WebAppSec 101
Last updated
Last updated
Date: 11, August, 2021
Author: Dhilip Sanjay S
to go to the TryHackMe room.
Answer: 2.4.7
Answer: PHP
Answer: 5.5.9
Two wasy to test a wb application:
Going through every page and testing all the functionality
Breaking down the testing into different stages like:
Authorization
Authentication
Injection
Client Side controls
Application Logic
Authentication can be tested in the following ways:
Brute Forcing/Weak Credentials
Session Management
Answer: admin
Answer: admin
Answer: session
Answer: bryce
Answer: bryce
Types of XSS:
Persistent/Non-Reflected - Here the XSS payload has been stored in the database, and once the server/framework passes the data from the database into the webpage, the script/payload is executed -** Non-Persistent/Reflected** - Here the XSS payload is usually crafted using a malicious link. It is not stored.
Test for XSS on the search bar - <script>alert(1)</script> (Non Persistent)
Test for XSS on the guestbook page - <script>alert(1)</script> (Persistent)
Test for XSS behind the flash form on the home page
Common injection attacks include:
SQL injection
Command Injection
Entering a simple payload gives the error:
Use the payload hi| rm -f to remove the /etc/dictionaries-common/words file from the server.
This will disrupt the working of passcheck.php
Register a user with username as ' or '1=1
Parameter Manipulation
In sample.php - http://10.10.116.46/users/sample.php?userid=2, change the userid parameter
Directory Traversal
In upload.php page, use ../ in the tag field.
Forceful Browsing
Use gobuster to find hidden URLs.
Logic flaw - try get an item for free.
Reuse the coupon - SUPERYOU21
The price will eventually reach zero
