This page contains a checklist of the tasks you typically need to perform when carrying out a comprehensive attack against a web application. You can use this as a quick reminder of the areas you need to cover. For more detail, and the specific action steps involved, refer to the full methodology in Chapter 21 (or Chapter 20 in the first edition).

Recon and analysis

Map visible content
Discover hidden & default content
Test for debug parameters
Identify data entry points
Identify the technologies used
Map the attack surface

Test handling of access

Authentication
Test password quality rules
Test for username enumeration
Test resilience to password guessing
Test any account recovery function
Test any "remember me" function
Test any impersonation function
Test username uniqueness
Check for unsafe distribution of credentials
Test for fail-open conditions
Test any multi-stage mechanisms
Session handling
Test tokens for meaning
Test tokens for predictability
Check for insecure transmission of tokens
Check for disclosure of tokens in logs
Check mapping of tokens to sessions
Check session termination
Check for session fixation
Check for cross-site request forgery
Check cookie scope
Access controls
Understand the access control requirements
Test effectiveness of controls, using multiple accounts if possible
Test for insecure access control methods (request parameters, Referer header, etc)

Test handling of input

Fuzz all request parameters
Test for SQL injection
Identify all reflected data
Test for reflected XSS
Test for HTTP header injection
Test for arbitrary redirection
Test for stored attacks
Test for OS command injection
Test for path traversal
Test for script injection
Test for file inclusion
Test for SMTP injection
Test for native software flaws (buffer overflow, integer bugs, format strings)
Test for SOAP injection
Test for LDAP injection
Test for XPath injection

Test application logic

Identify the logic attack surface
Test transmission of data via the client
Test for reliance on client-side input validation
Test any thick-client components (Java, ActiveX, Flash)
Test multi-stage processes for logic flaws
Test handling of incomplete input
Test trust boundaries
Test transaction logic

Assess application hosting

Test segregation in shared infrastructures
Test segregation between ASP-hosted applications
Test for web server vulnerabilities
Default credentials
Default content
Dangerous HTTP methods
Proxy functionality
Virtual hosting mis-configuration
Bugs in web server software

Miscellaneous tests

Check for DOM-based attacks
Check for frame injection
Check for local privacy vulnerabilities
Persistent cookies
Caching
Sensitive data in URL parameters
Forms with autocomplete enabled
Follow up any information leakage
Check for weak SSL ciphers

Copyright © 2011 Dafydd Stuttard and Marcus Pinto. All rights reserved.