Penetration Testing & Vulnerability Analysis
Methodology Top 10 Popular Threats What are Design Flaws? Example Design Flaws Design Analysis & Steps What are Operation Security Concerns? Example Operational Security Concerns Tools
Design Review & Analysis Operational Review & Analysis Vulnerability Verification Reporting & Submission
A1: Injection A2: Cross-Site Scripting (XSS) A3: Broken Authentication and Session Management A4: Insecure Direct Object References A5: Cross-Site Request Forgery (CSRF) A6: Security Misconfiguration A7: Insecure Cryptographic Storage A8: Failure to Restrict URL Access A9: Insufficient Transport Layer Protection A10: Invalidated Redirects and Forwards
A design vulnerability is a problem that arises from a fundamental mistake or oversight in the softwares design The Art of Software Security Assessment Lack of security forethought Intrinsic to the apps architecture Can be subtle Are often devastating
Reliable
Work seamlessly across OSes/versions Do not corrupt memory! Usually have little/no preventative protection mechanisms Rarely alarm detection tools Do not crash on failure
Easily fingerprinted Work well in symphony Difficult to fix, so they hang around for a while
Authentication
Bypasses Lack of Authentication Lack of Authorization Giving higher privileges to lower privileged users Storing key with plaintext Improper use
Authorization
Cryptography
Business Logic
Authentication Bypass
Lack of Authorization
RealVNC NULL Authentication Method, Authentication Bypass in 2006
switch(authentication_type) { case USE_PASSWORD: getCredentials(&creds.password); if (validateCreds(creds)) { auth_flag = 1; } break; case USE_NULL_AUTH: auth_flag = 1; break; }
Debugging / QA hardcoded usernames / passwords
if (!strcmp(password, mySecret)) { auth_flag = 1; break; }
Cryptographic
Hardcoded keys Hardcoded password Password stored in clear-text inside database
Collect Information Modelling The Application Understand Business Logic, Intention & Architecture Security analysis towards the application from gathered information
Application Specs, RFCs, etc Architectural Documentation, URS, SDS, etc Data Flow Diagrams Especially anything on security relevant matters
Identify Resources Resources are anything used by the application which may be useful to an attacker
Data (Credentials? Personal info?) used by the application Control the application has or grants access to
All of resources combined represent every piece of access to data or functionality offered by a system
Example Input
What type of input does the application get? Where/Who does the data come from? What is the purpose of the input? Track the input data flow How trusted is the data? How much validation is performed on the data?
Example Threats
SQL Injection Remote File Inclusion Local File Inclusion Remote Code Execution (Interpreter, OS) Bypass JavaScript Restriction
Something to think about
Any external influence you can provide which affects the program is input!
Examine Output
What type of output data is there? (Is it sensitive?) Where does the output go? How does the input result in output? How can the data be leveraged by an attacker?
Example Threats
Cross Site Scripting (XSS) Application Error Output
SQL, PHP, Database, File Physical Path, etc
Sensitive Information
Email, Phone
What type of External Components are there?
Network Services/Web Services used by the application
SOAP, REST, WCF, JSON, TCP/UDP
Libraries
DXUniversal, Telerik, etc.
Databases
MSSQL, Oracle, NoSQL/MongoDB/etc.
Anything the application relies on that is not part of the application itself
User Roles
What are the various roles of users?
Users Super Users Administrators Backup User
How do they identify themselves? How is a user authenticated?
Form, OpenID, CardSpace
How are privilege levels defined? Where are user roles unclear?
Trust Boundaries
Given the user roles, and the resources, where should trust boundaries lie?
Form URI
Where is trust granted by the application to external components
Physical Drive
Databases
Are these trust boundaries enforced uniformly? Are there unclear areas of trust?
Audit Trails
Are all submissions form logged? Are all transactions logged? Are all logged including timestamp, user access, etc. ? Are all deleted records being deleted from the data store (Database, Local log) ?
Operational vulnerabilities are the result of issues in an application's configuration or deployment environment. The Art of Software Security Assessment
Infrastructure supporting the application Environmental concerns
Operational issues happen outside the scope of the application Not problems which will be indicated in the source itself Possible concerns can be inferred by thinking about what the application does, and how it is likely deployed
Poor configuration? External components
Databases setup with open ports, default passwords Default scripts left around web servers Anonymous logins allowed on ftp servers Unpatched components
Failure to use secure technologies around the applications deployment
Lack of SSL on web servers exchanging credentials Poorly generated certificates/bad random data Compiled application binaries would easily being reverse engineered to let attacker read the application flow
Security Hardening Mechanisms
C/C++ - DEP, Stack Cookies, Hardened Heap, SEH validation, Address Space Layout Randomization IIS.Net Enable Custom Error, URL Rewriting, Application Firewall (ThreatSentry, WebKnight) Obfuscation To protect compilation binary from being reverse engineered
Policy, security in depth
Network segmentation System user roles Chroot/Jails Firewalls
Error Reporting Enable
Data Transaction In Clear-Text
Source Code From Reverse Engineered App
Static Analysis Tools Yasca (.Net, Java, C, C++) FlawFinder (C, C++) HP Fortify (.Net, Java, C, C++, Delphi) RATS (C, C++) Development Environment Tools Microsoft Visual Studio 2010 Coderush FXCop Eclipse
Obfuscation & Reverse Engineering .Net Reflector IDA Pro, OllyDbg Unity3D Obfuscator Dotfuscator Runtime Analyzer CheatEngine Fiddler2 Acunetix, Paros, Burp Suite
Web Vulnerability Scanner Acunetix Web Vulnerability Scanner SkipFish Vega Network Vulnerability Scanner Tenable Nessus Rapid7 Nexpose Exploitation SQLMap Havij Metasploit Framework
