THE WEB APPLICATION HACKER'S HANDBOOK
CHAPTER WEB APPLICATION (IN)SECURITY THE EVOLUTION OF WEB APPLICATIONS COMMON WEB APPLICATION FUNCTIONS BENEFITS OF WEB APPLICATIONS WEB APPLICATION SECURITY “THIS SITE IS SECURE” THE CORE SECURITY PROBLEM: USERS CAN SUBMIT ARBITRARY INPUT KEY PROBLEM FACTORS IMMATURE SECURITY AWARENESS IN-HOUSE DEVELOPMENT DECEPTIVE SIMPLICITY RAPIDLY EVOLVING THREAT PROFILE RESOURCE AND TIME CONSTRAINTS OVEREXTENDED TECHNOLOGIES THE NEW SECURITY PERIMETER THE FUTURE OF WEB APPLICATION SECURITY CHAPTER SUMMARY CORE DEFENSE MECHANISMS HANDLING USER ACCESS AUTHENTICATION SESSION MANAGEMENT ACCESS CONTROL HANDLING USER INPUT VARIETIES OF INPUT APPROACHES TO INPUT HANDLING CONTENTS “REJECT KNOWN BAD” “ACCEPT KNOWN GOOD” SANITIZATION SAFE DATA HANDLING SEMANTIC CHECKS BOUNDARY VALIDATION MULTISTEP VALIDATION AND CANONICALIZATION HANDLING ATTACKERS HANDLING ERRORS MAINTAINING AUDIT LOGS ALERTING ADMINISTRATORS REACTING TO ATTACKS MANAGING THE APPLICATION QUESTIONS WEB APPLICATION TECHNOLOGIES THE HTTP PROTOCOL HTTP REQUESTS HTTP RESPONSES HTTP METHODS URLS HTTP HEADERS GENERAL HEADERS REQUEST HEADERS RESPONSE HEADERS COOKIES STATUS CODES HTTPS HTTP PROXIES HTTP AUTHENTICATION WEB FUNCTIONALITY SERVER-SIDE FUNCTIONALITY THE JAVA PLATFORM ASP NET PHP CLIENT-SIDE FUNCTIONALITY HTML HYPERLINKS FORMS JAVASCRIPT THICK CLIENT COMPONENTS STATE AND SESSIONS ENCODING SCHEMES URL ENCODING UNICODE ENCODING HTML ENCODING BASE64 ENCODING HEX ENCODING NEXT STEPS MAPPING THE APPLICATION ENUMERATING CONTENT AND FUNCTIONALITY WEB SPIDERING USER-DIRECTED SPIDERING DISCOVERING HIDDEN CONTENT BRUTE-FORCE TECHNIQUES INFERENCE FROM PUBLISHED CONTENT USE OF PUBLIC INFORMATION LEVERAGING THE WEB SERVER APPLICATION PAGES VS FUNCTIONAL PATHS DISCOVERING HIDDEN PARAMETERS ANALYZING THE APPLICATION IDENTIFYING ENTRY POINTS FOR USER INPUT IDENTIFYING SERVER-SIDE TECHNOLOGIES BANNER GRABBING HTTP FINGERPRINTING FILE EXTENSIONS DIRECTORY NAMES SESSION TOKENS THIRD-PARTY CODE COMPONENTS IDENTIFYING SERVER-SIDE FUNCTIONALITY DISSECTING REQUESTS EXTRAPOLATING APPLICATION BEHAVIOR MAPPING THE ATTACK SURFACE BYPASSING CLIENT-SIDE CONTROLS TRANSMITTING DATA VIA THE CLIENT HIDDEN FORM FIELDS HTTP COOKIES URL PARAMETERS THE REFERER HEADER OPAQUE DATA THE ASP NET VIEWSTATE CAPTURING USER DATA: HTML FORMS LENGTH LIMITS SCRIPT-BASED VALIDATION DISABLED ELEMENTS CAPTURING USER DATA: THICK-CLIENT COMPONENTS JAVA APPLETS DECOMPILING JAVA BYTECODE COPING WITH BYTECODE OBFUSCATION ACTIVEX CONTROLS REVERSE ENGINEERING MANIPULATING EXPORTED FUNCTIONS FIXING INPUTS PROCESSED BY CONTROLS DECOMPILING MANAGED CODE SHOCKWAVE FLASH OBJECTS HANDLING CLIENT-SIDE DATA SECURELY VALIDATING CLIENT-GENERATED DATA LOGGING AND ALERTING ATTACKING AUTHENTICATION AUTHENTICATION TECHNOLOGIES DESIGN FLAWS IN AUTHENTICATION MECHANISMS BAD PASSWORDS BRUTE-FORCIBLE LOGIN VERBOSE FAILURE MESSAGES VULNERABLE TRANSMISSION OF CREDENTIALS PASSWORD CHANGE FUNCTIONALITY FORGOTTEN PASSWORD FUNCTIONALITY “REMEMBER ME” FUNCTIONALITY USER IMPERSONATION FUNCTIONALITY INCOMPLETE VALIDATION OF CREDENTIALS NON-UNIQUE USERNAMES PREDICTABLE USERNAMES PREDICTABLE INITIAL PASSWORDS INSECURE DISTRIBUTION OF CREDENTIALS IMPLEMENTATION FLAWS IN AUTHENTICATION FAIL-OPEN LOGIN MECHANISMS DEFECTS IN MULTISTAGE LOGIN MECHANISMS INSECURE STORAGE OF CREDENTIALS SECURING AUTHENTICATION USE STRONG CREDENTIALS HANDLE CREDENTIALS SECRETIVELY VALIDATE CREDENTIALS PROPERLY PREVENT INFORMATION LEAKAGE PREVENT BRUTE-FORCE ATTACKS PREVENT MISUSE OF THE PASSWORD CHANGE FUNCTION PREVENT MISUSE OF THE ACCOUNT RECOVERY FUNCTION LOG, MONITOR, AND NOTIFY ATTACKING SESSION MANAGEMENT THE NEED FOR STATE ALTERNATIVES TO SESSIONS WEAKNESSES IN SESSION TOKEN GENERATION MEANINGFUL TOKENS PREDICTABLE TOKENS CONCEALED SEQUENCES TIME DEPENDENCY WEAK RANDOM NUMBER GENERATION WEAKNESSES IN SESSION TOKEN HANDLING DISCLOSURE OF TOKENS ON THE NETWORK DISCLOSURE OF TOKENS IN LOGS VULNERABLE MAPPING OF TOKENS TO SESSIONS VULNERABLE SESSION TERMINATION CLIENT EXPOSURE TO TOKEN HIJACKING LIBERAL COOKIE SCOPE COOKIE DOMAIN RESTRICTIONS COOKIE PATH RESTRICTIONS SECURING SESSION MANAGEMENT GENERATE STRONG TOKENS PROTECT TOKENS THROUGHOUT THEIR LIFECYCLE PER-PAGE TOKENS LOG, MONITOR, AND ALERT REACTIVE SESSION TERMINATION ATTACKING ACCESS CONTROLS COMMON VULNERABILITIES COMPLETELY UNPROTECTED FUNCTIONALITY IDENTIFIER-BASED FUNCTIONS MULTISTAGE FUNCTIONS STATIC FILES INSECURE ACCESS CONTROL METHODS SECURING ACCESS CONTROLS A MULTI-LAYERED PRIVILEGE MODEL INJECTING CODE INJECTING INTO INTERPRETED LANGUAGES INJECTING INTO SQL EXPLOITING A BASIC VULNERABILITY BYPASSING A LOGIN FINDING SQL INJECTION BUGS INJECTING INTO DIFFERENT STATEMENT TYPES THE UNION OPERATOR FINGERPRINTING THE DATABASE EXTRACTING USEFUL DATA AN ORACLE HACK AN MS-SQL HACK EXPLOITING ODBC ERROR MESSAGES (MS-SQL ONLY) ENUMERATING TABLE AND COLUMN NAMES EXTRACTING ARBITRARY DATA USING RECURSION BYPASSING FILTERS SECOND-ORDER SQL INJECTION ADVANCED EXPLOITATION RETRIEVING DATA AS NUMBERS USING AN OUT-OF-BAND CHANNEL USING INFERENCE: CONDITIONAL RESPONSES BEYOND SQL INJECTION: ESCALATING THE DATABASE ATTACK MS-SQL ORACLE MYSQL SQL SYNTAX AND ERROR REFERENCE SQL SYNTAX SQL ERROR MESSAGES PREVENTING SQL INJECTION PARTIALLY EFFECTIVE MEASURES PARAMETERIZED QUERIES DEFENSE IN DEPTH INJECTING OS COMMANDS EXAMPLE 1: INJECTING VIA PERL EXAMPLE 2: INJECTING VIA ASP FINDING OS COMMAND INJECTION FLAWS PREVENTING OS COMMAND INJECTION INJECTING INTO WEB SCRIPTING LANGUAGES DYNAMIC EXECUTION VULNERABILITIES DYNAMIC EXECUTION IN PHP DYNAMIC EXECUTION IN ASP FINDING DYNAMIC EXECUTION VULNERABILITIES FILE INCLUSION VULNERABILITIES REMOTE FILE INCLUSION LOCAL FILE INCLUSION FINDING FILE INCLUSION VULNERABILITIES PREVENTING SCRIPT INJECTION VULNERABILITIES INJECTING INTO SOAP FINDING AND EXPLOITING SOAP INJECTION PREVENTING SOAP INJECTION INJECTING INTO XPATH SUBVERTING APPLICATION LOGIC INFORMED XPATH INJECTION BLIND XPATH INJECTION FINDING XPATH INJECTION FLAWS PREVENTING XPATH INJECTION INJECTING INTO SMTP EMAIL HEADER MANIPULATION SMTP COMMAND INJECTION FINDING SMTP INJECTION FLAWS PREVENTING SMTP INJECTION INJECTING INTO LDAP INJECTING QUERY ATTRIBUTES MODIFYING THE SEARCH FILTER FINDING LDAP INJECTION FLAWS PREVENTING LDAP INJECTION EXPLOITING PATH TRAVERSAL FINDING AND EXPLOITING PATH TRAVERSAL VULNERABILITIES LOCATING TARGETS FOR ATTACK DETECTING PATH TRAVERSAL VULNERABILITIES CIRCUMVENTING OBSTACLES TO TRAVERSAL ATTACKS COPING WITH CUSTOM ENCODING EXPLOITING TRAVERSAL VULNERABILITIES PREVENTING PATH TRAVERSAL VULNERABILITIES ATTACKING APPLICATION LOGIC THE NATURE OF LOGIC FLAWS REAL-WORLD LOGIC FLAWS EXAMPLE 1: FOOLING A PASSWORD CHANGE FUNCTION THE FUNCTIONALITY THE ASSUMPTION THE ATTACK EXAMPLE 2: PROCEEDING TO CHECKOUT EXAMPLE 3: ROLLING YOUR OWN INSURANCE EXAMPLE 4: BREAKING THE BANK EXAMPLE 5: ERASING AN AUDIT TRAIL EXAMPLE 6: BEATING A BUSINESS LIMIT EXAMPLE 7: CHEATING ON BULK DISCOUNTS EXAMPLE 8: ESCAPING FROM ESCAPING EXAMPLE 9: ABUSING A SEARCH FUNCTION EXAMPLE 10: SNARFING DEBUG MESSAGES EXAMPLE 11: RACING AGAINST THE LOGIN AVOIDING LOGIC FLAWS ATTACKING OTHER USERS CROSS-SITE SCRIPTING REFLECTED XSS VULNERABILITIES EXPLOITING THE VULNERABILITY STORED XSS VULNERABILITIES STORING XSS IN UPLOADED FILES DOM-BASED XSS VULNERABILITIES REAL-WORLD XSS ATTACKS CHAINING XSS AND OTHER ATTACKS PAYLOADS FOR XSS ATTACKS VIRTUAL DEFACEMENT INJECTING TROJAN FUNCTIONALITY INDUCING USER ACTIONS EXPLOITING ANY TRUST RELATIONSHIPS ESCALATING THE CLIENT-SIDE ATTACK DELIVERY MECHANISMS FOR XSS ATTACKS DELIVERING REFLECTED AND DOM-BASED XSS ATTACKS DELIVERING STORED XSS ATTACKS FINDING AND EXPLOITING XSS VULNERABILITIES FINDING AND EXPLOITING REFLECTED XSS VULNERABILITIES FINDING AND EXPLOITING STORED XSS VULNERABILITIES FINDING AND EXPLOITING DOM-BASED XSS VULNERABILITIES HTTPONLY COOKIES AND CROSS-SITE TRACING PREVENTING XSS ATTACKS PREVENTING REFLECTED AND STORED XSS PREVENTING DOM-BASED XSS PREVENTING XST REDIRECTION ATTACKS FINDING AND EXPLOITING REDIRECTION VULNERABILITIES CIRCUMVENTING OBSTACLES TO ATTACK PREVENTING REDIRECTION VULNERABILITIES HTTP HEADER INJECTION EXPLOITING HEADER INJECTION VULNERABILITIES INJECTING COOKIES DELIVERING OTHER ATTACKS HTTP RESPONSE SPLITTING PREVENTING HEADER INJECTION VULNERABILITIES FRAME INJECTION EXPLOITING FRAME INJECTION PREVENTING FRAME INJECTION REQUEST FORGERY ON-SITE REQUEST FORGERY CROSS-SITE REQUEST FORGERY EXPLOITING XSRF FLAWS PREVENTING XSRF FLAWS JSON HIJACKING JSON ATTACKS AGAINST JSON OVERRIDING THE ARRAY CONSTRUCTOR IMPLEMENTING A CALLBACK FUNCTION FINDING JSON HIJACKING VULNERABILITIES PREVENTING JSON HIJACKING SESSION FIXATION FINDING AND EXPLOITING SESSION FIXATION VULNERABILITIES PREVENTING SESSION FIXATION VULNERABILITIES ATTACKING ACTIVEX CONTROLS FINDING ACTIVEX VULNERABILITIES PREVENTING ACTIVEX VULNERABILITIES LOCAL PRIVACY ATTACKS PERSISTENT COOKIES CACHED WEB CONTENT BROWSING HISTORY AUTOCOMPLETE PREVENTING LOCAL PRIVACY ATTACKS ADVANCED EXPLOITATION TECHNIQUES LEVERAGING AJAX MAKING ASYNCHRONOUS OFF-SITE REQUESTS ANTI-DNS PINNING A HYPOTHETICAL ATTACK DNS PINNING ATTACKS AGAINST DNS PINNING BROWSER EXPLOITATION FRAMEWORKS AUTOMATING BESPOKE ATTACKS USES FOR BESPOKE AUTOMATION ENUMERATING VALID IDENTIFIERS THE BASIC APPROACH DETECTING HITS HTTP STATUS CODE RESPONSE LENGTH RESPONSE BODY LOCATION HEADER SET-COOKIE HEADER TIME DELAYS SCRIPTING THE ATTACK JATTACK HARVESTING USEFUL DATA FUZZING FOR COMMON VULNERABILITIES PUTTING IT ALL TOGETHER: BURP INTRUDER POSITIONING PAYLOADS CHOOSING PAYLOADS CONFIGURING RESPONSE ANALYSIS ATTACK 1: ENUMERATING IDENTIFIERS ATTACK 2: HARVESTING INFORMATION ATTACK 3: APPLICATION FUZZING EXPLOITING INFORMATION DISCLOSURE EXPLOITING ERROR MESSAGES SCRIPT ERROR MESSAGES STACK TRACES INFORMATIVE DEBUG MESSAGES SERVER AND DATABASE MESSAGES USING PUBLIC INFORMATION ENGINEERING INFORMATIVE ERROR MESSAGES GATHERING PUBLISHED INFORMATION USING INFERENCE PREVENTING INFORMATION LEAKAGE USE GENERIC ERROR MESSAGES PROTECT SENSITIVE INFORMATION MINIMIZE CLIENT-SIDE INFORMATION LEAKAGE ATTACKING COMPILED APPLICATIONS BUFFER OVERFLOW VULNERABILITIES STACK OVERFLOWS HEAP OVERFLOWS “OFF-BY-ONE” VULNERABILITIES DETECTING BUFFER OVERFLOW VULNERABILITIES INTEGER VULNERABILITIES INTEGER OVERFLOWS SIGNEDNESS ERRORS DETECTING INTEGER VULNERABILITIES FORMAT STRING VULNERABILITIES DETECTING FORMAT STRING VULNERABILITIES ATTACKING APPLICATION ARCHITECTURE TIERED ARCHITECTURES ATTACKING TIERED ARCHITECTURES EXPLOITING TRUST RELATIONSHIPS BETWEEN TIERS SUBVERTING OTHER TIERS ATTACKING OTHER TIERS SECURING TIERED ARCHITECTURES MINIMIZE TRUST RELATIONSHIPS SEGREGATE DIFFERENT COMPONENTS APPLY DEFENSE IN DEPTH SHARED HOSTING AND APPLICATION SERVICE PROVIDERS VIRTUAL HOSTING SHARED APPLICATION SERVICES ATTACKING SHARED ENVIRONMENTS ATTACKS AGAINST ACCESS MECHANISMS ATTACKS BETWEEN APPLICATIONS SECURING SHARED ENVIRONMENTS SECURE CUSTOMER ACCESS SEGREGATE CUSTOMER FUNCTIONALITY SEGREGATE COMPONENTS IN A SHARED APPLICATION ATTACKING THE WEB SERVER VULNERABLE WEB SERVER CONFIGURATION DEFAULT CREDENTIALS DEFAULT CONTENT DEBUG FUNCTIONALITY SAMPLE FUNCTIONALITY POWERFUL FUNCTIONS DIRECTORY LISTINGS DANGEROUS HTTP METHODS THE WEB SERVER AS A PROXY MISCONFIGURED VIRTUAL HOSTING SECURING WEB SERVER CONFIGURATION VULNERABLE WEB SERVER SOFTWARE MICROSOFT IIS ISAPI EXTENSIONS APACHE CHUNKED ENCODING OVERFLOW MICROSOFT IIS WEBDAV OVERFLOW IPLANET SEARCH OVERFLOW PATH TRAVERSAL VULNERABILITIES ACCIPITER DIRECTSERVER ALIBABA CISCO ACS ACME SERVER MCAFEE EPOLICY ORCESTRATOR ENCODING AND CANONICALIZATION VULNERABILITIES ALLAIRE JRUN DIRECTORY LISTING VULNERABILITY MICROSOFT IIS UNICODE PATH TRAVERSAL VULNERABILITIES ORACLE PL/SQL EXCLUSION LIST BYPASSES FINDING WEB SERVER FLAWS SECURING WEB SERVER SOFTWARE CHOOSE SOFTWARE WITH A GOOD TRACK RECORD APPLY VENDOR PATCHES PERFORM SECURITY HARDENING MONITOR FOR NEW VULNERABILITIES USE DEFENSE-IN-DEPTH FINDING VULNERABILITIES IN SOURCE CODE APPROACHES TO CODE REVIEW BLACK-BOX VS WHITE-BOX TESTING CODE REVIEW METHODOLOGY SIGNATURES OF COMMON VULNERABILITIES SQL INJECTION PATH TRAVERSAL ARBITRARY REDIRECTION OS COMMAND INJECTION BACKDOOR PASSWORDS NATIVE SOFTWARE BUGS SOURCE CODE COMMENTS IDENTIFYING USER-SUPPLIED DATA SESSION INTERACTION POTENTIALLY DANGEROUS APIS FILE ACCESS DATABASE ACCESS DYNAMIC CODE EXECUTION OS COMMAND EXECUTION URL REDIRECTION SOCKETS CONFIGURING THE JAVA ENVIRONMENT CONFIGURING THE ASP NET ENVIRONMENT CONFIGURING THE PHP ENVIRONMENT REGISTER GLOBALS SAFE MODE MAGIC QUOTES MISCELLANEOUS PERL CONFIGURING THE PERL ENVIRONMENT DATABASE CODE COMPONENTS CALLS TO DANGEROUS FUNCTIONS TOOLS FOR CODE BROWSING A WEB APPLICATION HACKER’S TOOLKIT WEB BROWSERS INTERNET EXPLORER FIREFOX OPERA INTEGRATED TESTING SUITES HOW THE TOOLS WORK INTERCEPTING PROXIES WEB APPLICATION SPIDERS APPLICATION FUZZERS AND SCANNERS MANUAL REQUEST TOOLS FEATURE COMPARISON BURP SUITE PAROS WEBSCARAB ALTERNATIVES TO THE INTERCEPTING PROXY TAMPER DATA TAMPERIE VULNERABILITY SCANNERS VULNERABILITIES DETECTED BY SCANNERS INHERENT LIMITATIONS OF SCANNERS EVERY WEB APPLICATION IS DIFFERENT SCANNERS OPERATE ON SYNTAX SCANNERS DO NOT IMPROVISE SCANNERS ARE NOT INTUITIVE TECHNICAL CHALLENGES FACED BY SCANNERS AUTHENTICATION AND SESSION HANDLING DANGEROUS EFFECTS INDIVIDUATING FUNCTIONALITY OTHER CHALLENGES TO AUTOMATION CURRENT PRODUCTS USING A VULNERABILITY SCANNER OTHER TOOLS NIKTO HYDRA CUSTOM SCRIPTS WGET CURL NETCAT STUNNEL A WEB APPLICATION HACKER’S METHODOLOGY GENERAL GUIDELINES 1 MAP THE APPLICATION’S CONTENT 1 1 EXPLORE VISIBLE CONTENT 1 2 CONSULT PUBLIC RESOURCES 1 3 DISCOVER HIDDEN CONTENT 1 4 DISCOVER DEFAULT CONTENT 1 5 ENUMERATE IDENTIFIER-SPECIFIED FUNCTIONS 1 6 TEST FOR DEBUG PARAMETERS 2 ANALYZE THE APPLICATION 2 1 IDENTIFY FUNCTIONALITY 2 2 IDENTIFY DATA ENTRY POINTS 2 3 IDENTIFY THE TECHNOLOGIES USED 2 4 MAP THE ATTACK SURFACE 3 TEST CLIENT-SIDE CONTROLS 3 1 TEST TRANSMISSION OF DATA VIA THE CLIENT 3 2 TEST CLIENT-SIDE CONTROLS OVER USER INPUT 3 3 TEST THICK-CLIENT COMPONENTS 3 3 1 TEST JAVA APPLETS 3 3 2 TEST ACTIVEX CONTROLS 3 3 3 TEST SHOCKWAVE FLASH OBJECTS 4 TEST THE AUTHENTICATION MECHANISM 4 1 UNDERSTAND THE MECHANISM 4 2 TEST PASSWORD QUALITY 4 3 TEST FOR USERNAME ENUMERATION 4 4 TEST RESILIENCE TO PASSWORD GUESSING 4 5 TEST ANY ACCOUNT RECOVERY FUNCTION 4 6 TEST ANY REMEMBER ME FUNCTION 4 7 TEST ANY IMPERSONATION FUNCTION 4 8 TEST USERNAME UNIQUENESS 4 9 TEST PREDICTABILITY OF AUTO-GENERATED CREDENTIALS 4 10 CHECK FOR UNSAFE TRANSMISSION OF CREDENTIALS 4 11 CHECK FOR UNSAFE DISTRIBUTION OF CREDENTIALS 4 12 TEST FOR LOGIC FLAWS 4 12 1 TEST FOR FAIL-OPEN CONDITIONS 4 12 2 TEST ANY MULTISTAGE MECHANISMS 4 13 EXPLOIT ANY VULNERABILITIES TO GAIN UNAUTHORIZED ACCESS 5 TEST THE SESSION MANAGEMENT MECHANISM 5 1 UNDERSTAND THE MECHANISM 5 2 TEST TOKENS FOR MEANING 5 3 TEST TOKENS FOR PREDICTABILITY 5 4 CHECK FOR INSECURE TRANSMISSION OF TOKENS 5 5 CHECK FOR DISCLOSURE OF TOKENS IN LOGS 5 6 CHECK MAPPING OF TOKENS TO SESSIONS 5 7 TEST SESSION TERMINATION 5 8 CHECK FOR SESSION FIXATION 5 9 CHECK FOR XSRF 5 10 CHECK COOKIE SCOPE 6 TEST ACCESS CONTROLS 6 1 UNDERSTAND THE ACCESS CONTROL REQUIREMENTS 6 2 TESTING WITH MULTIPLE ACCOUNTS 6 3 TESTING WITH LIMITED ACCESS 6 4 TEST FOR INSECURE ACCESS CONTROL METHODS 7 TEST FOR INPUT-BASED VULNERABILITIES 7 1 FUZZ ALL REQUEST PARAMETERS 7 2 TEST FOR SQL INJECTION 7 3 TEST FOR XSS AND OTHER RESPONSE INJECTION 7 3 1 IDENTIFY REFLECTED REQUEST PARAMETERS 7 3 2 TEST FOR REFLECTED XSS 7 3 3 TEST FOR HTTP HEADER INJECTION 7 3 4 TEST FOR ARBITRARY REDIRECTION 7 3 5 TEST FOR STORED ATTACKS 7 4 TEST FOR OS COMMAND INJECTION 7 5 TEST FOR PATH TRAVERSAL 7 6 TEST FOR SCRIPT INJECTION 7 7 TEST FOR FILE INCLUSION 8 TEST FOR FUNCTION-SPECIFIC INPUT VULNERABILITIES 8 1 TEST FOR SMTP INJECTION 8 2 TEST FOR NATIVE SOFTWARE VULNERABILITIES 8 2 1 TEST FOR BUFFER OVERFLOWS 8 2 2 TEST FOR INTEGER VULNERABILITIES 8 2 3 TEST FOR FORMAT STRING VULNERABILITIES 8 3 TEST FOR SOAP INJECTION 8 4 TEST FOR LDAP INJECTION 8 5 TEST FOR XPATH INJECTION 9 TEST FOR LOGIC FLAWS 9 1 IDENTIFY THE KEY ATTACK SURFACE 9 2 TEST MULTISTAGE PROCESSES 9 3 TEST HANDLING OF INCOMPLETE INPUT 9 4 TEST TRUST BOUNDARIES 9 5 TEST TRANSACTION LOGIC 10 TEST FOR SHARED HOSTING VULNERABILITIES 10 1 TEST SEGREGATION IN SHARED INFRASTRUCTURES 10 2 TEST SEGREGATION BETWEEN ASP-HOSTED APPLICATIONS 11 TEST FOR WEB SERVER VULNERABILITIES 11 1 TEST FOR DEFAULT CREDENTIALS 11 2 TEST FOR DEFAULT CONTENT 11 3 TEST FOR DANGEROUS HTTP METHODS 11 4 TEST FOR PROXY FUNCTIONALITY 11 5 TEST FOR VIRTUAL HOSTING MISCONFIGURATION 11 6 TEST FOR WEB SERVER SOFTWARE BUGS 12 MISCELLANEOUS CHECKS 12 1 CHECK FOR DOM-BASED ATTACKS 12 2 CHECK FOR FRAME INJECTION 12 3 CHECK FOR LOCAL PRIVACY VULNERABILITIES 12 4 FOLLOW UP ANY INFORMATION LEAKAGE 12 5 CHECK FOR WEAK SSL CIPHERS