Dhruv Patel

Cyber Security Analyst

Web Designer



Dhruv Patel

Cyber Security Analyst

Web Designer



Blog Post

Most Comprehensive Web Application Penetration Testing Checklist

August 7, 2020 Bug Bounty, Cyber Security
Most Comprehensive Web Application Penetration Testing Checklist
  • Bruteforce subdomains
  • Directory enumeration via Dirb, Dirbuster, BurpSuite Intruder,
  • Identidy underlying web client and server technology
  • Uncover HTTP/HTTPs services running on ports other than the 80 and 443
  • Find leaked email id, passwords using ‘We leak Info’ and ‘Hunter.io’
  • Identidy firewall
  • Find sensitive information through keywords after crawling entire site. Keywords such as admin, password, todo, http
  • Test for ping (ICMP packets are allowed or filtered)
  • DNS testing for zone transfer, missing DNSSEC policies
  • Missing DMARC policies
  • Perform Nessus scan
  • Banner disclosure for open ports and network services
  • Find all web and network services other than port 80 and 443
  • Perform UDP scan using UDP proto scanner
  • Generate site structure in any mindmap tool
  • List all dynamic features
  • Add all possible theoritical test cases within your mind map for testing security of those features
  • Test SSL/TLS weaknesses using Qualys SSL scanner
  • Identify known vulnerabilities in running web and network components using known CVE, searchsploits, Metasploit auxiliaries and exploits
  • Identify actual session cookie out of bulk cookies in the
  • Decode cookies using some standard decoding algorithms such as Base64, hex, URL
  • Modify cookie.session token value by 1 bit/byte. Then resubmit and do the same for all token. Reduce the amount of work you need to perform in order to identify which part of token is actually being used and which is
  • If self-registration is available and you can choose your username, log in with a series of similar usernames containing small variations between them, such as A, AA, AAA, AAAA, AAAB, AAAC, AABA, and so on. If other user-specific data is submitted at login or stored in user profiles (such as an e-mail address)
  • Token leakage via Referer header – Untrusted 3rd Party
  • Check for session cookies and cookie expiration date/time
  • Identify cookie domain scope
  • Check for HttpOnly flag in cookie
  • Check for Secure flag in cookie if the application is over SSL
  • Check for session fixation i.e. value of session cookie before and after authentication
  • Replay the session cookie from a different effective IP address or system to check whether server maintains the state of the machine or not.
  • Check for concurrent login through different machine/IP
  • Check if any user pertaining information is stored in cookie value or not If yes, tamper it with other user’s
  •  Check for duplicate registration / Overwrite existing user
  •  Check for weak password policy
  • Check for the stored chintan in username, account name for registration.
  • Check for insufficient email verification process
  • Weak registration implementation – Allows disposable email addresses
  • Overwrite default web application pages by specially crafted username registrations. => After registration, does your profile link appears something as www.dhruvp111296.com/chintan ? a. If so, enumerate default folders of web application such as /images, /contact, /portfolio b. Do a registration using the username such as images, contact, portfolio c. Check if those default folders have been overwritten by your profile link or not.”
  • Username enumeration
  • Bypass authentication using various SQL Injections on username and password field. Use combinations of below injections dhruvp111296′ — dhruvp111296′ # dhruvp111296’/* ‘ or 1=1 — ‘ or 1=1 # ‘ or 1=1/* ‘) or ‘1’=’1 — ‘) or (‘1’=’1 –“
  • Auto-complete testing
  • Lack of password confirmation on
    • Change email address
    • Change password
    • Manage 2FA
  • Is it possible to use resources without authentication? Access violation
  • Check if user credentials are transmitted over SSL or
  • Weak login function – HTTP and HTTPS both are
  • Test user account lockout mechanism on brute force attack
    • Variation : If server blocks instant user requests, then try with time throttle option from intruder and repeat the process again.
      • Bypass rate limiting by tampering user agent to Mobile User
      • Bypass rate limiting by tampering user agent to Anonymous user
    • Create a password wordlist using cewl command
    • Test 0auth login functionality for Open Redirection
      • Use burp ‘find’ option in order to find parameters such as URL, red, redirect, redir, origin,dest, targetURL, checkout_URL
      • Check the value of these parameter which may contain a
      • Check open redirection for 0auth
      • Change the URL value to dhruvp111296.com and check if gets redirected or not.
      • Check if same secret code request can be used multiple times.
  • Generate custom pages such as /dhruvp111296.php, dhruvp111296.aspx and identify error page
  • Add multiple parameters in same post get request using different value and generate error
  • Add [], ]], and [[ in cookie values and parameter values to create errors
  • Try to generate unusual error code by giving input as /~dhruvp111296/%s at the end of website URL
  • Fuzz using the Burp Intruder with malicious input and try to generate error codes
  • Find parameter which uses active account user id. Try to tamper it in order to change the details of other account.
  • Create a list of features that are pertaining to a user account – Change Email- Change Password- Change account details (Name, Number, Address, etc.) Try CSRF
  • Post login change email id and update with any existing email id. Check if its getting validated on server side or not. Does the application send any new email confirmation link to a new user or not? What if a user does not confirm the link in some time frame?
  • Perform all file upload test using extension tampering and file content modifying. Unsafe File upload – – No Antivirus – No Size Limit – File extension Filter Bypass
  • Open profile picture in new tab and check the URL. Find email id/user id info. EXIF Geolocation Data Not Stripped From Uploaded
  • Check account deletion option if application provides it and confirm that via forgot password feature
  • Change email id, account id, user id parameter and try to brute force other user’s password
  • Check whether application re-authenticates for performing sensitive operation for post authentication features
  • Failure to invalidate session on Logout and Password reset
  • Check if forget password reset link/code uniqueness
  • Check if reset link does get expire or not if its not used by the user for certain amount of time
  • Find user account identification parameter and tamper Id or parameter value to change other user’s password
  • Check for weak password policy
  • Weak password reset implementation – Token is not invalidated after use
  • If reset link have another params such as date and time, then. Change date and time value in order to make active & valid reset
  • Check if security questions are asked? How many guesses allowed? -> Lockout policy maintained or not?
  • Add only spaces in new password and confirmed password. Then Hit enter and see the
  • Does it display old password on the same page after completion of forget password formality?
  • Ask for two password reset link and use the older one from user’s email
  • Check if active session gets destroyed upon changing the password or not?
  • Weak password reset implementation – Password reset token sent over HTTP
  • Send continuous forget password requests so that it may send sequential tokens
  • Is CAPTCHA implemented on contact us form in order to restrict email flooding attacks?
  • Does it allow to upload file on the server?
    • Buy Now
      • Tamper product ID to purchase other high valued product with low prize
      • Tamper product data in order to increase the number of product with the same prize
    • Gift / Voucher
      • Tamper gift/voucher count in the request (if any) to increase/decrease the number of vouchers/gifts to be used
      • Tamper gift/voucher value to increase/decrease the value of voucher in terms of money. (e.g. $100 is given as a voucher, tamper value to increase, decrease money)
      • Reuse gift/voucher by using old gift values in parameter
      • Check the uniqueness of gift/voucher parameter and try guessing other gift/voucher
      • Use parameter pollution technique to add same voucher twice by adding same parameter name and value again with & in the BurpSuite
    • Add/Delete Product from Cart
      • Tamper user id to delete products from other user’s
      • Tamper cart id to add/delete products from other user’s
      • Identify cart id/user id for cart feature to view the added items from other user’s
    • Address
      • Tamper BurpSuite request to change other user’s shipping address to
      • Try stored-XSS by adding XSS vector on shipping
      • Use parameter pollution technique to add two shipping address instead of one trying to manipulate application to send same

    item on two shipping address.

    • Place Order
      • Tamper payment options parameter to change the payment method. E.g. Consider some items cannot be ordered for cash on delivery but tampering request parameters from debit/credit/PayPal/net banking option to cash on delivery may allow you to place order for that particular
      • Tamper the amount value for payment manipulation in each main and sub requests and
      • Check if CVV is going in cleartext or
      • Check if credit/debit card details are masked or
      • Check if application itself process your card details and then perform transaction or it calls any third party payment processing

    company to perform transaction.

    • Track Order
      • Track other user’s order by guessing order tracking number
  •          Booking details

    • View/Manage other user’s booking
    • Check reservation status for other users/behalf of other

    •         Ticket/Voucher

    • View other users vouchers/e-tickets from PRINT option
    • Check if sensitive data is passed in GET request
    • If e-ticket/voucher is sent on email then check for the email flooding

    •         Refund

    • View other user’s refund
    • Refund more money than the intended one by parameter
    • If refund tracking is allowed then gain other user’s refund tracking

    •         Cancellation

    • Gain higher cancellation amount with parameter modifying for amount

    •         Booking

    • Do 1st person booking and add 3 other persons in same prize
    • Hotel – Book normal room – Select Deluxe room in the same prize
  • Locator: ”;!–“<dhruvp111296>=&{()}
    • Try XSS using XSSstrike tool by Somdev Sangwan
    • Upload file using ‘”><img src=x onerror=alert(document.domain)>.txt
    • Standard payload for URI and all inputs:
      • “><img src=x onerror=prompt(document.cookie);><!–
      • “><img src=x onerror=confirm(document.cookie);><!–
      • “><img src=x onerror=alert(document.cookie);><!–
    • If script tags are banned, use <h1> and other HTML tags
    • If output is reflected back inside the JavaScript as a value of any variable just use alert(1)
    • if ” are filtered then use this payload /><img src=d onerror=confirm(/dhruvp111296/);>
    • Upload a JavaScript using Image file
    • Unusual way to execute your JS payload is to change method from POST to It bypasses filters sometimes.
    • Tag attribute value
      • Input landed – <input type=”text” name=”state” value=”INPUT_FROM_ USER”>
      • Payload to be inserted – “ onfocus=”alert(document.cookie)”
    • Syntax Encoding payload “%3cscript%3ealert(document.cookie)%3c/script%3e”
    • NET IE9 dhruvp111296 Filter evasion for htmlentities
      • &lt;%tag style=”dhruvp111296:expression(alert(‘dhruvp111296’))”&gt;
      • ‹%tag style=”dhruvp111296:expression(alert(123))
      • ‹%tag style=”dhruvp111296:expression(alert(123))”
    • Try base64 payload
    • If the logout button just performs the redirection then use old classic XSS payload
    • Polyglot payload
    • Use pure JS payload that worked for many popular websites if your input is reflected back in the JS
  • Locator (Error Based)
  • Test'”” 123′ “”Þ}j%Ùÿ'””‘””””‘;’ ‘””();=,%+-/**/ –«
  • If parameter=static_integer_value then follow below method. If id=4, then try id=3+1 or id=6-2 (if page loads in same way, it is vulnerable)
  • Use SQLmap to identify vulnerabile parameters
    • Fill form in browser GUI submit it
    • Go to history tab in burpsuite and find the relevent
    • Right click and select the option “copy to file”.
    • Save file as txt
    • SQLmap command to run
    • python sqlmap.py -r ~/Desktop/textsqli.txt –proxy=

o  Run SQL injection scanner on all requests

  • Inset new header in the GET/POST request as follows:

X-Forwarded-Host: www.dhruvp111296.com

If it gets redirected from the target application then its vulnerable Capture any request,

Change the host to google.com and see if its getting redirected or not

  • Check if net viewstate parameter is encrypted or not
  • Check if any ASP configuration is disclosed publicly or not
  • Check if error codes reveal the version of NET used in the application
  • Re-use Anti-CSRF token for CSRF attack
  • Check if token is validated on server side or not
  • Check if token validation for full length or partial length
  • Create few dummy account and compare the CSRF token for all those accounts
  • Bypass CSRF token using 2 input type fields in for updating user’s information in the same HTML file
  • Convert POST request to GET and remove _csrf (anti-csrf token) to bypass the CSRF
  • Check if the value you are trying to change is passed in multiple parameters such as cookie, http headers along with GET and POST
  • Change the content type to text/xml then insert below code. Check via repeater

<?xml version=”1.0″ encoding=”ISO-8859-1″?>

<!DOCTYPE dhruvp111296 [

<!ELEMENT dhruvp111296 ANY >

<!ENTITY xxe SYSTEM “file:///etc/passwd” >]><dhruvp111296>&xxe;</foo>

  • SOAP Message Tampering
    • Brute forcing using *
    • Brute forcing using user credentials
    • Parameter guessing
  • SQL injection using ‘ ” – * )
  • Test for directory traversal
  • Test for XML poisoning
  • Web services documentation disclosure – Enumeration of services, data types, input types boundaries and limits
  • Run automated scanner at least
    • Netsparker
    • BurpSuite Scanner
    • For WordPress – Pecan; For Joomla – Groomsman
    • Nessus for network services scan
    • Nexpose for network services scan
  • Replay attack
    • Send old captcha value with if accepts then it is
    • Send old captcha value with old session ID, if its accepts then it is
  • Check if captcha is retrievable with the absolute path such as dhruvp111296.com/internal/captcha/images/24.png
  • Check for the server-side validation for Remove captcha block from GUI using firebug addon and submit request to the server.
  • Check if image recognition can be done with OCR tool?
    • If OCR identifies then report as weak strength of captcha – OCR (Optical Character Recognition)
  • Intercepting websockets messaging
  • Websockets MITM attempts
  • XSS on websockets
  • Testing secret header websocket
  • Content stealing in websockets
  • Token authentication testing in websockets
  • Testing for any leaked secret
  • Dictionary attack on token
  • Exploiting the ‘None’ algorithm
  • Abusing transaction replay
  • Abusing key management
  • Testing for debug mode

Testing weak signing key

  • Abusing object level authentication
  • Abusing weak password/dictionary brute forcing
  • Testing for mass management
  • Testing for excessive data exposure
  • Testing for command injection
  • Testing for misconfigured permissions
  • Testing for SQL injection
Write a comment
error: Content is protected !!