Introduction to Web Application Security Testing

Web applications have become integral to modern business operations, spanning from government portals to financial services and social platforms. This ubiquity makes them attractive targets for malicious actors seeking to exploit vulnerabilities for data theft or service disruption. Organizations must proactively identify and remediate security weaknesses before deployment.

Modern development practices emphasize rapid iteration, often prioritizing functionality over security testing. This creates demand for specialized penetration testers who evaluate applications from an adversarial perspective, identifying exploitable flaws and recommending corrective measures.

Penetration Testing Methodology Overview

Security assessment approaches vary in scope and information availability:

• Black-box testing: Simulates external attackers with no prior knowledge of the target system
• White-box testing: Provides testers with complete information including source code access
• Gray-box testing: Supplies partial information such as application URLs and user credentials

Before commencing any engagement, formal rules must document the testing scope, client contacts, notification protocols, data handling procedures, and reporting schedules.

HTTP Protocol Fundamentals

The Hypertext Transfer Protocol governs client-server communication in web applications. HTTP operates as a stateless protocol, requiring session management mechanisms to maintain user context across multiple requests.

Request and Response Structure

HTTP messages contain headers and optional body sections. Key request headers include:

• Host: Specifies the target server and port
• User-Agent: Identifies the client software type
• Cookie: Transmits session identifiers and preferences
• Authorization: Carries authentication credentials

Response headers convey status codes, server information, cache directives, and cookie assignments. Status codes indicate operation outcomes: 2xx for success, 3xx for redirection, 4xx for client errors, and 5xx for server errors.

HTTP Methods

Common methods serve distinct purposes:

• GET: Retrieves resources, parameters embedded in URLs
• POST: Submits data in the request body
• HEAD: Returns headers without body content
• OPTIONS: Lists supported methods
• PUT/DELETE: Modify or remove resources
• TRACE: Echoes requests for debugging

Session Management Mechanisms

Cookies serve as the primary session tracking mechanism. Servers issue session identifiers through Set-Cookie headers, which clients return in subsequent requests. Cookie parameters define behavior:

• Domain/Path: Restrict cookie transmission scope
• Secure: Enforces encrypted transmission only
• HttpOnly: Blocks JavaScript access
• Expires: Sets persistence duration

Persistent cookies store data on client filesystems, while session cookies reside in browser memory and expire when sessions terminate.

Web Application Architecture

Enterprise applications typically employ multi-tier designs:

• Presentation tier: Handles user interface via web servers (Apache, nginx, IIS)
• Application tier: Processes business logic using languages like PHP, Python, Java
• Data tier: Manages persistence through database systems (MySQL, PostgreSQL, MongoDB)

Web Services and APIs

Service-oriented architectures enable platform-independent data exchange. Two dominant paradigms exist:

• SOAP: XML-based protocol with formal specifications
• REST: Lightweight architectural style leveraging HTTP methods for CRUD operations

REST APIs commonly map methods to operations: POST for creation, GET for retrieval, PUT for updates, DELETE for removal. Data formats include XML and JSON.

Asynchronous Web Technologies

AJAX enables background server communication without full page reloads, improving user experience through partial updates. The XMLHttpRequest object facilitates asynchronous data transfer, typically using JSON payloads.

HTML5 Security Features

HTML5 introduces WebSocket connections for bidirectional communication, bypassing HTTP's request-response model. The upgrade handshake transitions HTTP connections to persistent binary protocols.

Setting Up Kali Linux

Kali Linux provides a comprehensive penetration testing platform based on Debian. Installation options include virtual machines, Docker containers, cloud instances, and physical hardware deployment.

Virtualization offers advantages like snapshot restoration and resource flexibility but may impact performance for computationally intensive tasks like password cracking.

Key Web Testing Tools

Burp Suite functions as an intercepting proxy for request manipulation and analysis. Features include spidering, intrusion testing, and repeater modules for request modification.

OWASP ZAP offers similar proxy capabilities with forced browsing functionality. Additional tools include directory scanners (DIRB), vulnerability scanners (Nikto, w3af), and CMS-specific scanners (WPScan).

Reconnaissance Techniques

Information gathering precedes active testing. Passive methods harvest public data without direct target interaction.

Domain Intelligence

WHOIS queries reveal registration details including contacts and DNS servers. DNS enumeration identifies hosts through zone transfers, brute forcing, and reverse lookups.

dig axfr target.com @nameserver
whois target.com

Search engine harvesting extracts subdomains, email addresses, and employee information. Google dorking employs advanced search operators:

site:example.com filetype:pdf
intitle:admin site:example.com

Open Source Intelligence Tools

theHarvester aggregates data from multiple sources. Maltego visualizes relationships between entities. Recon-ng provides a modular framework similar to Metasploit for automated collection.

Server Analysis

Active probing identifies infrastructure components.

Port Scanning

Nmap discovers open ports and services:

nmap -sS -sV -p- target
nmap --script http-methods target

Technology Identification

WhatWeb fingerprints frameworks, libraries, and server technologies. HTTP headers and HTML source reveal implementation details.

Load Balancer Detection

Cookie analysis identifies load balancing mechanisms. F5 BIG-IP cookies encode server addresses:

BIGipServerPoolName=RIPv4.Port.0000

Authentication Vulnerability Assessment

Authentication Mechanisms

Web applications employ various authentication schemes:

• Basic: Base64-encoded credentials in headers
• Digest: MD5-hashed challenge responses
• NTLM/Kerberos: Windows-integrated authentication
• Form-based: Custom credential submission via POST
• OAuth: Token-based access delegation

Username Enumeration

Differential responses to valid and invalid usernames expose account existence. Login error messages may distinguish between "invalid user" and "wrong password" conditions.

Burp Intruder automates username discovery:

POST /login HTTP/1.1
Host: target.com

username=^USER^&password=test

Password Attacks

THC Hydra performs credential brute forcing across protocols:

hydra -L users.txt -P passwords.txt http-get://target/login
hydra target http-form-post "/login:user=^USER^&pass=^PASS^:Invalid" -L users.txt -P pass.txt

Session Quality Analysis

Burp Sequencer evaluates session identifier randomness. Low entropy indicates predictable tokens vulnerable to hijacking.

Session Fixation

Attackers preset session identifiers before victim authentication. If identifiers remain unchanged post-login, attackers reuse preset values to access authenticated sessions.

Defensive Measures

Robust authentication requires:

• Unique usernames with case-insensitivity
• Strong password policies rejecting common patterns
• Secure credential transmission via TLS
• Account lockout after failed attempts
• Secure reset mechanisms through verified channels

Session management best practices include:

• Long, random, unique identifiers
• Identifier regeneration at authentication boundaries
• Appropriate timeout intervals
• Secure cookie attributes (Secure, HttpOnly, SameSite)
• Authorization verification per request