4.0

187Web Application Penetration Testing• In the application navigate to the file submission or uploadmechanism.• Submit the “not approved” file for upload and verify that theyare properly prevented from uploadingRelated Test Cases• Test File Extensions Handling for Sensitive Information(OTG-CONFIG-003)• Test Upload of Malicious Files (OTG-BUSLOGIC-009)References• OWASP - Unrestricted File Upload - https://www.owasp.orgindex.php/Unrestricted_File_Upload• File upload security best practices: Block a malicious fileupload - http://www.computerweekly.com/answer/Fileupload-security-best-practices-Block-a-malicious-file-upload• Stop people uploading malicious PHP files via forms - http:/stackoverflow.com/questions/602539/stop-peopleuploading-malicious-php-files-via-forms• CWE-434: Unrestricted Upload of File with Dangerous Type -http://cwe.mitre.org/data/definitions/434.html• Secure Programming Tips - Handling File Uploads - https:/www.datasprings.com/resources/dnn-tutorials/artmid/535/articleid/65/secure-programming-tips-handling-file-uploads?AspxAutoDetectCookieSupport=1RemediationApplications should be developed with mechanisms to only acceptand manipulate “acceptable“ files that the rest of the applicationfunctionality is ready to handle and expecting. Some specificexamples include: Black or White listing of file extensions,using “Content-Type” from the header, or using a file type recognizer,all to only allow specified file types into the system.Test Upload of Malicious Files(OTG-BUSLOGIC-009)SummaryMany application’s business processes allow for the upload ofdata/information. We regularly check the validity and security oftext but accepting files can introduce even more risk. To reducethe risk we may only accept certain file extensions, but attackersare able to encapsulate malicious code into inert file types. Testingfor malicious files verifies that the application/system is ableto correctly protect against attackers uploading malicious files.Vulnerabilities related to the uploading of malicious files isunique in that these “malicious” files can easily be rejectedthrough including business logic that will scan files duringthe upload process and reject those perceived as malicious.Additionally, this is different from uploading unexpected files inthat while the file type may be accepted the file may still be maliciousto the system.Finally, “malicious” means different things to different systems,for example Malicious files that may exploit SQL server vulnerabilitiesmay not be considered a “malicious” to a main frame flatfile environment.The application may allow the upload of malicious files that includeexploits or shellcode without submitting them to maliciousfile scanning. Malicious files could be detected and stopped atvarious points of the application architecture such as: IPS/IDS,application server anti-virus software or anti-virus scanning byapplication as files are uploaded (perhaps offloading the scanningusing SCAP).ExampleSuppose a picture sharing application allows users to uploadtheir .gif or .jpg graphic files to the web site. What if an attackeris able to upload a PHP shell, or exe file, or virus? The attackermay then upload the file that may be saved on the system andthe virus may spread itself or through remote processes exes orshell code can be executed.How to TestGeneric Testing Method• Review the project documentation and use exploratory testinglooking at the application/system to identify what constitutesand “malicious” file in your environment.• Develop or acquire a known “malicious” file.• Try to upload the malicious file to the application/system andverify that it is correctly rejected.• If multiple files can be uploaded at once, there must be tests inplace to verify that each file is properly evaluated.Specific Testing Method 1• Using the Metasploit payload generation functionalitygenerates a shellcode as a Windows executable using theMetasploit “msfpayload” command.• Submit the executable via the application’s upload functionalityand see if it is accepted or properly rejected.Specific Testing Method 2• Develop or create a file that should fail the application malwaredetection process. There are many available on the Internetsuch as ducklin.htm or ducklin-html.htm.• Submit the executable via the application’s upload functionalityand see if it is accepted or properly rejected.Specific Testing Method 3• Set up the intercepting proxy to capture the “valid” request foran accepted file.• Send an “invalid” request through with a valid/acceptable fileextension and see if the request is accepted or properlyrejected.Related Test Cases• Test File Extensions Handling for Sensitive Information(OTG-CONFIG-003)