Web Applications RPT

With software being increasingly deployed over the Internet, the threat of attacks specific to web applications is a growing concern. Core Impact's WebApps RPT lets users test the vulnerability of their web-based applications or mobile application backends and gives them an opportunity to address any vulnerabilities. The Web Applications RPT tests the following attack types:

  • SQL Injection attacks occur when SQL queries are passed through the user interface of a web application and are executed in the database. Core Impact also tests for Blind SQL Injection attacks which can pose an additional threat to web applications.
  • PHP Remote File Inclusion vulnerabilities allow malicious users to execute their own PHP code on the vulnerable web application.
  • PHP Local File Inclusion vulnerabilities
  • Cross Site Scripting (XSS) occurs when attackers are able to inject arbitrary code into vulnerable web servers. The malicious code is ultimately executed by the web browsers of unsuspecting users of the vulnerable web application.
  • Hidden Web Pages: It is not uncommon for web applications to contain active pages that are not directly linked to from within the application. These tend to be "secret" pages for use by application administrators who know their direct URLs. Core Impact will attempt to locate these pages and add them to your scenario for further vulnerability assessment.
  • WebDav implementations that are configured poorly can be exploited and used to change, remove, or replace important files on a web server. Core Impact will alert you if this capability exists.
  • OS Command Injection vulnerabilities occur if the application takes user input as a system-level command.
  • Sensitive Information vulnerabilities are those where an application does not encrypt data stored in its database.
  • Weak Credentials vulnerabilities exist when an application's authentication functions have not been implemented with strong passwords. Applications with weak credentials are susceptible to dictionary attacks.
  • Weak SSL Ciphers: If a web application supports weak SSL ciphers, it may be vulnerable to traffic interception and modification.

Follow these links to learn about the different Web Application testing steps: