This room covers the methodology for exploring and understanding web applications through various techniques including source code analysis, developer tools, and network monitoring. Essential skills for web application security assessment.
Learn how to manually review a web application for security issues using only the in-built tools in your browser. More often than not, automated security tools and scripts will miss many potential vulnerabilities and useful information.
Browser Tools Covered:
As a penetration tester, your role when reviewing a website or web application is to discover features that could potentially be vulnerable and attempt to exploit them to assess whether or not they are. These features are usually parts of the website that require some interactivity with the user.
Finding interactive portions of the website can be as easy as spotting a login form to manually reviewing the website's JavaScript. An excellent place to start is just with your browser exploring the website and noting down the individual pages/areas/features with a summary for each one.
Example Site Review for Acme IT Support:
| Feature | URL | Summary |
|---|---|---|
| Home Page | / | This page contains a summary of what Acme IT Support does with a company photo of their staff. |
| Latest News | /news | This page contains a list of recently published news articles by the company, and each news article has a link with an id number, i.e. /news/article?id=1 |
| News Article | /news/article?id=1 | Displays the individual news article. Some articles seem to be blocked and reserved for premium customers only. |
| Contact Page | /contact | This page contains a form for customers to contact the company. It contains name, email and message input fields and a send button. |
| Customers | /customers | This link redirects to /customers/login. |
| Customer Login | /customers/login | This page contains a login form with username and password fields. |
| Customer Signup | /customers/signup | This page contains a user-signup form that consists of a username, email, password and password confirmation input fields. |
| Customer Reset Password | /customers/reset | Password reset form with an email address input field. |
| Customer Dashboard | /customers | This page contains a list of the user's tickets submitted to the IT support company and a "Create Ticket" button. |
| Create Ticket | /customers/ticket/new | This page contains a form with a textbox for entering the IT issue and a file upload option to create an IT support ticket. |
| Customer Account | /customers/account | This page allows the user to edit their username, email and password. |
| Customer Logout | /customers/logout | This link logs the user out of the customer area. |
The page source is the human-readable code returned to our browser/client from the web server each time we make a request.
The returned code is made up of HTML (HyperText Markup Language), CSS (Cascading Style Sheets) and JavaScript, and it's what tells our browser what content to display, how to show it and adds an element of interactivity with JavaScript.
For our purposes, viewing the page source can help us discover more information about the web application.
Comments in HTML start with . These are messages left by the website developer that don't get displayed on the actual webpage. Comments can contain useful information about the application.
Links to different pages in HTML are written in anchor tags (), and the link that you'll be directed to is stored in the href attribute.
Example: Comments may describe temporary pages or development status, providing insights into the application's current state.
Hidden Links: Look for hidden links starting with "secr" or similar patterns that may reveal private areas.
Directory Listing: Check for configuration errors that enable directory listing, which may expose backup files, source code, or confidential information.
Framework Detection: Look for comments about frameworks and versions. Outdated frameworks may have known vulnerabilities.
TryHackMe Answers:
Every modern browser includes developer tools; this is a tool kit used to aid web developers in debugging web applications and gives you a peek under the hood of a website to see what is going on. As a pentester, we can leverage these tools to provide us with a much better understanding of the web application.
The way to access developer tools is different for every browser. Common methods include F12, right-click → Inspect, or browser menu options.
The page source doesn't always represent what's shown on a webpage; this is because CSS, JavaScript and user interaction can change the content and style of the page, which means we need a way to view what's been displayed in the browser window at this exact time. Element inspector assists us with this by providing us with a live representation of what is currently on the website.
As well as viewing this live view, we can also edit and interact with the page elements, which is helpful for web developers to debug issues.
On the Acme IT Support website news section, the third article is blocked by a floating notice (paywall) stating you have to be a premium customer to view it.
Steps to Bypass:
If the element didn't have a display field, you could add your own style to hide it.
TryHackMe Answer:
This panel in the developer tools is intended for debugging JavaScript, and again is an excellent feature for web developers wanting to work out why something might not be working. But as penetration testers, it gives us the option of digging deep into the JavaScript code. In Firefox and Safari, this feature is called Debugger, but in Google Chrome, it's called Sources.
On the Acme IT Support website contact page, there's a rapid flash of red on the screen each time the page loads. We can use the Debugger to work out what this red flash is and if it contains anything interesting.
1. Locate JavaScript Files:
2. Handle Minified Code:
3. Set Breakpoints:
4. Analyze Execution:
TryHackMe Answer:
The network tab on the developer tools can be used to keep track of every external request a webpage makes. If you click on the Network tab and then refresh the page, you'll see all the files the page is requesting.
1. Monitor Network Activity:
2. Analyze Form Submissions:
3. Examine Network Requests:
TryHackMe Answer:
This room covers essential web application analysis skills for PT1 certification: