4.0

28Web Application Penetration Testing• Phase 2 Active mode:In this phase the tester begins to test using the methodology describedin the follow sections.The set of active tests have been split into 11 sub-categories for atotal of 91 controls:• Information Gathering• Configuration and Deployment Management Testing• Identity Management Testing• Authentication Testing• Authorization Testing• Session Management Testing• Input Validation Testing• Error Handling• Cryptography• Business Logic Testing• Client Side TestingTesting for Information GatheringUnderstanding the deployed configuration of the server hosting theweb application is almost as important as the application securitytesting itself. After all, an application chain is only as strong as itsweakest link. Application platforms are wide and varied, but some keyplatform configuration errors can compromise the application in thesame way an unsecured application can compromise the server.Conduct search engine discovery/reconnaissancefor information leakage (OTG-INFO-001)SummaryThere are direct and indirect elements to search engine discoveryand reconnaissance. Direct methods relate to searching the indexesand the associated content from caches. Indirect methods relate togleaning sensitive design and configuration information by searchingforums, newsgroups, and tendering websites.Once a search engine robot has completed crawling, it commences indexingthe web page based on tags and associated attributes, such as, in order to return the relevant search results [1]. If the robots.txt file is not updated during the lifetime of the web site, and inlineHTML meta tags that instruct robots not to index content have notbeen used, then it is possible for indexes to contain web content notintended to be included in by the owners. Website owners may usethe previously mentioned robots.txt, HTML meta tags, authentication,and tools provided by search engines to remove such content.Search operatorsUsing the advanced “site:” search operator, it is possible to restrictsearch results to a specific domain [2]. Do not limit testing to justone search engine provider as they may generate different resultsdepending on when they crawled content and their own algorithms.Consider using the following search engines:• Baidu• binsearch.info• Bing• Duck Duck Go• ixquick/Startpage• Google• Shodan• PunkSpiderDuck Duck Go and ixquick/Startpage provide reduced informationleakage about the tester.Google provides the Advanced “cache:” search operator [2], but thisis the equivalent to clicking the “Cached” next to each Google SearchResult. Hence, the use of the Advanced “site:” Search Operator andthen clicking “Cached” is preferred.The Google SOAP Search API supports the doGetCachedPage and theassociated doGetCachedPageResponse SOAP Messages [3] to assistwith retrieving cached pages. An implementation of this is under developmentby the OWASP “Google Hacking” Project.PunkSpider is web application vulnerability search engine. It is of littleuse for a penetration tester doing manual work. However it canbe useful as demonstration of easiness of finding vulnerabilities byscript-kiddies.Example To find the web content of owasp.org indexed by a typicalsearch engine, the syntax required is:site:owasp.orgTest ObjectivesTo understand what sensitive design and configuration information ofthe application/system/organization is exposed both directly (on theorganization’s website) or indirectly (on a third party website).How to TestUse a search engine to search for:• Network diagrams and configurations• Archived posts and emails by administrators and other key staff• Log on procedures and username formats• Usernames and passwords• Error message content• Development, test, UAT and staging versions of the websiteTo display the index.html of owasp.org as cached, the syntax is:cache:owasp.org