumeration is important for a web pentesting. If the website is using a subdomain for some services and later they stop using it but forgot to remove that subdomain redirection pointing to the website. In this case the attacker can register the subdomain. Now the attacker can clone the website and can phish users to get their login credentials by adding login forms. 

 Recommend Tools: 
aquatone : A fast subdomain brute force tool for subdomain enumeration.

Sublist3r Similar to aquatone Fast subdomains enumeration tool for penetration testers.
 
Exploitation

After getting what technology is in use we can check if there's any outdated version is running and if there's any outdated version is running we should check is if there's any exploit available for that version or not. 

Recommend Tools:
Exploit-Database Maintained by Offensive Security This  Exploit Database is a CVE compliant archive of public exploits and corresponding vulnerable software this can help you to get exploits for various outdated vulnerable software.

Searchsploit Command line version of exploit-db 

https://cxsecurity.com Another online search tool for getting exploit of vulnerable software.  

Static Code analysis 

Vulnerabilities like Injection attack such as SQL Injection,XSS, LDAP injection can happen due to code error in website, Static code analysis is important for checking code error that can help us to find most of the vulnerability in websites for example we should first focus on OWASP top 10 vulnerabilities. OWASP releases list of top 10 vulnerabilities every year which tell what are the most critical vulnerabilities which causing most website attacks.

Recommend tools: 

Buirp suite Burp Suite is a graphical tool for testing Web application security.You can also do code analysis of the websites ,manipulate GET-POST request to see how the website is behaving by doing so. This tool also contain  intruder functions for intercepting website request and response and later you can also change the response by using repeater function of this tool. 

awesome-burp-extensions This Repo contains some awesome burp plugins for people who want to enhance their burp experience. 

 cobra A source code security auditing tool that supports detection of most of the significant security issues and vulnerabilities in a variety of development language source code.

NodeJsScan This is a is a static security code scanner for Node.js applications.
 

Comments

  1. Securium Solutions Online Cybersecurity Training18 January 2021 at 03:49

    Web application penetration testing services are performed on such applications that allow checking the vulnerabilities present in the market and fix these errors before an attacker finds a way to harm the system and configured data in it.

    ReplyDelete
  2. Aishah Mahsuri18 January 2022 at 05:05

    you have written an excellent blog.. keep sharing your knowledge...


    |cybersecurity training Malaysia

    ReplyDelete
  3. Jessica John30 January 2022 at 23:33

    Interesting content about web application penetration testing tools. These also helpful for learning one. Know more here about penetration testing services and how it helps for your quality software development process.

    ReplyDelete
  4. williambritto14 March 2022 at 23:45

    Nice and really informative article. It's really informative post about software testing interview inputs. This content to helpful for testers who are looking work in software testing services companies. Keep sharing more information like this. Digital Assurance

    ReplyDelete

Post a Comment

Popular posts from this blog

USB forensic : Find the history of every connected USB device on your computer

Image
Sometime we need to know what USB devices were connected to our computer in our absence.These information could be very useful for forensic examiner or in general case also where we just want to know what USB devices were used . How do this works We all know about registry on windows, a registry is a database in windows which stores settings of the operating system, hardware devices, software programs and user preferences settings. Whenever we insert a USB drive in a computers a registry key with name "USBSTOR" is created this registry key store information about that USB device and whatever info the OS need to know can be found in this registry key.  Finding the all attached USB history To find the usb  history of your device just do the following step below  STEP 1  Go to run and type "regedit".  STEP 2: In the registry go to  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR and there you will find a registry key with na
Read more

Crawling pastebin to find specific pastedump

Image
In this post we will crawl into pastebin.com to find specific pastebin dump. For example if we want to find paste for specific keyword like "password" we can get all the paste containing that keyword. Preparing the Attack Usually some sites don't allow web crawling and by doing so you may get banned from accessing that site, which will also make this method vain.  So before doing this i recommend you to use THIS tool to anonymize all your traffic so that if we get banned we can switch our IP address immediately.  Start the Attack STEP 1 Clone into this URL by typing https://github.com/kahunalu/pwnbin.git STEP 2 Now type python pwnbin.py -k pass -n 10 -m 10 here "-k" is the keyword you want to search for "-n" is the number of paste you want to crawl and "-m" number of keywords matches you want.  As we can see above we have found a match and it's now saved to log.txt file so it's time to see the dump co
Read more

Hack WinRAR password by using Brute force attack

Image
Winrar have option to password protect your files in it.Some times we got password protected rar files or we forget our password so we go online to search to crack password of these type of rar files.Some website tell about some program who promises to decrypt the password, But unluckily there are lots of spam ,advertisement, on internet who ask you to complete the survey to download the program that can unlock the password and absolutely that's a spam,some websites also provide direct link downloadable  program to crack rar password but when we download them instead of doing that, they install lots of unwanted sponsors software and make your PC slower.But now we have a easiest way to get the password of rar file by using brute force attack. No spam,no survey,no unwanted software and with proof.So lets start the hack and follow some simple  step by step guide given below.  1 > For example i am going to set password in rar file 2> Now when ever i am try
Read more

Fileless malware Analysis with Cuckoo sandbox

Image
What is cuckoo Sandbox Cuckoo is a dynamic malware analysis sandbox which is open source and completely free. We can submit any malicious binary file and cuckoo will provide a detailed report of the malicious file, including the behaviour of that file during execution.   What is Fileless Malware A fileless malware is a favorite technique for malware authors, what this type of malware does, it doesn’t write anything on the disk to bypass mostly string base detection. The malware executes an obfuscated command usually PowerShell and during run time antivirus could not detect the strings which are being executed and after injecting it in memory the command get deobfuscated. Cuckoo Interface and sample analysis To run cuckoo just type cuckoo from your terminal, this will start cuckoo service. Now to get the web interface type cuckoo run webserver this will start the cuckoo web interface on its defined URL and port address as shown below.
Read more