Web Attacks

Tools

Tool	Details
BurpSuite Burpsuite-Professional	Web Proxy (Active Scan++, Param Miner, Reflected Parameters, HTTP Request Smuggler, Content Type Converter, JS Miner, JS Link Finder, Software Vulnerability Scanner, Retire.js, Autorize, JSON Web Tokens, Upload Scanner, Backslash Powered Scanner, Hackvertor, Turbo Intruder, Scan manual insertion point, Server-Side Prototype Pollution Scanner, JWT Editor, Web Cache Deception Scanner, Agartha) (Burp Clickbandit, Generate CSRF PoC, DOM Invader)
ZAP	Web Proxy Open Source
Caido	Other Web Proxy
Postman	Used to test APIs. CTRL + SHIFT + I pm.settings.setSetting("offlineAPIClientEnabled",0) pm.mediator.trigger("hideUserSwitchingExperienceModal")

Checks

• Set Target

• WAF

• nikto, wpscan, etc.

• Generic Active Scan

• Test:

  • Login / Authentication Method

    • JWT

    • OAuth 2.0

    • Request without Auth

  • Headers

    • Security Headers

    • Host Headers

    • CORS

  • Unencrypted Comunications

  • Authorization Mechanisms

    • BAC

    • IDOR

  • Different Method

    • Verb Tampering

  • Information Disclosure

  • Request Smuggling

  • API

  • Web Cache Poisoning/Deception

  • Parameter

    • Specific Active Scan

    • IDOR

    • SQLi

      • sqlmap

    • NoSQLi

    • XSS

    • XXE

    • CSRF

    • SSTI

    • Command Injection

    • Insecure Deserializaion

    • File Inclusion/Path Traversal

    • Unrestricted File Upload