4.0

More documents

Recommendations

Info

160Web Application Penetration Testing$ curl -kis http:/example.com/restricted/HTTP/1.1 401 Authorization RequiredDate: Fri, 01 Aug 2013 00:00:00 GMTWWW-Authenticate: Basic realm=”Restricted Area”Accept-Ranges: bytesVary: Accept-EncodingContent-Length: 162Content-Type: text/html401 Authorization Required401 Authorization RequiredInvalid login credentials!Testing for Weak SSL/TLS Ciphers/Protocols/Keys vulnerabilitiesThe large number of available cipher suites and quick progressin cryptanalysis makes testing an SSL server a non-trivial task.At the time of writing these criteria are widely recognized asminimum checklist:• Weak ciphers must not be used (e.g. less than 128 bits [10]; noNULL ciphers suite, due to no encryption used; no AnonymousDiffie-Hellmann, due to not provides authentication).• Weak protocols must be disabled (e.g. SSLv2 must be disabled,due to known weaknesses in protocol design [11]).• Renegotiation must be properly configured (e.g. InsecureRenegotiation must be disabled, due to MiTM attacks [12] andClient-initiated Renegotiation must be disabled, due to Denial ofService vulnerability [13]).• No Export (EXP) level cipher suites, due to can be easly broken[10].• X.509 certificates key length must be strong (e.g. if RSA or DSAis used the key must be at least 1024 bits).• X.509 certificates must be signed only with secure hashingalgoritms (e.g. not signed using MD5 hash, due to known collisionattacks on this hash).• Keys must be generated with proper entropy (e.g, Weak KeyGenerated with Debian) [14].A more complete checklist includes:• Secure Renegotiation should be enabled.• MD5 should not be used, due to known collision attacks. [35]• RC4 should not be used, due to crypto-analytical attacks [15].• Server should be protected from BEAST Attack [16].• Server should be protected from CRIME attack, TLS compression must be disabled [17].• Server should support Forward Secrecy [18].The following standards can be used as reference while assessingSSL servers:• PCI-DSS v2.0 in point 4.1 requires compliant parties to use“strong cryptography” without precisely defining key lengths andalgorithms. Common interpretation, partially based on previousversions of the standard, is that at least 128 bit key cipher, noexport strength algorithms and no SSLv2 should be used [19].• Qualys SSL Labs Server Rating Guide [14], Depoloyment bestpractice [10] and SSL Threat Model [20] has been proposed tostandardize SSL server assessment and configuration. But is lessupdated than the SSL Server tool [21].• OWASP has a lot of resources about SSL/TLS Security [22],[23], [24], [25]. [26].Some tools and scanners both free (e.g. SSLAudit [28] or SSLScan[29]) and commercial (e.g. Tenable Nessus [27]), can be used to assessSSL/TLS vulnerabilities. But due to evolution of these vulnerabilitiesa good way to test is to check them manually with openssl[30] or use the tool’s output as an input for manual evaluation usingthe references.Sometimes the SSL/TLS enabled service is not directly accessibleand the tester can access it only via a HTTP proxy using CONNECTmethod [36]. Most of the tools will try to connect to desired tcp portto start SSL/TLS handshake. This will not work since desired port isaccessible only via HTTP proxy. The tester can easily circumvent thisby using relaying software such as socat [37].Example 2. SSL service recognition via nmapThe first step is to identify ports which have SSL/TLS wrapped services.Typically tcp ports with SSL for web and mail services are -but not limited to - 443 (https), 465 (ssmtp), 585 (imap4-ssl), 993(imaps), 995 (ssl-pop).In this example we search for SSL services using nmap with “-sV”option, used to identify services and it is also able to identify SSLservices [31]. Other options are for this particular example and mustbe customized. Often in a Web Application Penetration Test scope islimited to port 80 and 443.$ nmap -sV --reason -PN -n --top-ports 100 www.example.comStarting Nmap 6.25 ( http:/nmap.org ) at 2013-01-01 00:00CESTNmap scan report for www.example.com (127.0.0.1)Host is up, received user-set (0.20s latency).Not shown: 89 filtered portsReason: 89 no-responsesPORT STATE SERVICE REASON VERSION21/tcp open ftp syn-ack Pure-FTPd22/tcp open ssh syn-ack OpenSSH 5.3 (protocol 2.0)25/tcp open smtp syn-ack Exim smtpd 4.8026/tcp open smtp syn-ack Exim smtpd 4.8080/tcp open http syn-ack110/tcp open pop3 syn-ack Dovecot pop3d143/tcp open imap syn-ack Dovecot imapd443/tcp open ssl/http syn-ack Apache465/tcp open ssl/smtp syn-ack Exim smtpd 4.80993/tcp open ssl/imap syn-ack Dovecot imapd995/tcp open ssl/pop3 syn-ack Dovecot pop3dService Info: Hosts: example.comService detection performed. Please report any incorrect resultsat http:/nmap.org/submit/ .Nmap done: 1 IP address (1 host up) scanned in 131.38 seconds
161Web Application Penetration TestingExample 3. Checking for Certificate information, Weak Ciphersand SSLv2 via nmapNmap has two scripts for checking Certificate information, WeakCiphers and SSLv2 [31].$ nmap --script ssl-cert,ssl-enum-ciphers -p443,465,993,995 www.example.comStarting Nmap 6.25 ( http: /nmap.org ) at 2013-01-01 00:00CESTNmap scan report for www.example.com (127.0.0.1)Host is up (0.090s latency).rDNS record for 127.0.0.1: www.example.comPORT STATE SERVICE443/tcp open https| ssl-cert: Subject: commonName=www.example.org| Issuer: commonName=*******| Public Key type: rsa| Public Key bits: 1024| Not valid before: 2010-01-23T00:00:00+00:00| Not valid after: 2020-02-28T23:59:59+00:00| MD5: *******|_SHA-1: *******| ssl-enum-ciphers:| SSLv3:| ciphers:| TLS_RSA_WITH_CAMELLIA_128_CBC_SHA - strong| TLS_RSA_WITH_CAMELLIA_256_CBC_SHA - strong| TLS_RSA_WITH_RC4_128_SHA - strong| compressors:| NULL| TLSv1.0:| ciphers:| TLS_RSA_WITH_CAMELLIA_128_CBC_SHA - strong| TLS_RSA_WITH_CAMELLIA_256_CBC_SHA - strong| TLS_RSA_WITH_RC4_128_SHA - strong| compressors:| NULL|_ least strength: strong465/tcp open smtps| ssl-cert: Subject: commonName=*.exapmple.com| Issuer: commonName=*******| Public Key type: rsa| Public Key bits: 2048| Not valid before: 2010-01-23T00:00:00+00:00| Not valid after: 2020-02-28T23:59:59+00:00| MD5: *******|_SHA-1: *******| ssl-enum-ciphers:| SSLv3:| ciphers:| TLS_RSA_WITH_CAMELLIA_128_CBC_SHA - strong| TLS_RSA_WITH_CAMELLIA_256_CBC_SHA - strong| TLS_RSA_WITH_RC4_128_SHA - strong| compressors:| NULL| TLSv1.0:| ciphers:| TLS_RSA_WITH_CAMELLIA_128_CBC_SHA - strong| TLS_RSA_WITH_CAMELLIA_256_CBC_SHA - strong| TLS_RSA_WITH_RC4_128_SHA - strong| compressors:| NULL|_ least strength: strong993/tcp open imaps| ssl-cert: Subject: commonName=*.exapmple.com| Issuer: commonName=*******| Public Key type: rsa| Public Key bits: 2048| Not valid before: 2010-01-23T00:00:00+00:00| Not valid after: 2020-02-28T23:59:59+00:00| MD5: *******|_SHA-1: *******| ssl-enum-ciphers:| SSLv3:| ciphers:| TLS_RSA_WITH_CAMELLIA_128_CBC_SHA - strong| TLS_RSA_WITH_CAMELLIA_256_CBC_SHA - strong| TLS_RSA_WITH_RC4_128_SHA - strong| compressors:| NULL| TLSv1.0:| ciphers:| TLS_RSA_WITH_CAMELLIA_128_CBC_SHA - strong| TLS_RSA_WITH_CAMELLIA_256_CBC_SHA - strong| TLS_RSA_WITH_RC4_128_SHA - strong| compressors:| NULL|_ least strength: strong995/tcp open pop3s| ssl-cert: Subject: commonName=*.exapmple.com| Issuer: commonName=*******| Public Key type: rsa| Public Key bits: 2048| Not valid before: 2010-01-23T00:00:00+00:00| Not valid after: 2020-02-28T23:59:59+00:00| MD5: *******|_SHA-1: *******| ssl-enum-ciphers:| SSLv3:| ciphers:| TLS_RSA_WITH_CAMELLIA_128_CBC_SHA - strong| TLS_RSA_WITH_CAMELLIA_256_CBC_SHA - strong| TLS_RSA_WITH_RC4_128_SHA - strong| compressors:| NULL| TLSv1.0:| ciphers:| TLS_RSA_WITH_CAMELLIA_128_CBC_SHA - strong| TLS_RSA_WITH_CAMELLIA_256_CBC_SHA - strong| TLS_RSA_WITH_RC4_128_SHA - strong| compressors:| NULL|_ least strength: strongNmap done: 1 IP address (1 host up) scanned in 8.64 seconds
Page 1 and 2:
1Testing Guide4.0Project Leaders: M
Page 3 and 4:
Testing Guide Foreword - Table of c
Page 5 and 6:
3Testing Guide Foreword - Table of
Page 7 and 8:
5Testing Guide Foreword - By Eoin K
Page 9 and 10:
7Testing Guide Frontispiece1Testing
Page 11 and 12:
9Testing Guide Introduction2The OWA
Page 13 and 14:
11Testing Guide Introductionvide en
Page 15 and 16:
13Testing Guide IntroductionTesting
Page 17 and 18:
15Testing Guide Introductionlaid on
Page 19 and 20:
17Testing Guide Introductionvalidat
Page 21 and 22:
19Testing Guide IntroductionUSERthe
Page 23 and 24:
21Testing Guide Introductionment wh
Page 25 and 26:
23Testing Guide Introductionoffendi
Page 27 and 28:
25The OWASP Testing Frameworksectio
Page 29 and 30:
27Web Application Penetration Testi
Page 31 and 32:
Page 33 and 34:
Page 35 and 36:
Page 37 and 38:
Page 39 and 40:
Page 41 and 42:
Page 43 and 44:
Page 45 and 46:
Page 47 and 48:
Page 49 and 50:
Page 51 and 52:
Page 53 and 54:
Page 55 and 56:
Page 57 and 58:
Page 59 and 60:
Page 61 and 62:
Page 63 and 64:
Page 65 and 66:
Page 67 and 68:
Page 69 and 70:
Page 71 and 72:
Page 73 and 74:
Page 75 and 76:
Page 77 and 78:
Page 79 and 80:
Page 81 and 82:
Page 83 and 84:
Page 85 and 86:
Page 87 and 88:
Page 89 and 90:
Page 91 and 92:
Page 93 and 94:
Page 95 and 96:
Page 97 and 98:
Page 99 and 100:
Page 101 and 102:
Page 103 and 104:
101Web Application Penetration Test
Page 105 and 106:
Page 107 and 108:
Page 109 and 110:
Page 111 and 112: 109Web Application Penetration Test
Page 161: 159Web Application Penetration Test
Page 211 and 212: 209same code can be applied to sess
Page 213 and 214:
211ReportingTest IDLowest versionIn
Page 215 and 216:
213ReportingTest IDBusiness Logic T
Page 217 and 218:
215Appendixkajfghlhfkcocafkcjlajldi
Page 219 and 220:
217AppendixTesting - http:/www.nist
Page 221 and 222:
219Cross Site Scripting (XSS)For de
Page 223 and 224:
221LDAP InjectionFor details on LDA
show all

4.0

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?