Lesson Content

Introduction to Web Applications & HTTP

Web applications are software applications accessed over a network (typically the internet) using a web browser. They rely on the Hypertext Transfer Protocol (HTTP) for communication. HTTP is a stateless protocol, meaning each request from a client (e.g., your browser) to a server is independent of previous requests. Understanding HTTP is crucial for web application security.

HTTP requests consist of methods (GET, POST, PUT, DELETE, etc.), headers, and a body (for methods like POST). For instance, when you submit a form, a POST request is often sent to the server containing the form data in the request body. GET requests, commonly used for retrieving information, typically have parameters in the URL.

Example:
* GET Request: GET /index.html HTTP/1.1 (Retrieves the homepage)
* POST Request (form submission, data in body): POST /login HTTP/1.1 Content-Type: application/x-www-form-urlencoded username=test&password=password (Submits login credentials)

Common Web Application Vulnerabilities

Several vulnerabilities plague web applications. Red teams target these to gain access or compromise data.

SQL Injection (SQLi): Occurs when an attacker injects malicious SQL code into user inputs, allowing them to manipulate the database. This can lead to data breaches, unauthorized access, and even server control.
Example: If a website's login uses SQL to query the database, an attacker might inject ' OR '1'='1 into the username field, bypassing authentication.
Cross-Site Scripting (XSS): Involves injecting malicious client-side scripts (usually JavaScript) into web pages viewed by other users. This can steal cookies, redirect users, or deface websites. There are three types: Reflected (injected in the URL), Stored (stored in the database and rendered), and DOM-based (modifying the HTML of the page).
Example (Reflected XSS): An attacker might inject <script>alert('XSS')</script> into a search box, which is then displayed on the results page.
Cross-Site Request Forgery (CSRF): Forces a logged-in user to unknowingly execute unwanted actions on a web application. An attacker crafts a malicious request (often a link or form) that, when clicked by the victim, exploits the web application's trust in the user's browser.
Example: An attacker could craft a link that, when clicked by a logged-in user, triggers a password change on the victim's account.
Broken Authentication and Session Management: Weaknesses in authentication (e.g., easily guessable passwords) and session management (e.g., predictable session IDs) allow attackers to gain unauthorized access to accounts.

Introduction to Web Application Pentesting Tools (Burp Suite)

Burp Suite is a powerful and popular tool for web application penetration testing. It acts as an intermediary (proxy) between your browser and the web server, allowing you to intercept, view, and modify HTTP traffic.

Proxy: Intercepts and modifies requests and responses.
Repeater: Allows you to resend and modify individual requests.
Intruder: Automates vulnerability discovery by sending a large number of requests with modified payloads.
Spider: Crawls the web application to map its structure.

Setting Up Burp Suite:
1. Install Burp Suite: Download and install Burp Suite Community Edition (free) or Professional Edition (paid).
2. Configure Your Browser's Proxy: Configure your browser (e.g., Firefox, Chrome) to use Burp Suite as a proxy. Typically, you'll set the proxy address to 127.0.0.1 (localhost) and the port to 8080 (the default for Burp Suite).
3. Browse the Web Application: Navigate to the web application you want to test in your browser. Burp Suite will intercept and display the HTTP traffic.

Deep Dive

Explore advanced insights, examples, and bonus exercises to deepen understanding.

Red Team Pentesting - Web Application Security - Day 6 Extended Learning

Day 6 Extended Learning: Web Application Security Deep Dive

Welcome back! Building on our introduction to web application security, we'll explore deeper concepts and practical applications. We'll revisit key vulnerabilities and examine their nuances, providing you with a more comprehensive understanding of the attacker's mindset and defensive strategies.

Deep Dive: Beyond the Basics

Let's go beyond simple definitions. We'll examine subtle attack vectors, the impact of different HTTP methods, and how to assess the effectiveness of common defenses.

SQL Injection - Advanced Perspectives

SQL injection isn't just about inserting ' OR 1=1--. It's about crafting queries that exploit how a database interprets user-supplied data. This often involves:

Error-Based SQLi: Leveraging database error messages to extract information (database version, table names, etc.).
Blind SQLi: Inferring information by observing the application's behavior. This can involve time delays (Time-based SQLi) or conditional statements (Boolean-based SQLi).
Union-Based SQLi: Using the UNION operator to combine results from multiple queries, often to extract data from other tables.
Parameter Tampering: Manipulating parameters that are passed into stored procedures, causing them to execute malicious SQL code.

Cross-Site Scripting (XSS) - The Three Flavors

While you know about XSS, understanding the three main types is critical:

Stored XSS: Malicious scripts are permanently stored on the server (e.g., in a database). They are executed whenever a user visits the page containing the malicious content.
Reflected XSS: The script is part of the request (e.g., in a URL parameter). The server reflects the script back to the user's browser. The victim needs to be tricked into clicking a crafted link.
DOM-Based XSS: The vulnerability lies within the client-side JavaScript code and how it manipulates the Document Object Model (DOM). The malicious script is injected and executed in the browser directly.

Cross-Site Request Forgery (CSRF) - Beyond the Basics

CSRF attacks target state-changing requests (like changing a password or making a purchase). Here's a deeper look:

Double Submit Cookies: A common CSRF mitigation technique, where the application stores a unique token in both a cookie and a hidden form field. The server verifies that the values match on form submission.
Referer Header: The Referer header indicates the origin of the request. While not always reliable (it can be spoofed), it's often used as an initial check.

Bonus Exercises

Practice makes perfect! Here are a few exercises to solidify your understanding.

Exercise 1: Burp Suite Traffic Manipulation

Task: Use Burp Suite to intercept and modify an HTTP request to a vulnerable web application (e.g., a deliberately vulnerable lab or a testing environment) and observe the impact. Try changing a parameter's value to something unexpected and see if the application reacts in a surprising way. This is very common in pentesting to explore attack vectors.

Exercise 2: SQL Injection - Manual Testing

Task: Manually test a simple web form (e.g., a login form or a search box) for SQL injection vulnerabilities. Try inserting single quotes ('), double quotes ("), and various SQL commands. Analyze the server's response to determine if it is vulnerable. If possible use a vulnerable lab to simulate a real-world scenario.

Real-World Connections

How do these concepts translate into real-world scenarios?

Penetration Testing engagements: Red teams use these techniques to identify vulnerabilities in production web applications and provide valuable insights into organizational security.
Vulnerability Assessments: These are useful for identifying vulnerabilities and providing valuable feedback to developers so the issues can be mitigated.
Bug Bounties: Ethical hackers are rewarded for discovering and reporting vulnerabilities to companies, playing a vital role in web security.
Everyday Browsing: Being aware of these vulnerabilities helps you identify potentially malicious links or websites. Always question suspicious links, and be cautious when entering sensitive information.

Challenge Yourself

Ready for a more advanced task?

Challenge: Find and exploit a simple stored XSS vulnerability in a deliberately vulnerable web application (e.g., OWASP Juice Shop or DVWA). Document the steps you take and the impact of the exploit. This is excellent practice!

Further Learning

Continue your learning journey with these resources:

OWASP (Open Web Application Security Project): A fantastic resource for web application security best practices, vulnerability reports, and tools. Start with the OWASP Top 10.
PortSwigger Web Security Academy: A free, comprehensive learning resource with hands-on labs for web application security.
Books: "The Web Application Hacker's Handbook" is a great resource.
Tools: Explore more advanced web application security tools, such as:
- SQLmap: Automated SQL injection tool.
- Nikto: Web server vulnerability scanner.
- Wfuzz: Web application fuzzing tool.

Interactive Exercises

Burp Suite Setup and Basic Interception

1. Download and install Burp Suite. 2. Configure your browser to use Burp Suite as a proxy. 3. Visit a simple website (e.g., a vulnerable web application if available; otherwise, use a public one). 4. Observe the HTTP requests and responses being intercepted by Burp Suite. 5. Try modifying a request (e.g., a GET request's URL) and forwarding it to the server and observe the response in Burp Suite.

SQL Injection Simulation (Conceptual)

Imagine a vulnerable login form where the SQL query is built directly from user input. Write a simple conceptual SQL query and demonstrate how an attacker could inject malicious code (e.g., `' OR '1'='1`) to bypass authentication. (No actual coding required, just explain the process)

XSS Vulnerability Analysis (Conceptual)

Describe the steps an attacker would take to exploit a reflected XSS vulnerability in a simple search form. Explain how a malicious script could be injected and what the attacker's goals might be. Focus on the attacker's actions and the potential impact.

Cookie Preferences

Regenerating Content

**Web Application Hacking Basics

Learning Objectives

Text-to-Speech