Practical Web Application Penetration Testing (WAPT)

Explore core ideas of software security, including software vulnerabilities, risk, and practical examples like SQL injection, broken access control, and stored XSS, plus OWASP and the software development life cycle.

Explore how software protects data by applying the CIA triad (confidentiality, integrity, and availability), balancing security with business continuity and usability.

Define software vulnerabilities as unexpected states that break confidentiality, integrity, or availability. Learn how exploits and payloads weaponize these flaws, and how fixes realign systems with expectations to reduce risk.

Explore a practical sql injection vulnerability in a simple flask app, showing how crafted input bypasses authentication and exposes admin data using a classic payload and sql querying.

Learn how IDOR (insecure direct object reference) enables broken access control by manipulating resource IDs in a web app, exposing unauthorized receipts and data through weak authorization checks.

Explore stored cross-site scripting (XSS) vulnerabilities in a simple guestbook, showing how user input stored on the server can inject HTML and JavaScript that executes in the DOM.

Investigate OS injection and OS command injection in web apps, showing how unvalidated input can trigger remote code execution and data exfiltration.

Understand software risk by linking vulnerabilities to threats through probability and impact, apply threat modeling and attack surface analysis to guide mitigations, and distinguish fixes from mitigation.

Distinguish software vulnerabilities from security risk, noting that vulnerabilities are unintended while risk can arise from intended design, and discuss remediation and business trade-offs.

Explore how a simple Flask login form reveals user enumeration via distinct error messages and why this is a low to medium security issue, not a vulnerability.

Measure security through falsifiability by breaking the system to prove insecurity, using web and mobile penetration tests and proof of concept evidence.

Vulnerability assessment uses automated scanners to enumerate known vulnerabilities without exploitation, reporting vulnerable versions and testing scope defined by IPs, domains, or subnets, with CVE, NVD, and exploit-db references.

Understand how a network penetration test differs from vulnerability assessment by exploiting weaknesses, enumerating services with nmap, testing scope across IPs or subnets, and maximizing privileges via misconfigurations and vulnerabilities.

Explore practical web application penetration testing, focusing on HTTP, TLS, browser interactions, and proxies such as Burp Suite, while defining scope across production and black, gray, and white box approaches.

Analyze source code to uncover vulnerabilities, tracing data from sources like user input to sinks such as sql queries, and learn tainting and mitigation with prepared statements.

Learn how mobile testing mirrors web testing, with Android and iOS differences and API interactions. Contrast penetration testing with red teaming, emphasizing technical and social factors like phishing.

Explore the CVE system, a MITRE-maintained catalog of publicly disclosed vulnerabilities that standardizes entries with IDs, CVSS scores, affected versions, and root cause analysis to aid risk assessment and patching.

CWE, a Mitre-maintained catalog of software and hardware weaknesses, standardizes security flaws and includes descriptions, consequences, mitigations, with examples CW 611 and CW 89.

Explore the common vulnerability scoring system (CVSS) and how base, temporal, and environmental scores combine to prioritize security issues, enabling effective vulnerability management and communication.

Analyze CVE-2022-22965 through a hands-on Docker-based demo, compute CVSS 3.1 risk scores, and explore remote code execution via Spring data binding in a Tomcat war deployment.

Explore OWASP, the open worldwide application security project, and its top ten risks, testing guides, and vulnerable web applications for practical security testing.

Trace Phrack and e-zines, the underground hacker lineage from phreaking to modern security, and see how plain-text articles shaped techniques like buffer overflow and code review.

Explore capture the flag challenges and categories like binary exploitation, reverse engineering, and web security, and learn how CTFs build hands-on security skills.

Explore how security integrates into every stage of the software development life cycle, from threat modeling and secure coding to testing, hardening, and decommissioning.

Explore web application penetration testing on the secure Bank, a dotnet cross-platform app with OWASP top ten vulnerabilities. Deploy, run reproducible proof-of-concept tests, and analyze transactions and admin features.

Deploy the secure bank application locally with docker on a Kali Linux VM. Launch three containers: secure bank, store API, and sql server on ports 1237, 1338, and 1433.

Close the tab and open the application in a new tab when the app shows an infinite loading screen, then load the application again to ensure it loads correctly.

This lecture simulates initiating a web application penetration test for a secure bank platform, outlining scope, authorization, and the start of authentication and testing activities.

Set up a working http proxy to view, analyze, and modify browser traffic and attack vectors between the client and the web app, using Burp Suite, mitmproxy, and Kydo.

Explore the HTTP protocol by analyzing requests and responses, including get and post methods, headers like host and cookie, and status codes, using Burp Suite to intercept and modify traffic.

Learn how nmap enumerates open ports and services on a host, including tcp and udp, and why the course concentrates on web application testing within domain scope.

Install burp suite community edition as the primary http proxy on linux. Download from the official site or via curl and run the installer or jar for a ram-based project.

Learn how to set up Burp Suite, configure modules like target, proxy, repeater, intruder, and decoder, intercept and inspect HTTP traffic, and manage scope for focused web app testing.

Explore Burp Suite extensions to extend testing capabilities with Java or Python extensions, installed from the Burp App Store, including auth analyzer and API access for HTTP, Repeater, and Decoder.

Mitmproxy is a free, open-source interactive HTTP proxy for debugging, testing, and penetration testing, enabling interception, inspection, modification, and replay of web traffic via a Python API.

Learn how to connect any browser to the Burp Suite proxy, configure the proxy settings, and install the Burp certificate to avoid TLS certificate errors and view https traffic.

Track testing coverage across pages, api endpoints, and parameters to quantify progress with a completion percentage and coordinate testing tasks.

Divide the application into areas of interest and classify security issues into categories. Explore information disclosure, injections, authentication, authorization, session management, privilege escalation, and insecure configuration.

Identify information disclosure across the UI, source code, and HTTP traffic, including errors, directory listings, and metadata, and explain how attackers map systems to plan exploits.

Explore file and directory enumeration to map resources, use Go-buster with word lists, and discover API endpoints and Swagger documentation to assess security risks.

Analyze how an exposed Swagger API can disclose internal infrastructure and admin endpoints, showing that public documentation may enable attackers to enumerate admin APIs and sensitive data.

This lecture explains how directory listing in a web app exposes documents in /docs without authentication, enabling unauthorized access to files and metadata, with medium risk depending on content.

Identify how stack traces leak sensitive backend details during error handling, file uploads, and cookie manipulation, creating a medium security risk.

Discover how unmanaged errors expose backend flaws by examining json versus html responses, deserialization issues, and vulnerable endpoints such as get transactions and admin store download and upload store items.

Analyze HTML comments to uncover exposed sensitive functionality, revealing a commented admin register API; this information disclosure can enable privilege escalation if not properly secured.

Identify and assess low-risk information disclosure from PDF metadata found in docs, using exiftool to reveal creator, dates, and software versions, and recommend metadata removal to reduce risk.

Identify how server banners reveal the tech stack, such as Kestrel or Nginx, potentially exposing versions and infrastructure; note this risk is low but educational.

Identify and mitigate injection vulnerabilities by understanding how untrusted input reaches interpreters or parsers, including Python commands and SQL queries, and test the secure bank app with special characters.

Demonstrates identifying and exploiting an SQL injection in a bank transaction search form, revealing database version, tables, columns, and user data including passwords, using manual payloads and SQL map.

Explore how sqlmap automates sql injection exploitation, tests parameters with a session cookie for authenticated requests, and dumps data from the database.

Explore practical web application penetration testing with an in-depth sql injection code review, tracing how user input and session cookies inject queries in the transaction api.

Explains stored cross-site scripting in the transaction page, demonstrating unencoded user input displayed in the page and the need for proper output encoding using render for protection.

In practical web application penetration testing, this lecture explains reflected XSS on the portal search page, showing how unencoded input enables JavaScript execution and potential session theft.

Identify a path traversal vulnerability in the profile image endpoint, test with Burp and dot-dot-slash payloads, and assess the impact of anonymous access exposing server files.

Demonstrate how a directory traversal can read arbitrary files, enumerate /proc to reveal environment variables and command lines, and uncover sensitive credentials from a running Linux process.

Demonstrates testing for XML external entity (XXE) flaws in a file upload by using a doctype payload to read server files like /etc/passwd, with mitigations to disable DTD processing.

An SSRF vulnerability enables the server to fetch a crafted image URL, potentially exposing internal store API data via the profile image update flow.

Demonstrates how an ssrf endpoint can write arbitrary files via a crafted username, enabling stored xss by overwriting server files with a malicious script.

Explore command injection in admin API, discover a cmd parameter that enables remote code execution, and learn to fuzz inputs with burp intruder and faf to identify vulnerabilities.

Identify seven injection vulnerabilities, including SQL injection, cross-site scripting, path traversal, XML external entity, server side request forgery, and command injection. Then move on to authentication, authorization, and session management.

Explore how authentication verifies user identity, exchanges credentials for a user session and cookie, and how testing authentication flows reveals vulnerabilities that could allow privilege escalation, impersonation, or unauthorized access.

Demonstrates authentication bypass testing by removing cookies to verify API endpoints enforce login, revealing unauthenticated access to funds and user profile data, a high risk for confidentiality.

During transaction creation, the autocomplete uses the /api/search/find user endpoint to enumerate emails by an empty term, revealing user data, with low to medium risk.

Identify an insecure password update vulnerability in authentication, showing how omitting the old password allows password changes and enables CSRF and XSS exploits.

Exposes a weak password policy in user registration, with client-side validation and passwords stored in clear text; recommends reporting to clients and enforcing server-side checks, longer passwords, and password managers.

highlights the lack of multi-factor authentication in a banking application, explains multi-factor authentication concepts, and stresses defense in depth to improve security.

The lecture reviews six authentication vulnerabilities, including bypass via endpoints, user enumeration through email lists, stored XSS using emails, insecure password updates, weak password policy, and lack of multi-factor authentication.

Explore authorization, including roles, permissions, and access control logic, and identify vertical and horizontal privilege escalation that enable unauthorized data or functionality access in web apps.

Identify insecure direct object reference (idor) as an authorization flaw by altering user identifiers in funds and profile image endpoints to access other users' data, using Burp Suite.

Idor vulnerabilities that enumerate transaction ids and read other users' data through endpoints like transaction details and store history, exploiting a session cookie that reveals the user's email.

Demonstrates horizontal privilege escalation by manipulating the sender ID and session cookie to trigger transactions and purchases on behalf of other users, exposing critical API design flaws.

explore vertical privilege escalation by exploiting an admin register endpoint and session cookie manipulation to access admin functions, highlighting client-side cookie manipulation and insecure password update risks.

Identify a vertical privilege escalation vulnerability via mass assignment in the API registration, where setting a user right value during signup grants admin access and cookie privileges.

Explain how authorization defines what a user may do after authentication, including idrs and cookie-based access. Highlight horizontal and vertical escalations enabling actions on behalf of others and admin access.

Maintain a user’s authenticated state across http requests with session cookies. Link this to authentication and authorization, and note that cookie handling vulnerabilities can cause impersonation and privilege escalation.

Analyze insecure session cookies with a structure exposing a base64 email and user rights, enabling tampering and bypass of access checks. Implement pseudo random IDs and integrity protection.

Explore how missing security attributes on session cookies, including http only, secure, and same-site, expose web apps to session hijacking, man-in-the-middle attacks, and cross-site request forgery, with practical testing insights.

Analyze improper logout by showing that a session cookie remains valid after logout, risking session hijacking and exposing purchase history. Classify this low risk and discuss its client implications.

Examine cross-site request forgery on the password update endpoint, showing how missing anti-forgery measures and not properly configured same-site cookies enable credential theft and account compromise.

Test session fixation by logging in with an existing cookie to see if the app regenerates a session ID; the vulnerability is hard to exploit and usually low risk.

Explore missing anti-automation controls that allow brute-forcing the login; the lecture demonstrates Burp Intruder setup, payloads, resource pools, and risks of weak automation defenses.

Test concurrent sessions by logging into the same account from multiple browsers to verify whether the application allows simultaneous logins, and document evidence with screenshots for low-risk reporting.

Explore json web tokens (jwt) as a session management mechanism, including header, payload, and signature structure, bearer authorization, and common integrity attacks.

Explore how an unverified JWT allows a user to become admin by tampering the token payload: decode, modify the payload, re-encode, and refresh to access admin data.

Showcase a none algorithm jwt attack by changing the header to none and removing the signature to bypass authorization in a flask app on port 1234, tested with burp suite.

Explore how a weak signing key enables tampered jwt tokens, showing offline brute-force cracking of hmac sha-256, payload tampering to gain admin access.

Showcases a JWT algorithm confusion attack in a docker lab, exploiting RSA 256 and HS256 by using a public key as a symmetric key, with mitigations.

Explore session management and cookies in web apps, focusing on integrity, http only, secure, same-site attributes, cross-site request forgery, logout issues, and session fixation testing.

Learn how business logic vulnerabilities arise from banking and e-commerce contexts, and how domain constraints and improper implementations can bypass security rules beyond technical flaws.

Uncovers a business logic vulnerability in a store buy API where the client-supplied price enables infinite money by manipulating zero or negative prices, compromising balance integrity.

Examine race conditions in store purchases, showing how parallel requests can bypass balance checks and allow multiple items to be bought without proper atomicity.

Validate user input with security checks and constraints to filter invalid data, prevent injection and business logic vulnerabilities, and prefer allow lists over deny lists.

Examine the malicious file upload vulnerability by testing the upload endpoint, antivirus/EDR checks, path traversal, and how uploads are saved to disk.

Explore how arbitrary file upload introduces risk through file metadata, content type, and path traversal, enabling extension manipulation and potential script execution in PHP environments.

Analyze how insecure file uploads allow arbitrary file write locations, enabling stored cross-site scripting and asset tampering by overwriting server assets such as main.js, with critical risk.

Demonstrates how a return URL in a logout flow enables an open redirect via the location header, and emphasizes whitelist validation to restrict redirects to trusted domains.

Identify a regular expression denial of service vulnerability in user registration email validation, analyze attack payloads and complexity, and propose a fix with safer regex to prevent denial of service.

explain insecure deserialization in a web application, focusing on the admin store upload endpoint that deserializes untrusted data using Json.NET type name handling.