Web Application Security

Parth Patel
Security Analyst & Trainer
Techdefence labs
 CHAPTER-2

Information Gathering
What is information gathering?
• Information Gathering is the act of gathering different kinds of information
against the targeted victim or system. It is the first step or the beginning
stage of Ethical Hacking, where the penetration testers or hackers (both
black hat or white hat) performed this stage; this is a necessary and crucial
step to be performed. The more the information gathered about the target,
the more the probability to obtain relevant results. Information gathering is
not just a phase of security testing; it is an art that every penetration-tester
(pen-tester) and hacker should master for a better experience in penetration
testing. There are various tools, techniques, and websites, including public
sources such as Whois, nslookup that can help hackers gather information.
This step is necessary because you may need any information (such as his pet
name, best friend's name, age, or phone number to perform password
guessing attack or other kinds of attacks) while performing attacks on any
target.
Contd..
• Information gathering can be classified into three major categories:
• Footprinting
Footprinting is the technique to collect as much information as possible
about the targeted network/victim/system. It helps hackers in various ways
to intrude on an organization's system. This technique also determines the
security postures of the target. Footprinting can be active as well as passive.
Passive footprinting/pseudonymous footprinting involves
collecting data without the owner, knowing that hackers gather his/her
data. In contrast, active footprints are created when personal data gets
released consciously and intentionally or by the owner's direct contact
Contd..

• Scanning
Scanning is another essential step, which is necessary, and it refers to
the package of techniques and procedures used to identify hosts,
ports, and various services within a network. Network scanning is one
of the components of intelligence gathering and information
retrieving mechanism an attacker used to create an overview
scenario of the target organization (target organization: means the
group of people or organization which falls in the prey of the Hacker).
Vulnerability scanning is performed by pen-testers to detect the
possibility of network security attacks. This technique led hackers to
identify vulnerabilities such as missing patches, unnecessary services,
weak authentication, or weak encryption algorithms. So a pen-tester
and ethical hacker list down all such vulnerabilities found in an
organization's network.
Contd..
• Tools that can are used to scan networks and ports are:
• Nmap: extract information such as live hosts on the network, services, type
of packet filters/firewalls, operating systems, and OS versions.
• Angry IP Scanner: scans for systems available in a given input range.
• Hping2/Hping3: are command-line packet crafting and network
scanning tools used for TCP/IP protocols.
• Superscan: is another powerful tool developed by Mcafee, which is a TCP
port scanner, also used for pinging.
• ZenMap: is another very powerful Graphical user interface (GUI) tool to
detect the type of OS, OS version, ping sweep, port scanning, etc.
• Net Scan Tool Suite Pack: is a collection of different types of tools that can
perform a port scan, flooding, webrippers, mass emailers; and This tool is a
trial version, but paid versions are also available.
• Wireshark and Omnipeak are two powerful and famous tools that listen
to network traffic and act as network analyzers.
WHOIS

A WHOIS search will

provide information
regarding a domain
name, such as
[Link]. It may
include information, such
as domain ownership,
where and when
registered, expiration
date, and the
nameservers assigned to
the domain.
NsLookup

• Displays information that you can use to diagnose Domain Name System (DNS)
infrastructure. Before using this tool, you should be familiar with how DNS
works. The nslookup command-line tool is available only if you have installed
the TCP/IP protocol.

• The nslookup command-line tool has two modes: interactive and

noninteractive.

• If you need to look up only a single piece of data, we recommend using the
non- interactive mode. For the first parameter, type the name or IP address of
the computer that you want to look up. For the second parameter, type the
name or IP address of a DNS name server. If you omit the second argument,
nslookup uses the default DNS name server.
• For more info: [Link]
us/windows- server/administration/windows-
commands/nslookup
Contd..
Netcraf
t
[Link]

SHODAN and Spiderfoot gives you a better result

though.
Webserver fingerprinting

• Web server fingerprinting is the task of identifying the type and version
of web server that a target is running on. While web server
fingerprinting is often encapsulated in automated testing tools, it is
important for researchers to understand the fundamentals of how these
tools attempt to identify software, and why this is useful.

• Accurately discovering the type of web server that an application runs on

can enable security testers to determine if the application is vulnerable
to attack. In particular, servers running older versions of software
without up-to-date security patches can be susceptible to known
version-specific exploits.
Banner Grabbing

• A banner grab is performed by sending

an HTTP request to the web server and
examining its response header. This
can be accomplished using a variety of
tools, including telnet for HTTP
requests, or openssl for requests over
SSL.

• For example, here is the response to

a request from an Apache and Nginx
server.
What is sub-domain enumeration?
• Sub-domain enumeration is the process
of finding sub-domains for one or
more domain(s). It is an essential part of
the reconnaissance phase.
Why sub-domain enumeration?
• Sub-domain enumeration can reveal a lot
of domains/sub-domains that are in scope of
a security assessment which in turn
increases the chances of finding vulnerabilities
• Finding applications running on hidden, forgotten
sub-domains may lead to uncovering critical
vulnerabilities. Often times the same
vulnerabilities tend to be present across different
domains/applications of the same organization.
How to Fingerprint Web Application Framework
:• Web Application Framework Fingerprinting
is one of the most important task
information gathering. Knowing the type of
framework, a web application is using will
give a great advantage to hacker or
penetration tester. Because once we know
framework, we can easily locate known
vulnerabilities in that framework. Most of
the web frameworks are widely used by
popular websites across the globe which
help an attacker to spot them. This is
basically what all automatic tools do, they
look for frameworks used from a
predefined location and then compare it to
the database of known signatures.
Enumeration and its Types

• Enumeration is defined as the process of extracting usernames,

machine names, network resources, shares and services from a system. In this
phase, the attacker creates an active connection to the system and performs
directed queries to gain more information about the target. The gathered
information is used to identify the vulnerabilities or weak points in system
security and tries to exploit in the System gaining phase.
Types of information enumerated by intruders:
• Network Resource and shares

• Users and Groups

• Routing tables

• Auditing and Service settings

• Machine names

• Applications and banners

• SNMP and DNS details

Techniques for Enumeration
• Extracting user names using email ID's

• Extract information using the default password

• Brute Force Active Directory

• Extract user names using SNMP

• Extract user groups from Windows

• Extract information using DNS Zone transfer

Security Misconfiguration
• Security misconfigurations are
security controls that are
inaccurately configured or left
insecure, putting your systems and
data at risk. Basically, any
poorly documented
configuration changes, default
settings, or a technical issue across
any component in your endpoints
could lead to a misconfiguration.
Probable reasons:

• Human errors
• Poor or weak encryption
• Excess privilege
• Misconfigured logging
• Improper versioning
• Insecure services
• Misconfigurations related to security tools
• Using out-of-the-box settings
Google Hacking Database

• The Google Hacking

Database (GHDB) is a
categorized index of
Internet search
engine queries
designed to uncover
interesting, and
usually sensitive,
information made
publicly available on
the Internet.
Contd..

Google hacking, sometimes, referred to as Google dorking, is an

information gathering technique used by an attacker leveraging
advanced Google searching techniques.
Google hacking search queries can be used to identify
security vulnerabilities in web applications, gather information for
arbitrary or individual targets, discover error messages disclosing
sensitive information, discover files containing credentials and
other sensitive data.
Contd..

The advanced search string crafted by an attacker could be searching for the
vulnerable version of a web application, or a specific file-type (.pwd, .sql...) in
order to further restrict the search. The search can also be restricted to pages
on a specific site, or it can search for specific information across all websites,
giving a list of sites that contain the information.

For instance, the following search query will list SQL files (filetype:sql) available
that have been indexed by Google on websites where directory listing is
enabled (intitle:"index of").
Contd..

➢ cache: this dork will show you the cached version of any website, e.g.
cache:[Link]
➢ allintext: searches for specific text contained on any web page,
e.g. allintext: hacking tools
➢ allintitle: exactly the same as allintext, but will show pages that
contain titles with X characters, e.g. allintitle:"Security Companies"
➢ allinurl: it can be used to fetch results whose URL contains all the
specified characters, e.g: allinurl:clientarea
➢ filetype: used to search for any kind of file extensions, for example, if
you want to search for pdf files you can use:
email security filetype: pdf
Contd..

➢ inurl: this is exactly the same as allinurl, but it is only useful for one single
keyword, e.g. inurl:admin
➢ intitle: used to search for various keywords inside the title, for
example, intitle:security tools will search for titles beginning with
"security" but "tools" can be somewhere else in the page.
➢ inanchor: this is useful when you need to search for an exact anchor text
used on any links, e.g. inanchor:"cyber security"
➢ intext: useful to locate pages that contain certain characters or strings
inside their text, e.g. intext:"safe internet"
➢ site: will show you the full list of all indexed URLs for the specified
domain and subdomain, e.g. site:[Link]
Contd..
➢ *: wildcard used to search pages that contain "anything" before your word,
e.g. how to * a website, will return "how to…" design/create/hack, etc… "a
website".
➢ |: this is a logical operator, e.g. "security" "tips" will show all the sites
which contain "security" or "tips," or both words.
➢ +: used to concatenate words, useful to detect pages that use more than one
specific key, e.g. security + trails
➢ –: minus operator is used to avoiding showing results that contain
certain words, e.g. security -trails will show pages that use "security" in
their text, but not those that have the word "trails."
OSINT Framework

OSINT stands for Open-Source Intelligence. It refers to the

collection and analysis of information that is publicly available
and accessible to anyone. This information is gathered from
open sources such as websites, social media platforms, online
forums, public records, news articles, and other publicly
accessible data sources.