EuroSTAR Software Testing Conference 2013 presentation on How About Security Testing by Jouri Dufour. See more at: http://conference.eurostarsoftwaretesting.com/past-presentations/

1. How About Security Testing?
Jouri Dufour, CTG
www.eurostarconferences.com
@esconfs
#esconfs

2. How About Cybercrime?

8. Our BUSINESS LIFE is online.

10. “If A happens, then B must be the case, so I will do C.”
BUT WHAT IF X OCCURS?

11. 01
Fooling
a password change function

12. Password change function
Administrator
N
Existing
password
parameter
?
Y
User
Password change request
Username
Existing password *
New password
Confirm new password
* Only presented to users
The functionality  The assumption  The attack

13. Password change function
Administrator
N
FLAW
Existing
password
parameter
?
Y
User
Password change request
Username
Existing password *
New password
Confirm new password
* Only presented to users
The functionality  The assumption  The attack

14. Password change function
Administrator
N
Existing
password
parameter
?
Y
User
Password change request
ATTACK
Username
Existing password *
New password
Confirm new password
* Only presented to users
The functionality  The assumption  The attack

15. RECOMMENDED HACK STEPS
Try removing in turn each request parameter
Be sure to delete the actual parameter name as
well as its value
Attack only one parameter at a time
Follow a multistage process through to completion

16. 02
Proceeding
to checkout

17. Retail application
Add
items to
shopping
basket
Finalize
order
Enter
payment
information
Enter
delivery
information
The functionality  The assumption  The attack

18. Retail application
Add
items to
shopping
basket
Finalize
order
Enter
payment
information
Enter
delivery
information
FLAW
The functionality  The assumption  The attack

19. Retail application
Add
items to
shopping
basket
Finalize
order
ATTACK
Enter
payment
information
Enter
delivery
information
The functionality  The assumption  The attack

20. RECOMMENDED HACK STEPS
Attempt to submit requests out of the expected
sequence
Be sure to fully understand the access mechanisms
to distinct stages
Try to violate the developers’ assumptions
Use any interesting error messages and debug
output to fine-tune your attacks

21. The application may enforce
strict access control only
on the initial stages of the process

22. 03
Beating
a business limit

23. ERP application
Bank
account
2
Bank
account
1
Less than
€10.000
?
Y
N
The functionality  The assumption  The attack

24. ERP application
Bank
account
2
Bank
account
1
Less than
€10.000
?
FLAW
Y
N
The functionality  The assumption  The attack

25. ERP application
Bank
account
2
Bank
account
1
€20.000
Less than
€10.000
?
Y
N
-€20.000
The functionality  The assumption  The attack

26. Many applications use numeric
limits and beating such limits may
have serious business consequences

27. RECOMMENDED HACK STEPS
Try entering negative values
Sometimes several steps need to be repeated to
bring the application in a vulnerable state

28. 04
Cheating
on bulk discounts

29. Retail application
Purchase
bundle
Shopping basket
Item 1 €...
Item 2 €...
Item 3 €...
-25%
The functionality  The assumption  The attack

30. Retail application
Purchase
bundle
Shopping basket
Item 1 €...
Item 2 €...
Item 3 €...
-25%
FLAW
The functionality  The assumption  The attack

31. Retail application
Purchase
bundle
Shopping basket
Item 1 €...
Item 2 €...
Item 3 €...
-25%
ATTACK
The functionality  The assumption  The attack

32. RECOMMENDED HACK STEPS
Find out if adjustments are made on a one-time
basis
Try to manipulate the application’s behavior to get
adjustments that don’t correspond to the original
intended criteria

33. 05
Escaping
from escaping

34. Web application
Operating
system
command
User-controllable input
Sanitization
using the
backslash
character
; | & < > `
space newline
The functionality  The assumption  The attack

35. Web application
Operating
system
command
User-controllable input
Sanitization
using the
backslash
character
; | & < > `
space newline
FLAW
The functionality  The assumption  The attack

36. Web application
Operating
system
command
ATTACK
User-controllable input
Sanitization
using the
backslash
character
; | & < > `
space newline
The functionality  The assumption  The attack

37. Web application
COMMAND INJECTION
Operating
system
command
Foo;ls
Sanitization
using the
backslash
character
; | & < > `
space newline
Foo;ls
The functionality  The assumption  The attack

38. RECOMMENDED HACK STEPS
Attempt to insert relevant metacharacters into the
data you control
Always try placing a backslash immediately before
each such character

39. This same defect can be
found in some defenses against
cross-site scripting attacks

40. Yesterday Today Tomorrow
Dynamic
Application
Security
Testing
(DAST)
Static
Application
Security
Testing
(SAST)
Integrated
Application
Security
Testing
(IAST)
+ =

41. 001:0123450123456789 331017012345678960123456789202468
00:00
Time
Victims

42. HOW ABOUT
SECURITY
TESTING?
Fooling a
password
change
function
Proceeding to
checkout
Beating a
business limit
Cheating on
bulk discounts
Escaping from
escaping
Speaker: Jouri Dufour
www.ctg.com
jouri.dufour@ctg.com