Authentication can be tested in the following ways:
Brute Forcing/Weak Credentials
Session Management
What is the admin username?
Answer: admin
What is the admin password?
Answer: admin
What is the name of the cookie that can be manipulated?
Answer: session
What is the username of a logged on user?
Answer: bryce
wfuzz-uhttp://10.10.215.90/users/login.php-d"username=FUZZ&password=FUZZ"--hs"invalid"-t20-w/usr/share/seclists/Usernames/Names/names.txt********************************************************* Wfuzz 3.1.0 - The Web Fuzzer *********************************************************Target:http://10.10.215.90/users/login.phpTotalrequests:10177=====================================================================IDResponseLinesWordCharsPayload=====================================================================000001214:3030L0W0Ch"bob - bob"000001389:3030L0W0Ch"bryce - bryce"[..snip..]
What is the corresponding password to the username?
Answer: bryce
XSS
Types of XSS:
Persistent/Non-Reflected - Here the XSS payload has been stored in the database, and once the server/framework passes the data from the database into the webpage, the script/payload is executed -** Non-Persistent/Reflected** - Here the XSS payload is usually crafted using a malicious link. It is not stored.
Test for XSS on the search bar - <script>alert(1)</script> (Non Persistent)
Test for XSS on the guestbook page - <script>alert(1)</script> (Persistent)
Test for XSS behind the flash form on the home page
Injection
Common injection attacks include:
SQL injection
Command Injection
Perform command injection on the check password field
Entering a simple payload gives the error:
The command "grep ^whomai$ /etc/dictionaries-common/words" was used to check if the password was in the dictionary.whomai is a Bad Password
Use the payload hi| rm -f to remove the /etc/dictionaries-common/words file from the server.
This will disrupt the working of passcheck.php
Check for SQLi on the application
Register a user with username as ' or '1=1
Misc & Logic Flaws
Parameter Manipulation
In sample.php - http://10.10.116.46/users/sample.php?userid=2, change the userid parameter
