📞
Contrxl
External Links
Theoretical Learning
Theoretical Learning
  • 🏡Home
  • 📰News & Information
  • Systems Administration
    • ⌨️Cisco
      • Networking Basics
        • Communication in a Connected World
        • Network Components, Types and Connections
        • Wireless and Mobile Networks
        • Home Networking Technologies
        • Communication Protocols
        • Network Media
        • The Access Layer
        • The Internet Protocol
        • IPv4 and Network Segmentation
    • 🎓Learning Links
    • 💻Microsoft
      • AZ-900
        • 1. Cloud Concepts
          • 1.1 Describe Cloud Computing
            • 1.1.1 Introduction - Cloud Computing
            • 1.1.2 What is Cloud Computing?
            • 1.1.3 The Shared Responsibility Model
            • 1.1.4 Define Cloud Models
            • 1.1.5 Define the Consumption based Model
            • 1.1.6 Summary - Cloud Computing
          • 1.2 Describe the Benefits of Cloud Services
            • 1.2.1 Introduction - Cloud Services
            • 1.2.2 Benefits of High Availability and Scalability
            • 1.2.3 Benefits of Reliability and Predictability
            • 1.2.4 Benefits of Security and Governance
            • 1.2.5 Manageability in the Cloud
            • 1.2.6 Summary - Cloud Services
          • 1.3 Describe Cloud Service Types
            • 1.3.1 Introduction - Cloud Service Types
            • 1.3.2 Describe Infrastructure as a Service
            • 1.3.3 Describe Platform as a Service
            • 1.3.4 Describe Software as a Service
            • 1.3.5 Summary - Cloud Service Types
        • 2. Architecture
          • 2.1 Core Architectural Components
            • 2.1.1 Introduction - Core Architectural Components
            • 2.1.2 What is Microsoft Azure
            • 2.1.3 Get Started with Azure Accounts
            • 2.1.4 Explore the Learn Sandbox
            • 2.1.5 Describe Azure Physical Infrastructure
            • 2.1.6 Describe Azure Management Infrastructure
            • 2.1.7 Create an Azure Resource
            • 2.1.8 Summary
          • 2.2 Compute and Networking
            • 2.2.1 Introduction - Compute and Networking
            • 2.2.2 Describe Azure VMs
            • 2.2.3 Create an Azure VM
            • 2.2.4 Describe Azure Virtual Desktop
            • 2.2.5 Describe Azure Containers
            • 2.2.6 Describe Azure Functions
            • 2.2.7 Describe Application Hosting Options
            • 2.2.8 Describe Azure Virtual Networking
            • 2.2.9 Configure Network Access
            • 2.2.10 Describe Azure VPNs
            • 2.2.11 Describe Azure ExpressRoute
            • 2.2.12 Describe Azure DNS
            • 2.2.13 Summary - Compute and Networking
          • 2.3 Azure Storage Services
            • 2.3.1 Introduction - Storage Services
            • 2.3.2 Describe Azure Storage Accounts
            • 2.3.3 Describe Azure Storage Redundancy
            • 2.3.4 Describe Azure Storage Services
            • 2.3.5 Create a Storage Blob
            • 2.3.6 Identify Azure Data Migration Options
            • 2.3.7 Identify Azure File Movement Options
            • 2.3.8 Summary - Storage Services
        • 3. Management and Governance
          • 3.1 Cost Management
            • 3.1.1 Introduction - Cost Management
            • 3.1.2 Describe Factors that can Affect Costs in Azure
            • 3.1.3 Compare Pricing and TCO Calculators
            • 3.1.4 Estimate Workload Costs
            • 3.1.5 Compare Workload Costs with TCO
            • 3.1.6 Describe the Microsoft Cost Management Tool
            • 3.1.7 Describe the Purpose of Tags
            • 3.1.8 Summary - Cost Management
          • 3.2 Governance and Compliance
            • 3.2.1 Introduction - Compliance and Governance
            • 3.2.2 Describe the Purpose of Microsoft Purview
            • 3.2.3 Describe the Purpose of Azure Policy
            • 3.2.4 Describe the Purpose of Resource Locks
            • 3.2.5 Configure a Resource Lock
            • 3.2.6 Describe the Purpose of the Service Trust Portal
            • 3.2.7 Summary - Compliance and Governance
          • 3.3 Tools for Managing Azure Resources
            • 3.3.1 Introduction - Tools for Managing Azure Resources
            • 3.3.2 Describe Tools for Interacting with Azure
            • 3.3.3 Describe the Purpose of Azure Arc
            • 3.3.4 Describe ARM and Azure ARM Templates
            • 3.3.5 Summary - Tools for Managing Azure Resources
          • 3.4 Monitoring Tools
            • 3.4.1 Introduction - Monitoring Tools
            • 3.4.2 Describe the Purpose of Azure Advisor
            • 3.4.3 Describe Azure Service Health
            • 3.4.4 Describe Azure Monitor
    • 📘Microsoft Portal Links
  • Cybersecurity
    • ❓Anonymity Tools
    • 💡OSINT
      • IP & Domain OSINT
      • Email & Username OSINT
      • Vulnerability OSINT
    • 📚Projects
      • ‼️A Simulation Study of DDoS
  • 🦈Hacking
    • ☁️Cloud Attack Vectors
      • Credential Harvesting
      • Privilege Escalation
      • Account Takeover
      • Metadata Service Attacks
      • Misconfigured Cloud Assets
      • Resource Exhaustion and DoS
      • Cloud Malware Injection Attacks
      • Side-Channel Attacks
    • Maintaining Persistence
      • Reverse and Bind Shells
      • Command and Control (C2) Utilities
      • Scheduled Jobs, Tasks and Custom Daemons
    • 💻Network-Based Vulnerabilities
      • Windows Name Resolution and SMB
      • DNS Cache Poisoning
      • SNMP
      • SMTP
      • FTP
      • Pass-the-Hash
      • Kerberos and LDAP-Based Attacks
      • On-Path
      • Route Manipulation
      • DoS and DDoS
      • NAC Bypass
      • VLAN Hopping
      • DHCP Starvation/Rogue DHCP Server
    • Pivoting
      • Post-Exploitation Scanning
      • Legitimate Utilities and LotL
      • Privilege Escalation
    • Specialised System Vulnerabilities
      • Mobile Devices
      • Internet of Things Devices
      • Virtual Machines
      • Containerised Workloads
    • ⚒️Tools
      • Burp Suite
        • Repeater
        • Intruder
        • Other Modules
      • GoPhish
      • Hydra
      • John the Ripper
      • Metasploit
        • Exploitation
        • Meterpreter
      • NMAP
      • Wireshark
    • 🖥️TryHackMe
      • Complete Beginner
        • 1. Complete Beginner Intro
        • 2. Linux Fundamentals
        • 3. Introductory Networking
        • 3.1 Network Exploitation Basics
        • 4. OWASP Top 10 Exploits
        • 5. Upload Vulnerabilities
        • 5.1 An Example Methodology
        • 6. Cryptography - Hashing
        • 7. Cryptography - Encryption
        • 8. Active Directory Basics
        • 9. What the Shell?
        • 10. Linux Privesc
        • 11. More Linux Privesc
      • Jr Penetration Tester
        • Walking an Application
        • Content Discovery
        • Subdomain Enumeration
        • Authentication Bypass
        • IDOR
        • File Inclusion
        • SSRF
        • XSS (Cross-site Scripting)
        • Command Injection
        • SQL Injection
        • Passive Reconnaissance
        • Active Reconnaissance
        • Protocols and Servers
        • Protocol and Server Attacks
        • Vulnerabilities
        • Exploiting Vulnerabilities
        • Linux Privilege Escalation
        • Windows Privilege Escalation
      • CompTIA Pentest+
        • Planning and Scoping
          • Pentesting Fundamentals
          • Red Team Engagements
          • Governance and Regulation
        • Tools and Code Analysis
          • Metasploit: Introduction
          • Wireshark: The Basics
          • Burp Suite: The Basics
          • Hydra
          • Python Basics
        • Attacks and Exploits
          • Phishing
          • Windows Local Persistence
          • Breaching Active Directory
          • Lateral Movement & Pivoting
    • Web Application Vulnerabilities
      • The HTTP Protocol
      • Business Logic Flaws
      • Injection-Based Vulnerabilities
      • Authentication-Based Vulnerabilities
      • Authorisation-Based Vulnerabilities
      • Cross-Site Scripting (XSS)
      • Cross-Site Request Forgery (CSRF/XSRF) and Server-Side Request Forgery (SSRF)
      • Clickjacking
      • Security Misconfigurations
      • File Inclusion Vulnerabilities
      • Insecure Coding Practices
    • Wireless Vulnerabilities
      • Rogue Access Point/Evil Twin
      • Disassociation/Deauthentication
      • Preferred Network List Attack
      • Wireless Signal Jamming
      • War Driving
      • Initialization Vector (IV) and Insecure Wireless Protocol
      • KARMA
      • Fragmentation Attacks
      • Credential Harvesting
      • Bluejacking and Bluesnarfing
      • RFID Attacks
Powered by GitBook
On this page
  • HTTP URL Structure
  • Web Sessions
  1. Hacking
  2. Web Application Vulnerabilities

The HTTP Protocol

Before getting into web application vulnerabilities, it is important to understand HTTP (Hyper Text Transfer Protocol). Some basic info about the HTTP protocol:

  • HTTP 1.1 is defined in RFCs 7230-7235

  • In most cases, HTTP is a stateless protocol which does not rely on persistent connection for communication logic

  • A HTTP transaction consists of a single request from client to server, followed by a single response from server to client

  • A server must maintain its connection to the client throughout transmission of successive commands until the interaction is terminated

  • A sequence of transmitted and executed commands is called a session

HTTP proxies operate between the client and server. They can make requests to web servers on behalf of clients, they enable HTTP transfers across firewalls and can also perform other roles, such as NAT and HTTP filtering.

HTTP is an application-level protocol in the TCP/IP suite. It uses TCP as the transport layer protocl for transmission.

A HTTP interaction typically has the following structure:

  • The Method:

    • GET: retrieve information from server

    • HEAD: same as GET, but only retrieves HTTP headers

    • POST: send data to server

    • TRACE: message loopback test along path to target

    • PUT: upload representation of specific URI

    • DELETE: delete resource

    • OPTIONS: return methods supported by server

    • CONNECT: convert request to transparent TCP/IP tunnel

  • The URI and path-to-resource field: path portion of the requested URL

  • Request version-number: specifies version of HTTP used by client

  • User-agent: the user-agent used to access the server e.g. Chrome, Firefox

  • Other fields like accept, accept-language may appear

Once this is sent, the server will respond and include a three digit status code alongside a human-readable explanation of the status code:

  • 100 range code: informational message

  • 200 range code: successful transaction message

  • 300 range code: HTTP redirection message

  • 400 range code: client side error message

  • 500 range code: server side error message

HTTP URL Structure

It is important to understand the component parts of a URL, looking at:

https://example.com:1234/dir/test;id=1?name=contrxl&admin=true

  • The Scheme: this defines the protocol to be used, this is always followed by a colon and two forward slashes, the scheme here is https://.

  • The Host: the IP server (number or DNS) of the web server to access, this follows the scheme. The host here is example.com.

  • The Port: this is optional and denotes the port number which the target server listens on. The port here is :1234.

  • The Path: the path from the root directory of the server to the resource you wish to access. Servers can use aliasing to identify documents, gateways and services. The path here is /dir.

  • The Path-Segment-Params: this includes optional name/value pairs, this is typically preceded by a semi-colon and immediately follows the path. Here, the path segment parameter is id=1.

  • The Query-String: optional portion of URL including name/value pairs which represent dynamic parameters associated with your request. The query string is typically preceded by a question mark. Here, the query string is ?name=contrxl&admin=true

Web Sessions

A web session is a sequence of HTTP request and response transactions. These include pre-authentication, authentication, session management, access control, and session finalisation. Sessions are used to track anonymous users throughout their session, this means an application can remember a users language preference each time they visit the site.

Authenticated sessions allow the app to identify the user on subsequent requests and apply relevant access controls. Once an authentication session is established, a session ID/token becomes temporarily equivalent to the strongest authentication method used by the application. If the default session ID name is not changed, it can be used to fingerprint common development frameworks:

  • PHPSESSID (PHP)

  • JSESSIONID (J2EE)

  • CFID / CFTOKEN (ColdFusion)

  • ASP.NET_SessionId (ASP.NET)

It is important that the session ID is at least 128bits to prevent brute force attacks, it should also be unique and unpredictable. The session ID should also be excluded from the URL at all times to prevent manipulation.

All web sessions should be encrypted at all times. This ensures the session ID is only exchanged over encrypted channels.

Session management based on cookies use two types of cookie: non-persistent (session) cookies and persistent cookies. Any cookie with the max-age or expires attribute is a persistent cookie and is stored on disk by the server. Most modern apps use non-persistent cookies, which are erased once the session expires or the browser instance is closed.

Last updated 3 months ago

🦈