Security testing of any system is about finding all possible ambiguities and flaws of the system which might result in loss of information at the hands of employees or outsiders of the organization. This seminar will give you knowledge of Security Testing and related topics with simple and useful examples to help you approach it easily.

1. SECURITY TESTING
Thuy Nguyen Thi Hong
Da Nang - 01/2018

2. AGENDA
What is Security
What is Security Testing
Techniques
Practices

3. WHAT IS SECURITY

4. WHAT IS SECURITY TESTING

5. SIX MEASURES
Confidentiality
Integrity
Authentication
Authorization
Availability
Non-repudiation

6. TECHNIQUES
1. Injection
2.Broken Authentication and
Session Management
3. Cross-Site Scripting (XSS)

7. TECHNIQUES
4. Insecure Direct Object
References
5. Security Misconfiguration
6. Sensitive Data Exposure

8. TECHNIQUES
7. Missing Function Level Access Control
8. Cross-Site Request Forgery (CSRF)
9. Using Components with Known
Vulnerabilities
10. Unvalidated Redirects and Forwards

10. 1 - INJECTION

11. Injection
$username = $_POST['username'];
$password = $_POST['password'];

12. $sql ="SELECT count(*) FROM user WHERE
username = '$username' AND password =
‘$password'";
SELECT count(*) FROM user WHERE username
= ‘thuynguyen' AND password = ‘123456’
SELECT * FROM user WHERE username =
'thuynguyen' AND password = 'something' OR '1'
Injection

13. Injection
$sql = "SELECT count(*) FROM user WHERE
username = '$username' AND password =
‘$password'";
SELECT * FROM user WHERE username =
'thuynguyen' AND password = ‘123456' OR ‘1=1'
SELECT * FROM user WHERE username =
'thuynguyen' AND password = 'something' ; DROP
TABLE Suppliers'

14. 2 - BROKEN AUTHENTICATION
AND SESSION MANAGEMENT

15. Broken Authentication And Session
Management
Scenario #1: Password is guessable

16. Scenario #2: Asking for the credentials
Broken Authentication And Session
Management

17. Broken Authentication and
Session Management
Scenario #3: Session Management

18. Broken Authentication and Session
Management
Scenario #4: Asking for the credentials

19. 3 - CROSS-SITE SCRIPTING
(XSS)

21. Cross-Site Scripting (XSS)

22. Cross-Site Scripting (XSS)

23. 4 - INSECURE DIRECT OBJECT
REFERENCESS

25. Insecure Direct Object References

26. 5 - SECURITY MISCONFIGURATION

28. Security Misconfiguration
Scenario #1 : sample
applications that are not
removed

29. Security Misconfiguration
Scenario #2 : Directory listing
is not disabled on the server

30. Security Misconfiguration
Scenario #3 : allows detailed error
messages, e.g. stack traces, to be
returned to users

31. Security Misconfiguration
Scenario #4 : open to the Internet
by other CSP users

32. 6 - SENSITIVE DATA EXPOSURE

34. Sensitive Data Exposure

35. Sensitive Data Exposure

36. 7 - MISSING FUNCTION LEVEL ACCESS
CONTROL

38. http://example.com/app/getappInfo
http://example.com/app/admin_geta
ppInfo
MISSING FUNCTION LEVEL
ACCESS CONTROL

40. 8 - CROSS-SITE REQUEST
FORGERY (CSRF)

42. Cross-Site Request
Forgery (CSRF)
http://bank.com/transfer.do?acct=BOB&amount=1
00
<a
href=“http://bank.com/transfer.do?acct=MARIA&a
mount=100000">View my Pictures!</a>
<img
src=“http://bank.com/transfer.do?acct=MARIA&a
mount=100000" width="0" height="0" border="0">

43. 9 - USING COMPONENTS
WITH KNOWN
VULNERABILITIES

45. Using Components with
Known Vulnerabilities
Apache CXF Authentication Bypass

46. Spring Remote Code Execution

47. 10 - UNVALIDATED REDIRECTS
AND FORWARDS

49. Scenario #1 :
http://www.example.com/redirec
t.jsp?url=evil.com
Unvalidated Redirects and
Forwards

50. Scenario #2 :
http://www.example.com/boring.
jsp?fwd=admin.jsp
Unvalidated Redirects and
Forwards

51. TOOLS
WireShark

52. THANK YOU!