Web application Penetration Testing

Explore web application architecture by examining the client, server, and database layers, including browsers, HTML, JavaScript, web servers like Apache or Tomcat, application servers, and MySQL.

Learn how http requests and responses enable data exchange, including get and post methods, headers, and cookies. Identify how untrusted inputs and misconfigurations create attacker entry points.

Explore the OWASP top 10 attacks overview, learn how the 2017 top 10 categories guide web application security, and preview practical examples to come in later videos.

Set up a three-vm lab on Linux to practice web application testing with bookshelf and an extremely vulnerable app. Use a bridge network and default credentials to access the VMs.

Verify the lab setup by logging in with default credentials, adjusting terminal preferences, and confirming access to the bookshelf and XviD applications via IPs using a private browser window.

Log into the bookshelf server via ssh using the bookshelf username and the server's IP address, then enter the password to access settings and perform tasks.

Explore the bookshelf application's two user roles: student and admin, covering borrowing, admin management, and uploading and verifying the borrowed books XML file, while highlighting security issues.

Explore SQL injection vulnerabilities from unsanitized user input concatenated into queries. See how crafted payloads bypass authentication and dump database data.

demonstrates authentication bypass on a vulnerable login page using a sql injection payload. the lecture explains how crafted input can manipulate the query to bypass authentication and gain access.

Learn how authentication bypass works through sql injection, test standard and modified payloads on a login page, and even extract data from the database.

Learn to extract data from a database via sql injection, not only bypass authentication, using manual techniques and automated tools through an error-based injection demonstration.

Learn to perform manual, error-based sql injection to exploit an editor-based app, identify columns, use union queries with information_schema, and reveal database details and user credentials.

Learn how to identify blind sql injection in a web application, compare manual exploitation with sqlmap automation, and use a proxy and repeater to craft and test payloads.

Learn to use sqlmap to exploit sql injection on a login page, and dump databases, tables, and columns to retrieve user data from the users table.

Mitigate sql injection by sanitizing and whitelist input, validating data on the server, and using prepared statements with parametrized queries to prevent code execution and data theft.

Understand how origin defines boundaries and how the same origin policy enforces browser security. Explore cross-origin interactions and the roles of cross site scripting and cross site request forgery.

Explore cross-site scripting vulnerabilities, including reflected, stored, and DOM-based attacks, where unsanitized input allows malicious JavaScript payloads, with practical examples.

Explore reflected, stored, and dom-based cross-site scripting, illustrating how malicious payloads reach targets via url parameters or databases and execute in victims' browsers.

Demonstrate practical reflected cross site scripting concepts by testing a vulnerable page, inserting data to reflect back in HTML, JavaScript, or CSS, and crafting payloads to exploit trust.

Explore stored cross-site scripting by submitting anonymous comments that save JavaScript, which later executes for other users, potentially stealing cookies.

Explore dom-based xss through type zero exercises, using payloads, proxy testing, and inspect element techniques to observe how enriched sink behavior echoes user input in the page source and url.

Test the bookshelf application for reflected cross-site scripting by injecting input, viewing the page source, and confirming the reflected JavaScript appears in the source.

Explore an XSS scenario in the bookshelf application by logging in as admin, uploading an SPG image via the file upload feature, and triggering cross-site scripting to reveal input vulnerabilities.

Demonstrates how reflected cross-site scripting can be exploited to steal a victim's cookies using a crafted JavaScript payload and an attacker server.

Cross-site request forgery forces an authenticated user to perform unwanted actions on a web app, such as transferring funds or changing passwords, via a crafted link or page.

Turn the change-password action into a post form with hidden password and confirmed fields, then submit to trigger a csrf payload using post.

Explore how XPath injection targets XML data stores to bypass authentication and reveal other users' borrowed books, highlighting similarities to SQL injection.

Learn how to prevent XPath injection by parameterizing XPath queries and validating user input with regex to ensure the student ID contains only numbers.

Explore XML entities, including internal and external types, and how external entities load data via system references or remote servers; learn how entities reduce repetition and enable remote data access.

Explore how external entity (xxe) injection can exploit insecure xml parsers to read arbitrary server files and potentially execute remote code, with denial of service and internal network access possible.

Learn to test for XML external entity (XXE) vulnerabilities by sending XML payloads to JSON endpoints, switching the content type to application/xml, and checking server processing of XML data.

Explore blind xxe injection and ssrf techniques by crafting external entity payloads and using out-of-band requests to reveal server-side data and read internal files.

Explore how blind XXE attacks exploit XML external entities and DTDs to read server files, exfiltrate data via remote and parameter entities, and reveal errors for data leakage.

Prevent XXE by avoiding external entities and enforcing strict input validation, and enable security features in Java DOM and SAX parsers to protect XML processing.

Explore how missing access controls enable privilege escalation, including horizontal and vertical, and how role-based controls enforce what users can access. Learn about a session-based admin dashboard flaw and prevention.

Implement role based access controls to prevent privileged escalation in web apps, using session checks and admin role validation for dashboards, and centralize access control rules for large applications.

Explore how unvalidated file uploads can let attackers gain control of a web application and server by uploading crafted files, bypassing authentication to access the admin panel and Tomcat credentials.

Enforce input validation with a whitelist of allowed extensions and reject nonconforming types. Store uploads outside the webroot and apply size limits and captcha to prevent abuse.