Web Application Security Testing Checklist

Hello everyone, Welcome to my Blog!

Today I am going to share with you how I personally start security testing of any web application step by step to ensure that I do not miss any security vulnerability in web application. Although, if I forgot any vulnerability that should be listed here, please forgive me and let me know in the comment section, I will review it and definitely try to incorporate the same.

I will try to keep this list updated, however, it might take some time. In the meantime, please have a look at the web application security testing checklist and let us know in the comment section if I have missed any test cases or if I should add some specific test cases for any specific vulnerability.

Let’s Start…

Prabhat Hudda

Web Application Security Testing

I personally prefer to start with the Black-Box approach where I try to enumerate banners information, some basic or I can say network-level findings that can be found using any automated tool as well as manually such as:

1. Missing HTTP Security Header (using Burp)
2. Cacheable HTTP Responses (using Burp)
3. Web vendor/version disclosure (using Burp)
4. Track/Trace/Delete method enabled (using Burp)
5. Vulnerable components/Outdated framework (using RetireJS, Wappalyser)
6. Cookie not marked Secure/HttpOnly (using Burp)
7. SSL/TLSv1.0 (using TestSSL)
8. SSL/TLS supports weak ciphers (using TestSSL)
9. SSL weak hashing algorithm (using TestSSL)
10. Form/Field autocomplete ON (using Browser)
11. Hardcoded Sensitive information (using Browser)
12. Data replay attack (using Burp)
13. Misconfigured CORS (using Burp)
14. Host Header Injection (using Burp)
15. HTTP Verb Tampering (using Burp)
16. Open Redirection (using Burp)
17. Sensitive Data in Clear Text (using Burp)
18. Unencrypted Communication (using Browser)
19. Web application accessible via IP (using Browser)

Alright, Now I will proceed further step by step to have a look at every possible vulnerability. When I browse any application, the first thing I usually see in the application is a dashboard with all the information about the business and a login and register page. Hence let’s try to dig from the Homepage itself.

Login Page:

1. No Captcha Implemented
2. Username/Email enumeration via verbose failure messages
3. Mobile enumeration via verbose failure messages
4. Brute Force Possible/No account lockout policy
5. Remember me Functionality
6. No MFA
7. No, Forget Password Functionality
8. No Virtual Keyboard Supported
9. Password is not case sensitive while login

Registration Functionality:

1. Username enumeration via verbose failure messages
2. No confirmed password functionality
3. No mobile number verification process
4. No email verification process/No account verification process
5. Weak Security Question/Answer
6. No multi-factor authentication enables option
7. No term and condition checkbox during registration
8. Nonunique usernames/Predictable usernames
9. Lack of User Input Validation (Max Length not Implemented)

Password Functionality:

1. No password change functionality post login
2. No password history enforcement
3. Insufficient password complexity
4. Password Policy accepts any Special Characters
5. Unverified Password Change/No old password required for new password
6. Password change link reused/ does not expire
7. Old password link does not expire on new link generation
8. Password change token is tied with email id/username
9. Reset Password Email flooding
10. No minimum time interval between password changes
11. Wrong Redirection post password change
12. No logout button enabled on Dashboard
13. No Email on sensitive action

Authentication Bypass:

1. Forced Browsing
2. Parameter Modification
3. using response manipulation
4. using response replay attack
5. using OTP bypass/MFA bypass
6. leveraging OTP misconfiguration
7. Using session ID prediction
8. SQL Injection

Session Management:

1. Weak token generation/predictable token
2. Session fixation
3. Multiple Concurrent Sessions Allowed
4. No session invalidation after logout/SessionID can be used post logout
5. Session timeout not implemented
6. Improper Session Management on Password Change
7. Back Button Enabled

Authorization Flaw:

1. Authentication bypass via invalidation of credentials (Parameter modification)
2. Insecure access (without token/OTP/MFA)
3. Directory traversal
4. File inclusion
5. Privilege escalation
6. Insecure direct object reference (IDOR)
7. Forced browsing

Business logic flaw

1. Business constraint bypass
2. Business flow bypasses
3. Business control bypass

Sensitive data exposure

1. PCI data in clear text
2. Sensitive data submission in clear text
3. Password without hashing and salting
4. Clear text password in response
5. Clear text password stored in cookies
6. Sensitive data traveled via GET method
7. Cleat text storage of sensitive information in Database
8. Information disclosure
9. Internal IP disclosure

Injection:

1. SQL injection

• Error based
• Union-based
• Boolean based
• Time-based
• Out-of-band
• Second-order

1. Cross-site scripting (XSS)

• Reflected
• Stored
• DOM
• Blind

1. HTML injection
2. CSS injection
3. Link injection
4. Iframe injection
5. CSV/Formula injection
6. XML injection
7. XPath injection
8. LDAP injection
9. NoSQL Injection
10. Command injection
11. Server-side template injection
12. Host header injection

Other Vulnerabilities:

1. Cross-site request forgery
2. Server-side request forgery
3. File upload
4. XML external entity (XXE)
5. Insecure deserialization
6. HTTP Request smuggling/Desynchronization attack
7. HTTP Response splitting/CRLF injection
8. HTTP Parameter pollution
9. HTTP Verb tempering
10. Open redirection
11. Clickjacking
12. Misconfigured CORS
13. Misconfigured referer header
14. Data replay attack
15. Race condition
16. Web cache poisoning
17. Web cache deception

Cryptographic Failures:

1. Unencrypted HTTP communication
2. Self-signed Certificate
3. SSL/TLSv1.0
4. SSL/TLS supports weak ciphers
5. SSL weak hashing algorithm
6. TLS fallback is not supported

Other Security Misconfigurations:

1. OTP Flooding
2. HTTP basic authentication/HTML form-based authentication
3. No email/activity alert on sensitive action (account registration/change password)
4. Weak/default/predictable username
5. Weak/default/predictable password
6. HTTP security header missing
7. Cookie not marked Secure/HttpOnly
8. Cacheable HTTP response
9. Web vendor/version disclosure
10. Email spoofing
11. Vulnerable components/Outdated framework
12. Track/Trace/Delete method enabled
13. No privacy policy implemented
14. Robots.txt file exposure
15. Robots.txt file misconfigured
16. Admin module exposed publicly
17. No separate table for admin and normal user accounts
18. No super admin for multiple admin accounts
19. Database running with root privileges
20. Backup file found on the server
21. Hidden/Sensitive/Default files found
22. Upload module on public page
23. Server time misconfigured
24. Insufficient logging and monitoring

Server-side Vulnerabilities are as below:

1. SQLi
2. Authentication
3. Business logic Vulnerabilities
4. Access Control
5. Server-side Request Forgery
6. XXE Injection
7. Directory Traversal
8. Command Injection
9. Information Disclosure

Client-side Vulnerabilities are as below:

1. XSS
2. CSRF
3. CORS
4. Clickjacking
5. DOM Based Vulnerabilities
6. Web Sockets

URL-based vulnerabilities:

1. SQL Injection

• Error based
• Union based
• Time-based

1. XSS

• Reflected
• DOM

1. XXE
2. File Inclusion

• LFI
• RFI

1. Directory Traversal
2. IDOR
3. Privilege Escalation

• Horizontal
• Vertical

1. OS Command Injection
2. SSRF
3. Parameter pollution
4. Response Splitting/CRLF

Form-based vulnerability

1. SQL Injection
2. XSS

• Reflection
• Stored
• DOM
• Blind

1. Other Injection

• HTML
• CSS
• iFrame
• Formula
• Command
• SSTI

1. XXE
2. CSRF
3. File Upload
4. Clickjacking

Header based vulnerability

1. Host header injection
2. Request Smuggling
3. Misconfigured CORS
4. Verb Tampering
5. Misconfigured referer header
6. Web cache Poisoning
7. Web cache deception
8. Data replay attack
9. Missing Security Header
10. Cookie Issues
11. Web Vendor/version disclosure
12. Cacheable response

Wrapping Up

Please note that this checklist is not assuring all the vulnerabilities present in the web application. Vulnerabilities may rely on business requirements and exposure. Hence, some vulnerabilities can be invalid as per the business requirements or as per the design.

Thank you