Qadit – VAPT Approach & Methodology
1.1 Major Vulnerabilities Covered (not an exhaustive list)
OWASP Top 10 Web
SANS 25 Vulnerabilities
Vulnerabilities (2021)
CWE-22- Improper Limitation of a Pathname to a Restricted
Directory ('Path Traversal')
CWE-200- Exposure of Sensitive Information to an
1.A01 Broken
Unauthorized Actor
Access Control
CWE-276- Incorrect Default Permissions
CWE-352- Cross-Site Request Forgery (CSRF)
CWE-862- Missing Authorization
2. A02
Cryptographic
Failures
CWE-20- Improper Input Validation
CWE-77- Improper Neutralization of Special Elements used in
a Command ('Command Injection')
CWE-78- Improper Neutralization of Special Elements used in
3. A03 Injection an OS Command ('OS Command Injection')
CWE-79- Improper Neutralization of Input During Web Page
Generation ('Cross-site Scripting')
CWE-89- Improper Neutralization of Special Elements used in
an SQL Command ('SQL Injection')
4. A04 Insecure CWE-434- Unrestricted Upload of File with Dangerous Type
Design CWE-522- Insufficiently Protected Credentials
5. A05 Security CWE-611- Improper Restriction of XML External Entity
Misconfiguration Reference
6. A06
Vulnerable and
Outdated
Components
7. A07
CWE-287- Improper Authentication
Identification and
CWE-306- Missing Authentication for Critical Function
Authentication
CWE-798- Use of Hard-coded Credentials
Failures
8. A08 Software
and Data Integrity CWE-502- Deserialization of Untrusted Data
Failures
9. A09 Security
Logging and
Monitoring
Failures
10. A10 Server-
Side Request CWE-918- Server-Side Request Forgery (SSRF)
Forgery (SSRF)
Qadit – VAPT Approach & Methodology
1.2 Web App Security testing methodology
Web application penetration testing involves a methodological series of steps aimed
at gathering information about the target system, finding vulnerabilities or faults in
them, researching for exploits that will succeed against those faults or vulnerabilities
and compromise the web application. These include but are not limited to the below
categories
Information Gathering
Configuration and Deploy Management
Identity Management
Authentication & Authorization
Session Management
Data Validation
Error Handling
Cryptography
Business Logic
Client side/Server side
Information Gathering
The information-gathering phase consists of server fingerprinting, application
enumeration, and more. Information gathering efforts result in a compiled list of
metadata and raw output to obtain as much information about the application's
makeup as possible.
Configuration and Deploy Management
Understanding the deployed configuration of the server hosting the web application is
almost as important as the application security testing itself. In order to evaluate the
readiness of the application platform, testing for configuration management includes
the following sections:
➢ Test File Extensions Handling for Sensitive Information
➢ Review Backup and Unreferenced Files for Sensitive Information
➢ Enumerate Infrastructure and Application Admin Interfaces
➢ HTTP Methods & HSTS
➢ Review Cross Domain Policy files
Qadit – VAPT Approach & Methodology
Identity Management
Identity management (ID management) is the organizational process for ensuring
individuals have the appropriate access to technology resources. This includes the
identification, authentication and authorization of a person, or persons, to have access
to applications, systems or networks.
➢ Roles/Privilege Definition & User registration process
➢ Checking Default & Guessable Accounts
➢ Testing for Password & Account Lockout
Authentication & Authorization
These testing includes:
➢ Ensure Credentials are transferred over encrypted channel
➢ Internal Urls cannot be probed without login
➢ Sensitive information are not stored in cache
➢ Autocomplete is off for sensitive fields
➢ Application last login & Failed Login
➢ Logout functionality available on all screens
➢ Testing for IDOR,Directory traversal & File inclusion
Session Management
Session Management is defined as the set of all controls governing state-full
interaction between a user and the web-based application. This broadly covers
anything from how user authentication is performed, to what happens upon them
logging out. Testing include
➢ Ensure Session Ids are not reused or can be user defined
➢ Session cookie attributes & Flags enabled
➢ Testing for Exposed session variables
➢ Session timout in place
➢ CSRF Protection enabled
Input Validation
The most common web application security weakness is the failure to properly validate
input coming from the client or from the environment before using it. This weakness
leads to almost all of the major vulnerabilities in web applications, such as cross site
scripting, SQL injection, interpreter injection, locale/Unicode attacks, file system
attacks, and buffer overflows. These include
➢ Cross-site Scripting
➢ HTTP Verb Tampering/Parameter Pollution
➢ Injection ( SQL, LDAP,XPath etc.;)
➢ File Inclusion
➢ Overflow Attacks
Qadit – VAPT Approach & Methodology
➢ HTTP Splitting/Smuggling
Error Handling
Improper handling of errors can introduce a variety of security problems for a web site.
The most common problem is when detailed internal error messages such as stack
traces, database dumps, and error codes are displayed to the user (hacker). These
messages reveal implementation details that should never be revealed.
➢ Error message reveal make or version information
➢ Error response to injection attacks
Cryptography
Cryptography provides for secure communication in the presence of malicious third-
parties—known as adversaries
➢ Testing for Weak SSL/TSL Ciphers, Insufficient Transport Layer Protection
➢ Testing for Sensitive information sent via unencrypted channels
➢ Use of Weak hashing algorithms
Business Logic Testing
Testing for business logic flaws in a multi-functional dynamic web application
requires thinking in unconventional methods.
➢ Testing for data validation
➢ Ability to Forge Request
➢ Test Number of Times a Function Can be Used Limits ( Ex: OTP generation)
➢ Multi-factor Authentication bypass/ OTP or Captcha bypass
➢ Malicious File upload
Client-side/ Server-side Testing
Testing Include:
➢ CSRF/SSRF
➢ Clickjacking
➢ Url Redirection
➢ CORS Sharing