Buy me a tea

General Methodo & Misc Tips

Notes mostly from work and also from XSSrat course

General Methodology

Exploration and enumeration

  • Read the documentation

  • Explore the application

  • Inspect JS files (you could find API key, hidden endpoint, hidden parameters, passwords etc.)

  • Testing as unauthenticated

  • Testing as user

  • Testing as admin

  • When doing web pentest it is always worth using checklist as there are so many things to test for. Here is one checklist

  • Do not hesitate to tamper with responses also (not only requests)

  • Test multiple injections at the same time with the following payload (SQLi, SSTi, CSTi, XSS)

'"`><img src=x>${7*7}

Investigate Parameters

  • Business logic erros

  • IDORS

  • CSRF tokens (check if it is present and test it if it exists)

  • Parameter pollution (adding same parameter multiple times)

  • Image upload: SVG for XXE

  • Soap Request: XXE

  • SQLi

  • JWT tokens

  • Unmapped object properties

  • XSS

  • Admin panel bypass

  • Template injection

  • Captcha bypass

Install and use Chrome in kali

It can happen that an application is not made for firefox. In this case you will need another browser. Chrome could do the job.

  • Intall Chrome

sudo apt update
wget https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb
sudo apt install ./google-chrome-stable_current_amd64.deb

  • Launch it with proxy and ignore cert errors google-chrome-stable --proxy-server=127.0.0.1:8080 --ignore-certificate-errors this way you will be able to see your request through burp as usual.

Bypass Cert not private error on Chrome - Kali

Warning: use we caution and only in your pentest environment/vm Sometimes when you test a website you get an annoying error related to the certificates when you have to go back to it multiple times a day it can be a paint to click on ignore every time. Here is a quick fix for this

  • At the end of "Command" add --ignore-certificate-errors and save, the command should look like this now:

/usr/bin/google-chrome-stable %U --ignore-certificate-errors

You can also use aliases if you prefer to launch everything with cmd. Here are the one I use (you have to add them in your .zshrc file or .bashrc file depending on the shell you use):

alias chromeburpnocert='google-chrome-stable --proxy-server=127.0.0.1:8080 --ignore-certificate-errors'
alias chromenocert='google-chrome-stable --ignore-certificate-errors'
alias chrome='google-chrome-stable'

For whitebox test

Git dorks

  • When you are in whitebox you might get access to git repos. If for some reason you are not able to download the code, you can use git dorks to find specific strings

  • org:NameOfOrg keyword-in-repo-that-is-used-for-a-specific-project in:name,description,tags keyword-to-look-for example org:MyOrg myproject in:name,description,tags password

How to test for External service interaction without burp collaborator

Recently I had to check if I was able to trigger my target into sending dns request to random hosts. However I could not use burp collaborator. To replace it I used a great python tool that is similar to http simple server but for dns. This tool is called dnserver

Install dnserver

sudo apt update
pip install dnsserver

Launch dnserver

  • sudo python3 -m dnserver --port 5053 example_zones.toml (if you use sudo you will have to put sudo in front of pip install dnserver for the install part)

  • To test if you server works you can do this dig @gabrielle.pwn -p 5053 gabrielle.pwn MX

Test if your target sends dns request to random hosts

Now you should be able to input your dns server where you need to and check if the app actually requests it. You can use wireshark or another tool to monitor the traffic.

Useful resources for web pentest

LogoUsing Burp Suite and Owasp ZAP at the same time (Chaining Proxys)CybersecurityLife
Use Burp Suite and OWASP Zap at the same time by chaining proxy

  • Foxyproxy

LogoFoxyProxy Standard
Chrome
LogoFoxyProxy Standard – Get this Extension for 🦊 Firefox (en-CA)mozamo
Firefox
LogoFirefox Multi-Account Containers – Get this Extension for 🦊 Firefox (en-CA)mozamo
Containers only on Firefox

  • I am more a Firefox user but when I have to use an alternate browser I use this extension it usually works pretty well. However the best method for Chrome, in my opinion, would be to use the new incognito window and allow foxyproxy in it, I find it more convenient.

https://chrome.google.com/webstore/detail/multilogin/ijfgglilaeakmoilplpcjcgjaoleopfi?hl=enchrome.google.com
Multi Login Firefox containers alternative for Chrome
LogoGitHub - snoopysecurity/awesome-burp-extensions: A curated list of amazingly awesome Burp ExtensionsGitHub
Awesome Burp extensions - Snoopy Security
LogoGitHub - swisskyrepo/PayloadsAllTheThings: A list of useful payloads and bypass for Web Application Security and Pentest/CTFGitHub
Payload all the things - swisskey repo
LogoIntroduction - OWASP Cheat Sheet Series
OWASP Cheat Sheet (useful for recommendations in report)
https://wiki.owasp.org/index.php/Web_Application_Penetration_Testingwiki.owasp.org
OWASP - Web Application Penetration Testing
LogoGitHub - danielmiessler/SecLists: SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.GitHub
Seclists
LogoGitHub - fuzzdb-project/fuzzdb: Dictionary of attack patterns and primitives for black-box application fault injection and resource discovery.GitHub
FuzzDB
LogoGitHub - tanprathan/OWASP-Testing-Checklist: OWASP based Web Application Security Testing Checklist is an Excel based checklist which helps you to track the status of completed and pending test cases.GitHub
OWASP Testing Checklist
https://owasp.org/www-project-web-security-testing-guide/assets/archive/OWASP_Testing_Guide_v4.pdf
OWASP Testing Guide

  • This can be useful if you want to install apps to practice on

LogoInstalling Docker on Kali Linux (updated for 2021.1)Medium
Install Docker on Kali

Resources for practice

RatSec Security
Practice with labs made by The XSS rat
LogoWeb Security Academy: Free Online Training from PortSwiggerWebSecAcademy
Portswigger Web Security Academy
LogoGitHub - juice-shop/juice-shop: OWASP Juice Shop: Probably the most modern and sophisticated insecure web applicationGitHub
OWASP Juice Shop
LogoUncle rat's notesWesley's Notion on Notion
Uncle rat's notes
PreviousOWASP Top 10NextWeb Services and API

Last updated