5 Lessons Learned From Hundreds of Penetration Tests

Attackers are still leveraging cross-site scripting (XSS). XSS has long been a popular Web application vulnerability. In 2021, it came off the Open Web Application Security Project (OWASP) top 10 list due to improvements in application development frameworks, but it's still evident in nearly every penetration test we perform.

It's often thought of as low risk, but the XSS risks can be severe, including account takeover, data theft, and the complete compromise of an application's infrastructure. Many developers think that using a mature-input validation library and setting proper HttpOnly cookie attributes is enough, but XSS bugs still find a way in when custom code is used. Take WordPress sites, for example — an XSS attack that targets an administrator is critical because the credentials allow the user to load plug-ins, thus executing code-like malicious payloads on the server.

Automated scanners don't go far enough. If you're only scanning Web applications using automated tooling, there's a good chance that vulnerabilities slip through the cracks. Those tools use fuzzing — a method that injects malformed data into systems — but that technique can create false positives.

Scanners are typically not up to date with modern Web development and don't offer the best results for JavaScript single-page applications, WebAssembly, or Graph. Complicated vulnerabilities need a handcrafted payload to validate them, making the automated tools less effective.

There's a human element required for the most accurate and detailed analysis of vulnerabilities and exploits, but these scanners can be a complementary resource to quickly find the low-hanging fruit.

When authentication is homegrown, it's usually too weak. Authentication is everything to securing a Web application. When developers try to create their own forgotten password workflow, they typically don't do it in the most secure way.

Pen testers often get access to other users' information or have excessive privileges that aren't in line with their role. This creates horizontal and vertical access control issues that can allow attackers to lock users out of their accounts or compromise the application.

It's all about how these protocols are implemented. Security Assertion Markup Language (SAML) authentication, for instance, is a single sign-on protocol that's becoming more popular as a means of increasing security, but if you implement it incorrectly, you've opened more doors than you've locked.

Attackers target flaws in business logic. Developers look at features to determine whether they accomplish a customer's use case. They're often not looking from the other side of the lens to identify how an attacker might use that feature maliciously.

A great example is the shopping cart for an e-commerce website. It's business-critical, but often not secure, which creates severe vulnerabilities such as zeroing out the total at checkout, adding items after checkout, or replacing products with other SKUs.

It's hard to blame developers for focusing on the primary use case and not recognizing other, typically nefarious, uses. Their performance is based on delivering the feature. Executives need to see the other side of the coin and understand that the business logic should correlate to security logic. The features with the highest business value, such as a shopping cart or authentication workflow, probably aren't the job for a junior developer.

There's no "out of scope" in a good penetration test. Web applications can quickly become complex based on how many resources and assets go into them. Back-end API servers that enable the functionality of the main application need to be considered.

It's important to share all those external assets, and how they connect to what the developers built, with security auditors that conduct penetration tests. The developer may consider those assets to be "out of scope" and that they therefore aren't responsible for them, but an attacker wouldn't respect that line in the sand. As penetration tests show, nothing is "out of scope."