![OWASP ZAP (Command Execution)
int main(char* argc, char** argv) {
char cmd[CMD_MAX] = "/usr/bin/cat ";
strcat(cmd, argv[1]);
system(cmd);
}](https://image.slidesharecdn.com/aaf9f449-3be5-4661-8028-02723bdda1ae-160501085819/85/Security-Testing-Zap-It-29-320.jpg)
Security Testing - Zap It
- 1. Hanika D Manjyot Singh Samaj Shekhar Security Testing - Zap It
- 2. Introduction Manjyot Singh QA @ Thoughtworks manjyots@thoughtworks.com Hanika D QA @ Thoughtworks hanikad@thoughtworks.com Samaj Shekhar App Dev @ Thoughtworks samajs@thoughtworks.com
- 4. Importance
- 5. Impact
- 6. OWASP ● Open Web Application Security Project. ● Online community, which creates freely-available articles, methodologies, documentation, tools, and technologies in the field of web application security ● Not-for-profit charitable organization. ● Focussed on improving the security of software. ● All material is available under a FOSS license. ● Currently has over 142 active projects.
- 7. OWASP Top 10 ● List the 10 most critical web application security risks. ● A powerful awareness document. ● Published at regular intervals. ○ Approximately once in 3 years. ○ Last published in 2013
- 8. OWASP Top 10 ● Injection. ● Broken authentication and session management. ● Cross-site scripting (XSS). ● Insecure direct object references. ● Cross-site request forgery (CSRF). ● Sensitive data exposure. ● Missing functional level access control. ● Security misconfigurations. ● Using component with known vulnerabilities. ● Unvalidated redirects and forwards.
- 9. OWASP ZAP (Zed Attack Proxy) DEMO
- 10. OWASP ZAP (Zed Attack Proxy) ● DVWA (An sample application with vulnerabilities) ● Take permission before attacking public web applications ● Bounty Programmes
- 11. ZAP
- 12. ZAP
- 13. ZAP
- 14. ZAP
- 15. ZAP
- 16. OWASP ZAP (Zed Attack Proxy) 1-Injection Injection flaws, such as SQL, OS, and LDAP injection occur when untrusted data is sent to an interpreter as part of a command or query. The attacker’s hostile data can trick the interpreter into executing unintended commands or accessing data without proper authorization.
- 17. OWASP ZAP (SQL Injection) http://192.168.99.100/vulnerabilities/sqli/?id=%20%2017:%20%27%20or%20%27a%27=%27a&Submit=Submit
- 18. OWASP ZAP (SQL Injection)
- 19. SELECT * FROM Users; DROP TABLE Suppliers; SQL Injection - Batched sql statement
- 20. Prevention Use parameterized queries. txtName = getRequestString("CustomerName"); txtSQL = "INSERT INTO Customers (CustomerName) Values(@0)"; db.Execute(txtSQL, txtNam);
- 21. Prevention declare @0 = ‘ThoughtWorks’; INSERT INTO Customers (CustomerName) Values(@0)";
- 22. OWASP ZAP (Zed Attack Proxy) 2- XSS XSS flaws occur whenever an application takes untrusted data and sends it to a web browser without proper validation or escaping. XSS allows attackers to execute scripts in the victim’s browser which can hijack user sessions, deface web sites, or redirect the user to malicious sites.
- 23. OWASP ZAP (XSS)
- 24. OWASP ZAP (XSS) What’s your name : <script>alert(1);</script>
- 25. XSS - Prevention
- 26. XSS - Prevention Never insert untrusted data in HTML. Escape untrusted JSON, JS or HTML before inserting. Sanitize HTML Markup with a Library Designed for the job.
- 27. OWASP ZAP (Zed Attack Proxy) 3-Command execution Command injection is an attack in which the goal is execution of arbitrary commands on the host operating system via a vulnerable application. Command injection attacks are possible when an application passes unsafe user supplied data (forms, cookies, HTTP headers etc.) to a system shell.
- 28. OWASP ZAP (Command Execution) IP = 192.168.1.1& ls
- 29. OWASP ZAP (Command Execution) int main(char* argc, char** argv) { char cmd[CMD_MAX] = "/usr/bin/cat "; strcat(cmd, argv[1]); system(cmd); }
- 30. Command Execution - Prevention The URL and form data needs to be sanitized for invalid characters. A “blacklist” of characters is an option but - - it may be difficult to think of all of the characters to validate against. Also there may be some that were not discovered as of yet. A “white list” containing only allowable characters should be created - - to validate the user input. Characters that were missed, as well as undiscovered threats, should be eliminated by this list.
- 31. OWASP ZAP (Zed Attack Proxy) 4-Brute Force A brute force attack can manifest itself in many different ways, but primarily consists in an attacker configuring predetermined values, making requests to a server using those values, and then analyzing the response.
- 32. OWASP ZAP(Brute Force) Username : admin’#
- 33. Brute Force - Prevention The most obvious way to block brute-force attacks is to simply lock out accounts after a defined number of incorrect password attempts. Another solution is to lock out an IP address with multiple failed logins. After one or two failed login attempts, you may want to prompt the user not only for the username and password but also to answer a secret question. Use a CAPTCHA to prevent automated attacks.
- 34. OWASP ZAP (Zed Attack Proxy) 5-Insecure Direct object references A direct object reference occurs when a developer exposes a reference to an internal implementation object, such as a file, directory, or database key. Without an access control check or other protection, attackers can manipulate these references to access unauthorized data.
- 35. OWASP ZAP (Insecure Direct object references) http://misc-security.com/file.jsp? file=report.txt http://misc-security.com/file.jsp? file=**../../../etc/shadow**
- 36. Insecure Direct object references - Prevention Use indirect reference maps. - Use hash of file name.
- 37. OWASP ZAP (Zed Attack Proxy) 6-CSRF A CSRF attack forces a logged-on victim’s browser to send a forged HTTP request, including the victim’s session cookie and any other automatically included authentication information, to a vulnerable web application. This allows the attacker to force the victim’s browser to generate requests the vulnerable application thinks are legitimate requests from the victim.
- 39. OWASP ZAP (CSRF) Malicious user tricks the user in opening the image with forged link <img src=”http://bank.com/transferFunds?amoun t=1500&destAccount=9999”/>
- 40. CSRF - Prevention Checking referrer header. Checking origin header. Requiring the user to reauthenticate or prove they are a user.
- 42. Questions