In this article I am going to share a checklist which you can use when you are doing a penetration test on a website, you can also use this list as a reference in bug bounties. This list is made for intermediates, so they can look it for reference.
Before starting this list I want to make a request that this is my advice that you should complete the previous checklist, so in this process you will not get confused.
You are not genius!! Remember this thing, so if you don’t understand something just Google about it and so some research, I also don’t know everything and there could be things that I have missed, so don’t worry and keep learning.
📋 The list
- Test for credentials transported over encryption.
- When you submit your login/registration data try intercepting the request and changing the requests method.
POSTtoGET, andGETtoPOST. If any points of time you find the data submitted by user are transported without encryption you can make this as low-level bug.
- When you submit your login/registration data try intercepting the request and changing the requests method.
- Test for default credentials on admin page/console or any sign in panel.
- Try submitting default username passwords like
admin:admin,admin:password
- Try submitting default username passwords like
- Bypassing the authentication.
- Forced browsing: Directly visiting the section of the website which requires authentication. For example, if you have to login at testwebsite.com/login to visit testwebsite.com/information, but if you can visit testwebiste.com/information directly just by typing this URL in the browser without authenticating then this will be known as forced browsing.
- Parameter modification: Try changing response which comes from the server for example, if your server response testwebsite.com/auth=false then try changing the parameter
auth=falsetoauth-true. - Session ID brute forcing.
- SQL injection.
- Check for broken access control.
- Remember password checking.
- Check that is password being stored in the cookies or being constantly transferred in every request of the website. The credentials should only be sent I login phase.
- Check for directory traversal includes file input.
- You have to check each and every input which your website and its directories take from user.
- You can referrer to this article.
- Checking for privilege escalation.
- You can check for this at some places like if user can make payment, adding something, sending message to someone.
- You can intercept request of two different sets of account and try modifying parameters like grp, id, and role if they exist.
- You can referrer to this article.
- Check for IDOR (Insecure Direct Object Reference).
- You can try for getting access to other user data by changing parameters in URL.
- Check for bypassing session management object.
- Set-cookies are secure or not?
- Are cookies transmitted in encrypted manner?
- Make sure cookies are not same every time when your browse website.
- Sometimes website can leak their token structure/information try to find it.
- Session ID predictability.
- Brute forcing session ID.
- Check for CSRF.
- Check for XSS (stored, reflected, blind).
- Check for SQL injection (blind, In band, Out band, Error based etc.).
- Check for XML injection.
- Check for file upload.
- Check for open redirection or client-side open redirection.
- You can referrer to this article.
- Checking for web sockets vulnerabilities.
- Check for code execution.
- You can referrer to this article.
- Check for SSRF (Server Side Request Forgery).
- Check fir command injection.
- You can referrer to this article.
- Checking for business logic flaws.
- You can referrer to this article.
- Checking for LDAP injection.
- You can referrer to this article.
- Check for HTTP request smuggling.
So this was all about some more things to check while doing penetration test on a website or in a bug bounty program. Hope you liked it and learned something new from it.
If you have any doubt, question, quires related to this topic or just want to share something with me, than please feel free to contact me.
🖥 My personal blog
📱 Contact Me
Twitter, LinkedIn, Telegram, Instagram,