

Jump to: navigation, search
(Black Box testing and example)
Line 1: Line 1:
{{Template:OWASP Testing Guide v3}}
{{Template:OWASP Testing Guide v3}}
== Brief Summary ==
== Brief Summary ==

Revision as of 04:30, 29 June 2008

OWASP Testing Guide v3 Table of Contents



Brief Summary


Description of the Issue

Before any testing begins always get a good understanding of the application and how the user/browser communicates with it as you walk through the application. As you walk through the application pay special attention to all HTTP requests (GET and POST Methods also known as Verbs) as well as every parameter and form field that is passed to the application. In addition to this pay attention to when GET requests are used and when POST requests are used to pass parameters. It is very common that GET requests will be used, but when sensitive information is passed it will often be done within the body of a POST request. Note that to see the parameters sent in a POST request you will need to use a tool such as an intercepting proxy (for example OWASP's Webscarab) or a browser plug-in. Within the POST request also make special note of any hidden form fields that are being passed to the application as these usually contain sensitive information such as state information, quantity of items, the price of items, etc. that the developer never intended for you to see or change.

In the author's experience it has been very useful in using an intercepting proxy and a spreadsheet for this stage. The proxy will keep track of every request and response between you and the application as you walk through it. Additionally at this point the tester usually traps every request and response so that they can see exactly every header, parameter, etc. that is being passed to the application and what is being returned. This can be quite tedious at times especially on large interactive sites (think of a banking application) but with experience of knowing what to look for this time can be significantly reduced. As you walk through the application and notice any interesting parameters in the URL, custom header, or body of the message then note this in your spreadsheet. The spreadsheet should include the page you requested (might be good to add the request number from the proxy here also for reference), the interesting parameters, the type of request (POST/GET), authenticated/unauthenticated access, if SSL is used, if it's part of a multi-step process, and any other relevant notes. Once you have every area of the application mapped out then you can go through the application and test each of the areas that you have identified and make notes for what worked and what didn't work. The rest of this guide will identify how to test each of these areas of interest but this section must be undertaken before any of the actual testing can commence.

Below are some points of interests for all requests and responses. Within the requests section focus on the GET and POST methods as these are the majority of the requests that are used. Also note that are other Methods that can be used such as PUT and DELETE which can be very dangerous if allowed. There is a special section in this guide dedicated for testing those HTTP Methods.


  • Identify where GETs are used and where POSTs are used


  • Identify where new cookies are set (set-cookie directive), modified or added to.
  • Identify where there are any redirects (300 type messages), 400 type messages in particular 403 Forbidden, and 500 internal server errors during normal responses (i.e. unmodified requests).
  • Also note where any interesting headers are identified such as "Server: BIG-IP" which indicates the site is being load balanced. Thus if load balanced and one server is incorrectly configured then you might have to make multiple requests to access the vulnerable server depending on the type of load balancing used.

Black Box testing and example

Testing for application entry points:



Example 1 of a simplified GET request:

Result Expected:




Example 2 of a simplified POST request:

Body of the POST message:


Result Expected:


Gray Box testing and example




  • Intercepting Proxy (for example OWASP's Webscarab, Burp proxy, or Paros Proxy)
  • Browser Plug-in (for example TamperIE for Internet Explorer or Tamper Data for Firefox)