Good Paper about Advanced Web Security Testing

There is a great article available about advanced web security testing, especially if a certain web-form requires other forms that have to be filled out correctly in advance – workflow issues – and how to test such applications where traditional web scanners fail because they can’t follow the flow of an application.


== Leveraging User Interactions for In-Depth Testing of Web Applications ==
Authors: Sean McAllister1, Engin Kirda2, and Christopher Kruegel3

Over the last years, the complexity of web applications has grown significantly, challenging desktop programs in terms of functionality and design. Along with the rising popularity of web applications, the number of exploitable bugs has also increased significantly. Web application flaws, such as cross-site scripting or SQL injection bugs, now account for more than two thirds of the reported security vulnerabilities. 

Black-box testing techniques are a common approach to improve software quality and detect bugs before deployment. There exist a number of vulnerability scanners, or fuzzers, that expose web applications to a barrage of malformed inputs in the hope to identify input validation errors. Unfortunately, these scanners often fail to test a substantial fraction of a web application?s logic, especially when this logic is invoked from pages that can only be reached after filling out complex forms that aggressively check the correctness of the provided values. 

In this paper, we present an automated testing tool that can find reflected and stored cross-ite scripting (XSS) vulnerabilities in web applications. The core of our system is a black-box vulnerability scanner. This scanner is enhanced by techniques that allow one to generate more comprehensive test cases and explore a larger fraction of the application. Our experiments demonstrate that our approach is able to test more thoroughly

these programs and identify more bugs than a number of open-source and commercial web vulnerability scanners.

Original URL:

• http://www.cs.ucsb.edu/~chris/research/doc/raid08_xss.pdf

Anatomy of a Cross-site Request Forgery Attack

So far, this is the best article to articulate our well-beloved Cross-site Request Forgery (CSRF) attack.

A Cross-site request forgery attack, also known as CSRF or XSRF (pronounced sea-surf) is the less well known, but equally dangerous, cousin of the Cross Site Scripting (XSS) attack. With XSRF, you make use of victim's browser to perform a transaction (GET or POST) on your behalf to the vulnerable site that pre-authenticated earlier.

In this article, it gives an example where how XSRF works in a POST situation, and provide a few suggestions for mitigation:

• Validate on Referer (not 100% recommended).
• Implement of "canary" in the form (typically a hidden input) that the attacker couldn’t know or compute.
• Implement ViewStateUserKey to makes ViewState more tamper-resistant.
  
• Remember that "POST-only" isn't aprotection for XSRF.

References:

• Anatomy of a Cross-site Request Forgery Attack
• CSRF Attacks and Web Forms
• Take Advantage of ASP.NET Built-in Features to Fend Off Web Attacks
• ViewStateUserKey makes ViewState more tamper-resistant

10 Things to Help Fixing the Web

Very interesting ideas on fixing the web.

>>>> From GNUcitizen's Let's Fix the Web:

Here they are:

1. Allow the user to sandbox and unsandbox applications and web resources with a single click
2. Sandbox by default known applications such as GMail, Yahoo Mail, etc.
3. In the sandbox, mark all cookies as secure to prevent session leaks
4. In the sandbox, mark none-session cookies as httpOnly to prevent session hijacks due to XSS
5. Make sure that while on HTTPS, all embedded resources are delivered over HTTPS as well.
6. Provide the option to turn off JavaScript, JAVA, Flash, SilverLight, etc on per-sandbox basis
7. Block any external requests to sandboxed applications
8. Implement the PHPIDS signature matching mechanism in JavaScript
9. If the HTML structure is heavily broken, block the page to prevent some types of persistent XSS
10. Record SSL signatures on trusted network and warn if signature changes while on untrusted network

RSS 2.0 Vs ATOM 1.0

Blogs, wikis, newsfeeds are parts of the Web 2.0. Web 2.0 has been known as the new trend nowadays in world wide web technologies which aims to enhance creativity, information sharing, and, most notably, collaboration among users.Today, for those who generate syndication feeds have a choice of feed formats: RSS 2.0 or ATOM 1.0. Here's an article to compare between the 2 formats.

For your information, the initials "RSS" are used to refer to the following formats:

• Really Simple Syndication (RSS 2.0)
• RDF Site Summary (RSS 1.0 and RSS 0.90)
• Rich Site Summary (RSS 0.91)

There's an interesting article posted by Ed Kohler (July 28, 2007) after he observed how some application handles the feed subscription option, at Why Do FireFox and Google Subtly Default to Atom Feeds?

References:

• http://en.wikipedia.org/wiki/RSS_(file_format)
• http://en.wikipedia.org/wiki/Atom_(standard)

Top 10 Strategies on Responding to Security Issues

This top 10 list is to about how to hide/handle security problems reported. It is taken from Thomas Ptacek's article at Matasano.

1. Deny everything
2. Keep it secret
3. Forget the report
4. Make excuses
5. Downplay
6. Wait for next release
7. Beta-test the fix
8. Patch the exploit
9. Shoot the messenger
10. Threaten lawsuit

You may laugh, but these are what loved by most employers.

How Skype Works

Interesting read on how skype works trough firewalls.

http://www.heise-security.co.uk/articles/82481/0

Rule-based Access Control

A very good article in describing Rule-based Access Control, to improve security and make programming easier with an authorization framework.

http://www-128.ibm.com/developerworks/webservices/library/ws-soa-access.html

SANS - Internet Storm Center - Cooperative Cyber Threat Monitor And Alert System

SANS - Windows CMDline Kung-Fu with wmic 

 

To kill a process, like 'kill -9 [pid] and killall-9 cmd.exe'

C:\> wmic process [pid] delete

C:\> wmic process where name='cmd.exe' delete

Like the 'top' command

C:\> wmic process list brief /every:1

 

To simulate 'net user'

 C:\> wmic useraccount

 

To show hotfixes and service packs. [qfe = quick fix enginering]

 C:\> wmic qfe

 

For malware analysis, including all files loaded at startup.

C:\> wmic startup list full

 

Similar to 'ps -aux | grep cmd.exe'.

C:\> wmic process list brief | find "cmd.exe"

Similar to 'man wmic'

C:\> wmic /?:full > wmic_docs_that_stink.txt

Similar to 'ifconfig -a'

C:\> wmic nicconfig where IPEnabled='true'

Similar to ' ifconfig'

C:\> wmic nicconfig where Index=1 call EnableStatic ("10.10.10.10"), ("255.255.255.0")

For DHCP

C:\> wmic nicconfig where Index=1 call EnableDHCP

Others:

c:\> wmic ComputerSystem GET Model

c:\> wmic computersystem get name,systemtype

c:\> wmic bios get serialnumber

c:\> wmic nic get macaddress,description

c:\> wmic csproduct get identifyingnumber

c:\> wmic baseboard get product,Manufacturer,version,serialnumber

c:\> wmic COMPUTERSYSTEM get TotalPhysicalMemory

c:\> wmic process get workingsetsize,commandline

c:\> wmic partition get name,size,type

c:\> wmic COMPUTERSYSTEM GET MANUFACTURER

c:\> wmic csproduct get  version

c:\> wmic service list brief

c:\> wmic process list brief

c:\> wmic startup list brief 

c:\> wmic csproduct get "UUID"