Web Application Penetration Testing Checklist

A great article that can be used as a checklist for perform web application penetration testing (webapp pentesting). 

Pentesting webapp requires a consistent methodology to perform repeatable tasks such as authentication and authorization checking, input validation checking, session management testing, etc.

Here's a detail cheat sheet for webapp pentesting methodology:

1. Information Gathering
2. Authentication Testing
3. Authorization Testing
4. Configuration Management Testing
5. Session Management Testing
6. Data Validation Testing
7. Denial of Service Testing

Links:

• https://gbhackers.com/web-application-penetration-testing-checklist-a-detailed-cheat-sheet/
  

Install ModSecurity for Nginx on Ubuntu

WebApp security can be a huge challenge especially with the prevalence of malicious tools such as rootkits, scanners, bots, and other malware. Although getting breached may seem a matter of when if not if, it is prudent to implement some decent security measures to safeguard your web applications.

One of the tools that can provide a decent level of security against attacks is called ModSecurity. This is a free and open-source Web Application Firewall (WAF) that can protects your web applications from a vast array of layer 7 attacks such as cross-site scripting (XSS), SQL injection, session hijacking, and many more.

In this guide, it show how to install and configure ModSecurity to work with Nginx on Ubuntu from source.

Steps:

1. Install dependencies
2. Install latest Nginx version
3. Download Nginx source package
4. Install the Libmodsecurity3 library
5. Download and compile ModSecurity v3 Nginx Connector
6. Load the ModSecurity Nginx Connector module
7. Download OWASP corerule set
8. Testing out ModSecurity
   

ModSecurity

Links:

• https://www.tecmint.com/install-modsecurity-nginx-debian-ubuntu/