Web Application Security Testing
ir. Geert Colpaert, CEH 8 oktober 2008
Web Application Security context
HTML JavaScript CSS Web Application + Services Web Application + Services HTML JavaScript CSS
Browser + Plugins
WebServer AppServer DBServer
WebServer AppServer DBServer
Browser + Plugins
Client OS
Server OS
Server OS
Client OS
External user
DMZ
Corporate network
Copyright 2008 ps_testware
Internal user
Integrity
Subject of security
Its about protecting
Confidentiality Availability
How compomised
On any layer or combination Only the result of the attack counts Secure every layer
Application Middleware OS Network
Misconception
We have good internet defense mechanisms... Yeah, but do you completely trust your users? We are secure because we use SSL, certificates, FW, IDS, IPS, Honeypots, patch management... Yeah, but what about your application code?
Copyright 2008 ps_testware
Maturity and attack surface
Vulnerability, attack level Application
Middleware
OS
Network Maturity, spending level
Copyright 2008 ps_testware
Functionality Application Security
This is what your application was supposed to do, but doesnt! Functionality bugs
The application as developed
This is what your application can do, but youre not aware of!
The application as designed
Security flaws
Copyright 2008 ps_testware
Functionality Application Security
Objective
Different Complementary
Functional Quality and Application Security correlate Functional Complexity and Application Security correlate
Copyright 2008 ps_testware
Problem with Web Application Security?
Create awareness Not my responsibility Application Security Requirements Assumed Quality Attribute
Reactive development approach Security integrated SDLC (build, review, test)
Rely on technology
Defense in depth
Copyright 2008 ps_testware
Two forces, One objective
Validate
Prevention
(best practices)
Acceptable Risk
Control
(Assess, Review,Test)
Root cause
Copyright 2008 ps_testware
Web Application Security Testing approach
Ethical hacker testing approach
By knowing your enemy, you can defeat him/her Use the same tools and methods Start with same initial application knowledge and rights But, a hacker has more time then you
Copyright 2008 ps_testware
Web Application Security Testing approach
Reconnaissance phase: Profile the application
Functionality, workflow, data, points of interaction Security mechanisms in place Technical infrastructure (OS, middleware, version) Application infrastructure (code, protocols, data formats)
Exploration phase: Vulnerability scanning
Low hanging fruit gives a first indication, but can be misleading (false positives, false negatives) No click and run, it needs configuration and control
Risk based test planning phase: limited resources Exploitation phase: Probing for known vulnerabilities Reporting phase: Risk evaluation
Copyright 2008 ps_testware
Common vulnerabilities and exploits
Vulnerabilities arise because users can
submit arbitrary input tamper data
Copyright 2008 ps_testware
Cross Site Scripting (XSS)
When an application can reflect user supplied data unvalidated or unencoded Allows an attacker to execute a script in the victims browser to
steal user sessionid insert hostile content conduct phishing attacks track user actions take over machine deface websites ...
Copyright 2008 ps_testware
Cross Site Scripting (XSS)
Copyright 2008 ps_testware
SQL Injection
When user-supplied data can change the intended query Allows an attacker to
CRUD data available to the application retrieve the full database content only based on returned ODBC error messages (UNION) execute operating system commands (; exec master..xp_cmdshell command --) store unwanted data plant backdoors ...
Copyright 2008 ps_testware
SQL Injection
Copyright 2008 ps_testware
Unprotected sensitive data
When application does not sufficiently protect, control and limit the information exchanged Allows an attacker
to snif (unencryted data in transit) to disclose (client/server storage/cache) to replay/reuse (sessionid) to execute scripts (e.g. javascript:function();) to manipulate data (e.g. hidden fields) ...
Copyright 2008 ps_testware
Unprotected sensitive data
POST http://www.purchase.com/purchase.do HTTP/1.1 Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/msword, */* Referer: http://www.purchase.com/shopping.do Accept-Language: en-us Content-Type: application/x-www-form-urlencoded UA-CPU: x86 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727) Proxy-Connection: Keep-Alive Content-Length: 32 Host: localhost. Pragma: no-cache Cookie: JSESSIONID=C36D784E8E9C9D988101167370F7007C Authorization: Basic Z3Vlc3Q6Z3Vlc3Q= QTY=1&SUBMIT=Purchase&Price=9.99
Copyright 2008 ps_testware
Attack surface
Large Areas of protection
Authentication, Authorization (Access Control), Session handling, Users, Auditing, Data in transit and at rest, Services...
Vulnerability Research
Common Vulnerabilty Exposure (CVE)
US-CERT Zone-h WASC WHID SANS ISC OWASP ...
Copyright 2008 ps_testware
Web 2.0: better or worse?
Web 2.0 is about AJAX and RIA What do these technologies offer
More functionality and better usability
Desktop-like feeling: widgets Dynamic behaviour: dynamic DOM makes asynchronous communication possible
Cross-browser compatibility Reduce development effort and cost
Ajax frameworks: Dojo, GWT... RIA frameworks: Flash, Flex, Silverlight...
Extra layer of code on client
Browser plugin (JavaScript, Flash, Silverlight... engines) JavaScripts, or variant (e.g. Flash ActionScripts)
Copyright 2008 ps_testware
Web 2.0: better or worse?
Dangers
More client-side code (functionality) & data that is visible
Ajax: JavaScripts using the XHR object for communication Flash: SWF files (decompilation is possible and easy)
Use of insecure languages for <> RIA technologies
Most of them are written in C: buffer overflows! JavaScript allows overriding of functions & native data types
Violation of Same Origin Policy by the frameworks
Use JavaScript to get around browser restrictions Flash has support for it: crossdomain.xml
Dynamic, mutable DOM: injection! More protocols: SOAP, REST, XML-RPC... More data formats: XML, JSON (use of eval!), RSS... Web 2.0 top vulnerabilities: XSS, CSRF
Copyright 2008 ps_testware
Web 2.0: better or worse?
Consequence on security
No security in the toolkits Its implementation adds more complexity More points of interaction Web 2.0 builds upon 1.0 and inherits its weaknesses It increases the attack surface
Web 2.0: Security challenge Web Application Security Testing
Automated vulnerability scanners need more configuration Less maturity in the testing market Depends more on the skillset of the penetration tester
Copyright 2008 ps_testware
Hope we will meet again
Copyright 2008 ps_testware
