Checklist

Reconnaissance Phase ▼

Identify web server, technologies, and database Subsidiary and Acquisition Enumeration Reverse Lookup ASN & IP Space Enumeration and Service Enumeration Google Dorking GitHub Reconnaissance Directory Enumeration IP Range Enumeration JavaScript File Analysis Subdomain Enumeration and Bruteforcing Subdomain Takeover Parameter Fuzzing Port Scanning Template-Based Scanning (Nuclei) Wayback History Analysis Broken Link Hijacking Internet Search Engine Discovery Misconfigured Cloud Storage Detection

Registration Feature Testing ▼

Check for duplicate registration/Overwrite existing user Check for weak password policy Check for reuse of existing usernames Check for insufficient email verification process Weak registration implementation - Allows disposable email addresses Weak registration implementation - Over HTTP Overwrite default web application pages by specially crafted username registrations (e.g., Does your profile link appear as www.test.com/test?)

Session Management Testing ▼

Identify actual session cookie out of bulk cookies in the application Decode cookies using standard algorithms like Base64, hex, URL, etc. Modify session token value by 1 bit/byte and resubmit Test login with similar usernames (e.g., A, AA, AAA, etc.) Check for session cookie expiration date/time Identify cookie domain scope Check for HttpOnly flag in cookies Check for Secure flag if application is over SSL Check for session fixation (before & after authentication) Replay session cookie from a different system/IP Test concurrent login from different machines/IPs Check if user data is stored in cookies and tamper it Test session invalidation on Email Change & 2FA Activation

Authentication Testing ▼

Username enumeration Bypass authentication using SQL Injection on username and password fields

Lack of password confirmation on ▼

Change email address Change password Manage 2FA

Is it possible to use resources without authentication? Access violation Check if user credentials are transmitted over SSL or not Weak login function HTTP and HTTPS both are available

Test user account lockout mechanism on brute force attack ▼

Variation: If server blocks instant user requests, then try with time throttle option from intruder and repeat the process again.

Bypass rate limiting by tampering user agent to Mobile User agent Bypass rate limiting by tampering user agent to Anonymous user agent Bypass rate limiting by using null byte

Create a password wordlist using CEWL command

Test OAuth Login Functionality ▼

OAuth Roles ▼

Resource Owner → User Resource Server → Twitter Client Application → Twitterdeck.com Authorization Server → Twitter client_id → Twitterdeck ID client_secret → Secret Token response_type → Token type scope → Requested access level redirect_uri → URL after authorization state → CSRF protection grant_type → Grant type and token code → Authorization code access_token → API request token refresh_token → Renew access_token

Code Flaws ▼

Re-Using the code Code Predict/Bruteforce and Rate-limit Is the code for application X valid for application Y?

Redirect_uri Flaws ▼

URL isn't validated at all Subdomains allowed Host is validated, path isn't Weak Regexes Bruteforcing the URL encoded chars URI validation open redirect payloads

State Flaws ▼

Missing State parameter? (CSRF) Predictable State parameter? Is State parameter being verified?

Misc ▼

Is client_secret validated? Pre ATO using Facebook phone-number signup No email validation Pre ATO

Test 2FA Misconfiguration ▼

Response Manipulation Status Code Manipulation 2FA Code Leakage in Response 2FA Code Reusability Lack of Brute-Force Protection Missing 2FA Code Integrity Validation With null or 000000 Denial of Service by creating an account with victim's email Session authentication during 2FA activation Disabling 2FA by CSRF

My Account (Post Login) Testing ▼

Find parameter which uses active account user ID and try to tamper it. Create a list of features related to a user account (Email, Password, CSRF, etc.). Change email ID to an existing one and check validation. Check if new email confirmation is required after update. Open profile picture in a new tab and check for sensitive data (email/user ID, EXIF, etc.). Verify the account deletion option and confirm via forgot password feature. Attempt brute force attacks on email ID, account ID, or user ID parameters. Check if re-authentication is required for sensitive operations.

Forgot Password Testing ▼

Failure to invalidate session on logout and password reset. Check if forget password reset link/code is unique. Verify if reset link expires after a certain period. Try tampering user account identification parameter. Check for weak password policy. Ensure token is invalidated after use. Modify reset link parameters (date, time) to extend validity. Check if security questions are asked & enforce lockout policy. Try using only spaces in new and confirmed passwords. Verify if old password is displayed after reset. Request two password reset links & use an older one. Check if active session is destroyed upon password change. Ensure password reset token is not sent over HTTP. Send multiple password reset requests & observe token behavior.

Contact Us Form Testing ▼

Is CAPTCHA implemented to prevent email flooding attacks? Does it allow file uploads on the server? Test for Blind XSS vulnerabilities.

Product Purchase Testing ▼

Buy Now ▼

Tamper product ID to buy expensive items at a low price Modify product quantity in requests

Gift/Voucher ▼

Modify voucher count in request Attempt voucher reuse

Add/Delete Product from Cart ▼

Tamper user/cart ID

Address ▼

Modify shipping address using BurpSuite

Place Order ▼

Modify payment method in request parameters Tamper payment amount

Track Order ▼

Attempt to track other users' orders

Wish List ▼

Check if a user can manipulate another's wishlist

Post Product Purchase Testing ▼

Check if user A can cancel user B’s orders

Out of Band Testing ▼

Test ordering out-of-stock products

Banking Application Testing ▼

Billing Activity ▼

Check if user 'A' can view the account statement for user 'B' Check if user 'A' can register for monthly/weekly statements for user 'B'

Deposit/Loan/Linked/External Account Checking ▼

Check if user 'A' can view the deposit account summary of user 'B'

Tax Deduction Inquiry Testing ▼

Check if user 'A' can see the tax details of user 'B' via parameter tampering

Fixed Deposit Account Testing ▼

Check if user 'A' can open an FD on behalf of user 'B'

Stopping Payment ▼

Check if user 'A' can stop user 'B's payment using cheque number

Status Enquiry Testing ▼

Check if user 'A' can modify the status enquiry of user 'B'

Fund Transfer Testing ▼

Check if fund transfer amount can be manipulated Check if payee list of user 'B' can be modified by user 'A'

Schedule Transfer Testing ▼

Check if user 'A' can modify schedule transfer details of user 'B'

NEFT Transfer Testing ▼

Check if NEFT amount can be manipulated

Bill Payment Testing ▼

Check if user can register payee without approval Check if user 'A' can view pending payments of user 'B'

Open Redirection Testing ▼

Common Injection Parameters ▼

/{payload}
?next={payload}
?url={payload}
?target={payload}
?rurl={payload}
?dest={payload}
?destination={payload}
?redir={payload}
?redirect_uri={payload}
?redirect_url={payload}
?redirect={payload}
/redirect/{payload}
/cgi-bin/redirect.cgi?{payload}
/out/{payload}
/out?{payload}
?view={payload}
/login?to={payload}
?image_url={payload}
?go={payload}
?return={payload}
?returnTo={payload}
?return_to={payload}
?checkout_url={payload}
?continue={payload}
?return_path={payload}

Test Cases ▼

Use Burp 'Find' option to identify redirect-related parameters Check if URL parameters contain redirect values Change URL value to www.hemantsolo.in and check if redirection occurs Try single slash `/` and URL encoding Test using a whitelisted domain or keyword Bypass `http` blacklist using `//` Bypass `//` blacklist using `https:` Bypass `//` blacklist using `\\` Bypass `//` blacklist using `\/\/` Use null byte `%00` to bypass blacklist filter Use `°` symbol to bypass filters

Host Header Injection ▼

Supply an arbitrary Host header Check for flawed validation

Send Ambiguous Requests ▼

Inject duplicate Host headers Supply an absolute URL Add line wrapping

Inject Host Override Headers ▼

X-Forwarded-For: attacker.com X-Forwarded-Host: attacker.com X-Forwarded-Proto headers: attacker.com Host: attacker.com (duplicate this header) X-Host: attacker.com X-Forwarded-Server: attacker.com X-HTTP-Host-Override: attacker.com Forwarded: attacker.com

SQL Injection Testing ▼

Entry Point Detection ▼

Simple characters Multiple encoding Merging characters Logic Testing Weird characters

Use SQLmap to Identify Vulnerable Parameters ▼

Fill form in browser GUI & submit Find relevant request in BurpSuite Copy request to file Save as anyname.txt Run SQLmap command python sqlmap.py -r ~/Desktop/textsqli.txt --proxy=http://127.0.0.1:8080

Run SQL injection scanner on all requests

Bypassing WAF ▼

Using Null byte before SQL query Using SQL inline comment sequence URL encoding Changing Cases (uppercase/lowercase) Use SQLMAP tamper scripts

Time Delays ▼

Oracle: dbms_pipe.receive_message(('a'),10) Microsoft: WAITFOR DELAY '0:0:10' PostgreSQL: SELECT pg_sleep(10) MySQL: SELECT sleep(10)

Conditional Delays ▼

Oracle: SELECT CASE WHEN (YOUR-CONDITION-HERE) THEN 'a'||dbms_pipe.receive_message(('a'),10) ELSE NULL END FROM dual Microsoft: IF (YOUR-CONDITION-HERE) WAITFOR DELAY '0:0:10' PostgreSQL: SELECT CASE WHEN (YOUR-CONDITION-HERE) THEN pg_sleep(10) ELSE pg_sleep(0) END MySQL: SELECT IF(YOUR-CONDITION-HERE,sleep(10),'a')

Cross-Site Scripting (XSS) Testing ▼

Try XSS using QuickXSS tool by theinfosecguy Upload file using &quot;&gt;&lt;img src=x onerror=alert(document.domain)&gt;.txt If script tags are banned, use <h1> and other HTML tags If output is reflected inside JavaScript, use alert(1) If " are filtered, use this payload: &lt;img src=d onerror=confirm(/hemantsolo/)&gt; Upload a JavaScript using an image file Change request method from POST to GET to bypass filters

Tag Attribute Value ▼

Input landed: <input type="text" name="state" value="INPUT_FROM_USER"> Payload to be inserted: “ onfocus="alert(document.cookie)"

Syntax Encoding payload: “%3cscript%3ealert(document.cookie)%3c/script%3e"

XSS Filter Evasion ▼

Replace < and > with HTML entities < and > Use an XSS polyglot, e.g., javascript:/*-></title></style></textarea></script></xmp><svg/onload='+/"/+/onmouseover=1/+/[*/[]/+alert(1)//'>

XSS Firewall Bypass ▼

Check if the firewall blocks only lowercase Try to break the firewall regex with a new line (\r\n) Try Double Encoding Test for recursive filters Inject anchor tag without whitespaces Try to bypass whitespaces using Bullet Change request method

CSRF Testing ▼

Validation of CSRF token depends on request method Validation of CSRF token depends on token being present CSRF token is not tied to the user session CSRF token is tied to a non-session cookie Validation of Referer depends on header being present Remove Anti-CSRF token Change few bits of CSRF token Use same token Guessable token Converting POST to GET request to bypass CSRF token

SAML Vulnerabilities ▼

Signature Wrapping (XSW) Attacks SAML Message Integrity Abuse Missing / Invalid Signature SAML Message Replay Token Recipient Confusion

XML Injection Testing ▼

Change content type to text/xml and insert payload

    <?xml version="1.0" encoding="ISO 8859 1"?>
    <!DOCTYPE hemantsolo [
    <!ELEMENT hemantsolo ANY>
    <!ENTITY xxe SYSTEM "file:///etc/passwd" >]><hemantsolo>&xxe;</hemantsolo>
    <!ENTITY xxe SYSTEM "file:///etc/hosts" >]><hemantsolo>&xxe;</hemantsolo>
    <!ENTITY xxe SYSTEM "file:///proc/self/cmdline" >]><hemantsolo>&xxe;</hemantsolo>
    <!ENTITY xxe SYSTEM "file:///proc/version" >]><hemantsolo>&xxe;</hemantsolo>

Blind XXE with out-of-band interaction

Cross-Origin Resource Sharing (CORS) ▼

Errors parsing Origin headers Whitelisted null origin value

Server-side Request Forgery (SSRF) ▼

Common Injection Parameters ▼

"access=", 
"admin=", 
"dbg=", 
"debug=", 
"edit=", 
"grant=", 
"test=", 
"alter=", 
"clone=", 
"create=", 
"delete=", 
"disable=", 
"enable=", 
"exec=", 
"execute=", 
"load=", 
"make=", 
"modify=", 
"rename=", 
"reset=", 
"shell=", 
"toggle=", 
"adm=", 
"root=", 
"cfg=",
"dest=", 
"redirect=", 
"uri=", 
"path=", 
"continue=", 
"url=", 
"window=", 
"next=", 
"data=", 
"reference=", 
"site=", 
"html=", 
"val=", 
"validate=", 
"domain=", 
"callback=", 
"return=", 
"page=", 
"feed=", 
"host=", 
"port=", 
"to=", 
"out=",
"view=", 
"dir=", 
"show=", 
"navigation=", 
"open=",
"file=",
"document=",
"folder=",
"pg=",
"php_path=",
"style=",
"doc=",
"img=",
"filename="

Try basic localhost payloads

Bypassing Filters ▼

Bypass using HTTPS Bypass with [::] Bypass with a domain redirection Bypass using a decimal IP location Bypass using IPv6/IPv4 Address Embedding Bypass using malformed URLs Bypass using rare address (short-hand IP addresses by dropping the zeros) Bypass using enclosed alphanumerics

Cloud Instances ▼

AWS ▼

http://instance-data http://169.254.169.254 http://169.254.169.254/latest/user-data http://169.254.169.254/latest/meta-data/ http://169.254.169.254/latest/meta-data/iam/security-credentials/[ROLE NAME] http://169.254.169.254/latest/meta-data/ami-id

Google Cloud ▼

http://169.254.169.254/computeMetadata/v1/ http://metadata.google.internal/computeMetadata/v1/ http://metadata/computeMetadata/v1/ http://metadata.google.internal/computeMetadata/v1/instance/hostname http://metadata.google.internal/computeMetadata/v1/instance/id http://metadata.google.internal/computeMetadata/v1/project/project-id

Digital Ocean ▼

curl http://169.254.169.254/metadata/v1/id http://169.254.169.254/metadata/v1.json http://169.254.169.254/metadata/v1/ http://169.254.169.254/metadata/v1/hostname http://169.254.169.254/metadata/v1/region http://169.254.169.254/metadata/v1/interfaces/public/0/ipv6/address

Azure ▼

http://169.254.169.254/metadata/v1/maintenance http://169.254.169.254/metadata/instance?api-version=2017-04-02 http://169.254.169.254/metadata/instance/network/interface/0/ipv4/ipAddress/0/publicIpAddress?api-version=2017-04-02&format=text

Bypassing via open redirection

File Upload Testing ▼

Upload the malicious file to the archive upload functionality and observe how the application responds Upload a file and change its path to overwrite an existing system file Large File Denial of Service Metadata Leakage ImageMagick Library Attacks Pixel Flood Attack

Bypasses ▼

Null Byte (%00) Bypass Content-Type Bypass Magic Byte Bypass Client-Side Validation Bypass Blacklisted Extension Bypass Homographic Character Bypass

CAPTCHA Testing ▼

Missing Captcha Field Integrity Checks HTTP Verb Manipulation Content Type Conversion Reusable Captcha Check if captcha is retrievable with the absolute path (e.g., `www.example.com/internal/captcha/images/24.png`) Check for server-side validation by removing the captcha block using Firebug and submitting the request Check if image recognition can be done with OCR tools

JWT Token Testing ▼

Brute-forcing secret keys Signing a new token with the “none” algorithm Changing the signing algorithm of the token (for fuzzing purposes) Signing the asymmetrically-signed token to its symmetric algorithm match (when you have the original public key)

Websockets Testing ▼

Intercepting and modifying WebSocket messages Websockets MITM attempts Testing secret header websocket Content stealing in websockets Token authentication testing in websockets

GraphQL Vulnerabilities Testing ▼

Inconsistent Authorization Checks Missing Validation of Custom Scalars Failure to Appropriately Rate-limit Introspection Query Enabled/Disabled

WordPress Common Vulnerabilities ▼

XSPA in WordPress Bruteforce in wp-login.php Information disclosure WordPress username Backup file wp-config exposed Log files exposed Denial of Service via load-styles.php Denial of Service via load-scripts.php DDOS using xmlrpc.php

Denial of Service (DoS) ▼

Cookie bomb Pixel flood, using image with huge pixels Frame flood, using GIF with huge frames ReDoS (Regex DoS) CPDoS (Cache Poisoned Denial of Service)

Other Test Cases (All Categories) ▼

Check for security headers and at least ▼

X Frame Options X-XSS header HSTS header CSP header Referrer Policy Cache Control Public key pins

Testing for Role authorization ▼

Check if normal user can access the resources of high privileged users? Forced browsing Insecure direct object reference Parameter tampering to switch user account to high privileged user

Blind OS command injection ▼

using time delays by redirecting output with out-of-band interaction with out-of-band data exfiltration

Command injection on CSV export (Upload/Download) CSV Excel Macro Injection If you find phpinfo.php file, check for the configuration leakage and try to exploit any network vulnerability. Parameter Pollution Social Media Sharing Buttons

Broken Cryptography ▼

Cryptography Implementation Flaw Encrypted Information Compromised Weak Ciphers Used for Encryption

Web Services Testing ▼

Test for directory traversal Web services documentation disclosure Enumeration of services, data types, input types boundaries and limits