Web Application Security: Port Scanning, OSINT, and XSS Attacks

Web Application Security, Port Scanning and OSINT
1

Contents
List of figures...................................................................................................................................2
NMAP..............................................................................................................................................3
OPEN PORT:...............................................................................................................................3
CLOSED PORT:..........................................................................................................................3
FILTERED PORT:......................................................................................................................4
OSINT..............................................................................................................................................8
Persistent & Non- Persistent Cross Site Scripting attack:...............................................................9
Persistent Cross Site Scripting attack...........................................................................................9
Non- Persistent Cross Site Scripting attack:..............................................................................10
Sensitive Data Exposure................................................................................................................12
OSWAP 10-2017 attacks:..........................................................................................................13
References......................................................................................................................................13
List of figures
Figure 1: OS detection.....................................................................................................................5
Figure 2: Track Information............................................................................................................7
Figure 3: Host service version number............................................................................................7
Figure 4: Persistent attack..............................................................................................................10
Figure 5: Reflected XSS attack......................................................................................................11
2

NMAP
Nmap is a free security scanner which is used to determine the hosts & the services on the
computer network. We can see Nmap as building a ‘map’ on the computer network. To analyze
the response, crafted packets are sends to the hosts. Nmap is started for the Linux only, but now
it is ported to windows, Solaris and many other platforms. It can be adjusted to various network
conditions with latency & congestion during a scan and it continues to extend and improve the
tool periodically.
Following are the features of Nmap:
• Host discovery: host is discovered in the host discovery features.
• Port Scanning: Identifying the open ports on target has.
• OS detection: OS detection determine the operation system in addition with hardware
characteristics of the computing and network device.
• Version detection: It is used to discover the name of the application and the number of
the version (Lyon, 2009).
A)
OPEN PORT:
Open port is a port which accepts the TCP and UDP connections on this port. The primary goal
of scanning is to find the type of connection. The person who find the connection knows about
the possibility of attack. The open port are closed & protect by the administrators from the
firewalls. These ports are also doing non- security scanning to know about the available services
on the specified network.
CLOSED PORT:
Closed port cannot be listening but it can be accessible. This port shows that on a specified IP
address the host is up. The scanning is worthy in the closed port which might be realized later.
Such port can be blocked by using firewalls by administrator.
3

FILTERED PORT:
Sometimes, Nmap is not available to determine whether the port is open or not because the
filtering of packets prevents it from reaching ports. These ports are considered as the firewall or
host based firewalls. These are useful when attacker wants to attack by providing little
information.
The scan is probably slow by forcing the Nmap to do the scan several times in the case of
network congestion..
B)
Command for identifying the OS:
-O is used to detect the operating system. –A can also be used to detect the Operating System in
addition with other things.
Syntax: nmap –O –v oversiondetect.txt 192.168.2.100
4