Web Applications & APIs

The HTTP service is used to host websites, web applications or files. The HTTP service listens on TCP port 80 by default, and port 443 for HTTPS.

💡 See Web Security Academy’s labs walkthroughs.
💡 For HTTP server on Kali Linux, see Apache Web Server.

Resources
Web Application Testing
Adapting Downloaded Exploits

Resources

Web Application Testing

Expand All | Collapse All

Pre-Engagement tasks

Pre-Engagement tasks like approval, defining the scope, test accounts. See Penetration Tests.

Before starting

Burp project

  • Open Burp Suite and create a new project.
  • Set the testing scope (Target->Scope settings):
    • Explicitly set targets in scope.
    • Explicitly exclude targets if needed (e.g. listed from bug bounty programs).
    • Drop requests from these targets. See Burp Suite Targets.
  • Set the Collaborator server if using a private server. See Burp Suite Collaborator.

Notes

  • Create a notebook for the project in your favorite note application.
  • Take note of out of scope vulnerabilities (from bug bounties).
Reconnaissance

WSTG-INFO-01: Conduct Search Engine Discovery Reconnaissance for Information Leakage (OWASP Testing Guide)

See Reconnaissance / Passive Information Gathering / OSINT.

Enumeration

WSTG-INFO-02/03/04/05/06/07/08/09/10, WSTG-CONF-02/04/05

See Web Application Enumeration.

Configurations

See Web Application Configuration.

WSTG-CONF-01/03/06/07/08/09/10/11/12/13, WSTG-AUTH-02

Source code analysis

Requires source code (whitebox testing) or when code is obtained via a vulnerability.

Static Code Analysis Scanners:

Session

WSTG-SESS: Session Management Testing (OWASP Testing Guide)

Input validation

WSTG-INPV: Input Validation Testing (OWASP Testing Guide)

Authorization

WSTG-ATHZ: Authorization Testing (OWASP Testing Guide)

Cryptography

WSTG-CRYP: Testing for Weak Cryptography (OWASP Testing Guide)

Client-side

WSTG-CLNT: Client-Side Testing (OWASP Testing Guide)

Application/Business logic

WSTG-BUSL: Business Logic Testing (OWASP Testing Guide)

APIs

REST Security Cheat Sheet (OWASP, GitHub)

WSTG-APIT: API Testing (OWASP Testing Guide)

Resources

💡 See labs WebSecurityAcademy (PortSwigger) – API testing.

Tools: Burp Suite, Postman, SoapUI

Features

Login

WSTG-ATHN: Authentication Testing (OWASP Testing Guide)

Logout
User registration / Self-registration
User profile
  • Email address change
  • Profil picture:
    • Test for File Upload
    • If image is fetched from a URL, try SSRF (port scan, read internal files, access internal hosts). If server is in the cloud, use SSRF to access the metadata endpoint to obtain a token and potentially take over the cloud environment. See Cloud SSRF (HackTricks).
  • Roles:
    • Try listing all the application roles from the profile section.
    • If your role is listed in the profile section, try editing your profile to change the role (privilege escalation).
    • Test Mass Assignment / Auto-binding. Add extra parameters like “role” or “isAdmin”.
  • Personal information:
    • Check for REST API calls with the user ID. Try other IDs to do an IDOR.
    • Look for messages with the username, like “Welcome <username>”. Try Server-side Template Injection (SSTI).
    • Try injection vulnerabilities.
  • MFA management:
    • Test CSRF on changing the MFA setting. Password should be required to change this setting.
    • Test XSS
    • Disable MFA for other users via IDOR.
Admin panel
  • Role Definitions (WSTG-IDNT-01)
  • Create user:
    • Try CSRF on user creation form (for privilege escalation).
    • Test creating a user via XSS in application inputs.
    • Send the user creation request as a normal user (change session cookie).
    • Try SQLi or NoSQLi.
    • Look for messages with the username, like “Welcome <username>”. Try Server-side Template Injection (SSTI).
    • Password:
      • Check if the initial password uses the same password policy as the password change.
      • How is the initial password transmitted to the user? When in clear text, the user should be forced to change it.
  • Delete user:
    • Try CSRF on user deletion form (for denial of service).
    • Send the user deletion request as a normal user (change session cookie).
    • Try SQLi or NoSQLi.
    • Validate if user content is also deleted.
File upload

WSTG-BUSL-08: Test Upload of Unexpected File Types
WSTG-BUSL-09: Test Upload of Malicious Files

See File Upload.

Password change or reset

WSTG-ATHN-09: Testing for Weak Password Change or Reset Functionalities (OWASP Testing Guide)

See Password change or reset. NOTE: password reset poisoning is in WSTG-INPV-17.

Payment functionality

WSTG-BUSL-10: Test Payment Functionality (OWASP Testing Guide)

See Payment functionality.

WebSockets

See WebSockets (WSTG-CLNT-10).

Artificial intelligence (AI)

Web LLM attacks (e.g. prompt injection), see Artificial Intelligence (AI)

Controls

Captcha

See Captcha.

Adapting Downloaded Exploits

  • Change the IP address and port (HTTP/HTTPS)
  • Change paths or route
  • If authentication, understand how it works, credentials etc.
  • Understand requests sent (GET or POST)
  • Does the exploit need special configuration settings to work?