21. Web Application Testing Tools
21.8 Red vs Blue, Project and Real Incidents
Chala mitrano, Burp, ZAP, Gobuster, sqlmap, WPScan shiklo – aata Purple Team loop. Red lab madhe proxy aani dir bust ne weak forms / backup paths / client-side-only checks dakhavto; Blue server-side validation, prepared statements, WAF/rate-limit, hidden dirs band, WordPress plugins update karto. Tumhi Raja-Rani Traders style OWN DVWA / helper site madhe build → hack → fix karun prove kara ki scan surface shrink hote. Tool awareness; fix = career. Samjla ka?
Red Team vs Blue Team – web application testing tools
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
| Burp/ZAP intercept to show client-side-only checks can be bypassed in the proxy | Server-side validation on every input; never trust JavaScript alone; log rejected requests |
Gobuster/Dirb wordlists find /admin, /backup, .bak, old configs |
Disable directory listing; remove backup/test files from web root; 403/404 hygiene; WAF path rules |
| sqlmap awareness against DVWA (security=low) injectable parameters | Prepared statements / parameterised queries; least-privilege DB user; raise DVWA to high in lab to prove |
| WPScan enumerates users / outdated plugins on a lab WordPress | Update core/themes/plugins; strong admin password + 2FA; limit username enumeration |
| Leaves Burp Intruder / automated scans aimed at public or classmate sites | Written scope; host-only targets only (192.168.56.20 / .50); rate-limit and WAF on real apps |
| Trusts ZAP "High" alerts without manual confirm | Reproduce in Burp Repeater; fix root cause; re-scan; document false positives |
Defender chi simple checklist: server-side checks → prepared statements → no backup files in web root → hide listing → update CMS plugins → WAF/rate-limit → re-verify with Gobuster/ZAP. Attack tools Kali var; bachav code aani config Blue var. Interview madhe "I can click Intruder" peksha "I can prove the fix and shrink Gobuster hits" jast strong.
# OWN host-only only – Kali 192.168.56.10 → DVWA on Metasploitable 192.168.56.20
# (or a tiny OWN PHP form on helper 192.168.56.50 – Raja-Rani shop lab)
mkdir -p ~/labs/raja-rani-web
# Pre-fix: hidden paths (lab only)
gobuster dir -u http://192.168.56.20/dvwa -w /usr/share/wordlists/dirb/common.txt \
-x php,txt,bak -o ~/labs/raja-rani-web/gobuster-pre.txt
# Optional helper site YOU built on .50:
# gobuster dir -u http://192.168.56.50/ -w /usr/share/wordlists/dirb/common.txt -x php,txt,bak
# ZAP/Burp: browse DVWA through the proxy; note client-side-only checks in Repeater (manual)
# sqlmap: awareness only against DVWA low as in 21.6 – then set security=high and show it fail
# On Amazon Linux / Ubuntu helper you own – defender moves:
# sudo yum update # or apt on Ubuntu
# remove backup files from the web root; Options -Indexes / autoindex off;
# sudo service httpd restart # or sudo service nginx restart after config test
Ravindra Bagale's Tip
Students Burp ne client-side bypass dakhavtat ani "hack zala" mhantat – pan Fix nahi kartat. Dusri common chuk: Gobuster ne .bak / /admin milala tari web root madhe backup files thevne. Rule: proxy finding → server-side fix → re-Gobuster / re-ZAP. sqlmap awareness lab madhe; production madhe prepared statements. CEH exam modules madhe web tools yetat – defence line nehmi joda. Ghabru naka, practice ne yetay.
Lab
DVWA security low theva. Gobuster common.txt + -x php,txt,bak ne paths note kara. Burp madhe ek form request Repeater la pathva – client-side check bypass demo (lab only). Mag security high kara (kiwa tumchya OWN PHP form var server-side check add kara) ani teach request punha pathva – behaviour fark liha. sqlmap lab (21.6) high var fail hota ka te confirm kara. Output ~/labs/raja-rani-web/ madhe save.
Project: Build it, hack it, fix it
Build: For fictional Raja-Rani Traders (Nashik) shop website practice, use DVWA on Metasploitable 192.168.56.20 at security low, and/or a tiny OWN PHP contact/price form on helper 192.168.56.50 (host-only) that checks price or role only in JavaScript. Deliberately leave:
- A backup file in the web root (e.g.
config.php.bakorbackup.zip– lab only, fake data) - Directory listing on or an obvious
/admintest folder - DVWA security = low (injectable training page as already used in 21.6)
Snapshot pre-web-tools-surface. No bridged adapter. Ethics card apply kara.
Hack (lab only – awareness, no new exploit chains): From Kali 192.168.56.10:
- Gobuster/Dirb against DVWA /
.50– show backup/admin paths - Burp Proxy + Repeater: demonstrate that client-side-only checks do not protect the server
- sqlmap against DVWA SQL Injection at low (as in 21.6) to list DBs – then stop; do not invent new payloads
- Optional WPScan only if you run a WordPress lab VM you own
Prove noisy surface + weak validation. Never aim these tools at public shops or classmate sites.
Fix:
- Raise DVWA security to high; on OWN PHP, move checks server-side and use prepared statements (pointer to Chapter 27)
- Delete backup/test files from the web root;
Options -Indexes/autoindex off; - Block sensitive paths at the reverse proxy / WAF; rate-limit login and search forms
- Update WordPress plugins/themes if that lab exists; disable user enumeration where the platform allows
sudo service httpd restartorsudo service nginx restartafterhttpd -t/nginx -t- On Amazon Linux helpers:
sudo yum updatefor package fixes
Re-verify: Same Gobuster wordlist – backup hits gone or 404; Burp bypass of the old client-only check no longer changes server state; sqlmap against DVWA high fails or surface shrinks; ZAP High alerts drop after confirm. 1-page Purple note for owner Rani: finding → risk → fix → evidence. Peer-review with Amir / Ravina. No real payment data, no internet targets.
Real incident: British Airways Magecart-style card skimming (2018)
In 2018, British Airways suffered a widely reported payment-data incident. Public ICO materials and industry reporting describe attackers who obtained a foothold (including via compromised third-party access paths) and later modified website payment-page script behaviour so card details entered by customers were copied to an attacker-controlled destination – a Magecart-style web-skimming pattern – while some card data was also exposed from insecure logging. Hundreds of thousands of customers were reported affected; the UK ICO later issued a substantial fine (reported final figure £20 million after reductions). Weakness: web supply-chain / script integrity failures + insufficient monitoring of payment-page changes + weak controls around privileged access. What would have reduced it: Subresource Integrity / strict script allow-lists, CSP, change detection on checkout pages, MFA and least privilege for remote access, no plaintext card logging, and faster anomaly detection. Lab lesson: Gobuster finding old JS/backup files and Burp showing unexpected requests are early warnings – Blue must protect what the browser loads. Source: UK ICO British Airways penalty notice (2020) and major reporting on the 2018 BA / Magecart-style events (verify summaries).
Real incident: Capital One cloud/WAF misconfiguration (2019)
In 2019, Capital One reported unauthorized access to data stored in its cloud environment. Public company statements and court-related reporting describe a misconfigured web application firewall / reverse-proxy style component plus overly broad permissions; after that foothold, SSRF-style access to cloud instance metadata was widely discussed as how temporary credentials were obtained to list and copy data from storage buckets. Capital One reported personal information related to on the order of 100 million U.S. applicants/customers (and additional Canadian records). Weakness: WAF/app-layer misconfiguration + excessive IAM permissions + SSRF path to metadata. What would have reduced it: harden and continuously scan WAF/proxy configs, least-privilege roles, block or restrict instance metadata (IMDSv2-style controls), SSRF-safe URL handling, and alerts on unusual cloud API activity (e.g. GuardDuty-class monitoring). Lab lesson: tools like Burp/ZAP help you see server-side request and access-control mistakes in your OWN apps – fix config and permissions, then re-test. Source: Capital One public incident notice (July 2019); AWS responses on misconfigured firewall + SSRF discussion; court complaint reporting (verify current summaries).
Interview model (clean English): "I use Burp, ZAP, Gobuster and sqlmap only against my host-only lab (DVWA or apps I built). I treat every finding as a Blue task – server-side validation, prepared statements, no backup files in the web root, plugin updates, WAF/rate-limits – and I re-run the same scans to prove the surface shrank."
Thodkyaat: web tools shika, pan server-side fix aani re-scan shika. Aata pudhe passwords – ethics card sobat. Chala pudhe, mitrano!
Thodkyaat sangaycha tar
- An intercepting proxy lets you read and change every request; server-side validation is the only real security.
- Burp Suite: Proxy/Intercept to see traffic, Repeater to test one input, Intruder to automate (watch the Length column).
- OWASP ZAP is a free alternative with a free automated scanner – good first pass, still confirm manually.
- Gobuster/Dirb find hidden directories and files; never ignore a 403.
- sqlmap finds and exploits SQL injection – lab only; understand the concept, not just the tool.
- WPScan checks WordPress; outdated plugins are the usual way in.
Samjla ka? Aata web tools tumchya haati aahet. Pudhchya chapter madhe passwords kade valu – John, Hashcat aani Hydra. Chala pudhe, mitrano!