Overview

Understanding the attacker's perspective is key to successful web application penetration testing. The course begins by thoroughly examining web technology, including protocols, languages, clients, and server architectures, from the attacker's perspective. We look at collecting open source intelligence (OSINT) specific to data points likely to help exploitation be more successful. We analyze the importance of encryption and HTTPS. Before leaving HTTPS, we dive into the infamous Heartbleed flaw and get our first taste of exploitation with a hands-on lab.

We look at the methodology promoted by OWASP to help ensure the delivery of high-quality assessments, as well as the things necessary for a penetration tester's toolkit. The most important tool, an interception proxy, is introduced through performing the initial configuration steps in OWASP's Zed Attack Proxy (ZAP) and BurpSuite Professional. To complete the course day, we explore aspects of a vulnerable web application using BurpSuite.

Overview

The second day begins with profiling the target(s) to understand the underlying configuration. The collected data is used to build a profile of each server and identify potential configuration flaws. The discussion is underscored through several practical, hands-on labs in which we conduct reconnaissance and use the Shellshock vulnerability to exploit a configuration flaw against in-class targets. The exploitation is an opportunity to get deeper hands-on experience with BurpSuite Pro, cURL, and manual exploitation techniques.

The system's configuration should involve proper logging and monitoring to ensure security-related events are not missed. We will briefly explore logging configuration and basic incident response testing.

We build a map or diagram of the application's pages and features. This phase involves identifying the components, analyzing the relationship between them, and determining how the pieces work together. We then dive deep into the spidering/crawling results, which represents a vital part of the overall penetration test, as well as perform forced browsing to find hidden content in a lab.

Towards the end of the day, we examine different authentication systems, including Basic, Digest, Forms, Windows Integrated and OAuth authentication, and discuss how servers use them and attackers abuse them. We will perform username enumeration and in the final exercise, we will use Burp's fuzzer, Intruder, to guess the password used to successfully authenticate to a web application.

Overview

After ending Day 2 with a successful authentication event, we begin by exploring how web applications track authenticated users and ways to exploit weaknesses in session management. We discuss authentication and authorization bypasses, which can expose sensitive data and business functions to attackers, as well as exploit an authentication flaw in Mutillidae.

We will build on the information identified during the target profiling, spidering, and forced browsing exercises, exploring methods to find and verify vulnerabilities within the application. Students also begin to explore the interactions between the various vulnerabilities.

This course day dives deeply into vital manual testing techniques for vulnerability discovery. We focus on developing in-depth knowledge of interception proxies for web application vulnerability discovery. Many of the most common injection flaws (command injection and local and remote file inclusion are introduced, and followed with lab exercises, to reinforce the discovery and exploitation.

Besides this, a section covers insecure deserialization, a common vulnerability in object-oriented programming languages, where students will exploit a Java insecure deserialization vulnerability in a lab, in order to steal a secret file from a vulnerable web application.

Due to its prevalence and the significant impact generally associated with the flaw, a significant portion of the day is devoted to traditional and blind SQL injection.

Overview

On day four, students continue exploring injection flaws. We cover methods to discover key vulnerabilities within web applications, such as XML External Entities (XXE). After XXE, the rest of the day spends time introducing Cross-Site Scripting (XSS) vulnerabilities, including reflected, stored and DOM-based XSS vulnerabilities. Manual discovery methods are employed during hands-on labs.

Day 4 also introduces BeEF to students, which is used in a lab. The course continues with a detailed discussion of AJAX as we explore how it enlarges the attack surface leveraged by penetration testers. We also analyze how AJAX is affected by other vulnerabilities already covered in depth earlier in the course.

Finally, the day ends with a lab in which an AJAX web application is exploited, and finally hooked with BeEF for total control.

Overview

On the fifth day, we launch actual exploits against real-world applications, expanding our foothold within the application, and extending it to the network on which it resides. As penetration testers, we specifically focus on ways to leverage previously discovered vulnerabilities to gain further access, highlighting the cyclical nature of web application penetration testing.

During our exploitation phase, we expand our use of tools such as ZAP and BurpSuite Pro, plus complement them with further use of sqlmap and Metasploit to help craft exploits against various web applications. We launch SQL injection and Cross-Site Request Forgery attacks, amongst others. In class we exploit these flaws to perform data theft, hijack sessions, deface a website, get shells, pivot against connected networks, and much more. Through various forms of exploitation, the student gains a keen understanding of the potential business impact of these flaws to an organization.

While the whole course is geared towards understanding how web application vulnerabilities work and how they can be exploited, on day five we also introduce the active scanner component in BurpSuite Pro.

To position students to take their skills to the next level, the last lab of day 5 looks at an instance where a Metasploit module fails to exploit a vulnerability that has been confirmed to exist in the target web application. We explore a process to research the flaw, manually exploit the vulnerability, and then reconfigure the Metasploit module to successfully gain a shell. This exercise gives students necessary skills to dig deeper when automated tools fail.

We wrap up course instruction by reviewing how to prepare for penetration testing assessments and important post assessment activities, such as report writing.