|
|
| (20 intermediate revisions by 7 users not shown) |
| Line 1: |
Line 1: |
| − | ==[[Web Application Penetration Testing |4. Web Application Penetration Testing ]]==
| + | {{Template:OWASP Testing Guide v4}} |
| | | | |
| − | [[Testing: Introduction and objectives|'''4.1 Introduction and objectives''']] <br>
| + | The following sections describe the 12 subcategories of the Web Application Penetration Testing Methodology: |
| | | | |
| − | [[Testing: Information Gathering|'''4.2 Information Gathering''']]<br> | + | [[Testing: Introduction and objectives|'''4.1 Introduction and Objectives''']] |
| | | | |
| − | [[Testing for Web Application Fingerprint|4.2.1 Testing Web Application Fingerprint]]<br> | + | [[Testing Information Gathering|'''4.2 Information Gathering ''']] |
| − | [[Testing for Application Discovery|4.2.2 Application Discovery]]<br>
| |
| − | [[Testing: Spidering and googling|4.2.3 Spidering and googling]] <br>
| |
| − | [[Testing for Error Code|4.2.4 Analysis of error code]] <br>
| |
| − | [[Testing for infrastructure configuration management|4.2.5 Infrastructure configuration management testing]]<br>
| |
| − | [[Testing for SSL-TLS|4.2.5.1 SSL/TLS Testing ]]<br>
| |
| − | [[Testing for DB Listener|4.2.5.2 DB Listener Testing ]]<br>
| |
| − | [[Testing for application configuration management|4.2.6 Application configuration management testing]] <br>
| |
| − | [[Testing for file extensions handling|4.2.6.1 File extensions handling ]]<br>
| |
| − | [[Testing for old_file|4.2.6.2 Old, backup and unreferenced files ]]<br>
| |
| | | | |
| − | [[Testing for business logic|'''4.3 Business logic testing''']] <br> | + | [[Testing for configuration management|'''4.3 Configuration and Deployment Management Testing ''']] |
| | | | |
| − | [[Testing for authentication|'''4.4 Authentication Testing''']] <br> | + | [[Testing Identity Management|'''4.4 Identity Management Testing''']] |
| − | [[Testing for Default or Guessable User Account|4.4.1 Default or guessable (dictionary) user account]]<br>
| |
| − | [[Testing for Brute Force|4.4.2 Brute Force]]<br>
| |
| − | [[Testing for Bypassing Authentication Schema|4.4.3 Bypassing authentication schema]]<br>
| |
| − | [[Testing for Directory Traversal|4.4.4 Directory traversal/file include]] <br>
| |
| − | [[Testing for Vulnerable Remember Password and Pwd Reset|4.4.5 Vulnerable remember password and pwd reset]]<br>
| |
| − | [[Testing for Logout and Browser Cache Management|4.4.6 Logout and Browser Cache Management Testing]]<br>
| |
| | | | |
| − | [[Testing for Session Management|'''4.5 Session Management Testing''']] <br> | + | [[Testing for authentication|'''4.5 Authentication Testing ''']] |
| − | [[Testing for Session_Management_Schema|4.5.1 Analysis of the Session Management Schema]] <br>
| |
| − | [[Testing for Cookie and Session Token Manipulation|4.5.2 Cookie and Session Token Manipulation]]<br>
| |
| − | [[Testing for Exposed Session Variables|4.5.3 Exposed Session Variables ]]<br>
| |
| − | [[Testing for Session Riding|4.5.4 Session Riding ]]<br>
| |
| − | [[Testing for HTTP Exploit|4.5.5 HTTP Exploit ]]<br>
| |
| | | | |
| − | [[Testing for Data Validation|'''4.6 Data Validation Testing''']] <br> | + | [[Testing for Authorization|'''4.6 Authorization Testing''']] |
| − | [[Testing for Cross site scripting|4.6.1 Cross Site Scripting]]<br>
| |
| − | [[Testing for HTTP Methods and XST|4.6.1.1 HTTP Methods and XST ]]<br>
| |
| − | [[Testing for SQL Injection|4.6.2 SQL Injection ]]<br>
| |
| − | [[Testing for Oracle|4.6.2.1 Oracle Testing ]]<br>
| |
| − | [[Testing for MySQL|4.6.2.2 MySQL Testing ]]<br>
| |
| − | [[Testing for SQL Server|4.6.2.3 SQL Server Testing ]]<br>
| |
| | | | |
| − | [[Testing for LDAP Injection|4.6.3 LDAP Injection]]<br> | + | [[Testing for Session Management|'''4.7 Session Management Testing''']] |
| − | [[Testing for ORM Injection|4.6.4 ORM Injection]]<br>
| |
| − | [[Testing for XML Injection|4.6.5 XML Injection]]<br>
| |
| − | [[Testing for SSI Injection|4.6.6 SSI Injection]]<br>
| |
| − | [[Testing for XPath Injection|4.6.7 XPath Injection]]<br>
| |
| − | [[Testing for IMAP/SMTP Injection|4.6.8 IMAP/SMTP Injection]]<br>
| |
| − | [[Testing for Code Injection|4.6.9 Code Injection]]<br>
| |
| − | [[Testing for OS Commanding|4.6.10 OS Commanding]]<br>
| |
| | | | |
| − | [[Testing for Buffer Overflow|4.6.11 Buffer overflow Testing ]]<br> | + | [[Testing for Input Validation|'''4.8 Input Validation Testing''']] |
| − | [[Testing for Heap Overflow|4.6.11.1 Heap overflow ]]<br>
| |
| − | [[Testing for Stack Overflow|4.6.11.2 Stack overflow ]]<br>
| |
| − | [[Testing for Format String|4.6.11.3 Format string ]]<br>
| |
| | | | |
| − | [[Testing for Incubated Vulnerability|4.6.12 Incubated vulnerability testing]] <br> | + | [[Error Handling|'''4.9 Error Handling''']] |
| | | | |
| − | [[Testing for Denial of Service|'''4.7 Denial of Service Testing''']] <br> | + | [[Cryptography|'''4.10 Cryptography''']] |
| − | [[Testing for DoS Locking Customer Accounts|4.7.1 Locking Customer Accounts]]<br>
| |
| − | [[Testing for DoS Buffer Overflows|4.7.2 Buffer Overflows]] <br>
| |
| − | [[Testing for DoS User Specified Object Allocation|4.7.3 User Specified Object Allocation]] <br>
| |
| − | [[Testing for User Input as a Loop Counter|4.7.4 User Input as a Loop Counter]] <br>
| |
| − | [[Testing for Writing User Provided Data to Disk|4.7.5 Writing User Provided Data to Disk]]<br>
| |
| − | [[Testing for DoS Failure to Release Resources|4.7.6 Failure to Release Resources]] <br>
| |
| − | [[Testing for Storing too Much Data in Session|4.7.7 Storing too Much Data in Session]]<br>
| |
| | | | |
| − | [[Testing for Web Services|'''4.8 Web Services Testing''']] <br> | + | [[Testing for business logic|'''4.11 Business Logic Testing ''']] |
| − | [[Testing for XML Structural|4.8.1 XML Structural Testing ]]<br>
| |
| − | [[Testing for XML Content-Level|4.8.2 XML Content-level Testing ]]<br>
| |
| − | [[Testing for WS HTTP GET parameters/REST attacks|4.8.3 HTTP GET parameters/REST Testing ]]<br>
| |
| − | [[Testing for Naughty SOAP Attachments|4.8.4 Naughty SOAP attachments ]]<br>
| |
| − | [[Testing for WS Replay|4.8.5 Replay Testing ]]<br>
| |
| | | | |
| − | [[Testing_for_AJAX:_introduction|'''4.9 AJAX Testing''']] <br> | + | [[Client Side Testing|'''4.12 Client Side Testing''']] |
| − | [[Testing for AJAX Vulnerabilities|4.9.1 AJAX Vulnerabilities ]]<br>
| |
| − | [[Testing for AJAX|4.9.2 How to test AJAX ]]<br>
| |
The following sections describe the 12 subcategories of the Web Application Penetration Testing Methodology:
