Trustwave Application Penetration Test Digitaltransactions-080815

CONFIDENTIAL INFORMATION – FOR INTERNAL USE ONLY
Trustwave
Application Penetration Test
unexpected characters. These characters are sometimes referred to as “special” characters.
Different shells, applications, command processors and languages respond in different but
predictable ways to specific combinations of characters. If an application does not properly
sanitize client input, a malicious user may, among other actions, be able to access or modify
protected or privileged data, execute arbitrary code on a server, or induce a legitimate user to
execute code on the attacker’s behalf.
In testing for meta-character sanitization, Trustwave supplied data with specific characters and
interpreted server responses. Meta-characters that have meaning to a wide variety of
applications were tested; some of these characters are likely benign in the Boland Hills
application infrastructure. Since application infrastructure changes cannot be accurately
predicted, Trustwave feels that the best approach is to protect against all meta-characters, not
just those known to the current environment.
An analysis of each category can be found below.
Session Management
(Analysis of session state, cookies,
session theft)
Input Validation
(This attack tree is predicated on
poor application input validation)
Parameter Tampering
(These attacks deal primarily with
data theft, and escalation of
privileges - there is overlap with
Input Validation attacks)
Programmatic Errors
(These attacks are launched against
the application engine and
application server themselves. They
deal with “universal” weaknesses in
the architecture that manifest
themselves in the application flow.)
Cookie Predictability, Cookie Manipulation, Cookie Analysis,
Session Theft, Session Fixation, Session Trapping, Ability to Sniff
Application Traffic, Potential for Man in the Middle, Potential for
phishing, Eavesdropping, Cross-Site Request Forgery, and others.
Cross-Site Scripting (XSS), Alternate XSS Syntax, Blind SQL
Injection, Blind XPath Injection, Command Injection, Handling of
Meta-Characters, HTTP Response Splitting, Application Interpreter
Injection, SQL Injection, Server-Side Includes (SSI) Injection,
Encoding Types Supported, and others.
Type Conversion Errors, Argument Injection or Modification,
Code/Command Injection, Application Common Elements, Direct
Dynamic Code Evaluation, HTTP Request Smuggling, HTTP
Response Splitting, XML Injection, and others.
Directory/Path Traversal, Attacks Against Application Error Pages,
Buffer Overflows, Format String, Forceful Browsing, Integer
Overflows/Underflows, Log Forging, and others.
Table 4 - Application Attack Classes
- 11 -
Copyright © 2008 Trustwave. All Rights Reserved.
CONFIDENTIAL INFORMATION – FOR INTERNAL USE ONLY