the-web-application-hackers-handbook

744 Chapter 19 n Finding Vulnerabilities in Source Code
Summary
Many people who have substantial experience with testing web applications
interactively, exhibit an irrational fear of looking inside an application’s codebase
to discover vulnerabilities directly. This fear is understandable for people who
are not programmers, but it is rarely justified. Anyone who is familiar with
dealing with computers can, with a little investment, gain sufficient knowledge
and confidence to perform an effective code audit. Your objective in reviewing
an application’s codebase need not be to discover “all” the vulnerabilities
it contains, any more than you would set yourself this unrealistic goal when
performing hands-on testing. More reasonably, you can aspire to understand
some of the key processing that the application performs on user-supplied input
and recognize some of the signatures that point toward potential problems.
Approached in this way, code review can be an extremely useful complement
to the more familiar black-box testing. It can improve the effectiveness of that
testing and reveal defects that may be extremely difficult to discover when you
are dealing with an application entirely from the outside.
Questions
Answers can be found at http://mdsec.net/wahh.
1. List three categories of common vulnerabilities that often have easily
recognizable signatures within source code.
2. Why can identifying all sources of user input sometimes be challenging
when reviewing a PHP application?
3. Consider the following two methods of performing a SQL query that
incorporates user-supplied input:
// method 1
String artist = request.getParameter(“artist”).replaceAll(“’”, “’’”);
String genre = request.getParameter(“genre”).replaceAll(“’”, “’’”);
String album = request.getParameter(“album”).replaceAll(“’”, “’’”);
Statement s = connection.createStatement();
s.executeQuery(“SELECT * FROM music WHERE artist = ‘” + artist +
‘” AND genre = ‘” + genre + ‘” AND album = ‘” + album + “’”);
// method 2
String artist = request.getParameter(“artist”);
String genre = request.getParameter(“genre”);
String album = request.getParameter(“album”);
Statement s = connection.prepareStatement(
“SELECT * FROM music WHERE artist = ‘” + artist +
“’ AND genre = ? AND album = ?”);