Sanjib Sinha

Bug Bounty Hunting for Web Security

Find and Exploit Vulnerabilities in Web sites and Applications

Sanjib Sinha
Howrah, West Bengal, India
ISBN 978-1-4842-5390-8e-ISBN 978-1-4842-5391-5
https://doi.org/10.1007/978-1-4842-5391-5
© Sanjib Sinha 2019
Standard Apress
Trademarked names, logos, and images may appear in this book. Rather than use a trademark symbol with every occurrence of a trademarked name, logo, or image we use the names, logos, and images only in an editorial fashion and to the benefit of the trademark owner, with no intention of infringement of the trademark. The use in this publication of trade names, trademarks, service marks, and similar terms, even if they are not identified as such, is not to be taken as an expression of opinion as to whether or not they are subject to proprietary rights.
While the advice and information in this book are believed to be true and accurate at the date of publication, neither the authors nor the editors nor the publisher can accept any legal responsibility for any errors or omissions that may be made. The publisher makes no warranty, express or implied, with respect to the material contained herein.
Distributed to the book trade worldwide by Springer Science+Business Media New York, 233 Spring Street, 6th Floor, New York, NY 10013. Phone 1-800-SPRINGER, fax (201) 348-4505, e-mail [email protected], or visit www.springeronline.com. Apress Media, LLC is a California LLC and the sole member (owner) is Springer Science + Business Media Finance Inc (SSBM Finance Inc). SSBM Finance Inc is a Delaware corporation.

To Kartick Paul, Ex-System Manager, AAJKAAL, Software Developer and enthusiast who has made my dream come true.

It is an essentially humble effort on my behalf to show that I am overwhelmed with gratitude for your help.

Introduction

In this book you will learn about implementing an offensive approach toward security bug hunting by finding vulnerabilities in web applications. You will also take a look at the type of tools necessary to build up this particular approach. You will learn how to use hacking tools like Burp Suite , OWASP ZAP , SQlMAP , and DirBuster and you will also get an introduction to Kali Linux. After taking a close look at the types of tools at your disposal, you will set up your virtual lab.

You will then learn how Request Forgery Injection works on web pages and applications in a mission critical setup. Moving on to the most challenging task for any web application developer, or a Penetration tester, you will take a look at how Cross-site Scripting works and learn effective ways to exploit it.

You will then learn how header injection and URL redirection work, along with key tips to find vulnerabilities in them. Keeping in mind how attackers can compromise your web site, you will learn to work with malicious files and automate your approach to defend against these attacks. You will be provided with tips to find and exploit vulnerabilities in the Sender Policy Framework (SPF). Following this, you will get to know how Unintended XML Injection and Command Injection work to keep attackers at bay. In conclusion, you will take a look at different attack vectors used to exploit HTML and SQL injection. Overall, this book will guide you to become a better Penetration tester, and at the same time it will teach you how to earn bounty by hunting bugs in web applications.

Essentially, you will learn how to

  • Implementan offensive approach to Bug Hunting

  • Create and manage Request Forgery on web pages

  • Poison Sender Policy Framework and exploit it

  • Defend against Cross Site Scripting (XSS) attacks

  • Inject Header and test URL redirection

  • Work with malicious files and Command Injection

  • Resist strongly unintended XML attacks and HTML, SQL injection

  • Earn Bounty by hunting bugs in web applications

In addition:

  • As a beginner, you will learn penetration testing from scratch.

  • You will gain a complete knowledge of web security.

  • Learning to find vulnerabilities in web applications will help you become a better Penetration tester.

  • You will get acquainted with two of the most powerful security tools of penetration testing: Burp Suite and OWASP ZAP.

Acknowledgments

I wish to record my gratitude to my wife, Kaberi, for her unstinting support and encouragement in the preparation of this book.

I am extremely grateful to Mr. Matthew Moodie, Lead Development Editor, for his numerous valuable suggestions, complementary opinions and thorough thumbing; Nikhil Karkal, Editor and Divya Modi, Coordinating Editor, and the whole Apress team for their persistent support and help.

In the preparation of this book, I have had to consult numerous open source documentation and textbooks on a variety of subjects related to web security research; I thank the countless authors and writers who have written them.

Table of Contents

Chapter 1:​ Introduction to Hunting Bugs 1
Bug Bounty Platforms 3
Introducing Burp Suite, OWASP ZAP, and WebGoat 5
Chapter 2:​ Setting Up Your Environment 7
Why We Need a Virtual Environment 8
Introduction to Kali Linux—the Hacker’s Operating System 10
Tools in Kali Linux 16
Burp Suite and OWASP ZAP 18
How to Start OWASP ZAP 21
Hack the WebGoat 23
Adding a Proxy to a Browser 26
Introducing Other Tools 31
Chapter 3:​ How to Inject Request Forgery 37
What Is Cross-Site Request Forgery?​ 37
Mission Critical Injection of CSRF 39
Other CSRF Attacks 45
How to Discover CSRF on Any Application 46
Chapter 4:​ How to Exploit Through Cross-Site Scripting (XSS) 57
What Is XSS?​ 58
Discovering XSS Vulnerabilities 60
Exploiting XSS Vulnerabilities 71
Chapter 5:​ Header Injection and URL Redirection 79
Introducing Header Injection and URL Redirection 79
Cross-Site Scripting Through Header Injection 82
Discovering Header Injection and URL Redirection Vulnerabilities 88
Chapter 6:​ Malicious Files 97
Uploading Malicious Files to Own a System 98
Owning a Web Site 107
Traditional Defacement 112
Chapter 7:​ Poisoning Sender Policy Framework 115
Testing SPF Records 116
Examining the Vulnerabilities of SPF 118
Chapter 8:​ Injecting Unintended XML 123
What Is XML?​ 124
What is a DTD?​ 125
What Is XML External Entity Injection?​ 126
Performing XML Injection in a Virtual Lab 127
Fetching System Configuration Files 134
Chapter 9:​ Finding Command Injection Vulnerabilities 147
Discovering OS Command Injection 148
Injecting and Exploiting Malicious Commands 153
Setting the Payload Position in Intruder 159
Chapter 10:​ Finding HTML and SQL Injection Vulnerabilities 167
What Is HTML Injection?​ 167
Finding HTML Injection Vulnerabilities 168
Exploiting HTML Injection 176
Preventing HTML Injection 181
What Is SQL Injection?​ 182
Bypassing Authentication by SQL Injection 183
Discovering the Database 190
Appendix:​ Further Reading and What’s Next 197
Tools that Can Be Used Alongside Burp Suite 197
How Source Code Disclosure Helps Information Gathering 216
What Could Be the Next Challenges to Hunting Bugs?​ 218
Index 221

About the Author

Sanjib Sinha
../images/484370_1_En_BookFrontmatter_Figb_HTML.jpg

is an author, and tech writer. Being a certified .NET Windows and Web developer, he has specialized in Python security programming, Linux, and many programming languages that include C#, PHP, Python, Dart, Java, and JavaScript. Sanjib has also won Microsoft’s Community Contributor Award in 2011, and he has written “Beginning Ethical Hacking with Python,” “Beginning Ethical Hacking with Kali Linux,” and “Beginning Laravel 5.8 (First and Second Edition)” for Apress.

 

About the Technical Reviewer

Prajal Kulkarni
../images/484370_1_En_BookFrontmatter_Figc_HTML.jpg

is a security researcher currently working with Flipkart. He has been an active member of the Null security community for the past 3 Years. His areas of interest include web, mobile, and system security. He writes a security blog at www.prajalkulkarni.com and he is also the lead contributor at project Code Vigilant ( https://codevigilant.com/ ). Code-Vigilant has disclosed 200+ vulnerabilities in various WordPress plugins and themes. In the past, he has disclosed several vulnerabilities in the core components of GLPI, BugGenie, ownCloud, etc. Prajal has also reported many security vulnerabilities to companies like Adobe, Twitter, Facebook, Google, and Mozilla. He has spoken at multiple security conferences and provided training at NullCon2015, NullCon2016, NullCon2018, Confidence 2014, Grace Hopper 2014, etc.

 
..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
52.15.135.63