Friday, January 11, 2013

All Web Applications Attacking Methods


This list is not full list, if there are some attacks I missed, please comment below.


This list below fits in category Parameter manipulation

  • Arbitary File Deletion
  • Code Execution
  • Cookie Manipulation ( meta http-equiv & crlf injection )
  • CRLF Injection ( HTTP response splitting )
  • Cross Frame Scripting ( XFS )
  • Cross-Site Scripting ( XSS )
  • Directory traversal
  • Email Injection
  • File inclusion
  • Full path disclosure
  • LDAP Injection
  • PHP code injection
  • PHP curl_exec() url is controlled by user
  • PHP invalid data type error message
  • PHP preg_replace used on user input
  • PHP unserialize() used on user input
  • Remote XSL inclusion
  • Script source code disclosure
  • Server-Side Includes (SSI) Injection
  • SQL injection
  • URL redirection
  • XPath Injection vulnerability
  • EXIF

This list below fits in category MultiRequest parameter manipulation

  • Blind SQL injection (timing)
  • Blind SQL/XPath injection (many types)

This list below fits in category File checks
  • 8.3 DOS filename source code disclosure
  • Search for Backup files
  • Cross Site Scripting in URI
  • PHP super-globals-overwrite
  • Script errors ( such as the Microsoft IIS Cookie Variable Information Disclosure )

This list below fits in category Directory checks
  • Cross Site Scripting in path
  • Cross Site Scripting in Referer
  • Directory permissions ( mostly for IIS )
  • HTTP Verb Tampering ( HTTP Verb POST & HTTP Verb WVS )
  • Possible sensitive files
  • Possible sensitive files
  • ******* fixation ( j*******id & PHPSESSID ******* fixation )
  • Vulnerabilities ( e.g. Apache Tomcat Directory Traversal, ASP.NET error message etc )
  • WebDAV ( very vulnerable component of IIS servers )

This list below fits in category Text Search Disclosure
  • Application error message
  • Check for common files
  • Directory Listing
  • Email address found
  • Local path disclosure
  • Possible sensitive files
  • Microsoft Office possible sensitive information
  • Possible internal IP address disclosure
  • Possible server path disclosure ( Unix and Windows )
  • Possible username or password disclosure
  • Sensitive data not encrypted
  • Source code disclosure
  • Trojan shell ( r57,c99,crystal shell etc )
  • ( IF ANY )Wordpress database credentials disclosure

This list below fits in category File Uploads
  • Unrestricted File Upload

This list below fits in category Authentication
  • Microsoft IIS WebDAV Authentication Bypass
  • SQL injection in the authentication header
  • Weak Password
  • GHDB - Google hacking database ( using dorks to find what google crawlers have found like passwords etc )

This list below fits in category Web Services - Parameter manipulation & with multirequest
  • Application Error Message ( testing with empty, NULL, negative, big hex etc )
  • Code Execution
  • SQL Injection
  • XPath Injection
  • Blind SQL/XPath injection ( test for numeric,string,number inputs etc )
  • Stored Cross-Site Scripting ( XSS )
  • Cross-Site Request Forgery ( CSRF )

0 comments:

Post a Comment