How About Security Testing? Jouri Dufour, CTG www.eurostarconferences.com @esconfs #esconfs
How About Cybercrime?
Our BUSINESS LIFE is online.
If A happens, then B must be the case, so I will do C. BUT WHAT IF X OCCURS?
01 Fooling a password change function
Password change function Administrator Username Existing password * New password Confirm new password * Only presented to users Password change request N Existing password parameter? Y User The functionality The assumption The attack
Password change function Administrator N FLAW Username Existing password * New password Confirm new password * Only presented to users Password change request Existing password parameter? Y User The functionality The assumption The attack
ATTACK Password change function Administrator Username Existing password * New password Confirm new password * Only presented to users Password change request N Existing password parameter? Y User The functionality The assumption The attack
RECOMMENDED HACK STEPS Try removing in turn each request parameter Be sure to delete the actual parameter name as well as its value Attack only one parameter at a time Follow a multistage process through to completion
02 Proceeding to checkout
Retail application Add items to shopping basket Finalize order Enter payment information Enter delivery information The functionality The assumption The attack
Retail application Add items to shopping basket Finalize order FLAW Enter payment information Enter delivery information The functionality The assumption The attack
Retail application ATTACK Add items to shopping basket Finalize order Enter payment information Enter delivery information The functionality The assumption The attack
RECOMMENDED HACK STEPS Attempt to submit requests out of the expected sequence Be sure to fully understand the access mechanisms to distinct stages Try to violate the developers assumptions Use any interesting error messages and debug output to fine-tune your attacks
The application may enforce strict access control only on the initial stages of the process
03 Beating a business limit
ERP application Bank account 1 Less than 10.000? Y Bank account 2 N The functionality The assumption The attack
ERP application FLAW Bank account 1 Less than 10.000? Y Bank account 2 N The functionality The assumption The attack
ERP application 20.000 Bank account 1-20.000 Less than 10.000? Y Bank account 2 N The functionality The assumption The attack
Many applications use numeric limits and beating such limits may have serious business consequences
RECOMMENDED HACK STEPS Try entering negative values Sometimes several steps need to be repeated to bring the application in a vulnerable state
04 Cheating on bulk discounts
Retail application Shopping basket Item 1... Item 2... Item 3... Purchase bundle -25% The functionality The assumption The attack
Retail application Shopping basket Item 1... Item 2... Item 3... FLAW Purchase bundle -25% The functionality The assumption The attack
ATTACK Retail application Shopping basket Item 1... Item 2... Item 3... Purchase bundle -25% The functionality The assumption The attack
RECOMMENDED HACK STEPS Find out if adjustments are made on a one-time basis Try to manipulate the application s behavior to get adjustments that don t correspond to the original intended criteria
05 Escaping from escaping
Web application User-controllable input Sanitization using the backslash character \ ; & < > ` space newline Operating system command The functionality The assumption The attack
Web application User-controllable input Sanitization using the backslash character \ ; & < > ` space newline FLAW Operating system command The functionality The assumption The attack
ATTACK Web application User-controllable input Sanitization using the backslash character \ ; & < > ` space newline Operating system command The functionality The assumption The attack
Web application COMMAND INJECTION Foo\;ls Sanitization using the backslash character \ Foo\\;ls Operating system command ; & < > ` space newline The functionality The assumption The attack
RECOMMENDED HACK STEPS Attempt to insert relevant metacharacters into the data you control Always try placing a backslash immediately before each such character
This same defect can be found in some defenses against cross-site scripting attacks
Yesterday Today Tomorrow Dynamic Application Security Testing (DAST) Static Application Security Testing (SAST) + = Integrated Application Security Testing (IAST)
Time 00:00 Victims 31762 00:01 00:02 00:03 00:04 00:05 00:06 00:07 00:08 00:09 00:10 00:11 00:12 00:13 00:14 00:15 00:16 00:17 00:18 00:19 00:20 00:21 00:22 00:23 00:24 00:25 00:26 00:27 00:28 00:29 00:30 00:31 00:32 00:33 00:34 00:35 00:36 00:37 00:38 00:39 00:40 00:41 00:42 00:43 00:44 00:45 00:46 00:47 00:48 00:49 00:50 00:51 00:52 00:53 00:54 00:55 00:56 00:57 00:58 00:59 01:00 31744 31726 31708 31690 31672 31654 31636 31618 31600 31582 31564 31546 31528 31510 31492 31474 31456 31438 31420 31402 31384 31366 31348 31330 31312 31294 31276 31258 31240 31222 31204 31186 31168 31150 31132 31114 31096 31078 31060 31042 31024 31006 30988 30970 30952 30934 30916 30898 30880 30862 30844 30826 30808
HOW ABOUT SECURITY TESTING? Fooling a password change function Proceeding to checkout Beating a business limit Cheating on bulk discounts Escaping from escaping Speaker: Jouri Dufour www.ctg.com jouri.dufour@ctg.com