Downloaded 113 times
![Alan Kan Technical Manager IBM Rational Software [email_address] Get Ready for Web Application Security Testing](https://image.slidesharecdn.com/100216-tpn-securitytesting-111030210918-phpapp01/85/Get-Ready-for-Web-Application-Security-Testing-1-320.jpg)
![Alan Kan Technical Manager IBM Rational Software [email_address] Get Ready for Web Application Security Testing](https://image.slidesharecdn.com/100216-tpn-securitytesting-111030210918-phpapp01/75/Get-Ready-for-Web-Application-Security-Testing-1-2048.jpg)
![SQL Injection User input inserted into SQL Command: Get product details by id: Select * from products where id=‘ $REQUEST[“id”] ’; Hack: send param id with value ‘ or ‘1’=‘1 Resulting executed SQL: Select * from products where id=‘ ’ or ‘1’=‘1 ’ All products returned](https://image.slidesharecdn.com/100216-tpn-securitytesting-111030210918-phpapp01/85/Get-Ready-for-Web-Application-Security-Testing-22-320.jpg)
Uploaded byAlan Kan
Get Ready for Web Application Security Testing
The document discusses web application security testing and provides guidance for testing professionals. It outlines some of the top attacks like SQL injection and cross-site scripting. It recommends getting educated on security topics, using tools like WebScarab and IBM Rational AppScan to test for vulnerabilities, and incorporating security testing into the development process.
More Related Content
Similar to Get Ready for Web Application Security Testing
Get Ready for Web Application Security Testing
- 1. Alan Kan TechnicalManager IBM Rational Software [email_address] Get Ready for Web Application Security Testing
- 2. Run Down TheSecurity Landscape What does it mean for Testing Professionals A Few Top Attacks and How to Test for Them What You Can Do to Prepare for Security Testing
- 3.
- 4.
- 5.
- 6. The Web Ecosystem(Simplified)
- 7.
- 8.
- 9. LexisNexis Data Breach- Washington Post Feb 17, 2008 IndiaTimes.com Malware — InformationWeek Feb 17,2008 Hacker breaks into Ecuador’s presidential website — Thaindian, Feb 11, 2008 Hacking Stage 6 — Wikipedia, Feb 9 2007 Hacker steals Davidson Cos client data - Falls Tribune, Feb 4 2008 RIAA wiped off the Net — TheRegister, Jan 20 2008 Chinese hacker steals 18M identities - HackBase.com, Feb 10,2008 Mac blogs defaced by XSS The Register, Feb 17, 2008 Your Free MacWorld Expo Platinum Pass — CNet, Jan 14, 2008 Hacker takes down Pennsylvania gvmt — AP, Jan 6, 2008 Drive-by Pharming in the Wild — Symantec, Jan 21 2008 Italian Bank hit by XSS fraudsters — Netcraft, Jan 8 2008 Greek Ministry websites hit by hacker intrusion — eKathimerini, Jan 31,2008
- 10. “ JB Hi-Fi'swebsites in Australia and New Zealand were redirecting customers to malicious web pages over the weekend in a cyber attack ” stuff.co.nz 01/12/2009 “ Turkish defacers broke into the New Zealand based registrar Domainz.net …Companies which had their New Zealand web sites defaced include Microsoft, HSBC, Coca-Cola, F-secure, Bitdefender, Sony and Xerox ” zone-h.org/news/id/4708 21/04/2009 “ Security Intelligence Service director Warren Tucker revealed government department websites had been attacked and information stolen ” nzherald.co.nz 12/09/2007 “ A florist which does all of its business online has had its website targeted by hackers and customers' credit card details have been stolen” abc.net.au 16/9/2007 “ Computer hackers have cracked the defences of dozens of top government and business sector internet sites this year, raising concerns about the safety of consumers' financial and personal information” SMH.com.au 14/10/ 2007 What about in this part of the world?
- 11.
- 12.
- 13. Web Application Securityis Neglected of all attacks on Information Security are directed to the Web Application Layer 75% of all Web Applications are vulnerable 2/3 Network Server Web Applications % of Attacks % of Dollars 75% 10% 25% 90% Security Spending
- 14. Run Down TheSecurity Landscape What does it mean for Testing Professionals A Few Top Attacks and How to Test for Them What You Can Do to Prepare for Security Testing
- 15. Secure Applications –Who is Responsible? System Administrator? Network Administrator? Security Professional? Solution Architect? Developers? Testing Professional?
- 16. The Trend –Incorporate Security into Testing Developers SDLC Developers Developers Incorporate Security as part of Testing Ensure vulnerabilities are addressed before applications are put into production Build Coding QA Security Production
- 17. Security Testing Stepsare not that different from usual Identify possible vulnerability Prove vulnerability Assess risk, scope, depth, severity and impact Create repeatable tests Test migitation, and fixes
- 18. Run Down TheSecurity Landscape What does it mean for Testing Professionals A Few Top Attacks and How to Test for Them What You Can Do to Prepare for Security Testing
- 19. OWASP and theOWASP Top 10 list Open Web Application Security Project – an open organization dedicated to fight insecure software “The OWASP Top Ten document represents a broad consensus about what the most critical web application security flaws are”
- 20.
- 21. 1 - InjectionFlaws What is it? User-supplied data is sent to an interpreter as part of a command, query or data. What are the implications? SQL Injection – Access/modify data in DB SSI Injection – Execute commands on server and access sensitive data LDAP Injection – Bypass authentication …
- 22. SQL Injection Userinput inserted into SQL Command: Get product details by id: Select * from products where id=‘ $REQUEST[“id”] ’; Hack: send param id with value ‘ or ‘1’=‘1 Resulting executed SQL: Select * from products where id=‘ ’ or ‘1’=‘1 ’ All products returned
- 23.
- 24.
- 25. SQL Injection Example- Exploit
- 26. SQL Injection Example- Outcome
- 27. Injection Flaws (SSIInjection Example) Creating commands from input
- 28. The return isthe private SSL key of the server
- 29. 2. Cross-Site Scripting(XSS) What is it? Malicious script echoed back into HTML returned from a trusted site, and runs under trusted context What are the implications? Session Tokens stolen (browser security circumvented) Complete page content compromised Future pages in browser compromised
- 30. Cross Site Scripting– The Exploit Process Evil.org User bank.com 1) Link to bank.com sent to user via E-mail or HTTP 2) User sends script embedded as data 3) Script/data returned, executed by browser 4) Script sends user’s cookie and session information without the user’s consent or knowledge 5) Evil.org uses stolen session information to impersonate user
- 31. XSS Example IHTML code:
- 32. XSS Example IIHTML code:
- 33. 4 - InsecureDirect Object Reference What is it? Part or all of a resource (file, table, etc.) name controlled by user input. What are the implications? Access to sensitive resources Information Leakage, aids future hacks
- 34. Insecure Direct ObjectReference - Example
- 35. Insecure Direct ObjectReference – Example Cont.
- 36. Insecure Direct ObjectReference – Example Cont.
- 37. Run Down TheSecurity Landscape What does it mean for Testing Professionals A Few Top Attacks and How to Test for Them What You Can Do to Prepare for Security Testing
- 38. Get Educated onthe Topic Beware of legal issues Create a Sandpit envrionment Know the latest trends – IBM X-Force Threat Reports http://www-935.ibm.com/services/nz/iss/xforce/trendreports/ Study pass and current exploits – US Computer Emergency Readiness Team http://www.kb.cert.org/vuls Learn how to test for the vulnerabilities - OWASP Testing guide http://www.owasp.org/index.php/OWASP_Testing_Guide_v3_Table_of_Contents Learn the syntax of operating system, databases, programming code Experiemnet with Tools – Web Scarab http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project Experiment with Tools – IBM Rational AppScan http ://www-01.ibm.com/software/rational/offerings/websecurity/webappsecurity.html
- 39. How Does AutomatedTool Work?
- 40. Get Tools –which ones? Automated vs Manual Do it a lot quicker in a shorter timeframe Regression tests Recommendations Security-specific vs general automated testing tool Time it takes to become a security expert Time it takes to learn coding Time it takes to create report templates Fix recommendations Hard to reach places – Malware, Flash Still needs a human being to validate results Commercial vs Free tools It costs Regular updates Usability, Quality
- 41. Tools Manual TestingOWASP WebScarab http://www.owasp.org/index.php/Category:OWASP_Project Firebug http ://getfirebug.com Automated Testing IBM Rational AppScan http://www-01.ibm.com/software/rational/offerings/websecurity/webappsecurity.html
- 42. © Copyright IBMCorporation 2010. All rights reserved. The information contained in these materials is provided for informational purposes only, and is provided AS IS without warranty of any kind, express or implied. IBM shall not be responsible for any damages arising out of the use of, or otherwise related to, these materials. Nothing contained in these materials is intended to, nor shall have the effect of, creating any warranties or representations from IBM or its suppliers or licensors, or altering the terms and conditions of the applicable license agreement governing the use of IBM software. References in these materials to IBM products, programs, or services do not imply that they will be available in all countries in which IBM operates. Product release dates and/or capabilities referenced in these materials may change at any time at IBM’s sole discretion based on market opportunities or other factors, and are not intended to be a commitment to future product or feature availability in any way. IBM, the IBM logo, the on-demand business logo, Rational, the Rational logo, and other IBM products and services are trademarks of the International Business Machines Corporation, in the United States, other countries or both. Other company, product, or service names may be trademarks or service marks of others.
- 43. IBM Rational AppScanThe undisputed market leader Ranked #1 in Market Share by IDC #1 in numerous industry “bake offs” Automatically scans web applications for vulnerabilities SQL Injection Cross-site Scripting Provides clear recommendations on how to fix them i.e. Character sanitization The Result? Improved security, lower costs, and the ability to meet PCI standards for application security
Editor's Notes
- #22 Injection flaws occur when user supplied data, is sent to an interpreter as a part of a command, query or data. The main issue here is that user input is not sanitized, and is embedded in pre-existing commands. Injection flaws can occur in: SQL queries (known as SQL Injection) Server Side Includes (execute commands on the web server) LDAP queries – used to bypass authentication
- #23 SQL Injection occurs when user input is embedded as-is inside a pre-built SQL query. For example: Let’s assume that our web application receives a product ID as input, and presents that product’s page. The SQL query looks like this: “ Select * from products where id=‘” + $REQUEST[‘id’]; You should note, that the query is basically a text string, and user input is concatenated to it. In this example, the user string is surrounded by apostrophes. Let’s take a look at what will happen if we submit the product ID value of ‘ or ‘’=‘ The query will be: SELECT * from products where id=‘’ or ‘’=‘’; You should pay attention to the fact that the WHERE criteria here is basically a Boolean TRUE. Since the results of this query matches every entry in the database, all the products will be returned.
- #24 Let’s take a look at how SQL Injection can assist a hacker to bypass the login mechanism of a banking application: - First, in order to sense that SQL Injection is possible, the hacker will injection the character apostrophe (‘), as the user name
- #25 This yields a very informative SQL error message, which helps the attacker to devise the next phase of the injection
- #26 Now, the hacker attempts to send the username: ‘ or 1=1— Note: the apostrophe is used to close the string context in which our input is embedded in 1=1 is a Boolean TRUE -- is used in MS SQL to comment out everything after the – sign, so we don’t have to worry about the rest of the SQL query
- #27 After sending this SQL injection payload, we will be logged into the application, as the first user in the user's table - without having to supply actual credentials.
- #28 Comments at one level can be command at another
- #30 A Cross Site Scripting attack, attempts to echo back a malicious script in the HTML returned from a trusted site. Since the script is echoed back from a trusted site, it runs in the context of that site. The implications of XSS are: Stealing HTTP session tokens Page content may be compromised (this may include “local” site defacement, or hijacking of the browser’s session using scripting) Future pages may be contaminated as well (by hijacking the session)
- #31 Let’s take a look at the chain of events during a XSS attack The attack creates and sends the victim a link to bank.com (a trusted site). The link contains a search string (or any other string that is echoed back), which contains a malicious JavaScript code The victim, clicks on this link, since he/she trusts the bank.com web site The bank.com web application, echoes back the malicious JavaScript code inside the response page. This JavaScript is executed in the security context of bank.com, since it is echoed by from that site. This means that it has access to DOM elements belonging to this domain/session The malicious script, sends the current cookie and session information, without the victim’s consent, to the evil.org web site, where the hacker is waiting for it.
- #32 Let’s take a look at the following banking web site – this site contains a search function, that allows users to search the site for specific text. If we type the string “asdf”, the response to the search will contain that string, inside the results page, in what we call “free HTML context”. What will happen if instead of typing “asdf”, we will type some JavaScript code? Let’s try to type the following JavaScript code: <script>alert(document.cookie)</script>
- #33 As you can see – the piece of JavaScript code that we wrote, was echoed back by the site’s search function – since it was returned from the banking application, it had access to the Document Object Model (DOM), and could access the current session cookie. In this situation, I myself planted this JavaScript code in the web page, but in a XSS attack, it is the attacker who creates a link that contains the malicious JavaScript, and then sends this link to the victim. When the victim clicks on the link, the malicious JavaScript will be echoed back from the trusted site.
- #34 In several scenarios, it may be possible for an attacker to manipulate the web application to disclose a resource such as a sensitive file. This can occur by either guessing a common file name and location and attempting to request it, or by manipulating a parameter value that is used to access a file, as will be seen in the next example. The implications of Insecure Direct Object Reference is usually information leakage or access to sensitive resources.
- #35 In this example, we see that a web application that uses a parameter called “content”, which points to the contents of the page to be displayed. An attacker might attempt to manipulate the parameter value, from “business_deposit.htm”, which is the valid page, to some other file – for example, the Boot.ini which is a system file.
- #36 The attempt failed, and the system disclosed that it only allows parameter value (file names) that end with either txt or htm as their file extension. Let’s try a little trick called “Poison Null Byte”, we’ll write the file we actually want to open which is Boot.ini, but append a NULL character and the extension the application is looking for (in this example .htm)
- #37 Bingo! – we managed to circumvent the file extension validation, and open a sensitive system file. Using this technique, we can manipulate the application to hand us the contents of other, more sensitive files, such as databases, customer files, etc.
- #43 Thank you!