Content security policy header

Currently, OWASP update the Header issue

To protect against Cross-Site Scripting, set the 'default-src' policy, or 'script-src' AND 'object-src' with proper values. Insecure values such as '*', 'data:', 'unsafe-inline', or 'unsafe-eval' should be avoided.

Protect against Cross-Frame Scripting or clickjacking, set the 'frame-ancestors' policy with proper values. Insecure values such as '*' or 'data:' should be avoided.

b     base-uri controls the protected resource’s ability to specify the document base URL.

       child-src deprecates and replaces frame-src, controlling the protected resource’s ability to embed frame

F     Form-action controls the protected resource’s ability to submit forms

       frame ansector controls the protected resource’s ability be embedded in other documents.

A protected resource’s ability to load Workers is now controlled via child-src rather than script-src

Content-Security-Policy: frame-ancestors 'self' example.com *.example.net ;

To prevent all framing of your content use:

Content-Security-Policy: frame-ancestors 'none';

To allow for your site only, use:

Content-Security-Policy: frame-ancestors 'self';

To allow for your site only, use:

Content-Security-Policy: frame-ancestors 'self';

<add name="Content-Security-Policy" value="frame-ancestors 'self' child-src 'self' *URL you website" />

Null byte Injection

It is also possible to pass the null character in the URL, which creates a vulnerability known as Null Byte Injection. In the URL it is represented by . A null byte is donated by \0 in C.

Exploitation:

Normal: http://www.example.host/user.php?file=myprofile.dat

Attacking: http://www.example.host/user.php?file=../../../etc/passwd

Exploitation:

Normal: http://www.example.host/mypage.jsp?fn=report.db

Attacking: http://www.example.host/mypage.jsp?fn=serverlogs.txt.db

Exploitation:

Normal: http://www.example.host/read.pl?page=userphoto.jpg

Attacking Mode: http://www.example.host/read.pl?page=../../../../etc/passwdjpg

Union SQL Injection

Union SQL Injection

In this attacker uses the UNION Statement for the attack which merges the two or more selected statement for retrieving the data from the database.

                                                                OR

UNION-based attacks allow the tester to easily extract information from the database. Using this extract the table name and number of column after that extract the data from the cell.

1.       url/order by 1

2.       url union select 1,2,3,4,5….

3.       url id=-1 union select 1,2,3,4,5….

4.       url id=-49 union select 1,2,@@ version,4,5,6

5.       url id=-49 union select 1,2, group_concate(database()),4,5,6

Security Testing Procedure and Approaches

Security Testing

It is a type of software testing that checks whether the application or product is secured or not.

                                                Or

Security testing is performed to check whether there is any information leakage.

                                                Or

The goal of security testing is to identify the threats in the system and measure security risk.

                                                Or

Check the loopholes, weakness, and vulnerabilities of the web application.

                                                Or

Ensure that application is free from any loopholes or weakness.

Type of Security Testing

Vulnerability scanning: - This is done by the automated software to scan a system.

Security scanning: - Identify the network and system weakness and also provide the solution for reducing the risk.

Penetration Testing: - It is also known as pen test. Hacker malicious attack on the loophole or weakness of the system.

Risk Assessment: - Check the potential risk is either high or low. Analyze and evaluate the risk with the particular threats.

Security Auditing:-In this inspection of code line by line. It is a manual measurable technique of a system or application.

Ethical hacking:-It is systematical attempts to penetrate malicious script to exploit computer system or network on the behalf of the owner.

Procedure of web application security testing:-

1.       Scope of the application

2.       Check static and dynamic pages

3.       Identify the all login role of application

4.       Gather the information about the application

5.       Make profiling of the threats or security related test data.

6.       Security-related tools

7.       Test according to the threats profiling

8.       Scan application according to the threats profiling

9.       Report creation

Report submission

Approaches of web application security testing

·         Passive Approach- Actions taken to monitor the security

·         Understand the logic of the application

·         Information Gathering

·         Understand all the login role of the application

·         Active Approach-Covers all actions designed to prevent a breech

·         Configuration Management Testing.

·         Testing for file extensions which is a need or not need

·         Test file name without script tag

·         Test old, backup, temporary file not be left

·         Testing for HTTP methods

·         Testing for the business logic of the application

·         Testing for XSS(cross-site scripting)

·         Testing for SQL injection

·         Authentication Testing

·         Credentials transport over an encrypted channel

·         Testing false login credential to account lockout

·         Brute Force Testing

·         Testing for bypassing authorization schema

·         Session Management Testing

·         Test all headers for mitigating the XSS and CSRF

·         Testing for Cookies attributes- http only, secure and time validity

·         Testing for CSRF(cross-site request forgery)