Web

Application
Pen-Testing
Course
Who am i?

• Also known as FlEx.

• Cyber Security Engineer @ CyShield.

• I also make videos about hacking on Youtube.

• [Small] Bug Hunter.

Mohamed Sayed
What we will talk about?
• What you need to start.
• How Web App work
• Vulnerabilities

• Explain the Vulnerability

• Solve Lab for it.

• Type of attacks for this vulnerability

• Explain the code which cause the bug.

• Solve the bug in the code.

• How to write a report.

• Skills you need.
• How to be good & next step.
What I need to start.
Web Applications
● Client Side [HTML, JS, CSS]

● Server Side [PHP, ASP.NET, etc….]

● HTTP / HTTPS

● What is Headers
HTTP / HTTPS

Comparison HTTP HTTPS

Secured False True

Port 80 443

SSL Certificate False True

Encryption False True

 What is Headers

Headers HTTP

Host Contain host name

(Host: example.com)
User-Agent Contain Browser info
(User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:67.0) Gecko/20100101
Firefox/67.0)
Content-Type Contain the type of the request or response
(Content-Type: application/json)
Referer Contain the link which come from
(Referer: http://example.com/prev-page.html)
Vulnerabilities
Vulnerabilities
• XSS
• CSRF
• LFI / Path traversal
• IDOR
• File Upload
• SQL injection
• Insecure Deserialization
• XXE
• Clickjacking
• JSONP
• Account Takeover
• PostMessage
• CORS
• How to Chain Bugs?
Vulnerabilities
XSS
Vulnerabilities (XSS)
• What is XSS?

• What can I do with XSS?

• Types of XSS.

• Filters & Bypasses for XSS.

• Solve XSS Lab.

• Patch bug in code.

Vulnerabilities
CSRF
Vulnerabilities (CSRF)
• What is CSRF?

• What can I do with CSRF?

• Bypasses for CSRF.

• Solve Lab.

• Patch bug in code.

Vulnerabilities
LFI/path traversal
Vulnerabilities (LFI/Path traversal)
• What is LFI & Path traversal?

• What is different between LFI & Path traversal?

• What can I do LFI & Path traversal?

• Solve lab.

• Patch bug in code.

Vulnerabilities
IDOR
Vulnerabilities (IDOR)
• What is IDOR?

• What can I do with IDOR?

• Solve Lab

• Patch bug in code.

Vulnerabilities
File Upload
Vulnerabilities (File Upload)
• What is File Upload vulnerability?

• What can I do with File Upload vulnerability?

• Filters & Bypasses for File upload.

• Solve lab.

• Patch bug in code.

Vulnerabilities
SQL injection
Vulnerabilities (SQL injection)
• What is SQL injection?

• What can I do with SQL injection?

• Types of SQL injection.

• Filters and Bypasses for SQL Injection.

• Solve lab.

• Patch bug in code.

Vulnerabilities
Insecure Deserialization
Vulnerabilities (Insecure Deserialization)
• What is Insecure Deserialization?

• What can I do with Insecure Deserialization?

• Solve lab.

• Patch bug in code

Vulnerabilities
XXE
Vulnerabilities (XXE)
• What is XML & XXE?

• What can I do with XXE?

• Why websites use XML.

• Types of XXE.

• Solve lab.

• Patch bug in code.

First line contain the Meta Data

Second line contain Root Element Opening

Third & Fourth line is children of root element

Fifth line is the closing of root element

Not Allowed:

1. Tag name is case sensitive

2. ‘”>< Not allowed in the XML doc directly
Entity Let’s say it like a variable

Document type definition (DTD) define the Entities

 Entities Types
● General

We saw this type in preview example

● Parameter

This type only in DTD and useful for creating entity have value another entity.

● Predefined

This type is used predefined values which could break the syntax like using (&#x3C;)
which is (<)
 Features we can use
1. Using System Keyword we can use External Entity.

2. XML accept any valid URI

 Types
• Inband

• The common type which display the output on the screen.

• Error Based

• This type is parsing the XML and you can see just Errors.

• (Out of band) OOB

• This type is Blind without any errors or results, you can do some requests to check
it.
 Exploit
Inband Type

Vulnerable
Send payload in function parsing Print the result
request payload

Error Based

Vulnerable Return error

Send payload in
function parsing contain the
request
payload result
 Exploit
Error Based Example

If we send a payload like that

The output will be in error like that

 Exploit
OOB Type

Vulnerable
Send payload in function parsing No result printed
request payload

The payload is
executed
Vulnerabilities
Clickjacking
Vulnerabilities (Clickjacking)
• What is Clickjacking?

• What can I do with Clickjacking?

• Solve lab.

• Patch bug.
Vulnerabilities
JSONP
Vulnerabilities (JSONP)
• What is JSONP?

• What can I do with JSONP?

• Why websites use JSONP?

• Solve lab.

• Patch bug.
Vulnerabilities
ATO
Vulnerabilities (ATO)
• What is ATO?

• How to gain ATO?

• Patch bugs.
How to gain ATO

• CSRF

• IDOR

• Host Header injection

• Open redirect with OAuth

• CSRF with OAuth

How to gain ATO (CSRF)
Exploit Page Vulnerable Page

Send request
Change Email when receive a request
How to gain ATO (IDOR)

User 1000

Change email of user 1001 Change email of user 1000

200 OK 200 OK
How to gain ATO (Host Header Injection)

Use forgot Catch the

password function request

vulnerable = true Change host

Link sent with ur
header value to ur
domain to victim
domain

Token sent to your

Victim open the link
domain
OAuth

Client Application  Web App want to access user’s data

Resource Owner  The user.

OAuth service provider  application that control user’s data and access to it.
OAuth
Client App User-Agent OAuth
Auth request
service API
1

Resource 2
Owner User Login & consent
/Auth
Access Token
/oauth-login
3

API Call
4

/info
5

Data
How to gain ATO (Open redirect with OAuth)
How to gain ATO (CSRF with OAuth)
Client App User-Agent OAuth
Auth request
service API
1

Resource 2
Owner User Login & consent
/Auth
Access Token & connect
Social account
/oauth-login
3

API Call
4

/info
5

Data
Vulnerabilities
PostMessage
Vulnerabilities (PostMessage)
• What is PostMessage?

• What can I do with PostMessage?

• How to make PostMessage a bug.

• Solve lab.

• Patch bug.
Explain
We can use it postMessage with iframe or pop-up

To create event listener

we will give it a name and a
function to call when it used,
this function will take the value
from postMessage and do its
actions.

message.origin  will display the origin which send the request.

message.data  will display the sent value.

We can use the following like to check and validate the origins before take the value
but the check have an issue and could be
bypassed.
 Exploit
Vulnerable page  Have a listener
Exploit Page
Exploit Page  send postMessage with
malicious value like XSS payload

The pages will communicate together using Vulnerable page in iframe

the postMessage.
Vulnerabilities
CORS
Vulnerabilities (CORS)
• What is CORS?

• What can I do with CORS?

• Why websites use CORS?

• Bypass Filter.

• Solve Labs.

• Patch Bug.
Vulnerabilities
Chaining Bugs
Vulnerabilities (Chaining Bugs)

• XSS to ATO

• Self-XSS to Reflected XSS

• CORS without useful result

XSS to ATO

Use payload to steal Use CSRF token to

Found XSS the CSRF token from send request to
the page change victim email
XSS to ATO Exploit
 Self-XSS to Reflected XSS
- By using Clickjacking

- Victim will copy the xss

payload to vulnerable page

Vulnerable page

Exploit page
un-exploitable CORS
Exploit Server Vulnerable Endpoint
Vulnerable Endpoint

Send Request

XMLHttpReqeuest
Backend Server
Code

Return Null or dummy Data

Another vulnerable Endpoint

Send Request to change value

XMLHttpReqeuest Content-Type: application/json

Body: {“name”:”Hacker”}
Code Backend Server

Return 200 OK Success

Writing A Good Report

● Choose well title to the vulnerability.

● Explain Finding.

● Risk and Impact [Business impact]

● Recommendations

● Proof-of-Concept

● References

● Ref [https://github.com/juliocesarfort/public-pentesting-reports]
Skills

● Scripting / write a code

● Write reports

● Dealing with clients

● Understand web technologies

○ Protocols

○ Html / Html5

○ Data formats (JSON, XML, CSV)

○ Web Framework

○ Programming languages (PHP, JS, etc..)

Improve yourself & Next Step

● PortSwigger

● PentesterLab

● Increase your knowledge [reading * 1000]

● Practice
Thank you

Talk to me if you need anything.

• Facebook: @flex0geek

• Twitter: @flex0geek

• Linkedin: @flex0geek

• Blog: https://flex0geek.blogspot.com/

• Youtube: http://youtube.com/c/HackWizFlEx/