4.0

More documents

Recommendations

Info

214AppendixAppendixThis section is often used to describe the commercial and opensourcetools that were used in conducting the assessment. Whencustom scripts or code are utilized during the assessment, it shouldbe disclosed in this section or noted as attachment. Customers appreciatewhen the methodology used by the consultants is included. Itgives them an idea of the thoroughness of the assessment and whatareas were included.References Industry standard vulnerability severity and risk rankings(CVSS) [1] – http:/www.first.org/cvssAppendix A: Testing ToolsOpen Source Black Box Testing toolsGeneral TestingOWASP ZAP• The Zed Attack Proxy (ZAP) is an easy to use integrated penetrationtesting tool for finding vulnerabilities in web applications. It is designedto be used by people with a wide range of security experience and assuch is ideal for developers and functional testers who are new topenetration testing.• ZAP provides automated scanners as well as a set of tools that allowyou to find security vulnerabilities manually.OWASP WebScarab• WebScarab is a framework for analysing applications that communicateusing the HTTP and HTTPS protocols. It is written in Java, and isportable to many platforms. WebScarab has several modes of operationthat are implemented by a number of plugins.OWASP CAL9000• CAL9000 is a collection of browser-based tools that enable more effectiveand efficient manual testing efforts.• Includes an XSS Attack Library, Character Encoder/Decoder, HTTPRequest Generator and Response Evaluator, Testing Checklist, AutomatedAttack Editor and much more.OWASP Pantera Web Assessment Studio Project• Pantera uses an improved version of SpikeProxy to provide a powerfulweb application analysis engine. The primary goal of Pantera is tocombine automated capabilities with complete manual testing to getthe best penetration testing results.OWASP Mantra - Security Framework• Mantra is a web application security testing framework built on topof a browser. It supports Windows, Linux(both 32 and 64 bit) and Macintosh.In addition, it can work with other software like ZAP using builtin proxy management function which makes it much more convenient.Mantra is available in 9 languages: Arabic, Chinese - Simplified,Chinese - Traditional, English, French, Portuguese, Russian, Spanishand Turkish.SPIKE - http:/www.immunitysec.com/resources-freesoftware.shtml• SPIKE designed to analyze new network protocols for buffer overflowsor similar weaknesses. It requires a strong knowledge of C touse and only available for the Linux platform.Burp Proxy - http:/www.portswigger.net/Burp/• Burp Proxy is an intercepting proxy server for security testing of webapplications it allows Intercepting and modifying all HTTP(S) trafficpassing in both directions, it can work with custom SSL certificatesand non-proxy-aware clients.Odysseus Proxy - http:/www.wastelands.gen.nz/odysseus/• Odysseus is a proxy server, which acts as a man-in-the-middleduring an HTTP session. A typical HTTP proxy will relay packets to andfrom a client browser and a web server. It will intercept an HTTP session’sdata in either direction.Webstretch Proxy - http:/sourceforge.net/projects/webstretch• Webstretch Proxy enable users to view and alter all aspects of communicationswith a web site via a proxy. It can also be used for debuggingduring development.WATOBO - http:/sourceforge.net/apps/mediawiki/watobo/index.php?title=Main_Page• WATOBO works like a local proxy, similar to Webscarab, ZAP orBurpSuite and it supports passive and active checks.Firefox LiveHTTPHeaders - https:/addons.mozilla.org/en-US/firefox/addon/live-http-headers/• View HTTP headers of a page and while browsing.Firefox Tamper Data - https:/addons.mozilla.org/en-US/firefox/addon/tamper-data/• Use tamperdata to view and modify HTTP/HTTPS headers and postparametersFirefox Web Developer Tools - https:/addons.mozilla.org/en-US/firefox/addon/web-developer/• The Web Developer extension adds various web developer tools tothe browser.DOM Inspector - https:/developer.mozilla.org/en/docs/DOM_Inspector• DOM Inspector is a developer tool used to inspect, browse, and editthe Document Object Model (DOM)Firefox Firebug - http:/getfirebug.com/• Firebug integrates with Firefox to edit, debug, and monitor CSS,HTML, and JavaScript.Grendel-Scan - http:/securitytube-tools.net/index.php?title=Grendel_Scan• Grendel-Scan is an automated security scanning of web applicationsand also supports manual penetration testing.OWASP SWFIntruder - http:/www.mindedsecurity.com/swfintruder.html• SWFIntruder (pronounced Swiff Intruder) is the first tool specificallydeveloped for analyzing and testing security of Flash applications atruntime.SWFScan - http:/h30499.www3.hp.com/t5/Following-the-Wh1t3-Rabbit/SWFScan-FREE-Flash-decompiler/bap/5440167• Flash decompilerWikto - http:/www.sensepost.com/labs/tools/pentest/wikto• Wikto features including fuzzy logic error code checking, a back-endminer, Google-assisted directory mining and real time HTTP request/response monitoring.w3af - http:/w3af.org• w3af is a Web Application Attack and Audit Framework. The project’sgoal is finding and exploiting web application vulnerabilities.skipfish - http:/code.google.com/p/skipfish/• Skipfish is an active web application security reconnaissance tool.Web Developer toolbar - https:/chrome.google.com/webstore/detail/bfbameneiokkgbdmiekhjnmfkcnldhhm• The Web Developer extension adds a toolbar button to the browserwith various web developer tools. This is the official port of the WebDeveloper extension for Firefox.HTTP Request Maker - https:/chrome.google.com/webstore/detail/
215Appendixkajfghlhfkcocafkcjlajldicbikpgnp?hl=en-US• Request Maker is a tool for penetration testing. With it you can easilycapture requests made by web pages, tamper with the URL, headersand POST data and, of course, make new requestsCookie Editor - https:/chrome.google.com/webstore/detail/fngmhnnpilhplaeedifhccceomclgfbg?hl=en-US• Edit This Cookie is a cookie manager. You can add, delete, edit, search,protect and block cookiesCookie swap - https:/chrome.google.com/webstore/detail/dffhipnliikkblkhpjapbecpmoilcama?hl=en-US• Swap My Cookies is a session manager, it manages cookies, lettingyou login on any website with several different accounts.Firebug lite for Chrome”” - https:/chrome.google.com/webstore/detail/bmagokdooijbeehmkpknfglimnifench• Firebug Lite is not a substitute for Firebug, or Chrome DeveloperTools. It is a tool to be used in conjunction with these tools. FirebugLite provides the rich visual representation we are used to see in Firebugwhen it comes to HTML elements, DOM elements, and Box Modelshading. It provides also some cool features like inspecting HTML elementswith your mouse, and live editing CSS propertiesSession Manager”” - https:/chrome.google.com/webstore/detail/bbcnbpafconjjigibnhbfmmgdbbkcjfi• With Session Manager you can quickly save your current browserstate and reload it whenever necessary. You can manage multiplesessions, rename or remove them from the session library. Each sessionremembers the state of the browser at its creation time, i.e theopened tabs and windows.Subgraph Vega - http:/www.subgraph.com/products.html• Vega is a free and open source scanner and testing platform to testthe security of web applications. Vega can help you find and validateSQL Injection, Cross-Site Scripting (XSS), inadvertently disclosed sensitiveinformation, and other vulnerabilities. It is written in Java, GUIbased, and runs on Linux, OS X, and Windows.Testing for specific vulnerabilitiesTesting for DOM XSS• DOMinator Pro - https:/dominator.mindedsecurity.comTesting AJAX• OWASP Sprajax ProjectTesting for SQL Injection• OWASP SQLiX• Sqlninja: a SQL Server Injection & Takeover Tool - http:/sqlninja.sourceforge.net• Bernardo Damele A. G.: sqlmap, automatic SQL injection tool - http:/sqlmap.org/• Absinthe 1.1 (formerly SQLSqueal) - http:/sourceforge.net/projects/absinthe/• SQLInjector - Uses inference techniques to extract data anddetermine the backend database server. http:/www.databasesecurity.com/sql-injector.htm• Bsqlbf-v2: A perl script allows extraction of data from Blind SQLInjections - http:/code.google.com/p/bsqlbf-v2/• Pangolin: An automatic SQL injection penetration testing tool - http:/www.darknet.org.uk/2009/05/pangolin-automatic-sql-injectiontool/• Antonio Parata: Dump Files by sql inference on Mysql - SqlDumper -http:/www.ruizata.com/• Multiple DBMS Sql Injection tool - SQL Power Injector - http:/www.sqlpowerinjector.com/• MySql Blind Injection Bruteforcing, Reversing.org - sqlbftools - http:/packetstormsecurity.org/files/43795/sqlbftools-1.2.tar.gz.htmlTesting Oracle• TNS Listener tool (Perl) - http:/www.jammed.com/%7Ejwa/hacks/security/tnscmd/tnscmd-doc.html• Toad for Oracle - http:/www.quest.com/toadTesting SSL• Foundstone SSL Digger - http:/www.mcafee.com/us/downloads/free-tools/ssldigger.aspxTesting for Brute Force Password• THC Hydra - http:/www.thc.org/thc-hydra/• John the Ripper - http:/www.openwall.com/john/• Brutus - http:/www.hoobie.net/brutus/• Medusa - http:/www.foofus.net/~jmk/medusa/medusa.html• Ncat - http:/nmap.org/ncat/Testing Buffer OverflowOllyDbg - http:/www.ollydbg.de• “A windows based debugger used for analyzing buffer overflowvulnerabilities”Spike - http:/www.immunitysec.com/downloads/SPIKE2.9.tgz• A fuzzer framework that can be used to explore vulnerabilities andperform length testingBrute Force Binary Tester (BFB) - http:/bfbtester.sourceforge.net• A proactive binary checkerMetasploit - http:/www.metasploit.com/• A rapid exploit development and Testing frame workFuzzer• OWASP WSFuzzer• Wfuzz - http:/www.darknet.org.uk/2007/07/wfuzz-a-tool-forbruteforcingfuzzing-web-applications/Googling• Stach & Liu’s Google Hacking Diggity Project - http:/www.stachliu.com/resources/tools/google-hacking-diggity-project/• Foundstone Sitedigger (Google cached fault-finding) - http:/www.mcafee.com/us/downloads/free-tools/sitedigger.aspxCommercial Black Box Testing tools• NGS Typhon III - http:/www.nccgroup.com/en/our-services/security-testing-audit-compliance/information-security-software/ngs-typhon-iii/• NGSSQuirreL - http:/www.nccgroup.com/en/our-services/securitytesting-audit-compliance/information-security-software/ngssquirrel-vulnerability-scanners/• IBM AppScan - http:/www-01.ibm.com/software/awdtools/appscan/• Cenzic Hailstorm - http:/www.cenzic.com/products_services/cenzic_hailstorm.php• Burp Intruder - http:/www.portswigger.net/burp/intruder.html• Acunetix Web Vulnerability Scanner - http:/www.acunetix.com• Sleuth - http:/www.sandsprite.com• NT Objectives NTOSpider - http:/www.ntobjectives.com/products/ntospider.php• MaxPatrol Security Scanner - http:/www.maxpatrol.com• Ecyware GreenBlue Inspector - http:/www.ecyware.com• Parasoft SOAtest (more QA-type tool) - http:/www.parasoft.com/
Page 1 and 2:
1Testing Guide4.0Project Leaders: M
Page 3 and 4:
Testing Guide Foreword - Table of c
Page 5 and 6:
3Testing Guide Foreword - Table of
Page 7 and 8:
5Testing Guide Foreword - By Eoin K
Page 9 and 10:
7Testing Guide Frontispiece1Testing
Page 11 and 12:
9Testing Guide Introduction2The OWA
Page 13 and 14:
11Testing Guide Introductionvide en
Page 15 and 16:
13Testing Guide IntroductionTesting
Page 17 and 18:
15Testing Guide Introductionlaid on
Page 19 and 20:
17Testing Guide Introductionvalidat
Page 21 and 22:
19Testing Guide IntroductionUSERthe
Page 23 and 24:
21Testing Guide Introductionment wh
Page 25 and 26:
23Testing Guide Introductionoffendi
Page 27 and 28:
25The OWASP Testing Frameworksectio
Page 29 and 30:
27Web Application Penetration Testi
Page 31 and 32:
Page 33 and 34:
Page 35 and 36:
Page 37 and 38:
Page 39 and 40:
Page 41 and 42:
Page 43 and 44:
Page 45 and 46:
Page 47 and 48:
Page 49 and 50:
Page 51 and 52:
Page 53 and 54:
Page 55 and 56:
Page 57 and 58:
Page 59 and 60:
Page 61 and 62:
Page 63 and 64:
Page 65 and 66:
Page 67 and 68:
Page 69 and 70:
Page 71 and 72:
Page 73 and 74:
Page 75 and 76:
Page 77 and 78:
Page 79 and 80:
Page 81 and 82:
Page 83 and 84:
Page 85 and 86:
Page 87 and 88:
Page 89 and 90:
Page 91 and 92:
Page 93 and 94:
Page 95 and 96:
Page 97 and 98:
Page 99 and 100:
Page 101 and 102:
Page 103 and 104:
101Web Application Penetration Test
Page 105 and 106:
Page 107 and 108:
Page 109 and 110:
Page 111 and 112:
Page 113 and 114:
Page 115 and 116:
Page 117 and 118:
Page 119 and 120:
Page 121 and 122:
Page 123 and 124:
Page 125 and 126:
Page 127 and 128:
Page 129 and 130:
Page 131 and 132:
Page 133 and 134:
Page 135 and 136:
Page 137 and 138:
Page 139 and 140:
Page 141 and 142:
Page 143 and 144:
Page 145 and 146:
Page 147 and 148:
Page 149 and 150:
Page 151 and 152:
Page 153 and 154:
Page 155 and 156:
Page 157 and 158:
Page 159 and 160:
Page 161 and 162:
Page 163 and 164:
Page 165 and 166: 163Web Application Penetration Test
Page 211 and 212: 209same code can be applied to sess
Page 213 and 214: 211ReportingTest IDLowest versionIn
Page 215: 213ReportingTest IDBusiness Logic T
Page 219 and 220: 217AppendixTesting - http:/www.nist
Page 221 and 222: 219Cross Site Scripting (XSS)For de
Page 223 and 224: 221LDAP InjectionFor details on LDA
show all

4.0

Create successful ePaper yourself

Delete template?

Save as template?