Thread by @harshbothra_

#SecurityExplained S-1: Web Testing Methodology

The below thread contains an overview of my pentesting methodology on the web application targets:

1. Initially, before starting with the engagement, I start with "Scoping" .........

(1/n)

(2/n)
where I go through the details shared by the client to understand the scope and see if the testing is feasible as per the given timeline. During this phase, I also check if the application is accessible and credentials (if required) are working properly.

(3/n)
If any of the things from "Step-1" are blocking, I reach out to the concerned person and request to unblock the blocking items.
2. Next, I start browsing the application while letting the traffic flow through Burp Suite to populate the "Target" menu.

(4/n)
...The main idea here is to understand core business logic, map out interesting functionalities and build an overall attack surface. I also take notes if required.
3. In parallel to Step-2, I also run "Recon" activities....

(5/n)
depending upon the scope size, however, some basic minimum are to run "Port Scan, Directory Fuzzing, Historical URL Scan, Nuclei, GitHub Scanning" and some other tools as required. I also perform quick OSINT to check for the information & data leakage related to my target.

(6/n)
4. Further, I start preparing a threat map that contains theoretical test cases of "What an attacker can possible do to exploit this application?".

(7/n)
For example, if an application has 3 user roles, I would check for the privilege escalation on "Three Different Levels"(Vertical) as well as privilege escalation on "Same Level" (Horizontal).

(8/n)
5. Lastly and most importantly, I start the manual penetration testing on the application. I include the test cases derived from "Step-4" in my manual testing. Now, breaking down the manual penetration testing approach a bit further:

(9/n)
a. I mainly rely upon "Burp Suite, Developer Tools and Skills" during the manual assessment.
b. I use the "Advance Scope" option in the Burp Suite to remove unnecessary noise and also help to be in the correct scope while running the "Active/Passive" Scanner.

(10/n)
c. I use "Autorize" to perform checks related to "Privilege Escalation & IDOR".
d. I check most of the "GET" endpoints that return data using an unauthenticated user to check for "Lack of Authorization Checks".

(11/n)
e. I use "Burp Match & Replace" to check for injection attacks, I define specific stings which are further replaced to the Payloads by Burp Proxy's Match & Replace rules. It makes overall testing quite easy.

(12/n)
f. I spend more time on functionalities such as "File Upload" because such functionalities themselves have a very big attack surface.
g. Similarly, I use "Burp Extensions" as per the "application".

(13/n)
For example, If the application uses "SSO" then only I enable the extensions related to "SSO" such as "SAML Raider" and others.
h. I keep logs of the testing using "Logger++". Taking logs helps a lot.

(14/n)
This is the basic testing methodology that I use while testing a web application. However, there's a lot more to cover in the "Manual Testing" that I will attempt to cover in near future through some Blog.

(n/n)
Feel free to ask if you have any questions on "How do I Test specific things", etc.

#appsec #infosec #bugbountytips #bugbounty #hacking #infosec #learn365 #securityexplained