Hello friends! Today we
are going to use Burp Suite Scanner
which is use for website security testing to identify certain vulnerability
inside it. It is the first phase for web penetration tesing for every security tester.
Burp Scanner
is a tool for automatically finding security vulnerabilities in web
applications. It is designed to be used by security testers, and to fit in
closely with your existing techniques and methodologies for performing manual
and semi-automated penetration tests of web applications.
Target:
www.testphp.vulnweb.com
Lets Start with burp proxy
in order to intercept request between browser and website. From screenshot you
can perceive that we have forwarded the intercepted data for “an active scan”.
Note: Always
configure your browser proxy while making use of burp suite to intercept the
request.
Through
a window alert it will ask to confirm your action for active scan; press YES to begin the active scan on
targeted website.
Issue Activity
The issue activity tab contains a sequential record of
the Scanner's activity in finding new issues and updating existing issues. This
is useful for various purposes:
·
An index number for the item, reflecting the
order in which items were added.
·
The time that the activity occurred.
·
The
action that was performed.
·
The issue type.
·
The host and URL path for the issue.
·
The insertion point for the issue, where
applicable.
·
The severity and confidence of the issue.
From screenshot you can observe that it highlighted 8 types of issues found inside website
from scanning result as following:
1.
Cross-site
scripting (reflected)
2.
Flash
cross-domain policy
3.
SQL
injection
4.
Unencrypted
communications
5.
Cross-domain
Referer leakage
6.
Email
addresses disclosed
7.
Frameable
response (potential Clickjacking)
8.
Path-relative
style sheet import
Active Scan Queue
Active scanning typically involves sending large numbers of requests to the server
for each base request that is scanned, and this can be a time consuming
process. When you send requests for active scanning, these are added to the
active scan queue, in which they are processed in turn.
·
An index
number for the item, reflecting the order in which items were added.
·
The destination protocol, host and URL.
·
The current
status of the item, including percentage complete.
·
The number
of requests made while scanning the item.
·
The number of network errors encountered.
·
The start
and end times of the item's scanning.
One by one we are going to demonstrate these
vulnerabilities in details using request and response.
It gave your brief detail of vulnerability and idea to
exploit it.
|
Issue:
|
Cross-site
scripting (reflected)
|
|
Severity:
|
High
|
|
Confidence:
|
Certain
|
|
Host:
|
http://testphp.vulnweb.com
|
|
Path:
|
/listproducts.php
|
The value of the cat request parameter is copied into
the HTML document as plain text between tags. The payload was submitted in the
cat parameter. This proof-of-concept attack demonstrates that it is possible to
inject arbitrary JavaScript into the application's response.
As
response we can see the injected payload get submitted inside database. Now it
will generate an alert prompt on screen when get executed on website.
Let’s verify it manually on running website.
Execute
following script inside URL with cat parameter As result you will receive
prompt 1 as alert window.
Similarly
test for other vulnerability
|
Issue:
|
SQL
injection
|
|
Severity:
|
High
|
|
Confidence:
|
Firm
|
|
Host:
|
http://testphp.vulnweb.com
|
|
Path:
|
/listproducts.php
|
The cat parameter appears to be
vulnerable to SQL injection attacks. The payload ' was submitted in the
cat parameter, and a database error message was returned. You should review the
contents of the error message, and the application's handling of other input,
to confirm whether vulnerability is present.
The database appears to be MySQL.
The database appears to be MySQL.
Under
response tab you can read the highlighted text which is clearly point towards
SQL vulnerability inside database.
|
Issue:
|
Flash
cross-domain policy
|
|
Severity:
|
High
|
|
Confidence:
|
Certain
|
|
Host:
|
http://testphp.vulnweb.com
|
|
Path:
|
/crossdomain.xml
|
The
application publishes a Flash cross-domain policy which allows access from any
domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Similarly as above it has generated the request through GET
method using crossdomain.xml
In
this way we can see how the burp suite scanner tests the security loop holes in
a website.
