4.0

150Web Application Penetration TestingThe functions that are primarily responsible for format string vulnerabilitiesare ones that treat format specifiers as optional. Thereforewhen manually reviewing code, emphasis can be given to functionssuch as:printffprintfsprintfsnprintfvfprintfvprintfvsprintfvsnprintfThere can be several formatting functions that are specific to thedevelopment platform. These should also be reviewed for absenceof format strings once their argument usage has been understood.Tools• ITS4: “A static code analysis tool for identifying format stringvulnerabilities using source code” - http://www.cigital.com/its4• An exploit string builder for format bugs - http://seclists.org/lists/pen-test/2001/Aug/0014.htmlReferencesWhitepapers• Format functions manual page -http://www.die.net/doc/linux/man/man3/fprintf.3.html• Tim Newsham: “A paper on format string attacks” -http://comsec.theclerk.com/CISSP/FormatString.pdf• Team Teso: “Exploiting Format String Vulnerabilities” -http://www.cs.ucsb.edu/~jzhou/security/formats-teso.html• Analysis of format string bugs -http://julianor.tripod.com/format-bug-analysis.pdfTesting for Incubated Vulnerability(OTG-INPVAL-015)SummaryAlso often refered to as persistent attacks, incubated testing is acomplex testing method that needs more than one data validationvulnerability to work. Incubated vulnerabilities are typicallyused to conduct “watering hole” attacks against users of legitimateweb applications.Incubated vulnerabilities have the following characteristics:• The attack vector needs to be persisted in the first place, itneeds to be stored in the persistence layer, and this would onlyoccur if weak data validation was present or the data arrivedinto the system via another channel such as an admin consoleor directly via a backend batch process.• Secondly, once the attack vector was “recalled” the vectorwould need to be executed successfully. For example, anincubated XSS attack would require weak output validation sothe script would be delivered to the client in its executable form.Exploitation of some vulnerabilities, or even functional featuresof a web application, will allow an attacker to plant a piece of datathat will later be retrieved by an unsuspecting user or other componentof the system, exploiting some vulnerability there.In a penetration test, incubated attacks can be used to assessthe criticality of certain bugs, using the particular security issuefound to build a client-side based attack that usually will be usedto target a large number of victims at the same time (i.e. all usersbrowsing the site).This type of asynchronous attack covers a great spectrum of attackvectors, among them the following:• File upload components in a web application, allowing theattacker to upload corrupted media files (jpg images exploitingCVE-2004-0200, png images exploiting CVE-2004-0597,executable files, site pages with active component, etc.)• Cross-site scripting issues in public forums posts (see Testingfor Stored Cross_site scripting (OTG-INPVAL-002) for additionaldetails). An attacker could potentially store malicious scriptsor code in a repository in the backend of the web-application(e.g., a database) so that this script/code gets executed by oneof the users (end users, administrators, etc). The archetypicalincubated attack is exemplified by using a cross-site scriptingvulnerability in a user forum, bulletin board, or blog in order toinject some JavaScript code at the vulnerable page, and will beeventually rendered and executed at the site user’s browser-using the trust level of the original (vulnerable) site at the user’sbrowser.• SQL/XPATH Injection allowing the attacker to upload content to adatabase, which will be later retrieved as part of the active contentin a web page. For example, if the attacker can post arbitraryJavaScript in a bulletin board so that it gets executed by users, thenhe might take control of their browsers (e.g., XSS-proxy).• Misconfigured servers allowing installation of Java packages orsimilar web site components (i.e. Tomcat, or web hosting consolessuch as Plesk, CPanel, Helm, etc.)How to TestBlack Box testingFile Upload ExampleVerify the content type allowed to upload to the web application andthe resultant URL for the uploaded file. Upload a file that will exploita component in the local user workstation when viewed or downloadedby the user. Send your victim an email or other kind of alert inorder to lead him/her to browse the page. The expected result is theexploit will be triggered when the user browses the resultant pageor downloads and executes the file from the trusted site.XSS Example on a Bulletin Board[1] Introduce JavaScript code as the value for the vulnerable field,for instance:document.write(‘’)[2] Direct users to browse the vulnerable page or wait for the usersto browse it. Have a “listener” at attackers.site host listeningfor all incoming connections.[3] When users browse the vulnerable page, a request containing