Scribd
Upload
4 views11 pages

Web App Testing

The document outlines various layers of software development and security, detailing approaches to security testing and tools used in network and Active Directory penetration testing. It highlights vulnerabilities related to authentication, authorization, session management, input validation, information leakage, cryptography, and system configuration. Specific tools and methods for testing and exploiting these vulnerabilities are also discussed.

Uploaded by

amjuri
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd
4 views11 pages

Web App Testing

The document outlines various layers of software development and security, detailing approaches to security testing and tools used in network and Active Directory penetration testing. It highlights vulnerabilities related to authentication, authorization, session management, input validation, information leakage, cryptography, and system configuration. Specific tools and methods for testing and exploiting these vulnerabilities are also discussed.

Uploaded by

amjuri
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd

• Layers of software development and security

• Approach of security testing


• What we have done
Network Pen Test
• Nmap – port scanning
• Caldera – automated red team system by MITRE (open source & licensed)
• Wireshark – packet sniffing
• Scapy – packet manipulation Very Simple Network Scanner – to ping windows based platforms
• Firewalk – to enumerate firewall rule set, works similar to Traceroute, currently the tool functionality
is merged with NMAP
• Useful windows utilities:
• netstat – to obtain information on current TCP/UDP connections, routing table Active Directory
Penetration Testing
• Mimikatz – extracts plaintext passwords, hash, pin codes and Kerberos tickets from memory
• DCShadow – a mimikatz feature used to manipulate AD data
• DCSync – used to simulate DC and ask for pwd
• SkeletonKey – it is a malware that allows any Domain user to authenticate using master pwd
• Authentication
• Authorization
• Session Management
• Input Validation
• Information Leakage
• Cryptography
• System Configuration
Authentication

• Authentication Bypass
• Poor Password Strength
• No Account Lockout
• No Log-out functionality
• Unencrypted Log in Request
• Weak Change Password functionality
• Weak Forgot Password functionality
• Weak Reset Password functionality
• No Change Password functionality
Authorization

• Horizontal Privilege Escalation


• Vertical Privilege Escalation
• Forceful Browsing
Session Management:

• Session Fixation
• Improper Session Expiration on logout
• Session time out too long
• Unencrypted Session Tokens
• Predictable Session Tokens
• Session ID transmitted as URL parameter
• HTTPOnly flag not enabled for session cookie
• Secure flag not enabled for session cookie
Input Validation

• Cross Site Scripting


• Cross Site Request Forgery
• SQL Injection
• LDAP Injection
• Buffer Overflow
• Malicious File Upload
• Code Injection
• URL Redirection
• Click Jacking
Information Leakage

• Error Messages
• HTML Comments
• Source Code Disclosure
• Cross Frame Spoofing
• Server Platform Info Leak
• Sensitive Data Revealed
Cryptography

• Weak SSL version


• Weak Encryption Key
• Unencrypted Sensitive Data (Eg: Passwords, Cookies)
• Weak Encryption Algorithm
• Weak Encryption Ciphers
System Configuration

• Default Passwords Enabled


• Default Pages Enabled
• Default Error Messages Enabled
• Unpatched Software
• Harmful HTTP Methods Enabled
• Unhandled Exceptions

You might also like