CEH 14- Hacking Web Applications

Before we are going to talk about "Hacking Web Applications", first we need to know about "Web Application, its development and its working". So let's get started.

What is Web Application? 

• A Web Application is a program that is accessed over internet using HTTP or HTTPS existing in the web server. 
• The web application is a client-server application.
• In which client is a web browser like chrome, firefox, safari, etc. 
• The web application contains a set of web pages, scripts, images, etc. 
• Web applications help organizations to grow their business. 
• Web applications include online forms, shopping carts, word processors, spreadsheets, video and photo editing, file conversion, file scanning, and email programs such as Gmail, Yahoo, etc,.

• Types of websites:

1. Static Website 
2. Dynamic Website 

Disclaimer: The articles provided on HackWithV is purely for informational and educational purpose only, and for those who are willing and curious to know & learn about Ethical Hacking, Security and Penetration Testing. Anytime the word "Hacking" that is used on this site shall be regarded as Ethical Hacking.

1. Static Website: 

• A static website contains web pages with fixed content. 
• A static site can be built using HTML and hosted on a Web server. 
• Examples: Wikipedia, Blog, etc.

2. Dynamic Website: 

• The information on dynamic website changes based on user interaction, the time zone, the viewer’s native language, and other factors. 
• These pages include Web scripting code, such as PHP or ASP. 
• When a dynamic page is accessed, the code within the page is parsed on the Web server, and the resulting HTML is sent to the client web browser. 
• Dynamic websites can interact with the user, capable of access information stored on the database. 
• Dynamic web pages are also known as database-driven websites.
• Examples: Gmail, Linkedin, Facebook, etc.

Web Application Working: 

• The user sends a request to the web server over the internet through a web browser. 
• Web server forward these requests to the web application server. 
• Web application server queries the database and generates the results as per the user request. 
• Web servers respond back to the client with the requested information.

How to Hack Website?

• There are 3 ways to hack a website, as shown in the below.

Web Application Pentesting	Server Side Attack	Client Side Attack
An application hosted on the computer.	Computer uses an OS or other application.	Managed by human.

In this article, we are going to discuss about Web Application Hacking(Web Application Pentesting).

OWASP: 

• The Open Web Application Security Project (OWASP), an online community, produces freely-available articles, methodologies, documentation, tools, and technologies in the field of web application security. 
• It aims to raise awareness about application security by identifying some of the most critical risks that organizations are facing. 

The Top 10 OWASP vulnerabilities:

• “Change has accelerated over the last four years, and the Top 10 needed to change,” OWASP said. 
• “Over the last few years, the fundamental technology and architecture of applications has changed significantly.”

1. Parameter Tampering: 

• This attack involves the manipulation of parameters exchanged between client and server.
• With this we can modify application data such as user credentials, permissions, price, the quantity of products. 
• Establishing a proxy can make the process of tampering simple if the web application fails in proper session management.

2. Directory Traversal: 

• Directory Traversal or Path Traversal is an attack on HTTP which allows attackers to access restricted directories outside of the web server root location. 
• Attackers try to access restricted directories that contain sensitive information like server configuration files, application source code, etc. 
• Attackers can manage to access files located outside the web root because of this vulnerability. 
• Example: http://www.example.com/abc.php=../../../../etc/passwd

3. Cross-Site Scripting(XSS) attack: 

• XSS attack takes advantage of dynamically generated web content based on user input provided on web pages. 
• An attacker tries to inject commands in input fields provided on web pages. 
• If the web server is unable to validate input fields on a web page properly. 
• Then it will execute the command provided by the attacker and unknowingly reveal information related to the client. 
• Types of XSS:

1. Reflected XSS 
2. Stored XSS 
3. DOM Based XSS

4. Cross-Site Request Forgery: 

• Any request sent to the server are not validated (No server-side validation). 
• The server processes the request without verifying whether the user made the request or not. 
• Because of poor validation, requests can be forged and sent to users to force them to do things that they are not intended to do. 
• By clicking some links, users may unknowingly change account passwords.

5. Command Injection: 

• Command injection vulnerability in a web application allows attackers to inject untrusted data and execute it as part of regular command or query. 
• Attackers use specially crafted malicious commands or queries to exploit these vulnerabilities which may result in data loss. 
• Injection attacks are possible because of poor web development capabilities.

6. File Inclusion: 

6.1. Local File Inclusion: 

• Allows an attacker to gain access to any file on the server computer. 
• An attacker can even access a file located apart from the web-root folder. 

6.2. Remote File Inclusion: 

• Allows an attacker to gain access to any file from any server. 
• We can execute file located on a remote server on the vulnerable server. 

Mitigation:

• Validate user input length, perform bound checking. 
• Define access rights to private folders on the web server. 
• Use the more secure HTTPS protocol instead of HTTP if available. 
• Use language-specific libraries for the programming language. 
• Log out from online user accounts instead of directly closing the browser, to properly end sessions. 
• Take careful note of security warnings from the web browser. 
• Avoid clicking links to sensitive portals, such as for e-banking, instead enter the URL of the website manually. 
• Keep web application building software (frameworks) up to date to protect websites from application-based attacks.

Be Aware, Be Secure.

Thank You 🙏