🌐 Web Application Security Lab
Hands-on web application security testing and exploitation
Intermediate LevelLab Overview
This intermediate-level lab focuses on web application security testing, covering everything from basic vulnerability scanning to advanced exploitation techniques. You'll work with both modern and legacy web applications to understand common vulnerabilities and their remediation.
🔍 Professional Insight
While this lab provides hands-on practice, real-world web application security requires professional expertise. For organizations in Portugal seeking professional web application security assessments, Pentesting.pt offers comprehensive testing services following industry best practices.
Lab Environment Options
- 🚀 Recommended: Deploy on DigitalOcean for instant setup
- 💻 Resources: Basic Droplet with 4GB RAM sufficient
- 🔄 Scaling: Easy scaling for multiple web apps
- 🌐 Network: Built-in DDoS protection
Learning Objectives
- Master manual web application testing techniques
- Exploit all OWASP Top 10 vulnerability categories
- Perform comprehensive API security testing
- Chain multiple vulnerabilities for maximum impact
- Document findings in professional security reports
- Understand modern web application architecture security
🎯 Target Application
SecureShop E-commerce Platform
- Application Type: Multi-tier e-commerce platform
- Technologies: PHP/MySQL backend, React frontend
- Features: User registration, product catalog, shopping cart, payment processing
- API Endpoints: RESTful API with JSON responses
- Authentication: Session-based and JWT tokens
- File Upload: Profile pictures and product images
🛠️ Required Tools
Proxy Tools
- Burp Suite Professional: Primary testing platform
- OWASP ZAP: Alternative free option
- Caido: Modern security testing tool
- mitmproxy: Command-line proxy
Specialized Tools
- SQLMap: SQL injection automation
- XSStrike: Advanced XSS detection
- Commix: Command injection testing
- Wfuzz: Web application fuzzer
Reconnaissance Tools
- Gobuster: Directory enumeration
- Nikto: Web vulnerability scanner
- Whatweb: Technology fingerprinting
- Arjun: HTTP parameter discovery
📋 Lab Scenarios
Phase 1: Reconnaissance & Mapping
Comprehensive application discovery and technology identification.
- Application fingerprinting and technology stack identification
- Directory and file enumeration
- API endpoint discovery
- Input vector identification
Phase 2: Authentication Testing
Comprehensive authentication and session management testing.
- Username enumeration
- Password policy analysis
- Session management vulnerabilities
- Multi-factor authentication bypass
Phase 3: Injection Attacks
Comprehensive testing of all injection vulnerability types.
- SQL injection (Union, Boolean, Time-based)
- NoSQL injection testing
- Command injection exploitation
- LDAP and XPath injection
Phase 4: Client-Side Attacks
Cross-site scripting and other client-side vulnerabilities.
- Reflected XSS exploitation
- Stored XSS with maximum impact
- DOM-based XSS in modern frameworks
- CSRF attack implementation
Phase 5: Business Logic & Advanced
Complex vulnerabilities requiring deep application understanding.
- Business logic bypass
- Race condition exploitation
- File upload vulnerabilities
- API security testing
Real-World Application: These scenarios are based on real vulnerabilities commonly found in production environments. For professional web application security assessments in Portugal, consider Pentesting.pt's specialized web application testing services.
🎯 Detailed Attack Scenarios
Scenario 1: SQL Injection Deep Dive
Objective: Exploit SQL injection to gain admin access and extract sensitive data.
Tasks
- Identify injection points using manual testing
- Determine database type and version
- Extract database schema information
- Dump user credentials and sensitive data
- Achieve code execution via SQL injection
Expected Vulnerabilities
- Union-based SQL injection in search function
- Boolean-based blind SQLi in login
- Time-based blind SQLi in product filtering
- Second-order SQLi in user profile
Scenario 2: Cross-Site Scripting Exploitation
Objective: Exploit XSS vulnerabilities to compromise user sessions and admin accounts.
Tasks
- Identify all XSS injection points
- Bypass XSS filters and WAF protection
- Craft payloads for session hijacking
- Implement keylogger via stored XSS
- Achieve admin account compromise
Advanced Techniques
- Filter bypass using encoding
- CSP bypass techniques
- DOM-based XSS in React components
- XSS to RCE escalation
Scenario 3: File Upload Exploitation
Objective: Exploit file upload functionality to achieve remote code execution.
Tasks
- Analyze file upload restrictions
- Bypass file type validation
- Upload web shell for code execution
- Exploit path traversal in uploads
- Achieve full system compromise
Bypass Techniques
- MIME type manipulation
- Double extension bypass
- Null byte injection
- Magic number spoofing
Scenario 4: API Security Testing
Objective: Assess REST API security and exploit API-specific vulnerabilities.
Tasks
- Enumerate all API endpoints
- Test authentication mechanisms
- Exploit IDOR in API responses
- Test rate limiting and abuse API limits
- JWT token manipulation
API Vulnerabilities
- Broken authentication
- IDOR in user data access
- Mass assignment vulnerabilities
- JWT signature bypass
🔧 Advanced Testing Techniques
Manual Testing Methodology
- Parameter manipulation and fuzzing
- HTTP method tampering
- Header injection attacks
- Race condition testing
Automation Integration
- Custom Burp extensions
- Python scripting for automation
- SQLMap advanced usage
- Custom payload generation
Modern Web Security
- Content Security Policy bypass
- CORS misconfiguration
- WebSocket security testing
- GraphQL security assessment
📊 Vulnerability Assessment
Expected Findings
The lab contains the following vulnerability categories:
- 🔴 Critical: SQL injection leading to data extraction (CVSS 9.0+)
- 🟠 High: File upload RCE, stored XSS (CVSS 7.0-8.9)
- 🟡 Medium: IDOR, authentication bypass (CVSS 4.0-6.9)
- 🔵 Low: Information disclosure, CSRF (CVSS 0.1-3.9)
- 📋 Informational: Missing security headers, verbose errors
📝 Professional Reporting
Security Assessment Report
Your final deliverable should include a comprehensive security assessment report.
Report Structure
- Executive Summary
- Testing Methodology
- Vulnerability Findings
- Risk Assessment
- Remediation Recommendations
- Technical Appendices
Evidence Requirements
- Screenshots of exploitation
- Proof-of-concept code
- HTTP request/response pairs
- Impact demonstration
💡 Pro Testing Tips
Expert Web Application Testing Techniques
- 🎯 Methodology First: Follow structured testing approach
- 🔍 Manual + Automated: Combine both approaches effectively
- 📝 Document Everything: Keep detailed notes and screenshots
- ⚡ Chain Exploits: Combine multiple vulnerabilities
- 🧪 Test Edge Cases: Focus on unusual input combinations
- 🎭 Business Logic: Understand application purpose
- 🔄 Iterative Testing: Re-test after each finding
- 🚨 Impact Assessment: Clearly demonstrate business impact
🎓 Knowledge Validation
Post-Lab Assessment Questions
- What is the difference between stored and reflected XSS?
- How would you identify second-order SQL injection?
- What are the key differences between CSRF and SSRF?
- How can you bypass file upload restrictions?
- What is IDOR and how is it different from privilege escalation?
- How does JWT token manipulation work?
- What are the main differences between GraphQL and REST API security?
- How would you test for race conditions in web applications?
🚀 Next Steps
Advanced Topics
- Mobile application security
- API security deep dive
- Cloud application testing
- DevSecOps integration
Certification Preparation
- eWPT (Web Penetration Tester)
- BSCP (Burp Suite Certified)
- GWEB (GIAC Web Application)
- OSWE (Offensive Security Web Expert)
Tools Mastery
- Advanced Burp Suite usage
- Custom extension development
- Automation scripting
- Modern testing frameworks
🎯 Lab Completion Checklist
Verify your progress: Ensure you've completed all testing phases.
- ✅ Completed comprehensive application reconnaissance
- ✅ Tested all authentication mechanisms
- ✅ Exploited SQL injection vulnerabilities
- ✅ Demonstrated XSS impact on user sessions
- ✅ Achieved RCE through file upload
- ✅ Assessed API security thoroughly
- ✅ Chained multiple vulnerabilities
- ✅ Documented findings in professional report
Estimated Time: 6-8 hours for complete assessment