The Ethical Hacker Network - Zend Framwork

Latest Additions

Who's Online

ledieu

Newbie

Offline

Posts: 2

Zend Framwork - Pentest

« on: January 14, 2012, 08:08:09 AM »

Hi there,

Soon i'll be performing an pentest on a webapplication that has been build using the Zend framework.
Are there any suggestions what I should look for besides the normal web vulnerabilities? So anything in particular related to the Zend framework?

Cheers.
LeDieu.


	Logged

millwalll

Guest

Re: Zend Framwork - Pentest

« Reply #1 on: January 15, 2012, 06:44:14 AM »

If I was you I would look for owasp top 10 then look for default directories might be idea to install zend on local machine to have look where things like database settings are stored.

Apart from that it hard to give any more advice as it depends on what version they are using.


	Logged

MaXe

Hero Member

Offline

Posts: 669

I've just upgraded myself to a cyborg muahahaa!!1

Re: Zend Framwork - Pentest

« Reply #2 on: January 15, 2012, 01:53:21 PM »

Along with what Jamie.R suggested, try to do a completely "default" installation, where you don't alter settings to improve security. Look for misconfigurations that could lead to various types of bugs as described in e.g., the owasp top 10 or whatever you prefer

For many years, cPanel had a few misconfigurations that lead to e.g., dns zone transfers, etc.


	Logged

I'm an InterN0T'er

nytfox

Newbie

Offline

Posts: 20

Re: Zend Framwork - Pentest

« Reply #3 on: January 29, 2012, 01:35:42 AM »

I'm not sure how much this will help . but in to knowledge Zend Core Framework is pretty secured, once I did a pentest on a Zend . their was not much exploit . but I found some XSS , and Redirection flows and miss functions in vote poll . all because of poor verification on submitions


	Logged

Unlike others I love NULLS
http://treasuresec.com

ledieu

Newbie

Offline

Posts: 2

Re: Zend Framwork - Pentest

« Reply #4 on: January 29, 2012, 02:40:56 AM »

Quote from: nytfox on January 29, 2012, 01:35:42 AM

@nytfox Ahh great thanks mate that is just the stuff I was looking for!

@Jamie.R and @MaXe Thanks for your advice, but your advice is more applicable to PHP in general. OWASP Top 10 and default installation failures are pretty common in the default PHP install. But I am really looking for issues that Zend framework based apps have. Still thanks for your comment though!

LeDieu