Server Side Penetration Testing

Broken Access Checklist

• Unprotected Admin Page (crawling admin pages hidden - viewed by sitemaps or robots.txt)

• Unprotected Admin Link in Java Script (checking the source code)

• Changing User Roles in Burp Suite Interception (changing authentication parameters (admin=true)

• x-Original-URL Check

• Manipulating User Roles(ID/GUID’s)

• Referrer based Access Control (changing the session ids — Admin access needed changing POST to POSTX & changing the request method)

• IDOR , Direct access to resources using the static URL

• Access based on Multi step (double verification changing normal user session & username)

• Location Based Access Control(same capture upgrade request & change normal user session & username)

---

Directory Bruteforce / Directory Traversal

• Simple case filesystem traversal (/etc/passwd)

• Absolute bypassing directory traversal process (filename-/etc/passwd)

• File traversal when the input is stripped (….//,,,,//,,,,/etc/passwd OR …./…./…./etc/passwd)

• Fuzzing path traversal (Encoded method) (..%252f..%252f..%252fetc/passwd)

• File traversal when the base folder is checked (/var/www/images../../../etc/passwd)

• File traversal using null bytes (../../etc/passwd%00.png) ( ” % ” is used to define null bytes)\

---

Password Bases Bruteforce

• Username enumeration (password is incorrect)

• Username enumeration (username or password is incorrect)

• Multiple entries in single parameters (JSON FORMAT)

• Account locking username enumeration as once correct credentials entered trigger resets

• Username enumeration (response time is checked)

• IP Block (x-Forwarded-For: {number} )

---

2-FA Bypass

• Simple 2fa bypass (the 2fa is not checked it only prompts can be bypassed by /home)

• 2FA broken logic (we can brute force via the request generated by hacker )

• Session will log out if we enter multiple wrong entries (build auto login by macros)

---

Server Side Request Forgery (SSRF)

• SSRF against local server (http://localhost/admin)
• SSRF against backend system (http://192.168.0.x/admin)
• SSRF with blacklisted filters (127.1 instead of localhost as some inputs are filtered)
• SSRF against whitelisted patterns (the api should only start with stock.webiste.com/admin)
• SSRF by replacing the path from which the connection is established

---

Blind SSRF

• Using burp collaborator client and replacing the referrer links to enumerate DNS and IP address

---

Command Injection (Execution of shell commands)

• Simple case use shell command in get requests

---

Blind Command Injection

• Check delay using ping requests

• Creating a file and getting details through it

• Enumerating DNS through nslookup commands

• Extrafiltration using single nslookup request (nslookup whoami {domain} )

---

SQL Injection Vulnerabilities

---

• Simple login bypass {using '-- as query ending, so doesn't check for the passwords}

• '+OR+1=1 for getting errors and successful retrieval of details that are not indexed on the website

• Check the database type by retrieval of database versions

• Listing the database contents such as Tables & related data

• Finding number of columns returned using ORDER BY query clause

• Finding the datatype using NULL payloads & number of columns

• Using UNION to ultrafiltrate data

• Trying to Retrieve multiple values into single column using || '~' ||