Wstg Info 06

wstg-info-06

Test ID

WSTG-INFO-06

Test Name

Identify Application Entry Points

High-Level Description

Entry points are the interfaces through which user-supplied data enters the application. Identifying all entry points is critical for mapping the application's attack surface before conducting targeted security tests. Entry points include URL parameters, POST body data, HTTP headers, cookies, file uploads, and any other mechanism that accepts user input. A comprehensive understanding of entry points allows penetration testers to systematically test each input vector for vulnerabilities such as injection, access control bypasses, and business logic flaws.

What to Check

Entry Point Categories

• URL query string parameters (GET)
• POST body parameters
• HTTP headers (custom and standard)
• Cookies and session tokens
• Hidden form fields
• File upload fields
• RESTful URL path parameters
• JSON/XML request bodies
• WebSocket messages
• GraphQL queries
• SOAP envelopes

Information to Document

• Parameter names and locations
• Data types (string, integer, boolean, etc.)
• Accepted value ranges
• Required vs optional parameters
• Authentication requirements
• Multi-step process flows
• State-dependent parameters
• Encoding schemes used

How to Test

Step 1: Configure Proxy and Browse Application

Burp Suite Setup

1. Configure browser to use Burp proxy (127.0.0.1:8080)
2. Enable interception or passive logging
3. Add target to scope
4. Browse all application functionality
5. Review Site Map for discovered endpoints

OWASP ZAP Setup

1. Launch ZAP and configure browser proxy
2. Enable HUD or traditional interface
3. Add target URL to context
4. Spider the application
5. Review Sites tree for entry points

Step 2: Analyze GET Requests

GET /app/search?query=test&category=all&page=1&sort=desc HTTP/1.1
Host: target.com
Cookie: session=abc123; preference=dark
User-Agent: Mozilla/5.0
Referer: https://target.com/home
X-Requested-With: XMLHttpRequest

Entry Points in GET Request

Step 3: Analyze POST Requests

POST /app/checkout HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded
Cookie: session=abc123

product_id=100&quantity=2&price=50.00&discount_code=SAVE10&shipping=express

Entry Points in POST Request

Step 4: Analyze JSON/API Requests

POST /api/v1/users HTTP/1.1
Host: target.com
Content-Type: application/json
Authorization: Bearer eyJhbGciOiJIUzI1...
X-API-Key: abcd1234

{
    "username": "newuser",
    "email": "user@example.com",
    "role": "user",
    "permissions": ["read", "write"],
    "metadata": {
        "source": "web",
        "version": "2.0"
    }
}

Entry Points in JSON Request

Step 5: Analyze RESTful URL Patterns

GET /api/users/123/orders/456/items

URL Path Parameters

Step 6: Analyze Response Headers

HTTP/1.1 200 OK
Server: nginx/1.18.0
Set-Cookie: session=newvalue; HttpOnly; Secure
Set-Cookie: tracking=xyz; Path=/
X-Request-ID: req-12345
X-Debug-Mode: enabled
Cache-Control: no-cache
Content-Type: application/json

Notable Response Elements

Step 7: Document Hidden Form Fields

<form action="/checkout" method="POST">
  <input type="hidden" name="csrf_token" value="abc123" />
  <input type="hidden" name="user_id" value="500" />
  <input type="hidden" name="base_price" value="100.00" />
  <input type="hidden" name="is_admin" value="false" />
  <input type="text" name="quantity" value="1" />
  <button type="submit">Purchase</button>
</form>

Hidden Field Analysis

Step 8: Map Multi-Step Processes

Document workflows that require multiple requests:

1. GET /cart → View cart
2. POST /cart/apply-coupon → Apply discount
3. GET /checkout → Checkout page
4. POST /checkout/address → Submit address
5. POST /checkout/payment → Submit payment
6. POST /checkout/confirm → Confirm order

Process Flow Entry Points

Step 9: Identify WebSocket Endpoints

// Browser DevTools > Network > WS
ws://target.com/socket
wss://target.com/secure-socket

// WebSocket message format
{"action": "subscribe", "channel": "orders", "user_id": 123}

Step 10: Document GraphQL Entry Points

# GraphQL query entry points
query {
  user(id: 123) {
    name
    email
    orders {
      id
      total
    }
  }
}

mutation {
  updateUser(id: 123, role: "admin") {
    success
  }
}

Tools

Proxy Tools

Automated Discovery

API Analysis

Example Commands/Payloads

Burp Suite Entry Point Extraction

1. Navigate to Target > Site map
2. Right-click target > Engagement tools > Analyze target
3. Review "Entry points" section
4. Export parameters: Target > Site map > Right-click > Copy URLs

Arjun - Hidden Parameter Discovery

# Install
pip3 install arjun

# Basic scan
arjun -u https://target.com/page

# With wordlist
arjun -u https://target.com/page -w params.txt

# JSON body parameters
arjun -u https://target.com/api -m POST -c 'Content-Type: application/json'

# Multiple URLs
arjun -i urls.txt -o results.json

ParamSpider - URL Parameter Extraction

# Install
git clone https://github.com/devanshbatham/paramspider
cd paramspider
pip3 install -r requirements.txt

# Basic usage
python3 paramspider.py -d target.com

# Exclude specific parameters
python3 paramspider.py -d target.com -e js,css,png

# Output to file
python3 paramspider.py -d target.com -o params.txt

x8 - Hidden Parameter Discovery

# Install (Rust required)
cargo install x8

# Basic scan
x8 -u https://target.com/page -w params.txt

# With method and body
x8 -u https://target.com/api -X POST -b '{"test":"value"}'

Custom Entry Point Documentation Script

#!/bin/bash
# Extract entry points from Burp Suite export

INPUT_FILE=$1
OUTPUT_FILE="entry_points.csv"

echo "URL,Method,Parameter,Location,Type" > $OUTPUT_FILE

# Parse URLs for GET parameters
grep -oP 'https?://[^\s]+' $INPUT_FILE | while read url; do
    # Extract query parameters
    echo "$url" | grep -oP '\?[^#]+' | tr '&' '\n' | while read param; do
        name=$(echo $param | cut -d= -f1 | tr -d '?')
        echo "$url,GET,$name,Query String,Unknown" >> $OUTPUT_FILE
    done
done

echo "Entry points saved to $OUTPUT_FILE"

Entry Point Documentation Template

## Endpoint: /api/users/{id}

### Request

- **Method**: PUT
- **Authentication**: Required (Bearer token)
- **Content-Type**: application/json

### Parameters

| Name          | Location | Type    | Required | Description   |
| ------------- | -------- | ------- | -------- | ------------- |
| id            | URL Path | Integer | Yes      | User ID       |
| Authorization | Header   | String  | Yes      | JWT Token     |
| name          | Body     | String  | No       | Display name  |
| email         | Body     | String  | No       | Email address |
| role          | Body     | Enum    | No       | user/admin    |

### Example Request

```json
PUT /api/users/123
Authorization: Bearer eyJ...
Content-Type: application/json

{
    "name": "John Doe",
    "email": "john@example.com",
    "role": "user"
}
```

Test Cases

• IDOR: Try accessing other user IDs
• Privilege escalation: Change role to admin
• SQL injection in path parameter
• Mass assignment via role field

---

## Remediation Guide

### 1. Input Validation

```python
# Server-side validation example
def validate_user_input(data):
    schema = {
        'username': {'type': 'string', 'minlength': 3, 'maxlength': 50},
        'email': {'type': 'string', 'regex': r'^[^@]+@[^@]+\.[^@]+$'},
        'age': {'type': 'integer', 'min': 0, 'max': 150},
        'role': {'type': 'string', 'allowed': ['user', 'moderator']}
    }
    # Validate against schema
    return validate(data, schema)

2. Minimize Exposed Parameters

<!-- BAD: Exposing sensitive data -->
<input type="hidden" name="price" value="100.00" />
<input type="hidden" name="is_admin" value="false" />

<!-- GOOD: Server-side price lookup -->
<input type="hidden" name="product_id" value="SKU123" />
<!-- Price calculated server-side based on product_id -->

3. Implement Proper Access Controls

# Check ownership before processing
def update_order(request, order_id):
    order = Order.objects.get(id=order_id)
    if order.user_id != request.user.id:
        return HttpResponseForbidden()
    # Process update

4. Use Security Headers

Set-Cookie: session=value; HttpOnly; Secure; SameSite=Strict
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Content-Security-Policy: default-src 'self'

5. Rate Limiting

# nginx rate limiting
limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s;

server {
    location /api/ {
        limit_req zone=api burst=20 nodelay;
    }
}

6. Monitor Reconnaissance Activity

• Log all 404 errors and unusual parameter patterns
• Alert on parameter fuzzing signatures
• Implement honeypot parameters

Risk Assessment

CVSS Score

This is a reconnaissance/enumeration activity, not a direct vulnerability. The CVSS score depends on what is discovered:

Entry Point Mapping (Info)

• Base Score: 0.0 (Informational)
• This is a testing methodology, not a finding

Excessive Entry Points (Observation)

• Wide attack surface may indicate architectural concerns
• Recommend minimizing unnecessary parameters

Attack Surface Indicators

CWE Categories

References

OWASP References

• OWASP WSTG - Identify Application Entry Points
• OWASP Attack Surface Analysis Cheat Sheet

Tools

• Burp Suite
• OWASP ZAP
• Arjun
• ParamSpider

Additional Resources

• Attack Surface Detector
• Param Miner (Burp Extension)

Checklist

[ ] Proxy configured and traffic captured
[ ] All GET parameters documented
[ ] All POST parameters documented
[ ] Hidden form fields identified
[ ] Cookie parameters noted
[ ] Custom headers recorded
[ ] RESTful path parameters mapped
[ ] JSON/XML body parameters extracted
[ ] File upload fields identified
[ ] WebSocket endpoints documented
[ ] GraphQL queries analyzed
[ ] Multi-step processes mapped
[ ] Authentication requirements noted
[ ] Parameter data types identified
[ ] Required vs optional parameters distinguished
[ ] Response headers analyzed
[ ] Entry point spreadsheet/document created
[ ] Attack surface summary prepared