Web Application Hacking

Web applications are the most common attack surface in modern organisations. This lesson covers the OWASP Top 10 vulnerabilities, practical exploitation techniques, and the tools used by ethical hackers to test web application security.

---

The OWASP Top 10 (2021)

The Open Web Application Security Project (OWASP) publishes the definitive list of critical web application security risks:

Rank	Category	Description
A01	Broken Access Control	Users acting beyond their permissions
A02	Cryptographic Failures	Weak or missing encryption of sensitive data
A03	Injection	SQL, NoSQL, OS, LDAP injection attacks
A04	Insecure Design	Missing or ineffective security controls by design
A05	Security Misconfiguration	Default configs, open cloud storage, verbose errors
A06	Vulnerable Components	Using libraries with known vulnerabilities
A07	Authentication Failures	Broken authentication and session management
A08	Software and Data Integrity	Insecure CI/CD pipelines, unsigned updates
A09	Security Logging Failures	Insufficient logging and monitoring
A10	Server-Side Request Forgery	Application fetches attacker-controlled URLs

---

SQL Injection (SQLi)

SQL injection occurs when user input is inserted directly into SQL queries without sanitisation:

How It Works

Normal login query:
SELECT * FROM users WHERE username = 'admin' AND password = 'secret123'

Injected query:
SELECT * FROM users WHERE username = 'admin' OR 1=1 --' AND password = ''
                                        ^^^^^^^^^^^
                                    Injected payload

Types of SQL Injection

Type	Description	Detection
In-band (Classic)	Results returned directly in the response	Error messages, changed output
Error-based	Database errors reveal information	Verbose error messages
Union-based	Use UNION to extract data from other tables	Additional data in response
Blind (Boolean)	No visible output; infer data from true/false responses	Different page behaviour
Blind (Time-based)	No visible output; infer data from response timing	Delayed responses
Out-of-band	Data exfiltrated via DNS or HTTP requests	External server interactions

Exploitation with sqlmap

# Test a URL parameter for SQL injection
sqlmap -u "http://target.com/page?id=1" --dbs

# Enumerate databases
sqlmap -u "http://target.com/page?id=1" --dbs

# Dump a specific table
sqlmap -u "http://target.com/page?id=1" -D webapp -T users --dump

# Test a POST parameter
sqlmap -u "http://target.com/login" --data="username=admin&password=test" --dbs

Prevention

• Use parameterised queries (prepared statements)
• Use an ORM (Object-Relational Mapping)
• Validate and sanitise all user input
• Apply the principle of least privilege to database accounts

---

Cross-Site Scripting (XSS)

XSS injects malicious scripts into web pages viewed by other users:

Types

Type	Persistence	Example
Reflected	Not stored; payload in URL or request	Search results reflecting user input
Stored	Stored in database; affects all viewers	Comment field with embedded script
DOM-based	Manipulates client-side JavaScript	URL fragment processed by JavaScript

Example Payloads

<!-- Basic alert test -->
<script>alert('XSS')</script>