OWASP: Testing Guide v4 Checklist: Information Gathering Test Name
OWASP: Testing Guide v4 Checklist: Information Gathering Test Name
Configuration and
Deploy Management Test Name
Testing
Identity Management
Test Name
Testing
Oracle Testing
MySQL Testing
Testing PostgreSQL
MS Access Testing
Not Started
Pass
Issues
N/A
Description Tools
Use a search engine to search for Network diagrams and Configurations, Google Hacking, Sitedigger,
Credentials, Error message content. Shodan, FOCA, Punkspider
Find the version and type of a running web server to determine known Httprint, Httprecon,
vulnerabilities and the appropriate exploits. Using Desenmascarame
"HTTP header field ordering" and "Malformed requests test".
Analyze robots.txt and identify <META> Tags from website. Browser, curl, wget
Webhosting.info, dnsrecon,
Find applications hosted in the webserver (Virtual hosts/Subdomain), non-
Nmap, fierce, Recon-ng,
standard ports, DNS zone transfers Intrigue
Find sensitive information from webpage comments and Metadata on Browser, curl, wget
source code.
Identify from hidden fields, parameters, methods HTTP header analysis Burp proxy, ZAP, Tamper data
Map the target application and understand the principal workflows. Burp proxy, ZAP
Find the type of web application framework/CMS from HTTP headers, Whatweb, BlindElephant,
Cookies, Source code, Specific files and folders. Wappalyzer
Identify the web application and version to determine known vulnerabilities Whatweb, BlindElephant,
and the appropriate exploits. Wappalyzer, CMSmap
Identify application architecture including Web language, WAF, Reverse Browser, curl, wget
proxy, Application Server, Backend Database
Description Tools
Directory and file enumeration, comments and links in source (/admin, Burp Proxy, dirb, Dirbuster,
/administrator, /backoffice, /backend, etc), alternative server port fuzzdb, Tilde Scanner
(Tomcat/8080)
Identify HTTP allowed methods on Web server with OPTIONS. Arbitrary netcat, curl
HTTP Methods, HEAD access control bypass and XST
Identify HSTS header on Web server through HTTP response header. Burp Proxy, ZAP, curl
curl -s -D- https://domain.com/ | grep Strict
Analyse the permissions allowed from the policy files Burp Proxy, ZAP, Nikto
(crossdomain.xml/clientaccesspolicy.xml) and allow-access-from.
Description Tools
Validate the system roles defined within the application by creating Burp Proxy, ZAP
permission matrix.
Verify that the identity requirements for user registration are aligned Burp Proxy, ZAP
with business and security requirements:
Determine which roles are able to provision users and what sort of Burp Proxy, ZAP
accounts they can provision.
Generic login error statement check, return codes/parameter values, Browser, Burp Proxy, ZAP
enumerate all possible valid userids (Login system, Forgot password)
User account names are often highly structured (e.g. Joe Bloggs
account name is jbloggs and Fred Nurks account name is fnurks) Browser, Burp Proxy, ZAP
and valid account names can easily be guessed.
Guest and Training accounts are useful ways to acquaint potential users
with system functionality prior to them completing the authorisation Burp Proxy, ZAP
process required for access.Evaluate consistency between access policy
and guest/training account access permissions.
Verify the identity requirements for user registration align with Burp Proxy, ZAP
business/security requirements. Validate the registration process.
Description Tools
Check referrer whether its HTTP or HTTPs. Sending data through HTTP Burp Proxy, ZAP
and HTTPS.
Testing for default credentials of common applications, Testing for default Burp Proxy, ZAP, Hydra
password of new accounts.
Look for passwords being stored in a cookie. Examine the cookies stored
by the application. Verify that the credentials are not stored in clear text, Burp Proxy, ZAP
but are hashed. Autocompleted=off?
Check browser history issue by clicking "Back" button after logging out. Burp Proxy, ZAP, Firefox add-
Check browser cache issue from HTTP response headers (Cache- on CacheViewer2
Control: no-cache)
Description Tools
dot-dot-slash attack (../), Directory traversal, Local File inclusion/Remote Burp Proxy, ZAP, Wfuzz
File Inclusion.
Access a resource without authentication?, Bypass ACL, Force browsing Burp Proxy (Autorize), ZAP
(/admin/adduser.jsp)
Testing for role/privilege manipulate the values of hidden variables. Burp Proxy (Autorize), ZAP
Change some param groupid=2 to groupid=1
Force changing parameter value (?invoice=123 -> ?invoice=456) Burp Proxy (Autorize), ZAP
Description Tools
SessionID analysis prediction, unencrypted cookie transport, Burp Proxy, ForceSSL, ZAP,
brute-force. CookieDigger
Check HTTPOnly and Secure flag, expiration, inspect for sensitive Burp Proxy, ZAP
data.
The application doesn't renew the cookie after a successfully user Burp Proxy, ZAP
authentication.
Encryption & Reuse of session Tokens vulnerabilities, Send Burp Proxy, ZAP
sessionID with GET method ?
Burp Proxy
(csrf_token_detect), burpy,
URL analysis, Direct access to functions without any token. ZAP
Check reuse session after logout both server-side and SSO. Burp Proxy, ZAP
Check session timeout, after the timeout has passed, all session tokens Burp Proxy, ZAP
should be destroyed or be unusable.
The application uses the same session variable for more than one
purpose. An attacker can potentially access pages in an order Burp Proxy, ZAP
unanticipated by the developers so that the session variable is set in one
context and then used in another.
Description Tools
Check for input validation, Replace the vector used to identify XSS, XSS Burp Proxy, ZAP, Xenotix XSS
with HTTP Parameter Pollution.
Check input forms/Upload forms and analyze HTML codes, Leverage XSS Burp Proxy, ZAP, BeEF, XSS
with BeEF Proxy
Craft custom HTTP requests to test the other methods to bypass URL netcat
authentication and authorization.
Identify any form or action that allows user-supplied input to bypass Input ZAP, HPP Finder (Chrome
validation and filters using HPP Plugin)
/ldapsearch?user=*
user=*user=*)(uid=*))(|(uid=* Burp Proxy, ZAP
pass=password
Testing ORM injection is identical to SQL injection testing Hibernate, Nhibernate
Check with XML Meta Characters Burp Proxy, ZAP, Wfuzz
', " , <>, <!--/-->, &, <![CDATA[ / ]]>, XXE, TAG
• Presense of .shtml extension
• Check for these characters Burp Proxy, ZAP
< ! # = / . " - > and [a-zA-Z0-9]
• include String = <!--#include virtual="/etc/passwd" -->
Check for XML error enumeration by supplying a single quote (')
Username: ‘ or ‘1’ = ‘1 Burp Proxy, ZAP
Password: ‘ or ‘1’ = ‘1
File Upload, Stored XSS , SQL/XPATH Injection, Misconfigured Burp Proxy, BeEF, MSF
servers (Tomcat, Plesk, Cpanel)
param=foobar%0d%0aContent-Length:%200%0d%0a%0d
Burp Proxy, ZAP, netcat
%0aHTTP/1.1%20200%20OK%0d%0aContent-Type:
%20text/html%0d%0aContent-Length:%2035%0d%0a%0d
%0a<html>Sorry,%20System%20Down</html>
Description Tools
Locate error codes generated from applications or web servers. Collect
sensitive information from that errors (Web Server, Application Server, Burp Proxy, ZAP
Database)
• Invalid Input / Empty inputs
• Input that contains non alphanumeric characters or query syn
tax Burp Proxy, ZAP
• Access to internal pages without authentication
• Bypassing application flow
Description Tools
Identify SSL service, Idectify weak ciphers/protocols (ie. RC4, BEAST, testssl.sh, SSL Breacher
CRIME, POODLE)
Compare the responses in three different states:
• Cipher text gets decrypted, resulting data is correct. PadBuster, Poracle, python-
• Cipher text gets decrypted, resulting data is garbled and causes paddingoracle, POET
some exception or error handling in the application logic.
• Cipher text decryption fails due to padding errors.
Description Tools
• Looking for data entry points or hand off points between systems or Burp Proxy, ZAP
software.
• Once found try to insert logically invalid data into the application/system.
Description Tools
Test for the user inputs obtained from client-side JavaScript Objects Burp Proxy, DOMinator
Inject JavaScript code: Burp Proxy, ZAP
www.victim.com/?javascript:alert(1)
Send malicious HTML code: Burp Proxy, ZAP
?user=<img%20src='aaa'%20onerror=alert(1)>
Modify untrusted URL input to a malicious site: (Open Redirect) Burp Proxy, ZAP
?redirect=www.fake-target.site
Determine whether the website is storing sensitive data in the storage. Chrome, Firebug, Burp Proxy,
XSS in localstorage ZAP
http://server/StoragePOC.html#<img src=x onerror=alert(1)>
Result Remark
Not Started
Not Started
Not Started
Not Started
Not Started
Not Started
Not Started
Not Started
Not Started
Not Started
Result Remark
Not Started
Not Started
Not Started
Not Started
Not Started
Not Started
Not Started
Not Started
Result Remark
Not Started
Not Started
Not Started
Not Started
Not Started
Not Started
Not Started
Result Remark
Not Started
Not Started
Not Started
Not Started
Not Started
Not Started
Not Started
Not Started
Not Started
Not Started
Result Remark
Not Started
Not Started
Not Started
Not Started
Result Remark
Not Started
Not Started
Not Started
Not Started
Not Started
Not Started
Not Started
Not Started
Result Remark
Not Started
Not Started
Not Started
Not Started
Not Started
Not Started
Not Started
Not Started
Not Started
Not Started
Not Started
Not Started
Not Started
Not Started
Not Started
Not Started
Not Started
Not Started
Not Started
Not Started
Not Started
Not Started
Not Started
Not Started
Not Started
Not Started
Not Started
Result Remark
Not Started
Not Started
Result Remark
Not Started
Not Started
Not Started
Result Remark
Not Started
Not Started
Not Started
Not Started
Not Started
Not Started
Not Started
Not Started
Not Started
Result Remark
Not Started
Not Started
Not Started
Not Started
Not Started
Not Started
Not Started
Not Started
Not Started
Not Started
Not Started
Not Started
No. Vulnerability Name OTG Affected Host/Path Impact Likelihood Risk
www.example.com/n
1 SQL Injection OTG-INPVAL-005 High Moderate High
ews.php (id,page)
Test
Observation/Implication Recommendation
Evidence
xxx-1
OWASP Risk Assessment Calculator
Risk Assessment Calculator
Likelihood factors
Threat Agent Factors
Skills required Some technical skills [3] 3
Motive Possible reward [4] 4
Opportunity Full access or expensive resources required [0] 0
Population Size System Administrators [2] 2
Vulnerability Factors
Easy of Discovery Practically impossible [1] 1
Ease of Exploit Easy [5] 5
Awareness Hidden [4] 4
Intrusion Detection Logged and reviewed [3] 3
Impact
Likelihood Low ->Moderate<- High
->Low<- Note ->Low<- Moderate
Moderate Low Moderate High
High Moderate High Critical
k Assessment Calculator
sessment Calculator
Impact factors
Technical Impact Factors
Loss of confidentiality Minimal non-sensitive data disclosed [2] 2
Loss of Integrity All data totally corrupt [9] 9
Loss of Availability Minimal secondary services interrupted [1] 1
Loss of Accountability Not Applicable [0] 0
Low
Skills required Motive
Select an option Select an option
Not Applicable [0] 0 Not Applicable [0] 0
No technical skills [1] 1 Low or no reward [1] 1
Some technical skills [3] 3 Possible reward [4] 4
Advanced computer user [5] 5 High reward [9] 9
Network and programming skills [6] 6
Security penetration skills [9] 9