This project demonstrates practical web application security testing using the WebGoat training platform. The assessment focuses on identifying and exploiting common web vulnerabilities including SQL Injection (SQLi), Cross-Site Scripting (XSS) and Session Hijacking.
The vulnerabilities explored in this project align with common OWASP Top 10 web application security risks. This project simulates real world web application security testing scenarios used in penetration testing and vulnerability assessment.
- Understand common web application vulnerabilities
- Perform SQL Injection attacks
- Test reflected and stored XSS payloads
- Analyze insecure session handling
- Observe requests and responses using OWASP ZAP
- WebGoat
- OWASP ZAP
- Kali Linux
- Browser Developer Tools
- VirtualBox
- Performed SQL Injection attacks using crafted payloads
- Retrieved data from vulnerable database queries
- Executed reflected and stored XSS payloads
- Tested DOM based XSS behavior
- Observed cookie manipulation and session hijacking
- Captured and analyzed HTTP requests using OWASP ZAP
This demonstrates a SQL Injection payload used to manipulate database queries and bypass input validation.
This demonstrates successful retrieval of database information using SQL Injection techniques.
This demonstrates execution of a reflected XSS payload using JavaScript alert execution in the browser.
This demonstrates a stored XSS payload executing within the application environment.
This demonstrates how insecure session handling and cookie manipulation can affect session security.
This demonstrates request capture and inspection using OWASP ZAP.
- SQL Injection can expose sensitive database information
- XSS vulnerabilities allow execution of malicious scripts in user browsers
- Insecure session handling increases risk of session hijacking
- Improper input validation is a major security weakness
- OWASP ZAP is effective for analyzing web requests and responses
- Learned practical web application testing techniques
- Understood SQL Injection and XSS attack methodology
- Gained experience using OWASP ZAP for request analysis
- Learned how insecure session handling can be exploited
- Improved understanding of OWASP Top 10 vulnerabilities
- Use parameterized queries / prepared statements
- Validate and sanitize user input
- Implement Content Security Policy (CSP)
- Use HttpOnly and Secure cookie flags
- Implement secure session management
This project demonstrates foundational web application security testing skills and highlights the importance of secure coding, input validation and proper session management in modern web applications.
Harsh – Cybersecurity Enthusiast