0

I have been given a project to perform penetration testing on a Vaadin Web Application. This kind of web application is new for me, so I'm just wondering what should I prepare to perform penetration testing on this application or what should I do after gathering information about the application?

I have tried to intercept the request and response using Burp and it seems like the application is using websockets to exchange data. I haven't seen such a method before.

If there are any tools that you think can help please let me know (Like JSON Beautifier, or vuln. scanner).

Improve this question

2 Answers 2

Reset to default
1

There isn't anything brilliant for web application testing with web sockets. Last time I tried, ZAP (https://www.zaproxy.org/) offered a better alternative to burpsuite, but I know that portswigger have since improved this aspect.

Like any other web application, you need to worry about user input, requests to the server, responses, etc. Consider the same layers of implementation where vulnerabilities could exist in: configuration, authentication, access controls, session management, input validation... https://owasp.org/www-project-web-security-testing-guide/stable/ https://owasp.org/www-project-top-ten/

Improve this answer
3
  • can you give some example scenario of access controls? I've observed that the functions in the application sent to the client by the server right after login, so if the server didn't send the function to the client, there is nothing that client can do to access the restricted functions, am I right?
    – WangChuu
    Commented Apr 30, 2020 at 3:11
  • 1
    there is only one way to find out. intercept those comms, change them, act on those and see what happens. if the server says user is not super user and therefore certain screens won't be visible, this does not mean the actions on those screens would not work if executed by the user.
    – Pedro
    Commented Apr 30, 2020 at 9:11
  • If the web application has multiple levels of permissions (such as "admin"/"user" roles, or "authenticated"/"guest", or so on), you should have several browsers (you can use private/incognito for this) testing with differently-permissioned users (ask the commissioner of the test about getting accounts with these roles). If all users have the same role, you can still test authorization both by trying to do things that require logging in without sending any authentication data (such as trying for IDORs), or trying to access one user's information from a different user.
    – CBHacking
    Commented Jul 3, 2021 at 4:26
0

First You need to understand Websocket mechanism Refer this link (https://portswigger.net/web-security/websockets#intercepting-and-modifying-websocket-messages)

After that you have to configure Burpsuite to Intercept Websocket communication Refer this link (https://portswigger.net/burp/documentation/desktop/tools/proxy/options#intercepting-websocket-messages)

You can refer below mentioned Book for more detail understanding of Websocket Security testing. (https://www.theseus.fi/bitstream/handle/10024/113390/Harri+Kuosmanen+-+Masters+thesis+-+Security+Testing+of+WebSockets+-+Final.pdf?sequence=1)

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .