Security Testing - Test for Buffer Overflows

Test for Buffer Overflows

One of the first security bugs exploited in computer history was a buffer overflow. Buffer overflows continue to be one of the most dangerous and most commonly occurring weaknesses. Attempts to exploit this type of vulnerability can result in problems ranging from crashing the application to an attacker inserting and executing malignant code in the application process.
When writing data to buffers, it is imperative that developers not write more to the buffer than it can possibly hold. If the amount of data being written exceeds the buffer space that has been allocated, a buffer overflow occurs. When a buffer overflow occurs, data is written into parts of memory that may be allocated for other purposes. A worst-case scenario is when the buffer overflow contains malicious code that is then executed. Buffer overflows account for a large percentage of security vulnerabilities.

About Clickjacking - Security Testing

What is clickjacking ?

The attack works like this: the attacker first creates an HTML page that included an iframe sourced to a legitimate site, but he doesn’t just display the top left 200x200 pixels. Instead, he positions and sizes the iframe and other page elements so that only the pixels of a specific control, such as a button, of the victim page are visible. The attacker then presents this partial iframe control in a completely different context from its original context in order to trick users into pressing it.

Clickhijacking.html

1. Make a HTML file using below code and save with an html extension Or execute attached html file named "Gowall_Clickjacking.html".

html

body

h1>Hello World

iframe src="http://www.google.com/" height="200px" width="200px" /

/body

/html

2. Execute saved html file by clicking on it.

3. Observe that Google.com website is loaded in iframe in web page.

google website is loaded in iframe in web page.

For More information of attack visit:

1)http://blogs.msdn.com/sdl/archive/2009/02/05/clickjacking-defense-in-ie8.aspx

2)http://blogs.msdn.com/ie/archive/2009/01/27/ie8-security-part-vii-clickjacking-defenses.aspx

3)http://www.sectheory.com/clickjacking.htm

If page is displayed in the iFrame then site is vulnerable to clickjacking and if the target page load with as normal page in browser then it is not vulnerable.

--> We should also check all the pages of application whether they set the top.location javascript as shown below code or not. If not then those pages are vulnerable.

Prevention :

There are some techniques exit to prevent clickjacking for the website. For more information visit

1)http://usablelayout.com/articles/automatically-break-out-iframe

2)https://blogs.sans.org/appsecstreetfighter/2009/10/15/adoption-of-x-frame-options-header/

Some known site like gmail dosn't allow their page to be loaded in iFrame which prenvents from clickjacking attack: I have attached the gmail script named 'Gmail_Clickhijacking.html' execute it and oberve the behaviour.

Security Testing concept and checklist

Security Testing

Security testing is a process to determine that an information system protects data and maintains functionality as intended.

Security testing is the process that determines that confidential data stays confidential (i.e. it is not exposed to individuals/ entities for which it is not meant) and users can perform only those tasks that they are authorized to perform (e.g. a user should not be able to deny the functionality of the web site to other users, a user should not be able to change the functionality of the web application in an unintended way etc.).

The purpose of the security test is to discover the vulnerabilities of the web application so that the developers can then remove these vulnerabilities from the application and make the web application and data safe from unauthorized actions.

Why Security Testing Required:

· Direct financial loss

· Loss of Reputation

Some Terms related to Security Testing

Vulnerability: This is a weakness in the web application. The cause of such a “weakness” can be bugs in the application, an injection (SQL/ script code) or the presence of viruses

URL manipulation: Some web applications communicate additional information between the client (browser) and the server in the URL. Changing some information in the URL may sometimes lead to unintended behavior by the server

SQL injection: This is the process of inserting SQL statements through the web application user interface into some query that is then executed by the server

XSS (Cross Site Scripting): When a user inserts HTML/ client-side script in the user interface of a web application and this insertion is visible to other users, it is called XSS

Spoofing: The creation of hoax look-alike websites or emails is called spoofing

For Security testing tester require skills like

• Knowledge of HTTP protocol
• How client and server request communicate with each other using HTTP
• Basics of sql injection and XSS

For security testing tester should careful about

• Configuration of the application or the server
• Services running on the server
• Existing user or customer data hosted by the application
• Security testing should not perform on production environment

Checklist for Security testing

• Password cracking
• SQL Injection
• URL Manipulation
• XSS cross site scripting
• Site functionality should be examined to ensure that access to sensitive data and administrative functions is protected appropriately. This applies to OS and server level functions, as well as application level.
• Only services necessary for the business process should be running on web-facing servers (the more different systems, the greater the likelihood of serious flaw
• Network traffic should be monitored to check for plain text transmission of user names and passwords (whether related to site users or to back office functions such as databases)