What common web application vulnerabilities should you look for during penetration testing?

2 Broken Authentication and Session Management

Broken authentication and session management refer to vulnerabilities that allow an attacker to compromise a user's identity or session on a web application. This can result in account takeover, identity theft, or privilege escalation. Some examples of broken authentication and session management are weak or default credentials, insecure password recovery, session hijacking, or lack of logout functionality. To test for broken authentication and session management, you should use tools and techniques that can brute-force, guess, or steal credentials, sessions, or tokens. To prevent broken authentication and session management, you should use strong encryption, hashing, and salting for passwords, implement multi-factor authentication, use secure cookies and tokens, and expire sessions after a period of inactivity.

3 Sensitive Data Exposure

Sensitive data exposure occurs when a web application fails to protect confidential or personal information from unauthorized access or disclosure. This can result in data breaches, privacy violations, or legal liabilities. Some examples of sensitive data exposure are unencrypted or weakly encrypted data in transit or at rest, insecure storage of passwords or keys, or verbose error messages that reveal sensitive information. To test for sensitive data exposure, you should use tools and techniques that can intercept, modify, or decrypt data in transit or at rest, or exploit misconfigurations or errors that expose sensitive information. To prevent sensitive data exposure, you should use strong encryption and hashing for data in transit and at rest, store passwords and keys securely, and implement proper error handling and logging.

4 XML External Entity (XXE) Attacks

XXE attacks occur when an attacker exploits a poorly configured XML parser to execute arbitrary commands or access files on a web application's server. This can result in remote code execution, file inclusion, or denial of service. Some examples of XXE attacks are entity expansion, external entity injection, or XML bomb. To test for XXE attacks, you should use tools and techniques that can craft and send malicious XML documents or entities to the web application's endpoints that accept XML input. To prevent XXE attacks, you should disable external entity processing, use less complex data formats such as JSON, or use secure XML libraries or parsers.

5 Broken Access Control

Broken access control refers to vulnerabilities that allow an attacker to bypass or exploit the web application's authorization mechanisms and access resources or functions that they are not supposed to. This can result in unauthorized data access, modification, or deletion, or unauthorized functionality execution. Some examples of broken access control are insecure direct object references, missing function level access control, or horizontal or vertical privilege escalation. To test for broken access control, you should use tools and techniques that can manipulate or forge requests, parameters, headers, or cookies to access or modify resources or functions that belong to other users or roles. To prevent broken access control, you should implement a robust and consistent authorization policy, use role-based access control, and enforce the principle of least privilege.

6 Cross-Site Request Forgery (CSRF) Attacks

CSRF attacks occur when an attacker tricks a user into performing an unwanted action on a web application that they are already logged into. This can result in account compromise, data loss, or malicious transactions. Some examples of CSRF attacks are changing a user's password, transferring funds, or posting a comment. To test for CSRF attacks, you should use tools and techniques that can create and send malicious requests or links that mimic the web application's legitimate requests, and trick the user into clicking or submitting them. To prevent CSRF attacks, you should use anti-CSRF tokens, validate the origin and referer headers, and use same-site cookies.

7 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?