How to get ROOT in the system through the WEB application

Risk of web vulnerebility is very high, the malicous user can get the root system from his vulner. with root user we can do what we want. so,

I will to explain how to hack root user through web application, I recommend to build your own lab, because it is safer to learn. let's start ...!!! 

WebGoat Installation - OWASP

WebGoat is a deliberately vulnerable Web application, now including helpful hints and videos to guide you into hacking it. 

=> Instal Java or download at http://java.com
=> Insatall Apache Tomcat or download at http://tomcat.apache.org/  

=> Download the WebGoat at here

=> extract it using command :

   p7zip -d WebGoat-OWASP_Standard-5.3_RC1.7z

File Inclusion (DVWA)

LFI (Local File Inclusion) is a hole at the site where the attacker can access all files on the server with only through the URL.

RFI (Remote File Inclusion) is a hole where the site permits an attacker to include a file from outside the server.

SQL Injection (DVWA)

SQL injection or SQLi is a code injection technique that exploits a security vulnerability in some computer software. An injection occurs at the database level of an application (like queries). The vulnerability is present when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and unexpectedly executed

BUSINESS LOGIC TESTING

Testing for business logic flaws in a multi-functional dynamic web application requires thinking in unconventional ways. If an application’s authentication mechanism is developed with the intention of performing steps 1,2,3 in order to
authenticate, what happens if you go from step 1 straight to step 3? In this simplistic example, does the application provide access by failing open, deny access, or just error out with a 500 message? There are many examples that can be made, but the one constant lesson is “think outside of conventional wisdom”. This type of vulnerability cannot be detected by a vulnerability scanner and relies upon the skills and creativity of the penetration tester. In addition, this type of vulnerability is usually one of the hardest to detect, but, at the same time, usually one of the most detrimental to the application, if exploited.

DATA VALIDATION TESTING

TESTING FOR REFLECTED CROSS SITE SCRIPTING (OWASP-DV-001)
Reflected Cross-site Scripting (XSS) is another name for non-persistent XSS, where the attack doesn’t load with the vulnerable web application but is originated by the victim loading the offending URI. In this article we will see some ways to test a web application for this kind of vulnerability.

AUTHORIZATION TESTING

Testing for Path Traversal (OWASP-AZ-001)

Many web applications use and manage files as part of their daily operation. Using input validation methods that have not been well designed or deployed, an aggressor could exploit the system in order to read/write files that are not intended to be accessible. In particular situations, it could be possible to execute arbitrary code or system commands.

Stage a

Input Vectors Enumeration (a systematic evaluation of each input vector)

Stage b

Testing Techniques (a methodical evaluation of each attack technique used by an attacker to exploit the
vulnerability)

Session Management Testing

These mechanisms are known as Session Management and, while they're most important in order to increase the ease of
use and user-friendliness of the application, they can be exploited by a penetration tester to gain access to a user account,
without the need to provide correct credentials. In this test, we want to check that cookies and other session tokens are
created in a secure and unpredictable way. An attacker who is able to predict and forge a weak cookie can easily hijack the
sessions of legitimate users.

Authentication Testing

<Credentials transport over an encrypted channel (OWASP-AT-001)>
not found
<Testing for user enumeration (OWASP-AT-002)>
>>we are test for valid user/right password
>>now i will try to insert a invalid userID and wrong password

Configuration Management Testing

Often analysis of the infrastructure and topology architecture can reveal a great deal about a web application. Information such as source code, HTTP methods permitted, administrative functionality, authentication methods, and infrastructural configurations can be obtained.

INFORMATION GATHERING

Intelligence assessment is the development of forecasts of behaviour or recommended courses of action to the leadership of an organisation, based on a wide range of available information sources both overt and covert. Assessments are developed in response to requirements declared by the leadership in order to inform decision making. Assessment may be carried out on behalf of a state, military or commercial organisation with a range of available sources of information available to each.