Web Security Testing Essentials

1. Do not log into the system, directly enter the login page URL can be accessed;
2. Do not log in the system, directly enter the download file URL can download files;
If input: http://url/download?name=file can download file
3. After exiting the login, the Back button can access the previous page;
4. ID/Password Authentication method can use simple password;
If the password standard is more than 6 digits, the combination of letters and numbers, does not contain ID, connected letters or numbers can not exceed n bits
5. ID/Password authentication method, the same account on different machines do not log on at the same time
6. ID/Password authentication method, the account is locked after several consecutive entries of the wrong password
7. Important information (such as password, ID card, credit card number, etc.) is displayed in clear text when entering or querying;
Is there any important information when entering command Javascript:alert (Doucument.cookie) in the browser address bar;
Can see the important information in the HTML source code;
8. Manually change the parameter values in the URL to access pages that do not have permission to access.
If the parameters in the URL of the normal user is l=e, the parameter in the URL of the advanced user is l=s, and the parameter E in the URL will be changed to the S to access the page without permission after logging in as a normal user.
9. The non-modifiable parameters in the URL can be modified;
10. After uploading an executable such as a file or EXE with the same extension as the server-side language (jsp,asp,php), confirm that it can be run directly on the server side
11. Can I use '--' or1=1-' as the user name when registering a user?
12. Parameters that are passed to the server (such as query keywords, parameters in URLs, etc.) contain special characters ('. '). And1=1--. ' And1=0--. '. ' or 1=0--) can be handled properly
13. When performing the new operation, enter the script tag (<script>alert ("") </script>) in all input boxes to save;
14. Do you have auto-complete function when adding or modifying important information (password, ID card, credit card number, etc.)
(Use autocomplete=0 in the Form tab to turn off AutoComplete)
15. Enter the following address in the URL to download
Http://url/download.jsp?file=c:\windows\system32\drivers\etc\hosts,http://url/download.jsp?file=/etc/password
16. Whether to process the duration of the session
17. Whether the error message contains SQL statements, SQL error messages, and the absolute path of the Web server.

Web Security Testing Essentials