Security Testing

Content security policy header

Currently, OWASP update the Header issue

To protect against Cross-Site Scripting, set the 'default-src' policy, or 'script-src' AND 'object-src' with proper values. Insecure values such as '*', 'data:', 'unsafe-inline', or 'unsafe-eval' should be avoided.

Protect against Cross-Frame Scripting or clickjacking, set the 'frame-ancestors' policy with proper values. Insecure values such as '*' or 'data:' should be avoided.

b base-uri controls the protected resource’s ability to specify the document base URL.

child-src deprecates and replaces frame-src, controlling the protected resource’s ability to embed frame

F Form-action controls the protected resource’s ability to submit forms

frame ansector controls the protected resource’s ability be embedded in other documents.

A protected resource’s ability to load Workers is now controlled via child-src rather than script-src

Content-Security-Policy: frame-ancestors 'self' example.com *.example.net ;

To prevent all framing of your content use:

Content-Security-Policy: frame-ancestors 'none';

To allow for your site only, use:

Content-Security-Policy: frame-ancestors 'self';

To allow for your site only, use:

Content-Security-Policy: frame-ancestors 'self';

Security Header

Below all headers are mitigating Cross-site scripting.

Content Security Policy Header:-

system.webServer>

<customHeaders>

<add name="Content-Security-Policy" value="default-src 'self';'unsafe-inline' 'unsafe-eval';" />

</customHeaders>

</httpProtocol>

</system.webServer>

X-Content-Type-Options header:-

system.webServer>

<customHeaders>

</customHeaders>

</httpProtocol>

</system.webServer>

X-XSS-Protection header:-

system.webServer>

<customHeaders>

</customHeaders>

</httpProtocol>

</system.webServer>

Missing X-Frame-Scripting Header:-

system.webServer>

<customHeaders>

</customHeaders>

</httpProtocol>

</system.webServer>

Missing strict-transport-security header:-

system.webServer>

<customHeaders>

</customHeaders>

</httpProtocol>

</system.webServer>

Denial of Service (DoS)

Denial of service attacks are most common to take website and servers down. It is easy to attack and hard to protect. The way to prevent of an attack is to block the response to the attackers. Catch the attacker as early as possible after the request has been received by the web server.

There are two challenges to blocking the attacks

Identify the attackers

Block the response only to the attackers

First to catch the request as early as possible, an HttpModule is the right place. It is executed before any page or any other handler so the impact on the server can be minimized. This HttpModule monitors all requests and block requests coming from IP addresses that make many requests in a short period of time. After a while the attacking IP address gets released from blocking.

Implementation

Download the DosAttackModule.cs file below and put it into the App_Code folder of your website. Then add the following lines to the web.config’s <system.web> section:

< httpModules >

< add type = " DosAttackModule " name = " DosAttackModule " />

</ httpModules >

Null byte Injection

It is also possible to pass the null character in the URL, which creates a vulnerability known as Null Byte Injection. In the URL it is represented by . A null byte is donated by \0 in C.

      Exploitation:

      Normal: http://www.example.host/user.php?file=myprofile.dat

      Attacking: http://www.example.host/user.php?file=../../../etc/passwd

      Exploitation:

      Normal: http://www.example.host/mypage.jsp?fn=report.db

      Attacking: http://www.example.host/mypage.jsp?fn=serverlogs.txt.db 

      Exploitation:

      Normal: http://www.example.host/read.pl?page=userphoto.jpg

      Attacking Mode: http://www.example.host/read.pl?page=../../../../etc/passwdjpg 

Union SQL Injection

Union SQL Injection

In this attacker uses the UNION Statement for the attack which merges the two or more selected statement for retrieving the data from the database.

UNION-based attacks allow the tester to easily extract information from the database. Using this extract the table name and number of column after that extract the data from the cell.

1. url/order by 1

2. url union select 1,2,3,4,5….

3. url id=-1 union select 1,2,3,4,5….

4. url id=-49 union select 1,2,@@ version,4,5,6

5. url id=-49 union select 1,2, group_concate(database()),4,5,6

Blind SQL Injection

Blind SQL Injection

It is nearly same as normal SQL injection but the difference is that it retrieved the data from the database. It asks a true and false question to the victim. An attacker force to steal the data by asking the question.

This attack is used when a web application is shown as a generic error message.

Two type of Blind SQL Injection

1. Boolean based

2. Time-based

Boolean Based:- This technique is sending a SQL query to the database which forces the different result in a True false form.

Time-based:- This technique is sending a SQL query to the database which forces the database to wait a specified time period. This allows to an attacker to inject payload used returned true or false, even though no data from the database is returned.

Defend:

‘(Escape the single quote)= replace(input,””,””)

“(double quote)= replace(input,”””,””)

‘ ‘(close parenthesis)= replace(input,”’”,””)

;(semi-colon)

-(dash)

SQL Injection

Nowadays SQL injection is a common attack that use malicious SQL injection code for database manipulation to access information.

When exploiting SQL injection, the web application display error message from the database. Database complaining that the query syntax is incorrect.

Gain the unauthorized access to the website through the SQL Injection and take the information.

How to exploit:-

Take a simple username (admin) and password we choose

‘ OR ‘a’=’a

From users WHERE user=’admin’ AND password=’ ‘ OR ’a’=’a’

‘a’ = ‘a is a true value

Let's analyze

Username=’admin’ AND Password=’’ OR ‘a’=’a’

Means username password true

Use Burp suite tool and inject the customize attack through Intruder

Here we introduce some SQL attack.

or 1=1
or 1=1--
admin' or '1'='1
admin' or '1'='1'--
admin' or '1'='1'# ………….etc

How to Fix:-

1. Use stored procedure

2. Use parameterize query

3. Limit database permission and privilege

4. Avoid display database error directly to the user

5. Use the regular expression to identify the text block and sql statements

Security Testing

Thursday, July 5, 2018