Skip to content

lab18.md

Latest commit

 

History

History
115 lines (78 loc) · 7.08 KB

lab18.md

File metadata and controls

115 lines (78 loc) · 7.08 KB
Raw

Lab - Use the OWASP Web Security Testing Guide

Objectives

In this lab, you will complete the following objectives:

  • Part 1: Investigate the WSTG
  • Part 2: Scan a Website and Investigate Vulnerability References

Background / Scenario

The Open Worldwide Application Security Project (OWASP) nonprofit foundation developed the Web Security Testing Guide (WSTG) to address the most common web application security issues. This guide is invaluable for various stakeholders, including developers, software testers, security specialists, and project managers. The OWASP Web Security Testing Guide is a free resource available to organizations and individuals, and it serves as a crucial tool for ethical hackers. By leveraging this guide, ethical hackers can assess their clients’ web applications for common security vulnerabilities.

In this lab, you will review the WSTG and then scan a web application for vulnerabilities using the OWASP Zed Attack Proxy (ZAP). You will investigate some of the vulnerabilities discovered and reference them back to the WSTG.

Required Resources

  • Kali VM customized for the Ethical Hacker course
  • Internet access

Instructions

Part 1: Investigate the WSTG

Step 1: Explore the OWASP WSTG Project Site.

  1. Navigate to the OWASP Web Security Testing Guide site at https://owasp.org/www-project-web-security-testing-guide/.

    • What is the purpose of the OWASP Web Security Testing Guide?
      • Reflect on how this guide can empower both security professionals and organizations in their security practices.

  2. Click the Release Versions tab.

    • What is the current release version of the guide?
      • Consider why keeping software documentation up to date is crucial in the field of cybersecurity.

  3. Click the most recent released version and review the Table of Contents.

Step 2: Review the Content.

  1. Click and review the Foreword by Eoin Keary in the Table of Contents.

    • According to Mr. Keary, who is initially responsible for application security?
      • Discuss how accountability for security can impact application development.

  2. Return to the Table of Contents and select Introduction.

    • Security testing should be included in which phase(s) of the Software Development Lifecycle (SDLC)?
      • Explore the implications of integrating security testing in various phases of the SDLC on the overall security posture of applications.
    • What three factors should be tested in an effective testing program?
      • Analyze how these factors contribute to a comprehensive security strategy.
    • What four testing techniques are presented in the introduction of the OWASP Web Testing Guide? Complete the table with the techniques and their definitions. Define the techniques in your own words.
    Technique Definition
    Technique 1 Your personalized definition based on your understanding and experience.
    Technique 2 Your personalized definition based on your understanding and experience.
    Technique 3 Your personalized definition based on your understanding and experience.
    Technique 4 Your personalized definition based on your understanding and experience.

  3. Return to the Table of Contents and select OWASP Testing Framework.

    • According to the framework, what are the phases in which testing activities should take place?
      • Contemplate how structuring testing activities in this manner enhances the effectiveness of security assessments.

  4. Return to the Table of Contents and select Web Application Security Testing.

    • What are the 12 categories of active testing described in the guide?
      • Evaluate how each category contributes to identifying specific vulnerabilities in web applications.

  5. Return to the Table of Contents and select Reporting.

    • The final report should be targeted to what two groups of stakeholders?
      • Consider the importance of tailoring security reports for different audiences to ensure clear communication of risks and recommendations.

Part 2: Scan a Website and Investigate Vulnerability References

In this part of the lab, you will conduct a vulnerability scan using the Zed Attack Proxy (ZAP). Your target is an intentionally vulnerable website available on your VM. You will then use the WSTG to learn more about a vulnerability that you discovered.

Step 1: Open ZAP and Start Scanning.

  1. Start the Kali VM as needed. Navigate to the Kali menu, search for ZAP, and start the OWASP ZAP scanner.

  2. Click the topmost radio button to persist the session, allowing you to return to the session later.

  3. Close the Manage Add-ons dialog window.

  4. In the ZAP main window, click the Automated Scan to initiate a scan.

  5. In the URL to Attack field, enter 172.17.0.2/dvwa.

  6. Click the Attack button to begin the scan. The scan should take less than 10 minutes to complete.

    Note: ZAP uses a web spider to crawl the URL to identify available resources, then applies vulnerability scans to each resource.

Step 2: Investigate the Results.

  1. Select the Alerts tab (if it is not already selected). You will be automatically switched there when the scan finishes.

    • How many alerts were returned?
      • Reflect on the significance of the number of alerts in assessing the security of the application.

  2. Locate and click the Remote Code Execution – CVE-2012-1823 alert. Scroll through the details of the alert.

    • What is the source of this vulnerability?
      • Investigate how understanding the source can aid in preventing similar vulnerabilities in the future.
    • How can this vulnerability be exploited?
      • Consider the implications of this vulnerability being exploited in a real-world scenario.

  3. Scroll down to the Alert Tags section of the vulnerability. Note the WSTG key and value. Click the value and use Ctrl-C keys to copy the URL to the clipboard.

  4. Open a browser, paste the URL, and navigate to the WSTG site. Read about the vulnerability and methods of testing for it. Review this information to understand what WSTG offers to the penetration tester.

Reflection Questions

  1. In what ways can the OWASP Web Security Testing Guide assist organizations in securing their applications?

    • Consider specific scenarios or examples where the guide could be instrumental in improving application security.

  2. When conducting a penetration test of a client’s web applications, how could you use the WSTG as a guide?

    • Reflect on how you would structure a testing engagement using the WSTG and any additional resources or methodologies you might incorporate.

Conclusion

This lab provides hands-on experience with the OWASP Web Security Testing Guide and practical skills in using ZAP for vulnerability scanning. By completing this lab, you will enhance your understanding of web application security testing and the importance of using established guidelines to identify and mitigate vulnerabilities.