Conducting Web Application Pentests. From Scoping to Report For Education Purposes Only

Save this PDF as:
Size: px
Start display at page:

Download "Conducting Web Application Pentests. From Scoping to Report For Education Purposes Only"

Transcription

1 Conducting Web Application Pentests From Scoping to Report For Education Purposes Only

2 Web App Pen Tests According to OWASP: A Web Application Penetration Test focuses only on evaluating the security of a web application.the process involves an active analysis of the application for any weaknesses, technical flaws, or vulnerabilities. Any security issues that are found will be presented to the system owner together with an assessment of their impact and often with a proposal for mitigation or a technical solution.

3 About Me Security guy for over 6 years now. Currently working for a Fortune 500 company doing web application and infrastructure pentesting. Recently new father.

4 Tip If you have any interest in web app pentesting, get these books!

5 Topics Why Tools OWASP Top 10 Scoping What to Gather Before Starting Recon / Discovery Application Mapping Attacking Common vulnerabilities Cleanup Reporting

6 Settings up Browsers and Tools OWASP ZAP and Burp Great tools for the price.. Free and under $300. Lots of add-ons to these. Configure browser for pentesting and web development. Chrome and Firefox/IceWeasle Manta project OWASP Hacking Plugins Developer Tools

7 Why Web App Pentest Perimeter security getting better. Almost all companies have web presence. More company transactions being done through e-commerce sites. Harder to detect in a lot of cases. NIPS/NIDS don t protect well. Multiple attack points. Can attack your customers, data, and reputation by abusing web apps. Easy for attacker to hide. Compliance requirements.

8 Selling Web App Pentest Can be huge impact to name brand. Web apps can lead to other system compromises through attack chaining. Internal threat agents can utilize internal web app vulnerabilities to gain greater access. Web App pentest can help identify issues with or lack of SDLC (Software Development Life Cycle) Identify common build configuration issues with web servers. Help to drive secure coding standards within an organization. Provides insight on if 3 rd party software is putting you at risk.

9 Don t Be Like.

10 Tools Many to choose from. Match tools to technology. Web App scanners differ. Some are better at detecting other things. 2-web-application-scanner-benchmark.html Validate findings. High false positive rates. Free vs. Pay

11 Tools Continued Need a good proxy with the ability to spider. Burp OWASP ZAP Fiddler Good web vulnerability scanners. Burp OWASP ZAP Accuntix W3AF Most infrastructure vulnerability scanners include some web app scanning though not good ones. Good Decoder/Encoder Good Web Browser with Plugins Foxy Proxy Developer Tools Etc

12 Hands On Kali Linux or BackTrack 5. Test Environment using OWASP BWA and DVWA specifically. Use ZAP and if you have the resources you can run it through BURP. Don t destroy VM s for others. Don t hack others, just hands on virtual machines. Your scope is $ipaddress/dvwa. That directory and all sub directories. Stay in scope!

13 Test Environment Info Must connect to wireless network Targets:

14 OWASP TOP 10

15 OWASP Top 10 A1 Injection LDAP, OS, SQL A2 Broken Auth and Session Management Auth bypasses Cookies Session Hijacking A3 XSS (Cross-Site Scripting) Reflective Persistent (Stored) DOM A4 Insecure Direct Object Reference - Being able to access objects without proper permission. A5 Security Misconfiguration Tons of possibilities here

16 OWASP Top 10 Continued A6 - Sensitive Data Exposure CC # s Personal Data Valid User Accounts A7 Missing Function Level Access Control Validate requests being submitted to the server. A8 Cross-Site Request Forgery Hidden iframe Clickjacking A9 Using Components with Known Vulnerabilities Framework version vulnerabilities. A10 Unvalidated Redirects and Forwards Redirecting to other pages or websites. Sending user to malicious website

17 Setting Up The Pentest

18 Scoping Pentest type? (Black, Gray, White) Source code review? Reason for the pentest? Code update. Compliance requirement. Identify attack scope. (How far down the rabbit hole can you go.) Demonstrate vs Fully Exploit Try and set up scope to match that of a real threat. Usually won t get permission. Attack chaining. What hours can the pentest be conducted during? Have had groups try and only allow 2 hours per day on huge application. Is there a code freeze? Is there scheduled patches, or updates during the pentest? Is there schedule downtime? Production or UAT/DEV/TEST> Make sure it s a true representation of production.

19 Scoping Continued Identify size of the application. How many: lines of code input points different parameters Types of technology used. (If not black box testing) Server Type (IIS, Apache, Websphere, ect.) Multiple Databases? 3 rd party content? Flash objects? Framework. WSDL s? Web Services? API? Types of functionality within the application. Does the website send or receive files? WebDAV. Is there any mobile components? JAVA RMI How many user roles? Admin role, External User, Internal User?

20 Questions to Ask Who is the primary contact for the penetration test? Someone should be available during operating hours of the pentest. This person should be able to expand scope if needed. (new functionality identified, trust relationships in place open scope to other systems) Who can engage developers or security people for discussions if needed. Possible to get network diagram? (identify load balancers, proxies, WAFS, etc)

21 Engagement Description Covers what was agreed upon. Primary contacts (tester and business contact) Who gets the report. How often is there status updates? State what was agreed upon for timeline. Hours for testing. Length of testing. Time provided for report writing. Finally Delivery Day Retesting / Remediation Validation Exit Meeting Scope. Make sure to cover what is not allowed too. Covers potential impacts and what to do if there is one. If doing contracting pentest or as a 3 rd party make sure all work documents are completed as well. (SOW, NDA, ect.) CYA!

22 Grey and White Box Testing Make sure to gather the right info. Previous Findings / Pentest Results Sometimes retests show lack of remediation. Point that out in the final report. Source code if possible. Two user accounts per user roles. Supporting documentation. Database Version and Types. Framework versions. Webserver version.

23 Starting the Pentest

24 Recon / Discovery Identify Web Server, and Technologies in Use. HTTP Header Leakage Openssl s_client Proxy Nmap Scripts Nmap sv Whatweb good at gathering information. Load balancing detection.- Halberd (also included in W3AF.) WAF Detection Waffit, http-waf-fingerprint.nse Known vulnerabilities?

25 Recon / Discovery Continued Directory Bruteforce WSDL? SOAP? Web Services? WebDav? Flash? AJAX?

26 Recon/Discovery Black Box Shodan - Google Hacking Bing Tor Wayback Machine Reconng Maltego Zmap University of Michigan Project Sonar Rapid 7 * Things that do not directly connect to the client from your box.

27 Application Mapping Browse site through proxy. Build tree for spidering. Identify a user work flow. How does the application work? Function dependencies. Gain a good understanding of the application. Look at the code if provided, look at source otherwise. Are there patterns? Comments in the code? Parameters named specific way? Engagement tools from Burp will pull this out.

28 DEMO DVWA Recon/Mapping using Whatweb, Burp and ZAP.

29 Authentication A2 Identify how the website validates you. Identify if there is hidden fields that are static or unique. Is there data send in POST or GET request that is static or unique? Can you bypass authentication and directly browse to page? Are there admin portals? Default creds? Are secure passwords required? * secure might depend on company policy. Can the password reset portal be abused. Use the two accounts if there is static values, see if you can do a horizontal priv. escalation.

30 COOKIES

31 Authentication - Cookies Are cookies easily decoded? Base encoded, IP address, Time/Date etc. Is the HTTPOnly and Secure flags set? How much entropy is in the cookie value? Does the cookie change on state change? First visit to page, Successful Sign In, Signoff.

32 A1 - Injection

33 SQLi A1 - Injection Usually start with providing to user input and check for errors or unexpected returned data. Identify where user input might be included in a query. Scanners can be decent at detection. Can lead to complete system compromise, not just data. SQLi Blind Return might not be to UI. Time Based Content Based OS Command Injection Does it seem to use OS commands to run queries, or provide function? Try submitting, and &, ;, and look for results.

34 A1 Injection Continued LDAP Injection Inject &, *, (, ), [, ],!,

35 DEMO SQL Injection with Zap fuzzer. SQLMap

36 A3 - XSS / Cross-Site Scripting Injecting code. Can own a website with it, contrary to what developers will argue. Attack Chaining. Cookie Stealing Reflective vs Stored BeEF Framework + Metasploit = Fun

37 Beef and Metasploit In beef/config.yaml enable meteasploit support. Kali dir /usr/share/beef-xss. Set MSGRPC password in beef/extensions/metasploit/config.yaml Start metasploit Run: load msgrpc ServerHost= Pass=abc123 *example only but default Beef config setting.

38 Beef and Metasploit

39 Beef Exploitation

40 BeEF Multiple Exploitation Paths Java Applet/ Key logger Malicious Redirects A10 Cookie Stealing. Browser Exploitation through Metasploit Powershell download and execute.

41

42 Cleanup Delete any persistent XSS you ve created. Can always reproduce if necessary. Already have screen shots right? Delete any additional things you ve created unless they want evidence. Notify customer that they can remove test accounts unless they want to keep them available for remediation testing.

43 The Report Most important piece of the pentest. This is what adds value and will help towards remediation and risk reduction. Customize to technologies and client. Include detailed remediation options and links. Include screenshots and url s for findings. Error on the side of more detail. Customers might not always read and comprehend the report. Expect to have to explain.

44 Finding Example Finding: SQL Injection Risk Rating: Critical Business Impact: SQL Injection attacks can affect all security aspects of a web application. Data integrity, availability, and confidentiality can all be impacted. It was possible to extract all the information from the database and to extract password hashes of valid users. With the access level obtained during the penetration test, it would also be possible to change and modified stored data. Steps to Reproduce: 1. Login to the application at: utilizing the provided accounts. 2. Click on the SQL Injection page at 3. Input and notice SQL syntax error due to user input.

45 Finding Example Continued Expected Outcome: User input is properly escaped, and validated. Parameterized queries are used to validate user input into SQL queries. Actual Outcome: User input is not properly escaped or validated by the application. By injecting into the input field it was possible to detect a SQL injection. It was possible to use the SQL injection to enumerate all data within the database, including usernames and password hashes.

46 Finding Example Continued Remediation: Implement PHP Data Objects and use prepared statements, also known as parameterized queries for database queries. This prevents malicious user input from being used directly in the query itself. In addition, make sure to implement system hardening and security recommended settings for MySQL. Example of PHP parameterized query: <?php $stmt = $dbh->prepare("select * FROM REGISTRY where name =?"); if ($stmt->execute(array($_get['name']))) { while ($row = $stmt->fetch()) { print_r($row); } }?>

47 Final Exit Meeting Hand over report if not already handed over. Discuss findings. Answer questions. Reiterate how remediation validation is going to take place.

48 QUESTIONS?

49 Resources and Links Burp Pro $300 portswigger.net/burp OWASP - Top ZAP - Acunetix - Fiddler - Web App Security Blogs Pentesting Standard Test Environments Security Dojo - Broken Web Apps -

50 Resources and Links SQLMAP Audit_using_SQLMap OWASP Top 10 Ebook

(WAPT) Web Application Penetration Testing

(WAPT) Web Application Penetration Testing (WAPT) Web Application Penetration Testing Module 0: Introduction 1. Introduction to the course. 2. How to get most out of the course 3. Resources you will need for the course 4. What is WAPT? Module 1:

More information

How to break in. Tecniche avanzate di pen testing in ambito Web Application, Internal Network and Social Engineering

How to break in. Tecniche avanzate di pen testing in ambito Web Application, Internal Network and Social Engineering How to break in Tecniche avanzate di pen testing in ambito Web Application, Internal Network and Social Engineering Time Agenda Agenda Item 9:30 10:00 Introduction 10:00 10:45 Web Application Penetration

More information

Introduction:... 1 Security in SDLC:... 2 Penetration Testing Methodology: Case Study... 3

Introduction:... 1 Security in SDLC:... 2 Penetration Testing Methodology: Case Study... 3 Table of Contents Introduction:... 1 Security in SDLC:... 2 Penetration Testing Methodology: Case Study... 3 Information Gathering... 3 Vulnerability Testing... 7 OWASP TOP 10 Vulnerabilities:... 8 Injection

More information

WEB SECURITY CONCERNS THAT WEB VULNERABILITY SCANNING CAN IDENTIFY

WEB SECURITY CONCERNS THAT WEB VULNERABILITY SCANNING CAN IDENTIFY WEB SECURITY CONCERNS THAT WEB VULNERABILITY SCANNING CAN IDENTIFY www.alliancetechpartners.com WEB SECURITY CONCERNS THAT WEB VULNERABILITY SCANNING CAN IDENTIFY More than 70% of all websites have vulnerabilities

More information

Web Application Penetration Testing

Web Application Penetration Testing Web Application Penetration Testing 2010 2010 AT&T Intellectual Property. All rights reserved. AT&T and the AT&T logo are trademarks of AT&T Intellectual Property. Will Bechtel William.Bechtel@att.com

More information

ArcGIS Server Security Threats & Best Practices 2014. David Cordes Michael Young

ArcGIS Server Security Threats & Best Practices 2014. David Cordes Michael Young ArcGIS Server Security Threats & Best Practices 2014 David Cordes Michael Young Agenda Introduction Threats Best practice - ArcGIS Server settings - Infrastructure settings - Processes Summary Introduction

More information

The Top Web Application Attacks: Are you vulnerable?

The Top Web Application Attacks: Are you vulnerable? QM07 The Top Web Application Attacks: Are you vulnerable? John Burroughs, CISSP Sr Security Architect, Watchfire Solutions jburroughs@uk.ibm.com Agenda Current State of Web Application Security Understanding

More information

Adobe Systems Incorporated

Adobe Systems Incorporated Adobe Connect 9.2 Page 1 of 8 Adobe Systems Incorporated Adobe Connect 9.2 Hosted Solution June 20 th 2014 Adobe Connect 9.2 Page 2 of 8 Table of Contents Engagement Overview... 3 About Connect 9.2...

More information

Cracking the Perimeter via Web Application Hacking. Zach Grace, CISSP, CEH zgrace@403labs.com January 17, 2014 2014 Mega Conference

Cracking the Perimeter via Web Application Hacking. Zach Grace, CISSP, CEH zgrace@403labs.com January 17, 2014 2014 Mega Conference Cracking the Perimeter via Web Application Hacking Zach Grace, CISSP, CEH zgrace@403labs.com January 17, 2014 2014 Mega Conference About 403 Labs 403 Labs is a full-service information security and compliance

More information

OWASP Top Ten Tools and Tactics

OWASP Top Ten Tools and Tactics OWASP Top Ten Tools and Tactics Russ McRee Copyright 2012 HolisticInfoSec.org SANSFIRE 2012 10 JULY Welcome Manager, Security Analytics for Microsoft Online Services Security & Compliance Writer (toolsmith),

More information

The purpose of this report is to educate our prospective clients about capabilities of Hackers Locked.

The purpose of this report is to educate our prospective clients about capabilities of Hackers Locked. This sample report is published with prior consent of our client in view of the fact that the current release of this web application is three major releases ahead in its life cycle. Issues pointed out

More information

HackMiami Web Application Scanner 2013 PwnOff

HackMiami Web Application Scanner 2013 PwnOff HackMiami Web Application Scanner 2013 PwnOff An Analysis of Automated Web Application Scanning Suites James Ball, Alexander Heid, Rod Soto http://www.hackmiami.org Overview Web application scanning suites

More information

ASL IT SECURITY BEGINNERS WEB HACKING AND EXPLOITATION

ASL IT SECURITY BEGINNERS WEB HACKING AND EXPLOITATION ASL IT SECURITY BEGINNERS WEB HACKING AND EXPLOITATION V 2.0 A S L I T S e c u r i t y P v t L t d. Page 1 Overview: Learn the various attacks like sql injections, cross site scripting, command execution

More information

Web application testing

Web application testing CL-WTS Web application testing Classroom 2 days Testing plays a very important role in ensuring security and robustness of web applications. Various approaches from high level auditing through penetration

More information

Using Free Tools To Test Web Application Security

Using Free Tools To Test Web Application Security Using Free Tools To Test Web Application Security Speaker Biography Matt Neely, CISSP, CTGA, GCIH, and GCWN Manager of the Profiling Team at SecureState Areas of expertise: wireless, penetration testing,

More information

Where every interaction matters.

Where every interaction matters. Where every interaction matters. Peer 1 Vigilant Web Application Firewall Powered by Alert Logic The Open Web Application Security Project (OWASP) Top Ten Web Security Risks and Countermeasures White Paper

More information

EVALUATING COMMERCIAL WEB APPLICATION SECURITY. By Aaron Parke

EVALUATING COMMERCIAL WEB APPLICATION SECURITY. By Aaron Parke EVALUATING COMMERCIAL WEB APPLICATION SECURITY By Aaron Parke Outline Project background What and why? Targeted sites Testing process Burp s findings Technical talk My findings and thoughts Questions Project

More information

Vulnerability Assessment and Penetration Testing

Vulnerability Assessment and Penetration Testing Vulnerability Assessment and Penetration Testing Module 1: Vulnerability Assessment & Penetration Testing: Introduction 1.1 Brief Introduction of Linux 1.2 About Vulnerability Assessment and Penetration

More information

With so many web applications, universities have a huge attack surface often without the IT security budgets or influence to back it up.

With so many web applications, universities have a huge attack surface often without the IT security budgets or influence to back it up. 1 2 Why do we care about web application security? With so many web applications, universities have a huge attack surface often without the IT security budgets or influence to back it up. We constantly

More information

Recon and Mapping Tools and Exploitation Tools in SamuraiWTF Report section Nick Robbins

Recon and Mapping Tools and Exploitation Tools in SamuraiWTF Report section Nick Robbins Recon and Mapping Tools and Exploitation Tools in SamuraiWTF Report section Nick Robbins During initial stages of penetration testing it is essential to build a strong information foundation before you

More information

Essential IT Security Testing

Essential IT Security Testing Essential IT Security Testing Application Security Testing for System Testers By Andrew Muller Director of Ionize Who is this guy? IT Security consultant to the stars Member of OWASP Member of IT-012-04

More information

Secure development and the SDLC. Presented By Jerry Hoff @jerryhoff

Secure development and the SDLC. Presented By Jerry Hoff @jerryhoff Secure development and the SDLC Presented By Jerry Hoff @jerryhoff Agenda Part 1: The Big Picture Part 2: Web Attacks Part 3: Secure Development Part 4: Organizational Defense Part 1: The Big Picture Non

More information

Executive Summary On IronWASP

Executive Summary On IronWASP Executive Summary On IronWASP CYBER SECURITY & PRIVACY FOUNDATION 1 Software Product: IronWASP Description of the Product: IronWASP (Iron Web application Advanced Security testing Platform) is an open

More information

https://elearn.zdresearch.com https://training.zdresearch.com/course/pentesting

https://elearn.zdresearch.com https://training.zdresearch.com/course/pentesting https://elearn.zdresearch.com https://training.zdresearch.com/course/pentesting Chapter 1 1. Introducing Penetration Testing 1.1 What is penetration testing 1.2 Different types of test 1.2.1 External Tests

More information

Bust a cap in a web app with OWASP ZAP

Bust a cap in a web app with OWASP ZAP The OWASP Foundation http://www.owasp.org Bust a cap in a web app with OWASP ZAP Adrien de Beaupré GSEC, GCIH, GPEN, GWAPT, GCIA, GXPN ZAP Evangelist Intru-Shun.ca Inc. SANS Instructor, Penetration Tester,

More information

External Vulnerability Assessment. -Technical Summary- ABC ORGANIZATION

External Vulnerability Assessment. -Technical Summary- ABC ORGANIZATION External Vulnerability Assessment -Technical Summary- Prepared for: ABC ORGANIZATI On March 9, 2008 Prepared by: AOS Security Solutions 1 of 13 Table of Contents Executive Summary... 3 Discovered Security

More information

1. Introduction. 2. Web Application. 3. Components. 4. Common Vulnerabilities. 5. Improving security in Web applications

1. Introduction. 2. Web Application. 3. Components. 4. Common Vulnerabilities. 5. Improving security in Web applications 1. Introduction 2. Web Application 3. Components 4. Common Vulnerabilities 5. Improving security in Web applications 2 What does World Wide Web security mean? Webmasters=> confidence that their site won

More information

Web Application Report

Web Application Report Web Application Report This report includes important security information about your Web Application. Security Report This report was created by IBM Rational AppScan 8.5.0.1 11/14/2012 8:52:13 AM 11/14/2012

More information

Web Application Vulnerability Testing with Nessus

Web Application Vulnerability Testing with Nessus The OWASP Foundation http://www.owasp.org Web Application Vulnerability Testing with Nessus Rïk A. Jones, CISSP rikjones@computer.org Rïk A. Jones Web developer since 1995 (16+ years) Involved with information

More information

Using Nessus In Web Application Vulnerability Assessments

Using Nessus In Web Application Vulnerability Assessments Using Nessus In Web Application Vulnerability Assessments Paul Asadoorian Product Evangelist Tenable Network Security pasadoorian@tenablesecurity.com About Tenable Nessus vulnerability scanner, ProfessionalFeed

More information

ASL IT Security Advanced Web Exploitation Kung Fu V2.0

ASL IT Security Advanced Web Exploitation Kung Fu V2.0 ASL IT Security Advanced Web Exploitation Kung Fu V2.0 A S L I T S e c u r i t y P v t L t d. Page 1 Overview: There is a lot more in modern day web exploitation than the good old alert( xss ) and union

More information

Chapter 1 Web Application (In)security 1

Chapter 1 Web Application (In)security 1 Introduction xxiii Chapter 1 Web Application (In)security 1 The Evolution of Web Applications 2 Common Web Application Functions 4 Benefits of Web Applications 5 Web Application Security 6 "This Site Is

More information

Excellence Doesn t Need a Certificate. Be an. Believe in You. 2014 AMIGOSEC Consulting Private Limited

Excellence Doesn t Need a Certificate. Be an. Believe in You. 2014 AMIGOSEC Consulting Private Limited Excellence Doesn t Need a Certificate Be an 2014 AMIGOSEC Consulting Private Limited Believe in You Introduction In this age of emerging technologies where IT plays a crucial role in enabling and running

More information

ABC LTD EXTERNAL WEBSITE AND INFRASTRUCTURE IT HEALTH CHECK (ITHC) / PENETRATION TEST

ABC LTD EXTERNAL WEBSITE AND INFRASTRUCTURE IT HEALTH CHECK (ITHC) / PENETRATION TEST ABC LTD EXTERNAL WEBSITE AND INFRASTRUCTURE IT HEALTH CHECK (ITHC) / PENETRATION TEST Performed Between Testing start date and end date By SSL247 Limited SSL247 Limited 63, Lisson Street Marylebone London

More information

Web Application Hacking (Penetration Testing) 5-day Hands-On Course

Web Application Hacking (Penetration Testing) 5-day Hands-On Course Web Application Hacking (Penetration Testing) 5-day Hands-On Course Web Application Hacking (Penetration Testing) 5-day Hands-On Course Course Description Our web sites are under attack on a daily basis

More information

Magento Security and Vulnerabilities. Roman Stepanov

Magento Security and Vulnerabilities. Roman Stepanov Magento Security and Vulnerabilities Roman Stepanov http://ice.eltrino.com/ Table of contents Introduction Open Web Application Security Project OWASP TOP 10 List Common issues in Magento A1 Injection

More information

Ethical Hacking as a Professional Penetration Testing Technique

Ethical Hacking as a Professional Penetration Testing Technique Ethical Hacking as a Professional Penetration Testing Technique Rochester ISSA Chapter Rochester OWASP Chapter - Durkee Consulting, Inc. info@rd1.net 2 Background Founder of Durkee Consulting since 1996

More information

Bridging the Gap - Security and Software Testing. Roberto Suggi Liverani ANZTB Test Conference - March 2011

Bridging the Gap - Security and Software Testing. Roberto Suggi Liverani ANZTB Test Conference - March 2011 Bridging the Gap - Security and Software Testing Roberto Suggi Liverani ANZTB Test Conference - March 2011 1 Agenda Roberto, what test are you doing? Is this a defect, vulnerability or both? What can we

More information

Web Application Attacks And WAF Evasion

Web Application Attacks And WAF Evasion Web Application Attacks And WAF Evasion Ahmed ALaa (EG-CERT) 19 March 2013 What Are We Going To Talk About? - introduction to web attacks - OWASP organization - OWASP frameworks - Crawling & info. gathering

More information

Creating Stronger, Safer, Web Facing Code. JPL IT Security Mary Rivera June 17, 2011

Creating Stronger, Safer, Web Facing Code. JPL IT Security Mary Rivera June 17, 2011 Creating Stronger, Safer, Web Facing Code JPL IT Security Mary Rivera June 17, 2011 Agenda Evolving Threats Operating System Application User Generated Content JPL s Application Security Program Securing

More information

BASELINE SECURITY TEST PLAN FOR EDUCATIONAL WEB AND MOBILE APPLICATIONS

BASELINE SECURITY TEST PLAN FOR EDUCATIONAL WEB AND MOBILE APPLICATIONS BASELINE SECURITY TEST PLAN FOR EDUCATIONAL WEB AND MOBILE APPLICATIONS Published by Tony Porterfield Feb 1, 2015. Overview The intent of this test plan is to evaluate a baseline set of data security practices

More information

Web Application Security

Web Application Security Web Application Security John Zaharopoulos ITS - Security 10/9/2012 1 Web App Security Trends Web 2.0 Dynamic Webpages Growth of Ajax / Client side Javascript Hardening of OSes Secure by default Auto-patching

More information

Criteria for web application security check. Version 2015.1

Criteria for web application security check. Version 2015.1 Criteria for web application security check Version 2015.1 i Content Introduction... iii ISC- P- 001 ISC- P- 001.1 ISC- P- 001.2 ISC- P- 001.3 ISC- P- 001.4 ISC- P- 001.5 ISC- P- 001.6 ISC- P- 001.7 ISC-

More information

Attack and Penetration Testing 101

Attack and Penetration Testing 101 Attack and Penetration Testing 101 Presented by Paul Petefish PaulPetefish@Solutionary.com July 15, 2009 Copyright 2000-2009, Solutionary, Inc. All rights reserved. Version 2.2 Agenda Penetration Testing

More information

Web Application Security

Web Application Security E-SPIN PROFESSIONAL BOOK Vulnerability Management Web Application Security ALL THE PRACTICAL KNOW HOW AND HOW TO RELATED TO THE SUBJECT MATTERS. COMBATING THE WEB VULNERABILITY THREAT Editor s Summary

More information

Cloud Security:Threats & Mitgations

Cloud Security:Threats & Mitgations Cloud Security:Threats & Mitgations Vineet Mago Naresh Khalasi Vayana 1 What are we gonna talk about? What we need to know to get started Its your responsibility Threats and Remediations: Hacker v/s Developer

More information

The Security Development Life Cycle

The Security Development Life Cycle Intelligent Testing 18 June 2015 Declan O Riordan The Security Development Life Cycle Test and Verification Solutions Delivering Tailored Solutions for Hardware Verification and Software Testing The Systems

More information

Cyber Security Challenge Australia 2014

Cyber Security Challenge Australia 2014 Cyber Security Challenge Australia 2014 www.cyberchallenge.com.au CySCA2014 Web Penetration Testing Writeup Background: Pentest the web server that is hosted in the environment at www.fortcerts.cysca Web

More information

Application Security Testing

Application Security Testing Tstsec - Version: 1 09 July 2016 Application Security Testing Application Security Testing Tstsec - Version: 1 4 days Course Description: We are living in a world of data and communication, in which the

More information

Application Security Testing. Erez Metula (CISSP), Founder Application Security Expert ErezMetula@AppSec.co.il

Application Security Testing. Erez Metula (CISSP), Founder Application Security Expert ErezMetula@AppSec.co.il Application Security Testing Erez Metula (CISSP), Founder Application Security Expert ErezMetula@AppSec.co.il Agenda The most common security vulnerabilities you should test for Understanding the problems

More information

National Information Security Group The Top Web Application Hack Attacks. Danny Allan Director, Security Research

National Information Security Group The Top Web Application Hack Attacks. Danny Allan Director, Security Research National Information Security Group The Top Web Application Hack Attacks Danny Allan Director, Security Research 1 Agenda Web Application Security Background What are the Top 10 Web Application Attacks?

More information

ETHICAL HACKING 010101010101APPLICATIO 00100101010WIRELESS110 00NETWORK1100011000 101001010101011APPLICATION0 1100011010MOBILE0001010 10101MOBILE0001

ETHICAL HACKING 010101010101APPLICATIO 00100101010WIRELESS110 00NETWORK1100011000 101001010101011APPLICATION0 1100011010MOBILE0001010 10101MOBILE0001 001011 1100010110 0010110001 010110001 0110001011000 011000101100 010101010101APPLICATIO 0 010WIRELESS110001 10100MOBILE00010100111010 0010NETW110001100001 10101APPLICATION00010 00100101010WIRELESS110

More information

Still Aren't Doing. Frank Kim

Still Aren't Doing. Frank Kim Ten Things Web Developers Still Aren't Doing Frank Kim Think Security Consulting Background Frank Kim Consultant, Think Security Consulting Security in the SDLC SANS Author & Instructor DEV541 Secure Coding

More information

June 2014 WMLUG Meeting Kali Linux

June 2014 WMLUG Meeting Kali Linux June 2014 WMLUG Meeting Kali Linux "the quieter you become, the more you are able to hear" Patrick TenHoopen Kali Linux Kali Linux is a free and open source penetration testing Linux distribution designed

More information

Thick Client Application Security

Thick Client Application Security Thick Client Application Security Arindam Mandal (arindam.mandal@paladion.net) (http://www.paladion.net) January 2005 This paper discusses the critical vulnerabilities and corresponding risks in a two

More information

Detecting Web Application Vulnerabilities Using Open Source Means. OWASP 3rd Free / Libre / Open Source Software (FLOSS) Conference 27/5/2008

Detecting Web Application Vulnerabilities Using Open Source Means. OWASP 3rd Free / Libre / Open Source Software (FLOSS) Conference 27/5/2008 Detecting Web Application Vulnerabilities Using Open Source Means OWASP 3rd Free / Libre / Open Source Software (FLOSS) Conference 27/5/2008 Kostas Papapanagiotou Committee Member OWASP Greek Chapter conpap@owasp.gr

More information

EC-Council CAST CENTER FOR ADVANCED SECURITY TRAINING. CAST 619 Advanced SQLi Attacks and Countermeasures. Make The Difference CAST.

EC-Council CAST CENTER FOR ADVANCED SECURITY TRAINING. CAST 619 Advanced SQLi Attacks and Countermeasures. Make The Difference CAST. CENTER FOR ADVANCED SECURITY TRAINING 619 Advanced SQLi Attacks and Countermeasures Make The Difference About Center of Advanced Security Training () The rapidly evolving information security landscape

More information

OWASP Application Security Building and Breaking Applications

OWASP Application Security Building and Breaking Applications OWASP Application Security Building and Breaking Applications Rochester OWASP Chapter - Durkee Consulting, Inc. info@rd1.net Who's? Principal Security Consultant Durkee Consulting Inc. Founder of Rochester

More information

State of The Art: Automated Black Box Web Application Vulnerability Testing. Jason Bau, Elie Bursztein, Divij Gupta, John Mitchell

State of The Art: Automated Black Box Web Application Vulnerability Testing. Jason Bau, Elie Bursztein, Divij Gupta, John Mitchell Stanford Computer Security Lab State of The Art: Automated Black Box Web Application Vulnerability Testing, Elie Bursztein, Divij Gupta, John Mitchell Background Web Application Vulnerability Protection

More information

Penetration Testing with Kali Linux

Penetration Testing with Kali Linux Penetration Testing with Kali Linux PWK Copyright 2014 Offensive Security Ltd. All rights reserved. Page 1 of 11 All rights reserved to Offensive Security, 2014 No part of this publication, in whole or

More information

Rational AppScan & Ounce Products

Rational AppScan & Ounce Products IBM Software Group Rational AppScan & Ounce Products Presenters Tony Sisson and Frank Sassano 2007 IBM Corporation IBM Software Group The Alarming Truth CheckFree warns 5 million customers after hack http://infosecurity.us/?p=5168

More information

Learn Ethical Hacking, Become a Pentester

Learn Ethical Hacking, Become a Pentester Learn Ethical Hacking, Become a Pentester Course Syllabus & Certification Program DOCUMENT CLASSIFICATION: PUBLIC Copyrighted Material No part of this publication, in whole or in part, may be reproduced,

More information

How to hack a website with Metasploit

How to hack a website with Metasploit How to hack a website with Metasploit By Sumedt Jitpukdebodin Normally, Penetration Tester or a Hacker use Metasploit to exploit vulnerability services in the target server or to create a payload to make

More information

Members of the UK cyber security forum. Soteria Health Check. A Cyber Security Health Check for SAP systems

Members of the UK cyber security forum. Soteria Health Check. A Cyber Security Health Check for SAP systems Soteria Health Check A Cyber Security Health Check for SAP systems Soteria Cyber Security are staffed by SAP certified consultants. We are CISSP qualified, and members of the UK Cyber Security Forum. Security

More information

CYBERTRON NETWORK SOLUTIONS

CYBERTRON NETWORK SOLUTIONS CYBERTRON NETWORK SOLUTIONS CybertTron Certified Ethical Hacker (CT-CEH) CT-CEH a Certification offered by CyberTron @Copyright 2015 CyberTron Network Solutions All Rights Reserved CyberTron Certified

More information

Web Application Security: Exercise Development Approaches

Web Application Security: Exercise Development Approaches Web Application Security: Exercise Development Approaches James Walden waldenj@nku.edu Approaches 1. Write your own web application Students evaluate and fix your code. 2. Students write a web application

More information

Internal Penetration Test

Internal Penetration Test Internal Penetration Test Agenda Time Agenda Item 10:00 10:15 Introduction 10:15 12:15 Seminar: Web Application Penetration Test 12:15 12:30 Break 12:30 13:30 Seminar: Social Engineering Test 13:30 15:00

More information

Detecting and Exploiting XSS with Xenotix XSS Exploit Framework

Detecting and Exploiting XSS with Xenotix XSS Exploit Framework Detecting and Exploiting XSS with Xenotix XSS Exploit Framework ajin25@gmail.com keralacyberforce.in Introduction Cross Site Scripting or XSS vulnerabilities have been reported and exploited since 1990s.

More information

Web application security

Web application security Web application security Sebastian Lopienski CERN Computer Security Team openlab and summer lectures 2010 (non-web question) Is this OK? int set_non_root_uid(int uid) { // making sure that uid is not 0

More information

WHITE PAPER. FortiWeb and the OWASP Top 10 Mitigating the most dangerous application security threats

WHITE PAPER. FortiWeb and the OWASP Top 10 Mitigating the most dangerous application security threats WHITE PAPER FortiWeb and the OWASP Top 10 PAGE 2 Introduction The Open Web Application Security project (OWASP) Top Ten provides a powerful awareness document for web application security. The OWASP Top

More information

Enterprise Application Security Workshop Series

Enterprise Application Security Workshop Series Enterprise Application Security Workshop Series Phone 877-697-2434 fax 877-697-2434 www.thesagegrp.com Defending JAVA Applications (3 Days) In The Sage Group s Defending JAVA Applications workshop, participants

More information

Real World Web Service Testing For Web Hackers

Real World Web Service Testing For Web Hackers Real World Web Service Testing For Web Hackers TOM ESTON» Senior Security Consultant SecureState» Web Application / Network Penetration Tester» Founder of SocialMediaSecurity.com» Previous Security Research

More information

Web Security Testing Cookbook*

Web Security Testing Cookbook* Web Security Testing Cookbook* Systematic Techniques to Find Problems Fast Paco Hope and Ben Walther O'REILLY' Beijing Cambridge Farnham Koln Sebastopol Tokyo Table of Contents Foreword Preface xiii xv

More information

STABLE & SECURE BANK lab writeup. Page 1 of 21

STABLE & SECURE BANK lab writeup. Page 1 of 21 STABLE & SECURE BANK lab writeup 1 of 21 Penetrating an imaginary bank through real present-date security vulnerabilities PENTESTIT, a Russian Information Security company has launched its new, eighth

More information

3. Broken Account and Session Management. 4. Cross-Site Scripting (XSS) Flaws. Web browsers execute code sent from websites. Account Management

3. Broken Account and Session Management. 4. Cross-Site Scripting (XSS) Flaws. Web browsers execute code sent from websites. Account Management What is an? s Ten Most Critical Web Application Security Vulnerabilities Anthony LAI, CISSP, CISA Chapter Leader (Hong Kong) anthonylai@owasp.org Open Web Application Security Project http://www.owasp.org

More information

Pentests more than just using the proper tools

Pentests more than just using the proper tools Pentests more than just using the proper tools Agenda 1. Information Security @ TÜV Rheinland 2. Penetration testing Introduction Evaluation scheme Security Analyses of web applications Internal Security

More information

Penetration Testing. Types Black Box. Methods Automated Manual Hybrid. oless productive, more difficult White Box

Penetration Testing. Types Black Box. Methods Automated Manual Hybrid. oless productive, more difficult White Box Penetration Testing Penetration Testing Types Black Box oless productive, more difficult White Box oopen, team supported, typically internal osource available Gray Box (Grey Box) omixture of the two Methods

More information

Data Breaches and Web Servers: The Giant Sucking Sound

Data Breaches and Web Servers: The Giant Sucking Sound Data Breaches and Web Servers: The Giant Sucking Sound Guy Helmer CTO, Palisade Systems, Inc. Lecturer, Iowa State University @ghelmer Session ID: DAS-204 Session Classification: Intermediate The Giant

More information

elearning for Secure Application Development

elearning for Secure Application Development elearning for Secure Application Development Curriculum Application Security Awareness Series 1-2 Secure Software Development Series 2-8 Secure Architectures and Threat Modeling Series 9 Application Security

More information

Nuclear Regulatory Commission Computer Security Office Computer Security Standard

Nuclear Regulatory Commission Computer Security Office Computer Security Standard Nuclear Regulatory Commission Computer Security Office Computer Security Standard Office Instruction: Office Instruction Title: CSO-STD-1108 Web Application Standard Revision Number: 1.0 Effective Date:

More information

Is Drupal secure? A high-level perspective on web vulnerabilities, Drupal s solutions, and how to maintain site security

Is Drupal secure? A high-level perspective on web vulnerabilities, Drupal s solutions, and how to maintain site security Is Drupal secure? A high-level perspective on web vulnerabilities, Drupal s solutions, and how to maintain site security Presented 2009-05-29 by David Strauss Thinking Securely Security is a process, not

More information

OWASP AND APPLICATION SECURITY

OWASP AND APPLICATION SECURITY SECURING THE 3DEXPERIENCE PLATFORM OWASP AND APPLICATION SECURITY Milan Bruchter/Shutterstock.com WHITE PAPER EXECUTIVE SUMMARY As part of Dassault Systèmes efforts to counter threats of hacking, particularly

More information

SENSITIVE AUSTRALIAN SPORTS COMMISSION ATHLETE MANAGEMENT SYSTEM (AMS) SMARTBASE SECURITY TEST PLAN. Final. Version 1.0

SENSITIVE AUSTRALIAN SPORTS COMMISSION ATHLETE MANAGEMENT SYSTEM (AMS) SMARTBASE SECURITY TEST PLAN. Final. Version 1.0 SENSITIVE AUSTRALIAN SPORTS COMMISSION ATHLETE MANAGEMENT SYSTEM (AMS) SMARTBASE SECURITY TEST PLAN Final Version 1.0 Preconditions This security testing plan is dependent on the following preconditions:

More information

Practical Identification of SQL Injection Vulnerabilities

Practical Identification of SQL Injection Vulnerabilities Practical Identification of SQL Injection Vulnerabilities Chad Dougherty Background and Motivation The class of vulnerabilities known as SQL injection continues to present an extremely high risk in the

More information

Web Application Security

Web Application Security Web Application Security Kenneth Ingham and Anil Somayaji September 29, 2009 1 Course overview Web applications are essential to everything from embedded systems to e-commerce systems. This class looks

More information

Web Application Security. Vulnerabilities, Weakness and Countermeasures. Massimo Cotelli CISSP. Secure

Web Application Security. Vulnerabilities, Weakness and Countermeasures. Massimo Cotelli CISSP. Secure Vulnerabilities, Weakness and Countermeasures Massimo Cotelli CISSP Secure : Goal of This Talk Security awareness purpose Know the Web Application vulnerabilities Understand the impacts and consequences

More information

JOOMLA SECURITY. ireland website design. by Oliver Hummel. ADDRESS Unit 12D, Six Cross Roads Business Park, Waterford City

JOOMLA SECURITY. ireland website design. by Oliver Hummel. ADDRESS Unit 12D, Six Cross Roads Business Park, Waterford City JOOMLA SECURITY by Oliver Hummel ADDRESS Unit 12D, Six Cross Roads Business Park, Waterford City CONTACT Nicholas Butler 051-393524 089-4278112 info@irelandwebsitedesign.com Contents Introduction 3 Installation

More information

Passing PCI Compliance How to Address the Application Security Mandates

Passing PCI Compliance How to Address the Application Security Mandates Passing PCI Compliance How to Address the Application Security Mandates The Payment Card Industry Data Security Standards includes several requirements that mandate security at the application layer. These

More information

QualysGuard WAS. Getting Started Guide Version 3.3. March 21, 2014

QualysGuard WAS. Getting Started Guide Version 3.3. March 21, 2014 QualysGuard WAS Getting Started Guide Version 3.3 March 21, 2014 Copyright 2011-2014 by Qualys, Inc. All Rights Reserved. Qualys, the Qualys logo and QualysGuard are registered trademarks of Qualys, Inc.

More information

Overview of the Penetration Test Implementation and Service. Peter Kanters

Overview of the Penetration Test Implementation and Service. Peter Kanters Penetration Test Service @ ABN AMRO Overview of the Penetration Test Implementation and Service. Peter Kanters ABN AMRO / ISO April 2010 Contents 1. Introduction. 2. The history of Penetration Testing

More information

Web applications. Web security: web basics. HTTP requests. URLs. GET request. Myrto Arapinis School of Informatics University of Edinburgh

Web applications. Web security: web basics. HTTP requests. URLs. GET request. Myrto Arapinis School of Informatics University of Edinburgh Web applications Web security: web basics Myrto Arapinis School of Informatics University of Edinburgh HTTP March 19, 2015 Client Server Database (HTML, JavaScript) (PHP) (SQL) 1 / 24 2 / 24 URLs HTTP

More information

Introduction to Web Application Security. Microsoft CSO Roundtable Houston, TX. September 13 th, 2006

Introduction to Web Application Security. Microsoft CSO Roundtable Houston, TX. September 13 th, 2006 Introduction to Web Application Security Microsoft CSO Roundtable Houston, TX September 13 th, 2006 Overview Background What is Application Security and Why Is It Important? Examples Where Do We Go From

More information

Testnet Summerschool. Web Application Security Testing. Dave van Stein

Testnet Summerschool. Web Application Security Testing. Dave van Stein Testnet Summerschool Web Application Security Testing Dave van Stein Welcome Your coach for today Dave van Stein Security Consultant Web Application Penetration Tester Purpose of today s workshop Creating

More information

Penetration testing: exposure of fallacies 1-14

Penetration testing: exposure of fallacies 1-14 Penetration testing: exposure of fallacies 1-14 Statistics of the vulnerabilities distribution (2014) Network perimeter: 73% 52% 34% Ability to connect third-party equipment without pre-authorization Weak

More information

Cloud Application Security Assessment, Guerrilla Style

Cloud Application Security Assessment, Guerrilla Style Cloud Application Security Assessment, Guerrilla Style SESSION ID: CSV-F03A Mark Orlando Director of Cyber Operations Foreground Security Adam Willard Application Security Analyst Foreground Security Agenda

More information

OWASP TOP 10 ILIA ALSHANETSKY @ILIAA HTTPS://JOIND.IN/15741

OWASP TOP 10 ILIA ALSHANETSKY @ILIAA HTTPS://JOIND.IN/15741 OWASP TOP 10 ILIA ALSHANETSKY @ILIAA HTTPS://JOIND.IN/15741 ME, MYSELF & I PHP Core Developer Author of Guide to PHP Security Security Aficionado THE CONUNDRUM USABILITY SECURITY YOU CAN HAVE ONE ;-) OPEN

More information

Secure Web Development Teaching Modules 1. Security Testing. 1.1 Security Practices for Software Verification

Secure Web Development Teaching Modules 1. Security Testing. 1.1 Security Practices for Software Verification Secure Web Development Teaching Modules 1 Security Testing Contents 1 Concepts... 1 1.1 Security Practices for Software Verification... 1 1.2 Software Security Testing... 2 2 Labs Objectives... 2 3 Lab

More information

What is Web Security? Motivation

What is Web Security? Motivation brucker@inf.ethz.ch http://www.brucker.ch/ Information Security ETH Zürich Zürich, Switzerland Information Security Fundamentals March 23, 2004 The End Users View The Server Providers View What is Web

More information

Web Application Firewalls Evaluation and Analysis. University of Amsterdam System & Network Engineering MSc

Web Application Firewalls Evaluation and Analysis. University of Amsterdam System & Network Engineering MSc Web Application Firewalls Evaluation and Analysis Andreas Karakannas Andreas.Karakanas@os3.nl George Thessalonikefs George.Thessalonikefs@os3.nl University of Amsterdam System & Network Engineering MSc

More information

Pentests more than just using the proper tools

Pentests more than just using the proper tools Pentests more than just using the proper tools Agenda 1. Information Security @ TÜV Rheinland 2. Security testing 3. Penetration testing Introduction Evaluation scheme Security Analyses of web applications

More information