Web Application VAPT Checklist
Uploaded by
bookpdf092Web Application VAPT Checklist
Uploaded by
bookpdf092Common questions
Powered by AIAllowing CORS with a wildcard or a non-specific domain can lead to security vulnerabilities where any external site can initiate requests to the web application, potentially exposing sensitive data. Proper CORS configuration should involve allowing only specific, trusted domains to interact with the service, ensuring that credentials are only shared under strict conditions .
Open redirect vulnerabilities allow attackers to redirect users from a trusted site to a malicious one, increasing the effectiveness of phishing campaigns. By crafting URLs that appear trustworthy, attackers can deceive users into providing sensitive information on fake sites, thereby facilitating credential theft and identity fraud. Prevention involves validating redirect destinations to ensure they are to expected, approved locations .
Local File Inclusion (LFI) can be exploited to disclose sensitive application data or configuration files, such as accessing '/etc/passwd'. By inserting specially crafted payloads into included files, attackers might convert an LFI into Remote Code Execution (RCE), gaining control over the system. Combining these vulnerabilities can significantly elevate the potential impact of an initial LFI finding .
Using paid mass email services like Amazon SES carries risks such as the possibility of exploitation for mass phishing attacks, where attackers could trigger a large volume of phishing emails mimicking legitimate communications. Configuring these services with strict permission controls and monitoring for unusual activity can help mitigate risks .
Cross-site scripting (XSS) attacks exploit vulnerabilities such as improper input handling in web applications to inject and execute malicious scripts. These attacks can compromise user data, steal session cookies, and lead to unauthorized actions performed on behalf of the users. Mitigation strategies include using content security policies, ensuring data validation and sanitation, and employing XSS protection headers .
Tools like Burp Suite can automate the discovery of vulnerabilities by spidering web applications to identify parameters, injecting payloads to test for SQL Injection or Cross-Site Scripting, and analyzing the responses for anomalies or exploitable patterns. This process can streamline vulnerability assessments, making it easier to identify and remediate potential issues .
Sensitive data exposure can occur through directory listings, tokens leaked on platforms like Github, or open S3 buckets. Such exposure can lead to unauthorized access and theft of sensitive information, leading to identity theft or unauthorized transactions. Proper configurations like securing API keys and bucket permissions, and avoiding exposing tokens publicly, are essential to prevent such breaches .
Manipulating a response from 'false' to 'true' or '0' to '1' can bypass authentication processes, allowing unauthorized access to systems. This is because these manipulations trick the system into believing that a condition (e.g., authentication success) has been met when it has not, effectively allowing an attacker to masquerade as an authenticated user .
Session invalidation is crucial because failing to terminate active sessions after a logout or password change can allow attackers to continue accessing a user's account with a valid session token. This oversight could lead to unauthorized data access and account manipulation, as old sessions remain valid even after security credentials have been updated .
The absence of rate limiting allows attackers to repeatedly carry out operations such as login attempts or data submissions without restriction, leading to potential brute force attacks or data flooding. Race conditions in sensitive functions like 'add money' or 'like' can be exploited to perform actions multiple times when only one instance should occur, potentially allowing for unauthorized financial gains or manipulation of service metrics .