4.0

180Web Application Penetration Testingpossible to exceed my limit if the systems are basing decisionson last night’s data.How to TestGeneric Test Method• Review the project documentation and use exploratory testinglooking for data entry points or hand off points between systemsor software.• Once found try to insert logically invalid data into the application/system.Specific Testing Method:• Perform front-end GUI Functional Valid testing on theapplication to ensure that the only “valid” values are accepted.• Using an intercepting proxy observe the HTTP POST/GET looking for places that variables such as cost and quality are passed.Specifically, look for “hand-offs” between application/systemsthat may be possible injection of tamper points.• Once variables are found start interrogating the field with logically “invalid” data, such as social security numbers or uniqueidentifiers that do not exist or that do not fit the business logic.This testing verifies that the server functions properly anddoes not accept logically invalid data them.Related Test Cases• All Input Validation test cases• Testing for Account Enumeration and Guessable User Account(OTG-IDENT-004)• Testing for Bypassing Session Management Schema(OTG-SESS-001)• Testing for Exposed Session Variables (OTG-SESS-004)Tools• OWASP Zed Attack Proxy (ZAP) -https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project• ZAP is an easy to use integrated penetration testing tool forfinding vulnerabilities in web applications. It is designed to beused by people with a wide range of security experience and assuch is ideal for developers and functional testers who are newto penetration testing. ZAP provides automated scanners aswell as a set of tools that allow you to find security vulnerabilitiesmanually.ReferencesBeginning Microsoft Visual Studio LightSwitch Development -http://books.google.com/books?id=x76L_kaTgdEC&pg=PA280&lpg=PA280&dq=business+logic+example+valid+data+example&source=bl&ots=GOfQ-7f4Hu&sig=4jOejZVligZOrvjBFRAT4-jy8DI&hl=en&sa=X&ei=mydYUt6qE-OX54APu7IDgCQ&ved=0CFIQ6AEwBDgK#v=onepage&q=business%20logic%20example%20valid%20data%20example&f=falseRemediationThe application/system must ensure that only “logically valid”data is accepted at all input and hand off points of the applicationor system and data is not simply trusted once it has enteredthe system.Test Ability to forge requests(OTG-BUSLOGIC-002)SummaryForging requests is a method that attackers use to circumventthe front end GUI application to directly submit information forback end processing. The goal of the attacker is to send HTTPPOST/GET requests through an intercepting proxy with data valuesthat is not supported, guarded against or expected by theapplications business logic. Some examples of forged requestsinclude exploiting guessable or predictable parameters or expose“hidden” features and functionality such as enabling debuggingor presenting special screens or windows that are veryuseful during development but may leak information or bypassthe business logic.Vulnerabilities related to the ability to forge requests is uniqueto each application and different from business logic data validationin that it s focus is on breaking the business logic workflow.Applications should have logic checks in place to prevent thesystem from accepting forged requests that may allow attackersthe opportunity to exploit the business logic, process, or flowof the application. Request forgery is nothing new; the attackeruses an intercepting proxy to send HTTP POST/GET requests tothe application. Through request forgeries attackers may be ableto circumvent the business logic or process by finding, predictingand manipulating parameters to make the application think aprocess or task has or has not taken place.Also, forged requests may allow subvention of programmatic orbusiness logic flow by invoking “hidden” features or functionalitysuch as debugging initially used by developers and testerssometimes referred to as an ”Easter egg”. “An Easter egg is anintentional inside joke, hidden message, or feature in a work suchas a computer program, movie, book, or crossword. According togame designer Warren Robinett, the term was coined at Atari bypersonnel who were alerted to the presence of a secret messagewhich had been hidden by Robinett in his already widely distributedgame, Adventure. The name has been said to evoke the ideaof a traditional Easter egg hunt.” http://en.wikipedia.org/wiki/Easter_egg_(media)ExamplesExample 1Suppose an e-commerce theater site allows users to select theirticket, apply a onetime 10% Senior discount on the entire sale,view the subtotal and tender the sale. If an attacker is able tosee through a proxy that the application has a hidden field (of1 or 0) used by the business logic to determine if a discount hasbeen taken or not. The attacker is then able to submit the 1 or “nodiscount has been taken” value multiple times to take advantageof the same discount multiple times.