Web Application Penetration Testing In-Depth

Overview

Assess Your Web Apps in Depth

Web applications are a major point of vulnerability in organizations today. Web app holes have resulted in the theft of millions of credit cards, major financial and reputational damage for hundreds of enterprises, and even the compromise of thousands of browsing machines that visited web sites altered by attackers. In this intermediate-to-advanced class, you'll learn the art of exploiting web applications so you can find flaws in your enterprise's web apps before the bad guys do. Through detailed, hands-on exercises and training from a seasoned professional, you will be taught the four-step process for web application penetration testing. You will inject SQL into back-end databases, learning how attackers exfiltrate sensitive data. You will utilize Cross Site Scripting attacks to dominate a target infrastructure in our unique hands-on laboratory environment. And, you will explore various other web app vulnerabilities in-depth, with tried-and-true techniques for finding them using a structured testing regimen. You will learn the tools and methods of the attacker, so that you can be a powerful defender.

On Day 1, we will study the attacker's view of the web. On Day 2, we will study the art of reconnaissance, specifically targeted to web applications. We will also examine the mapping phase, when we interact with a real application to determine its internal structure. We will also start the discovery step. During Day 3, we will continue our discovery using the information we gathered on Day 2. We will then move into the final stage of exploitation. On Day 4, students will continue the deep exploitation methods, combining various attacks to gain further access within the application. Throughout the class, you will learn the context behind the attacks, so that you intuitively understand the real-life applications of exploitation. In the end, you will be able to assess your own organization's web applications to find some of the most common and damaging web application vulnerabilities today.

By knowing your enemy, you can defeat your enemy. General security practitioners, as well as web site designers, architects, and developers, will benefit from learning the practical art of web application penetration testing in this intermediate to advanced level class.

Laptop

Minimum hardware requirements:

• 1GHz processor
• 512MB RAM (1+GB highly recommended)
• 2.5GB free hard disk space
• CD ROM drive

A laptop with Windows 2000 or XP is required with the latest Service Packs and patches. Windows XP Pro is preferred but Windows XP Home should work. Do not use server OSes such as Windows 2000 Server or Windows 2003 Server. Please install the following software on the computer:

• VMWare Player or VMWare Workstation 5.x or newer (Server and ESX are not supported)
• Firefox browser (latest version)

You must have ability to disable the host firewall (Windows firewall or other third party firewall) and anti-virus running on your desktop. This usually means you need to have administrative privilege on the machine. The Windows host and Linux host need to talk to each other through the VMWare network interface. A firewall could disallow such communication and render some of the exercise unsuccessful.

DO NOT plan on just killing your anti-virus service or processes, because most anti-virus tools still function even when their associated services and processes have been terminated.

Day Information

Day 1

Web Application Penetration Testing: The Attacker's View of the Web

Understanding the attacker's perspective is key to successful web application penetration testing. We will begin by thoroughly examining web technology, including protocols, languages, clients and server architectures, from the attacker's perspective. In this portion of the class we will also examine different authentication systems, including Basic, Digest, Forms and Windows Integrated authentication, discussing how servers use them and how attackers abuse them.

Following this, we will discuss the four steps that make up our process for conducting web application penetration tests: Reconnaissance, Mapping, Discovery and Exploitation. During the next few days, we will delve into each of these steps more deeply. For the first day, we will review the fundamental principles of each phase, and discuss how we will use them together as a cyclical attack process. Finally, we will cover the types of penetration testing and what pieces need to be part of the report.

• Overview of the web from a penetration tester's perspective
• Exploring the various servers and clients
• Discussion of the various web architectures
• Discover how session state works
• Discussion of the different types of vulnerabilities
• Define a web application test scope and process
• Define types of penetration testing

Day 2

Web Application Penetration Testing: The Attack Process Parts 1 and 2, Reconnaissance & Mapping

On the second day, we will start the actual penetration testing process, beginning with the reconnaissance and mapping phases. Reconnaissance includes gathering publicly available information regarding the target application and organization, identifying the machines which support our target application, and building a profile of each server, including operating system, specific software, and configuration. Our discussion will be augmented by practical, hands-on exercises in which we conduct reconnaissance against an in-class target.

In the mapping phase, we will build a "map" or diagram of the application. In order to do this, we identify the components, analyze the relationship between them, and determine how the pieces work together. We will specifically consider how the session management system works within an application. This will help us identify potential vulnerabilities during the next sections.

Finally we will start the discovery phase of the penetration test. We will start interacting with sites in order to uncover vulnerabilities that we can leverage during exploitation. We will explore common vulnerabilities in-depth, including information leakage, username harvesting, command injection, SQL injection and Blind SQL injection. Then we will delve deeply into Cross-Site Scripting and Cross-Site Request Forgery.

• Discover the infrastructure within the application
• Identify the machines and operating systems
• SSL configurations and weaknesses
• Explore virtual hosting and its impact on testing
• Learn methods to identify load balancers
• Software configuration discovery
• Explore external information sources
• Google Hacking
• Learn tools to spider a web site
• Scripting to automate web requests and spidering
• Application Flow Charting
• Relationship Analysis within an application
• Learn methods to discover various vulnerabilities
  • Information Leakage
  • Username Harvesting
  • Command Injection
  • SQL Injection
  • Blind SQL Injection
  • Cross Site Scripting (XSS)
  • Cross Site Request Forgery

Day 3

Web Application Penetration Testing: The Attack Process Part 3, Discovery

In this section, we will continue to explore the discovery phase. We will build upon the discovery started yesterday, exploring methods to find and verify vulnerabilities within the application. The students will also begin to explore the interactions between the various vulnerabilities.

After we cover vulnerabilities, we will explore the different user interfaces that web apps expose to clients. This will include a detailed discussion of Web Services and AJAX, in which we will explore how AJAX and Web service technology enlarge the attack surface that penetration testers leverage. We will also explore the how AJAX and Web services are affected by the vulnerabilities already explored.

Throughout the discovery phase, we will explore both manual and automated methods of discovering vulnerabilities within applications, and discuss the circumstances under which each is appropriate.

We will also begin to work through the final phase of a penetration test, exploitation. In this step, we will use the vulnerabilities found to gain access to various parts of the application. This step enables us to verify the vulnerabilities and explore the access these application issues grant the attacker.

• Learn methods to discover various vulnerabilities
  • Information Leakage
  • Username Harvesting
  • Command Injection
  • SQL Injection
  • Blind SQL Injection
  • Cross Site Scripting (XSS)
  • Cross Site Request Forgery
• Explore differences between different data back-ends
• Explore Fuzzing and various fuzzing tools
• Discuss the different interfaces web sites contain
• Understand methods for attacking web services
• Learn how AJAX and Web services change penetration tests

Day 4

Web Application Penetration Testing: The Attack Process Part 4, Exploitation

On the fourth day we will continue to launch actual exploits against real-world applications. In this component, we will build upon the previous three steps, expanding our foothold within the application and extending that to the network on which it resides. As penetration testers, we will specifically focus on ways that we can leverage previously discovered vulnerabilities to gain further access, highlighting the cyclical nature of our four-step attack methodology.

During our exploitation, we will use tools such as the Burp Suite and Paros Proxy to assist us in crafting exploits against real world applications like Wordpress and AWStats. We will launch a SQL injection attack against Wordpress, intercepting real transactions and modifying them. We will use Cross-Site Scripting attacks against phpMyAdmin and phpBB to steal cookies and sessions from other users.

We are also going to explore the use of attack frameworks, such as AttackAPI and BeEF. We will discuss how the frameworks can assist us in our testing process, gain us access to browser history, port scanning internal networks, and searching for other vulnerable web applications through a zombie browsers. By fully uncovering vulnerabilities within applications using the same resources as attackers, we can provide organizations with the best assessment possible.

• Exploit the various vulnerabilities discovered
• Leverage the attacks to gain access to the system
• Learn how to pivot our attacks through a web application
• Understand methods of interacting with a server through SQL injection
• Explore methods to zombify browsers
• Discuss using zombies to port scan or attack internal networks
• Explore attack frameworks
• AttackAPI
• BeEF
• XSS-Proxy
• Walk through an entire attack scenario