Web App Penetration Testing & Bug Bounty Hunting

Setting up a web app pentesting lab‌

The Broken Web Application (BWA) is an OWASP project that provides a self-contained VM complete with a variety of applications with known vulnerabilities. The applications within this VM enable students to learn about web application security, practice and observe web attacks, and make use of penetration tools such as Burp.‌

We will download the OWASP BWA VM along with supportive tools to create our web app pentesting lab.‌

Software tool requirements‌

To complete this recipe, you will need the following:‌

1. Oracle VirtualBox (https://www.virtualbox.org/wiki/Downloads)

2. Choose an executable specific to your platform

3. Mozilla Firefox Browser (https://www.mozilla.org/en-US/firefox/new/)

4. 7-Zip file archiver (https://www.7-zip.org/download.html)

5. OWASP BWA VM (https://sourceforge.net/projects/owaspbwa/files/)

6. Burp Proxy Community or Professional (https://portswigger.net/burp/)

7. Oracle Java (https://www.java.com/en/download/)

1. Start Burp and Listening for HTTP traffic, using Burp

2. How to setup proxy in browser Burp Suite Proxy

Getting to Know the Burp Suite of Tools // Know the Burp Suite

1. Setting the Target Site Map

2. Understanding Message Editor

3. Repeating with Repeater

4. Decoding with Decoder

5. Intruding with Intruder

Assessing Authentication Schemes

1. Testing for account enumeration and guessable accounts

2. Testing for weak lock-out mechanisms

3. Testing for bypassing authentication schemes

4. Testing for browser cache weaknesses

5. Testing the account provisioning process via REST API

Assessing Authorization Checks

1. Testing for directory traversal

2. Testing for Local File Include (LFI)

3. Testing for Remote File Include (RFI)

4. Testing for privilege escalation

5. Testing for insecure direct object reference

Assessing Session Management Mechanisms

1. Testing session token strength using Sequencer

2. Testing for cookie attributes

3. Testing for session fixation

4. Testing for exposed session variables

5. Testing for Cross-Site Request Forgery

Assessing Business Logic:

This Video covers the basics of business logic testing, including an explanation of some of the more common tests performed in this area. Web penetration testing involves key assessments of business logic to determine how well the design of an application performs integrity checks, especially within sequential application function steps, and we will be learning how to use Burp to perform such tests.