Skip to main content

How to Approach Web Application Vulnerability Assessment using Burp Community | Part - 2 | Audit Guidelines | High Impact Web Vulnerability

The blog is part-2 in continuation to basically cover how to check the web application vulnerability with Burp Community Edition. This blog will be very helpful while performing the web application security assessment( VAPT) manually. In this part of the blog, we will cover a few vulnerabilities with High impact severity. Please refer the audit guidelines below for serious vulnerabilities.

IP Spoofing (Bypass Whitelisting)

Audit Guideline

  1. Try to access the application from any network except the whitelisted one.
  2. Capture the base request in the burp community and send the request to the repeater.
  3. Add X-Forwarded-For in the request and the IP that has whitelisted for application access.
  4. Observe the application will respond normally. Hence, bypassed the whitelisting to access the application.
Proof of Concept


Request without X-Forwarded-For Header


Request with X-Forwarded-For Header

Account Takeover via Forgot Password — A Practical Attack Scenario of Host Header Injection

Audit Guideline

  1. Capture the change password request in the burp community and send the request to the repeater.
  2. Add one more Host Header with the custom domain as a value in the request and send the request.
  3. Observe the victim will get the password reset mail having a link with a custom domain and the token. Once the victim clicks on the link, the attacker will get the link in his web logs.
Proof of Concept


Original Reset Password link mail


Modified reset link request


Reset password link mail with attacker provided domain

Security blog of the month

JWTweak v2.1 – A Guided, Offline Toolkit for Modern JWT Attacks

Introduction JSON Web Tokens sit at the heart of modern authentication – and because the token travels in the user’s hands, a single weak check on the server side can hand an attacker an admin account. JWTweak was built to test for exactly these flaws. It started as a small utility to switch a token’s algorithm and re-issue it in seconds, helping security enthusiasts hunt for issues like the JWT Algorithm Confusion Attack. Version 2.1 is a complete rewrite into a guided, menu-driven toolkit: you paste a token, it decodes and risk-analyses it, recommends the attacks that fit, and walks you through each one – entirely offline, with no flags to memorise. In this post we’ll tour the tool and then break into a deliberately vulnerable app with two live proof-of-concept attacks.
Post a Comment
Read more