SECGURU Web Application Cheat Sheet

Application & Version Backend Authentication SQL injection

Trust relationships Mirror website and search for all input parameters
What Components Encryption Gain database related information
Plaintext password in HTML Error Messages
Which protocol? If SSL then version & cipher. Password in configuration file. Privileges given to the webserver or database

Parameter Checklist XSS OS calls

URL request Which type – stored or reflected Using any interpreter?
URL encoding Check for 404/500 error pages for OS service calls (e.g. Sendmail)
Query string return information. Mirror and search code for all calls to external sources.
Header Input validation Privileges given to other services and webserver.
Cookie
Form field MisConfiguration Complete check of information returned in error messages. Guess
Hidden field Nikto results application logic through errors codes and messages.
Client side validation Nessus results
‘Tainted’ parameters Patch level Deconstruction of binary codes (if any)
Min/Max lengths Directory listing
Concatenate commands Directory permission Is critical data secured and encrypted?
Error messages
Determine policies for access to content and Default username/pass Examine
functions. SSL cert. Configuration Token
Debug or configuration Files Cookie
Credential Management Check for latest vulnerabilities SSID
Password storage Serialized Objects
Password change Unwanted
User Update section Backup files Access points
Password strength Defaults files Regular users
Lockout policy Services Admin access
Login attempts allowed Remote admin. Access Any other?

Session Management Flaws in access control? Ability to brute force at the discovered access points.
Token protection
Session Duration Check for path transversal. Ability to bypass auth. with spoofed tokens
Idle time Duration
Guess Session ID format Client side Caching Ability to conduct replay attack.
Transfer in URL or BODY? Check header
Is Session Id linked to the IP address? Check metatag Forced browsing, does application keep a check by tracking
Change Referrer tag request from each user.
Determine file permissions

© secguru.com