11

No idea where to begin, I would like to ask for tips, direction and approaches when it comes to performing such a web testing.

Source code analysis is not within scope for this test. I intend to run scanning tools (nmap, nikto, etc) on the website's server.

Improve this question
6
  • 3
    How have you ascertained that it is in fact static? The .html extension is meaningless.
    – MonkeyZeus
    Jul 7, 2021 at 18:04
  • 2
    @MonkeyZeus Why is it meaningless?
    – Hashim Aziz
    Jul 7, 2021 at 20:05
  • 11
    @HashimAziz You can configure a web server to send any file extension to any script processor. Hence you cannot blindly say that .html is static.
    – MonkeyZeus
    Jul 7, 2021 at 20:09
  • 1
    I wouldn't say the file extensions are meaningless, but they're definitely not reliable.
    – barbecue
    Jul 8, 2021 at 13:36
  • What's the reason for assuming the site is static? I've heard people describe Wordpress sites as being static content sites. It's not safe to assume the site is static just because someone else told you it is.
    – barbecue
    Jul 8, 2021 at 13:38

2 Answers 2

Reset to default
22

For a static web application there are things you should and shouldn't consider (this is non exhaustive):

For should:

  • Directory traversal: Is there any directories you can access? Were these intended?
  • Inspect elements: Did the developer or similar leave any comments in the client side returned HTML?
  • Server version: Despite being static something still needs to host it! Is the nginx/apache out of date?
  • Host Setup: Does the host go to a domain name (trust) and are ports restricted to what is absolutely necessary?
  • SSL Certificate:(Corrected) Although there is minimal value in HTTPS on a static site, it is a baseline requirement for 2021. See here.

For shouldn't:

  • Injection: If it is static, there should be nowhere to inject.
  • Access Management: No handling of accounts.

If I was in readers position, I would confirm the application is static, write a minimal report, and deliver quick. I would encourage the reader to apply the Web Security Testing Guide (WSTG) to what they are doing, only picking the applicable testing steps.

Improve this answer
15
  • 22
    SSL/TLS is not just encryption nor a "quality thing". When used correctly, it guarantees that you are talking to the correct server, and nobody else can see what you are doing and they cannot inject malicious content. All websites should use it; there is no reason in 2021 to not deploy TLS.
    – multithr3at3d
    Jul 7, 2021 at 1:58
  • 1
    Agree with some things @multithr3at3d. Will change SSL to a should look at, as even though there is minimal value it is a baseline, and a five minute job to do (no reason why you shouldn't). In terms of integrity and preventing injection I would argue SSL isn't the mitigator for those.
    – Rivesticles
    Jul 7, 2021 at 4:32
  • 9
    You could possibly do some reflected XSS if the static website uses some (eg. query string) URI input in (client-side) JavaScript.
    – ysdx
    Jul 7, 2021 at 7:31
  • 1
    I would add if you haven't XSS, SQLI, IDOR, file uploads.
    – LUser
    Jul 7, 2021 at 13:47
  • 3
    @LUser "Injection: If it is static, there should be nowhere to inject."—XSS yes because that's client side, but it's static, there's no opportunities for SQLI or file uploads.
    – lights0123
    Jul 7, 2021 at 16:26
7

You need to look for vulnerabilities in web servers, cache systems and also reverse proxies.

I suggest you to watch James Kettle talks to learn about HTTP attack surfaces:

And also you can look for sensitive files/directories such as backup files, .git, Dockerfile or .env using tools like dirsearch. You can also use fuzz.txt as dictionary.

And also look for client-side vulnerabilities such as DOM-based XSS and client-side template injection. BurpSuite has useful analysis to find DOM-based XSS, most of the time false positive but occasionally valid ;)

If your target is using WebAssembly, you can look for its vulnerabilities such as BOF that leads to XSS.

Watch this video on WebAssembly exploitation: WebAssembly A New World of Native Exploits on the Browser

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .