Lab 2: Perform Web Application Attacks

Module 14: Hacking Web Applications

Lab 2: Perform Web Application Attacks

Task 1: Perform a Brute-force Attack using Burp Suite

preform web application attacks

perform a brute-force attack using burp suite bruteforce

for this cenario go to http://10.10.10.16:8080/CEH/wp-login.php?

you will be at a login page

in firefox go to prefrences

scroll down press network settings

select manual proxy configuration

HTTP proxy: 127.0.0.1 port 8080

use this proxy server for all protocols checked

click ok

apps - pentesting - web app analysis - web app proxie - burpsuite

enter pass

temp project click next

use burp defaults click start burp

click proxy tab

make sure intercept is on is selected it should be

go back to browser

type admin and password press login then go back to burp suite

right click the giant white window in burp suite and select send to intruder

at the bottom it should say log=admin&pwd=password and other stuff if not click intercept is on and off and on and try again

with login

click on intruder tab

click positions tab

click the clear S button

select cluster bomb from the drop down menu where it says Attack type:

highlight the username and press the add$ and highlight password and press add$

this will be the user and admin you tryied to log in with earlier

go to payload tab

then click load

locate username.txt file for this one its /home/attacker/desktop/cehv11 modle 14 username.txt

select payload 2 drop down from payload set from 1 to 2

do same thing but add passwords.

top right click start attack

if this does not work go back and re try steps be sure you selected username and passwoord when doing the add$ button and

on cluster

wait for it to finish

In the Raw tab at the bottom, the HTTP request with a set of the correct credentials is displayed. (here, username=admin

and password=qwerty@123), as shown in the screenshot. Note down these user credentials.

note the raw admin and password shown at the bottom in this case was admin and qwerty@123

if nothing shows up in the bottom scroll down and look for a status code of 302 or something diff from the others

go back to intercept is on button and turn it off

Switch to the browser window and perform Steps 5-7. Remove the browser proxy set up in Step 8, by selecting the No proxy

radio-button in the Connection Settings window and click OK. Close the tab.

last few steps are pretty much you wrapping things up

done

---------------------------------------------------------------------------------------------------------------------------------------

Module 14: Hacking Web Applications

Lab 2: Perform Web Application Attacks

Task 2: Perform Parameter Tampering using Burp Suite

A web parameter tampering attack involves the manipulation of parameters exchanged between the client and server

to modify application data such as user credentials and permissions, price, and quantity of products.

Here, we will use the Burp Suite tool to perform parameter tampering.

refer to blog kinda long

---------------------------------------------------------------------------------------------------------------------------------------

Module 14: Hacking Web Applications

Lab 2: Perform Web Application Attacks

Task 3: Exploit Parameter Tampering and XSS Vulnerabilities in Web Applications

Parameter tampering is a simple form of attack aimed directly at an application’s business logic. A parameter tampering

attack exploits vulnerabilities in integrity and logic validation mechanisms that may result in XSS or SQL injection

exploitation.

XSS attacks exploit vulnerabilities in dynamically generated web pages, which enables malicious attackers to inject

client-side script into web pages viewed by other users. Attackers inject malicious JavaScript, VBScript, ActiveX, HTML,

or Flash code for execution on a victim’s system by hiding it within legitimate requests.

Although implementing a strict application security routine, parameters, and input validation can minimize parameter

tampering and XSS vulnerabilities, many websites and web applications are still vulnerable to these security threats.

Attacking web applications through parameter tampering and XSS vulnerabilities is one of the steps an attacker takes

in attempting to compromise a web application’s security. An expert ethical hacker and pen tester should be aware of

the different parameter tampering and XSS methods that can be employed by an attacker to hack web applications.

Here, we will learn how to exploit parameter tampering and XSS vulnerabilities in the target web application

refer to blog kinda long

---------------------------------------------------------------------------------------------------------------------------------------

Module 14: Hacking Web Applications

Lab 2: Perform Web Application Attacks

Task 4: Perform Cross-site Request Forgery (CSRF) Attack

CSRF, also known as a one-click attack, occurs when a hacker instructs a user’s web browser to send a request to the

vulnerable website through a malicious web page. Financial websites commonly contain CSRF vulnerabilities. Usually,

outside attackers cannot access corporate intranets, so CSRF is one of the methods used to enter these networks. The

inability of web applications to differentiate a request made using malicious code from a genuine request exposes

it to the CSRF attack. These attacks exploit web page vulnerabilities that allow an attacker to force an unsuspecting

user’s browser to send malicious requests that they did not intend.

CSRF attacks can be performed using various techniques and tools. Here, we will perform a CSRF attack using WPScan.

refer to blog kinda long

---------------------------------------------------------------------------------------------------------------------------------------

Module 14: Hacking Web Applications

Lab 2: Perform Web Application Attacks

Task 5: Enumerate and Hack a Web Application using WPScan and Metasploit

The Metasploit Framework is a penetration testing toolkit, exploit development platform, and research tool that

includes hundreds of working remote exploits for a variety of platforms. It helps pen testers to verify vulnerabilities

and manage security assessments.

In this task, we will perform multiple attacks on a vulnerable PHP website (WordPress) in an attempt to gain sensitive

information such as usernames and passwords. You will also learn how to use the WPScan tool to enumerate usernames on a

WordPress website, and how to crack passwords by performing a dictionary attack using an msf auxiliary module.

refer to blog kinda long

---------------------------------------------------------------------------------------------------------------------------------------

Module 14: Hacking Web Applications

Lab 2: Perform Web Application Attacks

Task 6: Exploit a Remote Command Execution Vulnerability to Compromise a Target Web Server

Damn Vulnerable Web App (DVWA) is a PHP/MySQL web application that is extremely vulnerable. The main objective of DVWA is

to aid security professionals in testing their skills and tools in a legal environment, to help web developers better

understand the processes of securing web applications, and to aid teachers and students in teaching and learning web

application security in a classroom environment.

In this task, we will perform command-line execution on a vulnerability found in DVWA. Here, you will learn how to extract

information about a target machine, create a user account, assign administrative privileges to the created account, and use

that account to log in to the target machine.

refer to blog kinda long

---------------------------------------------------------------------------------------------------------------------------------------

Module 14: Hacking Web Applications

Lab 2: Perform Web Application Attacks

Task 7: Exploit a File Upload Vulnerability at Different Security Levels

Metasploit Framework is a tool for developing and executing exploit code against a remote target machine. It is a

Ruby-based, modular penetration testing platform that enables you to write, test, and execute exploit code. It contains

a suite of tools that you can use to test security vulnerabilities, enumerate networks, execute attacks, and evade

detection. Meterpreter is a Metasploit attack payload that provides an interactive shell that can be used to explore

the target machine and execute code.

Here, we will use exploit a file upload vulnerability at different security levels of DVWA using Metasploit.

refer to blog super super long RIP long good luck on test long goodby 6 hours long

---------------------------------------------------------------------------------------------------------------------------------------

Module 14: Hacking Web Applications

Lab 2: Perform Web Application Attacks

Task 8: Gain Backdoor Access via a Web Shell using Weevely

Gaining backdoor access refers to entering a website in a stealthy way. These Backdoors are often installed via some

unvalidated uploads. This vulnerability allows you to upload harmful files to the target web server. Websites that are

developed using PHP are often susceptible to this kind of attack.

A professional ethical hacker or pen tester can use tools such as Weevely to gain backdoor access to a website without

being traced. Weevely is used to develop a backdoor shell and upload it to a target server in order to gain remote shell

access. This tool also helps in performing administrative tasks, maintaining persistence, and spreading backdoors across

the target network.

Here, we will gain backdoor access via a web shell using Weevely.

refer to blog little long

---------------------------------------------------------------------------------------------------------------------------------------

Lab Scenario

For an ethical hacker or pen tester, the next step after gathering required information about the target web application is to attack the web application. They must have the required knowledge to perform web application attacks to test the target network’s web application security infrastructure.

Attackers perform web application attacks with certain goals in mind. These goals may be either technical or non-technical. For example, attackers may breach the security of the web application and steal sensitive information for financial gain or for curiosity’s sake. To hack the web app, first, the attacker analyzes it to determine its vulnerable areas. Next, they attempt to reduce the “attack surface.” Even if the target web application only has a single vulnerability, attackers will try to compromise its security by launching an appropriate attack. They try various application-level attacks such as injection, XSS, broken authentication, broken access control, security misconfiguration, and insecure deserialization to compromise the security of web applications to commit fraud or steal sensitive information.

An ethical hacker or pen tester must test their company’s web application against various attacks and other vulnerabilities. They must find various ways to extend the security test and analyze web applications, for which they employ multiple testing techniques. This will help in predicting the effectiveness of additional security measures in strengthening and protecting web applications in the organization.

The tasks in this lab will assist in performing attacks on web applications using various techniques and tools.

Lab Objectives

Perform a brute-force attack using Burp Suite
Perform parameter tampering using Burp Suite
Exploit parameter tampering and XSS vulnerabilities in web applications
Perform cross-site request forgery (CSRF) attack
Enumerate and hack a web application using WPScan and Metasploit
Exploit a remote command execution vulnerability to compromise a target web server
Exploit a file upload vulnerability at different security levels
Gain backdoor access via a web shell using Weevely

Overview of Web Application Attacks

One maintains and accesses web applications through various levels that include custom web applications, third-party components, databases, web servers, OSes, networks, and security. All the mechanisms or services employed at each layer help the user in one way or another to access the web application securely. When talking about web applications, the organization considers security to be a critical component, because web applications are major sources of attacks. Attackers make use of vulnerabilities to exploit and gain unrestricted access to the application or the entire network. Attackers try various application-level attacks to compromise the security of web applications to commit fraud or steal sensitive information.

Task 1: Perform a Brute-force Attack using Burp Suite

Burp Suite is an integrated platform for performing security testing of web applications. It has various tools that work together to support the entire testing process from the initial mapping and analysis of an application’s attack surface to finding and exploiting security vulnerabilities. Burp Suite contains key components such as an intercepting proxy, application-aware spider, advanced web application scanner, intruder tool, repeater tool, and sequencer tool.

Here, we will perform a brute-force attack on the target website using Burp Suite.

In this task, the target WordPress website (http://10.10.10.16:8080/CEH) is hosted by the victim machine, Windows Server 2016. Keep this machine running until the end of the task. Here, the host machine is the Parrot Security machine.

Task 2: Perform Parameter Tampering using Burp Suite

A web parameter tampering attack involves the manipulation of parameters exchanged between the client and server to modify application data such as user credentials and permissions, price, and quantity of products.

Here, we will use the Burp Suite tool to perform parameter tampering.

In this task, the target website (www.moviescope.com) is hosted by the victim machine, Windows Server 2019. Here, the host machine is the Parrot Security machine.

Task 3: Exploit Parameter Tampering and XSS Vulnerabilities in Web Applications

Parameter tampering is a simple form of attack aimed directly at an application’s business logic. A parameter tampering attack exploits vulnerabilities in integrity and logic validation mechanisms that may result in XSS or SQL injection exploitation.

XSS attacks exploit vulnerabilities in dynamically generated web pages, which enables malicious attackers to inject client-side script into web pages viewed by other users. Attackers inject malicious JavaScript, VBScript, ActiveX, HTML, or Flash code for execution on a victim’s system by hiding it within legitimate requests.

Although implementing a strict application security routine, parameters, and input validation can minimize parameter tampering and XSS vulnerabilities, many websites and web applications are still vulnerable to these security threats.

Attacking web applications through parameter tampering and XSS vulnerabilities is one of the steps an attacker takes in attempting to compromise a web application’s security. An expert ethical hacker and pen tester should be aware of the different parameter tampering and XSS methods that can be employed by an attacker to hack web applications.

Here, we will learn how to exploit parameter tampering and XSS vulnerabilities in the target web application.

In this task, the target website (www.moviescope.com) is hosted by the victim machine Windows Server 2019. Here, the host machine is the Windows 10 machine.

Task 4: Perform Cross-site Request Forgery (CSRF) Attack

CSRF, also known as a one-click attack, occurs when a hacker instructs a user’s web browser to send a request to the vulnerable website through a malicious web page. Financial websites commonly contain CSRF vulnerabilities. Usually, outside attackers cannot access corporate intranets, so CSRF is one of the methods used to enter these networks. The inability of web applications to differentiate a request made using malicious code from a genuine request exposes it to the CSRF attack. These attacks exploit web page vulnerabilities that allow an attacker to force an unsuspecting user’s browser to send malicious requests that they did not intend.

CSRF attacks can be performed using various techniques and tools. Here, we will perform a CSRF attack using WPScan.

In this task, the target WordPress website (http://10.10.10.16:8080/CEH) is hosted by the victim machine Windows Server 2016. Here, the host machine is the Parrot Security machine.

Task 5: Enumerate and Hack a Web Application using WPScan and Metasploit

The Metasploit Framework is a penetration testing toolkit, exploit development platform, and research tool that includes hundreds of working remote exploits for a variety of platforms. It helps pen testers to verify vulnerabilities and manage security assessments.

In this task, we will perform multiple attacks on a vulnerable PHP website (WordPress) in an attempt to gain sensitive information such as usernames and passwords. You will also learn how to use the WPScan tool to enumerate usernames on a WordPress website, and how to crack passwords by performing a dictionary attack using an msf auxiliary module.

Task 6: Exploit a Remote Command Execution Vulnerability to Compromise a Target Web Server

Damn Vulnerable Web App (DVWA) is a PHP/MySQL web application that is extremely vulnerable. The main objective of DVWA is to aid security professionals in testing their skills and tools in a legal environment, to help web developers better understand the processes of securing web applications, and to aid teachers and students in teaching and learning web application security in a classroom environment.

In this task, we will perform command-line execution on a vulnerability found in DVWA. Here, you will learn how to extract information about a target machine, create a user account, assign administrative privileges to the created account, and use that account to log in to the target machine.

Task 7: Exploit a File Upload Vulnerability at Different Security Levels

Metasploit Framework is a tool for developing and executing exploit code against a remote target machine. It is a Ruby-based, modular penetration testing platform that enables you to write, test, and execute exploit code. It contains a suite of tools that you can use to test security vulnerabilities, enumerate networks, execute attacks, and evade detection. Meterpreter is a Metasploit attack payload that provides an interactive shell that can be used to explore the target machine and execute code.

Here, we will use exploit a file upload vulnerability at different security levels of DVWA using Metasploit.

Before starting this task, ensure that the WampServer is running on the Windows Server 2016 machine.

Task 8: Gain Backdoor Access via a Web Shell using Weevely

Gaining backdoor access refers to entering a website in a stealthy way. These Backdoors are often installed via some unvalidated uploads. This vulnerability allows you to upload harmful files to the target web server. Websites that are developed using PHP are often susceptible to this kind of attack.

A professional ethical hacker or pen tester can use tools such as Weevely to gain backdoor access to a website without being traced. Weevely is used to develop a backdoor shell and upload it to a target server in order to gain remote shell access. This tool also helps in performing administrative tasks, maintaining persistence, and spreading backdoors across the target network.

Here, we will gain backdoor access via a web shell using Weevely.