WEB APPLICATION PENETRATION TESTING EXTREME VERSION 1

Transcription

1 WEB APPLICATION PENETRATION TESTING EXTREME VERSION 1 The most advanced course on web application penetration testing elearnsecurity has been chosen by students in over 140 countries in the world and by leading organizations such as:

2 INTRODUCTION COURSE DESCRIPTION Web Application Penetration Testing extreme is a practical online course on the most advanced web application penetration testing techniques. This training course is tied to Hera Lab where students will access a number of laboratories for each learning module. PRE-REQUISITES This is an advanced course that requires the following pre-requisites: Deep understanding of HTML, HTTP, Server-side languages, XML, JavaScript. Good understanding and practical proficiency of XSS, XSRF, SQLi and basic HTML5 attacks. Ability to read and understand PHP code will help, although not mandatory Basic development skills The elearnsecurity WAPT course provides most of the above pre-requisites. WHO SHOULD TAKE THIS COURSE? WAPTX course is primarily geared towards: Penetration Testers Web Developers IT Security professionals with a technical background HOW AM I GOING TO LEARN THIS? elearnsecurity courses are very interactive, addictive, and presents content in such a way that it appeals to all learning styles. During this training course, you will have to deal with several guided labs, that will provide you with relevant and hands-on practical application experience. Every module comes with videos, and practical lessons so do not expect the outdated way of learning by just reading pages of theoretical methodologies.

3 INTRODUCTION WILL I GET A CERTIFICATE? Once you satisfy the requirements of the final practical certification test, you will be awarded an elearnsecurity Web Penetration Tester extreme certificate and will hold the ewptx certification. INTRODUCTION ORGANIZATION OF CONTENTS The WAPTX is a follow up of the WAPT course, but at an extreme level. This course brings students into a new world of advanced exploitation techniques using realworld scenarios all served with challenging and extremely hands-on laboratories in which to put the covered techniques into practice. Module 1: Encoding and Filtering Module 2: Evasion Basic Module 3: Cross-Site Scripting Module 4: XSS Filter Evasion and WAF Bypassing Module 5: Cross-Site Request Forgery Module 6: HTML 5 Module 7: SQL Injections Module 8: SQLi Filter Evasion and WAF Bypassing Module 9: XML Attacks

4 MODULE 1: ENCODING AND FILTERING This module is not just another module on encoding. It provides some esoteric encoding skills that will be helpful during the rest of the course. Understanding what kind of data encoding is used and how it works is fundamental and ensures that the tests are performed as intended, which is why this module starts with the basic concept of data encoding. The following section is about filtering basics, starting from a brief introduction on how to deal with regular expression, to understanding how to detect, fingerprint and evade web application firewalls. We conclude by analyzing the most common clientside defensive mechanism. 1. Introduction 1.1. Data encoding basics Dissecting encoding types URL Encoding HTML Encoding Document character encoding Character references Base (36 64) encoding Base 36 Base Unicode encoding Multiple (De En)codings 1.2. Filtering basics Regular Expressions Metacharacters Shorthand character classes Non-printing characters Unicode Web Application Firewall WAF Detection and Fingerprinting Client-side Filters

5 MODULE 2: EVASION BASICS This module provides advanced coverage of most modern filter evasion techniques using different client-side and server-side languages. To ensure that you have a complete understanding of filters and encoding, this module introduces the main evasion techniques that start from Base64 and lesserknown URI obfuscation techniques and concludes with JavaScript and PHP obfuscation techniques. 2. Introduction 2.1. Base64 Encoding evasion 2.2. URI Obfuscation techniques URL shortening URL Hostname obfuscation 2.3. JavaScript Obfuscation Techniques JavaScript Encoding Non-alphanumeric JavaScript Compressing Minifying Packing 2.4. PHP Obfuscation Techniques Basic Language Reference Type Juggling Numerical Data types String Data types Array Data types Variable Variables Non-alphanumeric Code String generation Hackvector.co.uk

6 MODULE 3: CROSS-SITE SCRIPTING This module is entirely dedicated to cross-site scripting attacks. It starts with a brief recap of the different types of XSS and then introduces advanced attacking techniques and exotic XSS vectors. This module covers how to use the most advanced tools available, and exploit any kind of XSS. Hera Labs are included in this module 3. Introduction 3.1. Cross-Site Scripting Reflected XSS Persistent XSS DOM XSS Universal XSS 3.2. XSS Attacks Cookie Grabbing Script Injection Cookie Recording & Logging Bypassing HTTPOnly flag Cross-site Tracing (XST) CVE: BeEF s Tunneling Proxy Defacements Virtual Defacement Persistent Defacement Phishing Keylogging Keylogging with Metasploit Keylogging with BeEF Network Attacks IP detection Subnet detection Ping Sweeping Port Scanning Simple Port Scanner HTML5 alternatives Self-XSS

7 Browsers security measures Chromium-based browser Mozilla Firefox-based browser Internet Explorer Safari JavaScript console limitations 3.3. Exotic XSS Vectors Mutation-based XSS mxss Examples mxss Multiple MODULE 4: XSS FILTER EVASION AND WAF BYPASSING In this module, the student will learn about advanced filter evasion and WAF bypassing techniques. Starting from simple blacklisting filters, the student will go through different mechanisms to bypass common input sanitization techniques, browser filters and much more. The student will not only find a number of well-known vectors but will also understand how to find new ones. At the end of this module, the student will be able to recognize the presence of WAF s and filters and implement effective bypassing techniques. Hera Labs are included in this module 4. Introduction 4.1. Bypassing Blacklisting Filters Injecting Script Code Bypassing weak <script> tag banning ModSecurity > Script tag based XSS Beyond <script> tag Using HTML attributes Keyword based filter Character escaping Unicode Decimal, Octal, Hexadecimal Constructing Strings Execution Sinks Pseudo-protocols Data

8 Vbscript 4.2. Bypassing Sanitization String Manipulations Removing HTML Tags Escaping Quotes Escape Parenthesis 4.3. Bypassing Browser Filters (Un)Filtered Scenarios Injecting inside HTML attributes Injecting inside SCRIPT tag Injecting inside event attributes DOM Based Other scenarios MODULE 5: CROSS-SITE REQUEST FORGERY This module is entirely dedicated to cross-site request forgery attacks. It begins with a brief recap of the basics of this vulnerability and then introduces the main attacking techniques and vectors. During this module, we will start with how to exploit weak Anti-CSRF mechanisms and conclude with advanced exploitation techniques Hera Labs are included in this module 5. Introduction 5.1. XSRF: Recap & More Vulnerable scenario 5.2. Attack Vectors Force Browsing with GET Example: Change address Post Requests Auto-submitting from > v Auto-submitting form > v Exploiting Weak Anti-CSRF Measures Using Post-only requests Multi-Step Transactions Checking Referer Header Predictable Anti-CSRF token Unverified Anti-CSRF token Secret Cookies 5.4. Advanced CSRF Exploitation

9 Bypassing CSRF defenses with XSS Bypassing Anti-CSRF Token Request a valid form with a valid token Extract the valid token from the source code Forge the form with the stolen token Bypassing Anti-CSRF Token Brute MODULE 6: HTML5 This module is entirely dedicated to HTML5 and its new attack vectors. It starts from a recap of this language, analyzing the main features to focus our security research. After that, we will go deep into the main exploitation techniques and attack scenarios. Once the security concerns related to HTML5 features are analyzed, the student will learn about the most common security mechanisms developers use. These are critical in understanding how to leverage even more sophisticated attacks. The module concludes with an analysis of the UI redressing attacks and an overview of related new attack vectors introduced with HTML5. 6. Introduction 6.1. HTML5: Recap & More Semantics New attack vectors Form Elements Media Elements Semantic/Structural Elements Attributes Offline & Storage Web Storage > Attack Scenario Session Hijacking Offline Web Application > Attack Scenario Device Access Geolocation > Attack Scenario Fullscreen mode > Attack Scenario Phishing Performance, Integration & Connectivity Attack Scenarios 6.2. Exploiting HTML CORS Attack Scenario

10 Universal Allow Allow by wildcard value * Allow by server-side Weak Access Control Check Origin Example Intranet Scanning JS-Recon Remote Web Shell The Shell of the Future Storage Attack Scenarios Web Storage Session Hijacking Cross-directory attacks User Tracking and Confidential Data disclosure IndexedDB IndexedDB vs WebSQL Database Web Messaging Attack Scenarios Web Messaging DOM XSS Origin Issue Web Sockets Attack Scenarios Web Sockets Data Validation MiTM Remote Shell Network Reconnaissance Web Workers Attack Scenarios WebWorkers Browser-Based Botnet Distributed Password Cracking DDoS Attacks 6.3. HTML5 Security Measures Security Headers X-XSS-Protection X-Frame-Options Strict-Transport-Security X-Content-Type-Options Content Security Policy 6.4. UI Redressing: The x-jacking Art ClickJacking

11 LikeJacking StrokeJacking New Attack Vectors in HTML Drag-and-Drop Text Field Injection Content Extraction MODULE 7: SQL INJECTIONS This module is entirely dedicated to SQL injection attacks, which starts with a brief recap of the main classification of exploitation techniques and then introduces advanced attack techniques on different DBMS s 7. Introduction 7.1. SQL Injection: Recap & More 7.2. Exploiting SQLi Techniques Classification Gathering Information from the Environment Identify the DBMS Error Codes Analysis > MySQL Error Codes Analysis > MSSQL Error Codes Analysis > Oracle Banner Grabbing Educated Guessing String Concatenation Numeric Functions SQL Dialect Enumerating the DBMS Content MySQL MSSQL Oracle Tables & Columns Users and Privileges 7.3. Advanced SQLi Exploitation Out-of-Band Exploitation Alternative OOB Channels OOB vi HTTP Oracle URL_HTTP Package Oracle HTTPURITYPE Package OOB via DNS

12 DNS Exfiltration Flow Provoking DNS requests MySQL MSSQL Oracle Exploiting Second-Order SQL Injection First-order example Security Considerations Automation Considerations MODULE 8: SQLi FILTER EVASION AND WAF BYPASSING In this advanced module, the student will learn about advanced filter evasion and WAF bypassing techniques. These foundation skills will be necessary to understand and master further techniques. At the end of this module, the student will be able to recognize the presence of WAF s and filters and implement effective bypassing techniques. Hera Labs are included in this module 8. Introduction 8.1. DBMS gadgets Functions Constants and variables System variables Typecasting 8.2. Bypassing Keywords filters Using comments Case changing Replaced keywords Circumventing by Encoding URL encode Double URL encode Characters encoding Inline comments Allowed Whitespaces 8.3. Bypassing Functions filters 8.4. Bypassing Regular Expression filters

13 MODULE 9: XML ATTACKS This module is entirely dedicated to XML attacks, which starts with a recap of this language and then dives into the most modern attacks such as XML Tag Injection, XXE, XEE and XPath Injection. Basic and advanced exploitation techniques are analyzed for each attack. At the end of this module, the student will be able to pentest complex applications using XML. Hera Labs are included in this module 9. Introduction 9.1. XML Attacks: Recap & More Entities block XML Document with External DTD + Entities 9.2. XML Tag Injection Testing XML Injection Single/Double Quotes Ampersand Angular parentheses XSS with CDATA 9.3. XML external Entity Taxonomy External Entities: Private vs. Public Resource Inclusion Resource Inclusion Improved Invalid resource to extract CDATA Escape using Parameter Entities php://i/o Stream Bypassing Access Control Out-Of-Band Data Retrieval OOB via HTTP OOB via HTTP using XXEServe 9.4. XML Entity Expansion Recursive Entity Expansion Billion Laugh Attack Generic Entity Expansion Quadratic Blowup Attack Remote Entity Expansion

14 9.5. XPath Injection XPath 1.0 vs New Operations and Expressions on Sequences Function on Strings Function accessors FOR Operator Conditional Expression Regular Expression Assemble/Disassemble String Data Types Advanced XPath Exploitation

15 We are elearnsecurity. Based in Santa Clara, California, with offices in Pisa, Italy, and Dubai, UAE, Caendra Inc. is a trusted source of IT security skills for IT professionals and corporations of all sizes. Caendra Inc. is the Silicon Valley-based company behind the elearnsecurity brand. elearnsecurity has proven to be a leading innovator in the field of practical security training, with best of breed virtualization technology, in-house projects such as Coliseum Web Application Security Framework and Hera Network Security Lab, which has changed the way students learn and practice new skills. Contact details: contactus@elearnsecurity.com