Before the gym app goes live
A small gym has paid a developer for a booking app. It goes live on Monday. The owner asks: is it safe?
Nobody can answer that by looking at the home page. Somebody has to test it, on a copy, with permission, and write down what they find. That is a real job, and companies pay for it.
The one rule
Warning
This lab is a website that is weak on purpose. Test only your own private copy, with your teacher's permission. It has no way out to the internet. Testing a site without its owner's written permission is a crime under the Computer Misuse Act 1990. Testers find flaws so they get fixed.
By the end of this lesson
Note
I can test my own copy of an app for common flaws.
Key words
| Word | What it means | Example |
|---|---|---|
| Scope | what you are allowed to test, written down | |
| Flaw | a mistake in an app that could be misused | |
| Cookie | a small value a site asks the browser to keep and send back | |
| Session | a site remembering that you signed in | PHPSESSID |
| Input | anything a visitor sends to the app | |
| Finding | one flaw written up in a report |
The cells students fill in are left blank in this preview.
A test starts with a plan
A tester never starts by attacking. They agree a scope with the owner: which addresses, which accounts, which days, and what is off limits.
Then they test one thing at a time and write down each result, even the ones that were fine. A page that correctly refuses a stranger is worth a line in the report too.
Your scope today is one site, http://dvwa, in your own lab.
Is the sign-in page up?
curl -s -o /dev/null -w "%{http_code}\n" http://dvwa/login.phpShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Ask for an exercise without signing in
curl -s -o /dev/null -w "%{http_code} %{redirect_url}\n" http://dvwa/vulnerabilities/sqli/Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
The session cookie is the account's key
After you sign in, a site remembers you with a session cookie. Whoever holds that cookie is you, as far as the site knows.
So a careful site marks it HttpOnly, which stops scripts in the page reading it. These two Runs look at the cookies DVWA hands to every visitor.
The cookies the site sets
curl -s -I http://dvwa/login.php | grep -i "^set-cookie"Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
How many cookies say HttpOnly?
curl -s -I http://dvwa/login.php | grep -ic httponlyShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Worked example: writing up one finding
| Part of the finding | What to write |
|---|---|
| Title | The session cookie can be read by scripts |
| Where | http://dvwa/login.php, the PHPSESSID cookie |
| Evidence | The HttpOnly count printed 0 |
| Why it matters | A script that gets into a page could steal the session and become the user |
| Fix | Mark the session cookie HttpOnly, and Secure when the site uses HTTPS |
The cells students fill in are left blank in this preview.
Three common flaws come from trusting input
SQL injection: typed text becomes part of a database query. You spot it when a quote mark causes a database error. The fix is a parameterised query.
Cross-site scripting: typed text is put into a page and runs as code. You spot it when a tag you typed is drawn, not shown. The fix is escaping output.
Path traversal: a file name with ../ reaches files outside a folder. The fix is checking names against a list.
A common mistake
Warning
Many people think a check in the browser, such as a form that refuses odd characters, protects an app. A visitor can send any request without the form. Check every input again on the server, because only the server is in your control.
Going further: one finding of your own
Pick one DVWA exercise you did at low. Write it up as a finding with the five parts of the worked example: title, where, evidence, why it matters and fix.
Then do the same exercise at high and add one sentence: what the code at high does differently.