WEB APPLICATION TESTING Web Application Penetration Testing ‘17

Web Application Testing Let’s Play with the security of Web Application & Learn about how bug are found. Through out this, we’ll work on DVWA and related tools.

Installing XAMPP XAMPP is used for creating web servers like apache, mysql, etc. Download & Install XAMPP - https://www.apachefriends.org Start Apache & Mysql services.

DVWA DVWA – Damn Vulnerable Web Application. An intentionally made vulnerable web application which is used for skills development. It contains all the common vulnerabilities which are usually found in web applications. Download - http://www.dvwa.co.uk/

Installing DVWA Open directory where dvwa was downloaded. Unzip DVWA Move DVWA directory to apache server directory – Open Web browser and direct to – Localhost/<path of dvwa in apache> Ex. Localhost/DVWA

Setting up DVWA Database Initially DVWA will show database error and ask for change in “config.inc.php” file. Open the file by any of editor Change default password and Leave rest of the things same. Now again open web browser and direct to Localhost/DVWA Click on “Create/Update Database” It will redirected to login window, login with DVWA username – admin and password – password .

Setting Up DVWA Login to DVWA Select “DVWA Security” Choose Security Level to “LOW” {for initial testing, then we will increase the level}. There are several types of attacks are present which includes – SQL, XSS, CSRF, Brute Force, File Upload, File Inclusion, Insecure Captcha Etc. Let’s Start Testing ;)

DVWA – SQL Injection {Low Level} SQL Injection is top rated vulnerability which may leads to full sql based database compromise. OWASP SQL Injection Cheat sheet. Click on SQL Injection. It will show USER ID Field, Let’s apply basic Injection – 1’ or ‘1’ = ‘1 1’ or 1 = 1# 1’ or 1 = 1 UNION SELECT NULL, NULL# TABLE_NAME FROM INFORMATION_SCHEMA.TABLES# USER, PASSWORD FROM USERS#

SQL Injection {Medium Level} Set DVWA Security to Medium and Open SQL Injection. Open Burp Suite Proxy and Set Intercept as ON. Check with several queries and forward request each time. Queries – 1’ or 1 = 1# 1’ or 1 = 1 UNION SELECT NULL, NULL# TABLE_NAME FROM INFORMATION_SCHEMA.TABLES# USER, PASSWORD FROM USERS#

SQL Injection {High} Set DVWA Security to High and open SQL Injection. Check source code to see added security features. Apply Queries – 1’ or 1 = 1# 1' OR 1=1 UNION SELECT NULL, table_name from information_schema.tables# 1' OR 1=1 UNION SELECT NULL, table_name from information_schema.columns=users#

Brute Force {Low Level} Open Burp Suite >> Proxy >> Options >> Set Proxy “127.0.0.1:8080” Proxy>>Intercept>>Intercept On Open Firefox >> options >> advanced >> network >> Connection >> setting Manual Proxy Config >> 127.0.0.1:8080 Open DVWA {LOW} >> Brute Force >> Provide Fake Username & Password. Setting Up Attack – Send to Intruder. Set Attack Type >> Cluster Bomb Add Position to Bruteforce. Set Payloads – admin, administrator, username, password. Add GREP – welcome. Start Attack. Where the length changes, that will be username and password.

Command Injection {Low} Command Line Introduction – Dir – list all the directories. Cd – change the directory. Type - display file content information. Open DVWA{LOW} >> Command Injection. Enter IP – 127.0.0.1 {local host} and view source to understand functionality. Join Two commands using “&, &&, |, || “ etc. Join Commands – <ip> & dir <ip> & dir ..\..\ <ip> & type ..\..\config\config.inc.php <ip> & copy ..\..\config\config.inc.php <new file name>

Command Injection {Medium} Open DVWA{Medium} >> Command Injection. Use OR Operator ( | ). Rest procedure is same.

Command Injection {High} Open DVWA{High} >> Command Injection. Use OR Operator ( | ) without space. Rest procedure is same.

File Inclusion It allows an attacker to include a file. Open DVWA {LOW} >> File Inclusion. Try to Access – Robots.txt Localhost/dvwa/robots.txt Phpinfo.php {root of site} Localhost/dvwa/phpinfo.php Bootmgr {root of drive}

File Upload {low} File Extension validation is not set/can be bypassed which gives rise to uploading infected file which in return can infect and lead to total compromising. Open DVWA{low}>> file upload. Try Uploading files with different Extensions. Access uploaded file to >> http://localhost/dvwa/hackable/uploads/

File Upload {Medium} Open DVWA{Medium}>> file upload. Turn on Intercept on Burp Suit Try Uploading the shell. Change Content type in Burp suite to “image/png” and forward the request. Access uploaded file to >> http://localhost/dvwa/hackable/uploads/

THANKS