Web APPs & APIs

Web applications are critical for modern businesses but pose significant risks. Enfoa’s Web Application Penetration Testing thoroughly evaluates your web apps’ security, identifying exploitable vulnerabilities. Using advanced methodologies, we simulate real-world attacks to ensure no vulnerability is overlooked.

On the other hand, Application Programming Interfaces (APIs) are fundamental for enabling seamless communication between different software components. However, they can also expose vulnerabilities that may be exploited to compromise the integrity of your systems and data. Our API Penetration Testing service aims to assess the security of your APIs and ensure they adhere to industry best practices.

Public Reconnaissance

• Perform a Google Dorks search
• Perform OSINT

Fingerprinting Web Server

• Find the type of Web Server
• Find the version details of the Web Server

Looking For Metafiles

• View the robots.txt file
• View the sitemap.xml file
• View the humans.txt file
• View the security.txt file

Enumerating Web Server’s Applications

• Enumerating with Nmap
• Enumerating with Netcat
• Perform a DNS lookup
• Perform a Reverse DNS lookup

Review The Web Contents

• Inspect the page source for sensitive info
• Try to find sensitive Javascript codes
• Try to find any keys
• Make sure the autocomplete is disabled

Identifying Application’s Entry Points

• Identify what the methods used are
• Identify where the methods used are
• Identify the injection point

Fingerprint Web Application Framework

• View URL extensions
• View HTML source code
• View the cookie parameter
• View the HTTP headers

Map Application Architecture

• Map the overall site structure

Network Configuration

• Check the network configuration
• Check for default settings
• Check for default credentials

Application Configuration

• Ensure only required modules are used
• Ensure unwanted modules are disabled
• Check how the application is handling 4xx & 5xx errors
• Check for the privilege required to run
• Check logs for sensitive info

File Extension Handling

• Ensure the server won’t return sensitive extensions
• Ensure the server won’t accept malicious extensions
• Test for file upload vulnerabilities

Review Backup & Unreferenced Files

• Ensure unreferenced files don’t contain any sensitive info
• Ensure the naming of old and new backup files
• Check the functionality of unreferenced pages

Enumerate Infrastructure & Admin Interfaces

• Try to find the infrastructure interface
• Try to find the admin interface
• Identify the hidden admin functionalities

HTTP Methods

• Discover the supported methods
• Ensure the PUT method is disabled
• Ensure the OPTIONS method is disabled
• Test access control bypass
• Test for XST attacks
• Test for HTTP method overriding

HSTS

• Ensure HSTS is enabled

RIA Cross Domain Policy

• Check for Adobe’s cross domain policy
• Ensure it has the least privilege

File Permissions

• Ensure the permissions for sensitive files
• Test for directory enumeration

Subdomain Takeover

• Test DNS, A, and CNAME records for subdomain takeover
• Test NS records for subdomain takeover
• Test 404 response for subdomain takeover

Cloud Storage

• Check the sensitive paths of AWS
• Check the sensitive paths of Google Cloud
• Check the sensitive paths of Azure

Role Definitions

• Test for Forced Browsing
• Test for IDOR (Insecure Direct Object Reference)
• Test for parameter tampering
• Ensure low-privilege users can’t able to access high-privilege resources

User Registration Process

• Ensure the same user or identity can’t register again and again
• Ensure the registrations are verified
• Ensure disposable email addresses are rejected
• Check what proof is required for successful registration

Account Provisioning Process

• Check the verification for the provisioning process
• Check the verification for the de-provisioning process
• Check the provisioning rights for an admin user to other users
• Check whether a user can de-provision themself or not
• Check for the resources of a de-provisioned user

Account Enumeration

• Check the response when a valid username and password entered
• Check the response when a valid username and an invalid password entered
• Check the response when an invalid username and password entered
• Ensure the rate-limiting functionality is enabled in username and password fields

Weak Username Policy

• Check the response for both valid and invalid usernames
• Check for username enumeration

Unencrypted Channel

• Check for the HTTP login page
• Check for the HTTP register or sign-in page
• Check for HTTP forgot password page
• Check for HTTP change password
• Check for resources on HTTP after logout
• Test for forced browsing to HTTP pages

Default Credentials

• Test with default credentials
• Test organization name as credentials
• Test for response manipulation
• Test for the default username and a blank password
• Review the page source for credentials

Weak Lockout Mechanism

• Ensure the account has been locked after 3-5 incorrect attempts
• Ensure the system accepts only the valid Captcha
• Ensure the system rejects the invalid Captcha
• Ensure the Captcha code is regenerated after reloading
• Ensure Captcha reloads after entering the wrong code
• Ensure the user has a recovery option for a lockout account

Bypassing Authentication Schema

• Test forced browsing directly to the internal dashboard without login
• Test for session ID prediction
• Test for authentication parameter tampering
• Test for SQL injection on the login page
• Test to gain access with the help of session ID
• Test multiple logins allowed or not

Vulnerable Remember Password

• Ensure that the stored password is encrypted
• Ensure that the stored password is on the server-side

Browser Cache Weakness

• Ensure proper cache control is set on sensitive pages
• Ensure no sensitive data is stored in the browser cache storage

Weak Password Policy

• Ensure the password policy is set to strong
• Check for password reusability
• Check that the user is prevented from using his username as a password
• Check for the usage of common weak passwords
• Check the minimum password length to be set
• Check the maximum password length to be set

Weak Security Questions

• Check for the complexity of the questions
• Check for brute-forcing

Weak Password Reset Function

• Check what information is required to reset the password
• Check for password reset function with HTTP
• Test the randomness of the password reset tokens
• Test the uniqueness of the password reset tokens
• Test for rate limiting on password reset tokens
• Ensure the token must expire after being used
• Ensure the token must expire after not being used for a long time

Weak Password Change Function

• Check if the old password asked to make a change
• Check for the uniqueness of the forgotten password
• Check for blank password change
• Check for password change function with HTTP
• Ensure the old password is not displayed after changed
• Ensure the other sessions got destroyed after the password change

Weak Authentication In Alternative Channel

• Test authentication on the desktop browsers
• Test authentication on the mobile browsers
• Test authentication in a different country
• Test authentication in a different language
• Test authentication on desktop applications
• Test authentication on mobile applications

Directory Traversal File Include

• Identify the injection point on the URL
• Test for Local File Inclusion
• Test for Remote File Inclusion
• Test Traversal on the URL parameter
• Test Traversal on the cookie parameter

Traversal With Encoding

• Test Traversal with Base64 encoding
• Test Traversal with URL encoding
• Test Traversal with ASCII encoding
• Test Traversal with HTML encoding
• Test Traversal with Hex encoding
• Test Traversal with Binary encoding
• Test Traversal with Octal encoding
• Test Traversal with Gzip encoding

Traversal With Different OS Schemes

• Test Traversal with Unix schemes
• Test Traversal with Windows schemes
• Test Traversal with Mac schemes

Other Encoding Techniques

• Test Traversal with Double encoding
• Test Traversal with all characters encode
• Test Traversal with only special characters encode

Authorization Schema Bypass

• Test for Horizontal authorization schema bypass
• Test for Vertical authorization schema bypass
• Test override the target with custom headers

Privilege Escalation

• Identify the injection point
• Test for bypassing the security measures
• Test for forced browsing
• Test for IDOR
• Test for parameter tampering to high privileged user

Insecure Direct Object Reference

• Test to change the ID parameter
• Test to add parameters at the endpoints
• Test for HTTP parameter pollution
• Test by adding an extension at the end
• Test with outdated API versions
• Test by wrapping the ID with an array
• Test by wrapping the ID with a JSON object
• Test for JSON parameter pollution
• Test by changing the case
• Test for path traversal
• Test by changing words
• Test by changing methods

Session Management Schema

• Ensure all Set-Cookie directives are secure
• Ensure no cookie operation takes place over an unencrypted channel
• Ensure the cookie can’t be forced over an unencrypted channel
• Ensure the HTTPOnly flag is enabled
• Check if any cookies are persistent
• Check for session cookies and cookie expiration date/time
• Check for session fixation
• Check for concurrent login
• Check for session after logout
• Check for the session after closing the browser
• Try decoding cookies (Base64, Hex, URL, etc.)

Cookie Attributes

• Ensure the cookie must be set with the secure attribute
• Ensure the cookie must be set with the path attribute
• Ensure the cookie must have the HttpOnly flag

Session Fixation

• Ensure new cookies have been issued upon a successful authentication
• Test manipulating the cookies

Exposed Session Variables

• Test for encryption
• Test for GET and POST vulnerabilities
• Test if the GET request incorporating the session ID used
• Test by interchanging POST with GET method

Back Refresh Attack

• Test after password change
• Test after logout

Cross-Site Request Forgery

• Check if the token is validated on the server side or not
• Check if the token is validated for full or partial length
• Check by comparing the CSRF tokens for multiple dummy accounts
• Check CSRF by interchanging POST with the GET method
• Check CSRF by removing the CSRF token parameter
• Check CSRF by removing the CSRF token and using a blank parameter
• Check CSRF by using unused tokens
• Check CSRF by replacing the CSRF token with its own values
• Check CSRF by changing the content type to form-multipart
• Check CSRF by changing or deleting some characters of the CSRF token
• Check CSRF by changing the referrer to Referrer
• Check CSRF by changing the host values
• Check CSRF alongside clickjacking

Logout Functionality

• Check the logout function on different pages
• Check for the visibility of the logout button
• Ensure that after logout the session was ended
• Ensure that after logout we can’t able to access the dashboard by pressing the back button
• Ensure proper session timeout has been set

Session Timeout

• Ensure there is a session timeout exists
• Ensure that after the timeout, all of the tokens are destroyed

Session Puzzling

• Identify all the session variables
• Try to break the logical flow of the session generation

Session Hijacking

• Test session hijacking on target that doesn’t have HSTS enabled
• Test by login with the help of captured cookies

Reflected Cross-Site Scripting

• Ensure these characters are filtered ‘<>’’&”””
• Test with a character escape sequence
• Test by replacing ‘<‘ and ‘>’ with HTML entities ‘<‘ and ‘>’
• Test payload with both lower and upper case
• Test to break firewall regex by new line ‘/r/n’
• Test with double encoding
• Test with recursive filters
• Test injecting anchor tags without whitespace
• Test by replacing whitespace with bullets
• Test by changing HTTP methods

Stored Cross-Site Scripting

• Identify stored input parameters that will reflect on the client-side
• Look for input parameters on the profile page
• Look for input parameters on the shopping cart page
• Look for input parameters on the file upload page
• Look for input parameters on the settings page
• Look for input parameters on the forum, comment page
• Test uploading a file with XSS payload as its file name
• Test with HTML tags

HTTP Parameter Pollution

• Identify the backend server and parsing method used
• Try to access the injection point
• Try to bypass the input filters using HTTP Parameter Pollution

SQL Injection

• Test SQL Injection on authentication forms
• Test SQL Injection on the search bar
• Test SQL Injection on editable characteristics
• Try to find SQL keywords or entry point detections
• Try to inject SQL queries
• Use Google dorks to find the SQL keywords
• Try GET-based SQL injection
• Try POST-based SQL injection
• Try COOKIE-based SQL injection
• Try HEADER-based SQL injection
• Try SQL Injection with null bytes before the SQL query
• Try SQL Injection with URL encoding
• Try SQL Injection with both lower and upper cases
• Try SQL Injection with SQL Tamper scripts
• Try SQL Injection with SQL Time delay payloads
• Try SQL Injection with SQL Conditional delays
• Try SQL Injection with Boolean-based SQL
• Try SQL Injection with Time based SQL

LDAP Injection

• Use LDAP search filters
• Try LDAP Injection for access control bypass

XML Injection

• Check if the application is using XML for processing
• Identify the XML injection point by XML metacharacter
• Construct XSS payload on top of XML

Server Side Includes

• Use Google dorks to find the SSI
• Construct RCE on top of SSI
• Construct other injections on top of SSI
• Test Injecting SSI on login pages, header fields, referrer, etc

XPATH Injection

• Identify the XPATH injection point
• Test for XPATH injection

IMAP SMTP Injection

• Identify IMAP SMTP injection point
• Understand the data flow
• Understand the deployment structure of the system
• Assess the injection impact

Local File Inclusion

• Look for LFI keywords
• Try to change the local path
• Use the LFI payload list
• Test LFI by adding a null byte at the end

Remote File Inclusion

• Look for RFI keywords
• Try to change the remote path
• Use the RFI payload list

Command Injection

• Identify the injection points
• Look for Command injection keywords
• Test command injection using different delimiters
• Test command injection with payload list
• Test command injection with different OS commands

Format String Injection

• Identify the injection points
• Use different format parameters as payloads
• Assess the injection impact

Host Header Injection

• Test for HHI by changing the real Host parameter
• Test for HHI by adding X-Forwarded Host parameter
• Test for HHI by swapping the real Host and X-Forwarded Host parameter
• Test for HHI by adding two Host parameters
• Test for HHI by adding the target values in front of the original values
• Test for HHI by adding the target with a slash after the original values
• Test for HHI with other injections on the Host parameter
• Test for HHI by password reset poisoning

Server-Side Request Forgery

• Look for SSRF keywords
• Search for SSRF keywords only under the request header and body
• Identify the Injection points
• Test if the Injection points are exploitable
• Assess the injection impact

Server Side Template Injection

• Identify the Template injection vulnerability points
• Identify the Templating engine
• Use the tplmap to exploit

Improper Error Handling

• Identify the error output
• Analyze the different outputs returned
• Look for common error-handling flaws
• Test error handling by modifying the URL parameter
• Test error handling by uploading unrecognized file formats
• Test error handling by entering unrecognized inputs
• Test error handling by making all possible errors

Weak Transport Layer Security

• Test for DROWN weakness on SSLv2 protocol
• Test for POODLE weakness on SSLv3 protocol
• Test for BEAST weakness on TLSv1.0 protocol
• Test for FREAK weakness on export cipher suites
• Test for Null ciphers
• Test for NOMORE weakness on RC4
• Test for LUCKY 13 weakness on CBC mode ciphers
• Test for CRIME weakness on TLS compression
• Test for LOGJAM on DHE keys
• Ensure the digital certificates should have at least 2048 bits of key length
• Ensure the digital certificates should have at least a SHA-256 signature algorithm
• Ensure the digital certificates should not use MDF and SHA-1
• Ensure the validity of the digital certificate
• Ensure the minimum key length requirements
• Look for weak cipher suites

Business Logic

• Identify the logic of how the application works
• Identify the functionality of all the buttons
• Test by changing the numerical values into high or negative values
• Test by changing the quantity
• Test by modifying the payments
• Test for parameter tampering

Malicious File Upload

• Test malicious file upload by uploading malicious files
• Test malicious file upload by putting your IP address on the file name
• Test malicious file upload by right-to-left override
• Test malicious file upload by encoded file name
• Test malicious file upload by XSS payload on the file name
• Test malicious file upload by RCE payload on the file name
• Test malicious file upload by LFI payload on the file name
• Test malicious file upload by RFI payload on the file name
• Test malicious file upload by SQL payload on the file name
• Test malicious file upload by other injections on the file name
• Test malicious file upload by Inserting the payload inside of an image
• Test malicious file upload by uploading large files (leads to DoS)

DOM Based Cross Site Scripting

• Try to identify DOM sinks
• Build payloads to that DOM sink type

URL Redirect

• Look for URL redirect parameters
• Test for URL redirection on domain parameters
• Test for URL redirection by using a payload list
• Test for URL redirection by using a whitelisted word at the end
• Test for URL redirection by creating a new subdomain with the same as the target
• Test for URL redirection by XSS
• Test for URL redirection by profile URL flaw

Cross Origin Resource Sharing

• Look for “Access-Control-Allow-Origin” on the response
• Use the CORS HTML exploit code for further exploitation

Clickjacking

• Ensure “X-Frame-Options” headers are enabled
• Exploit with iframe HTML code for PoC

No-Rate Limiting

• Ensure rate limiting is enabled
• Try to bypass rate limiting by changing the case of the endpoints
• Try to bypass rate limiting by adding ‘/” at the end of the URL
• Try to bypass rate limiting by adding HTTP headers
• Try to bypass rate limiting by adding HTTP headers twice
• Try to bypass rate limiting by adding Origin headers
• Try to bypass rate limiting by IP rotation
• Try to bypass rate limiting by using null bytes at the end
• Try to bypass rate limiting by using race conditions

EXIF Geodata

• Ensure the website is striping the geodata
• Test with EXIF checker

SPF

• Ensure the website is having SPF record
• Test SPF by nslookup command

Weak 2FA

• Try to bypass 2FA by using poor session management
• Try to bypass 2FA via the OAuth mechanism
• Try to bypass 2FA via brute-forcing
• Try to bypass 2FA via response manipulation
• Try to bypass 2FA by using activation links to login
• Try to bypass 2FA by using status code manipulation
• Try to bypass 2FA by changing the email or password
• Try to bypass 2FA by using a null or empty entry
• Try to bypass 2FA by changing the boolean into false
• Try to bypass 2FA by removing the 2FA parameter on the request

Weak OTP Implementation

• Try to bypass OTP by entering the old OTP
• Try to bypass OTP by brute-forcing
• Try to bypass OTP by using a null or empty entry
• Try to bypass OTP by response manipulation
• Try to bypass OTP by status code manipulation

API Security

• Check the strength of the authentication mechanisms used by the API, such as passwords, tokens, or API keys
• Verify if the API uses secure transport protocols such as HTTPS
• Ensure that the API access controls are implemented correctly and if unauthorized access is restricted
• Check the API implements a proper password policy
• Verify if the API uses rate-limiting to prevent brute-force attacks
• Ensure that all API input parameters are validated on the server and client sides
• Check that the API is not vulnerable to common Injection attacks like SQL injection, NoSQL injection, or LDAP injection
• Verify if the API accepts only the expected data formats and rejects unexpected formats
• Ensure that the API provides meaningful error messages to the client
• Check that the API does not leak sensitive information such as system details, stack traces, or error codes
• Verify if the API logs all the incoming requests, errors, and responses
• Ensure if API sensitive data is encrypted both in transit and at rest.
• Check if the API follows the principle of least privilege and ensures that users can access only the necessary data.
• Verify if the API implements proper data validation and sanitization to prevent data tampering or exposure
• Verify if the API uses secure session management mechanisms such as tokenization or session IDs
• Check if the session tokens are invalidated after a certain period of inactivity or logout
• Verify if the API is vulnerable to common business logic flaws such as unauthorized access, privilege escalation, or transaction manipulation
• Check if the API performs proper access controls and validations for all user actions
• Check if the API is integrated with any third-party services or libraries and if they are up-to-date and secure
• Verify if the API performs proper input validation and sanitization for third-party data