Security Testing Tools: Experiences and Recommendations (White Paper)

Software Testing Specialists

White Paper

Security Testing Tools: Experiences and Recommendations - A Gallop Insight

The Average security breach can cost a company anywhere between $90 and $305 per lost record, according to a new study from Forrester research.

Abstract This white paper is an incorporation of inputs from Gallop’s Security Testing team and is designed to help you understand the types of Security Testing, their requirement and the tools that enable testing. In addition, the white paper explains scenarios which affect the security of an IT system. The white paper aims to predict, prevent and address the security issues with testing approaches that improve overall resilience.

www.gallop.net | Gallop is #1 Independent Testing and Quality Engineering Services Company in North America.

The Need for Security Testing The new age enterprises face a relentless onslaught of security challenges ranging from DDoS attacks, Database compromises, unauthorized entry, breach of access control, login flaws and vulnerabilities across sessions, multiple authentications, caches etc.

Security is one area which needs constant reinforcements, meticulous assessment and a one step ahead approach to minimize the scope of error. Hence, security testing is a combination of offensive procedures backed by CEHs and strategic reviews which block and cement the IT system against threats, inherent as well as directed. Security testing is a combination of attacks like fault injections, assessment of vulnerable areas like the presence of redundant, readable and downloadable files on a web server. The combination of test approach depends on the size, scope and the coverage of the IT system.

55% OF IT PRACTITIONERS LACK A FORMAL STRATEGY TO GOVERN MOVING DATA

61% OF ORGANIZATIONS SAY DATA THEFT AND CYBERCRIME ARE THE GREATEST THREATS TO THEIR REPUTATION

www.gallop.net | Gallop is #1 Independent Testing and Quality Engineering Services Company in North America.

Configuration Management Security Testing Often analysis of the network infrastructure and web application architecture can reveal a good amount of information such as source code, HTTP methods permitted, administrative functionality, authentication methods, infrastructural configurations etc. In the present scenario, the complex interconnected and heterogeneous web server infrastructure - which can count hundreds of servers - makes configuration management review and validation a fundamental step in testing. The application penetration test should include the checking of how infrastructure was deployed and secured. While the application may be secure, a small aspect of the configuration could still be at a default install stage and vulnerable to exploitation.

Testing for Configuration Management usually includes Usage of strong cipher algorithm and its proper implementation Security of DB listener port and component web servers, database servers, authentication servers, software versions and THE AVERAGE SECURITY their associated vulnerabilities BREACH CAN COST A Default configuration of the application and its COMPANY BETWEEN associated vulnerabilities File extension handling configuration

$90

Presence of redundant, readable and downloadable files on a web server Admin functionality usage by authorized users Configuration of HTTP methods and its associated vulnerabilities

&

$305

PER LOST RECORD, ACCORDING TO A NEW STUDY FROM RESEARCH.

Sample Scanning Tools A list of scanning tools that can identify vulnerabilities related to configurations are as follows:

Vulnerability Type

Open Source / Free Tools

Commercial Tools

Application Configuration Weakness

W3AF, Nessus, Sandcat, Skipfish, arachni, oedipus, iScan, N-Stalker, WSTool

IBM AppScan, WebInspect, Cenzic Hailstorm, Acunetix, Sandcat, Jsky, Netsparker, Grendel Scan, ParosPro, Webcruiser, Web Injection Scanner

HTTP Methods and XST

W3AF, Nessus, Sandcat, arachni, ZAP, Oedipus, Andiparos, Watobo, Jsky, N-Stalker, Skipfish

IBM AppScan, WebInspect, Cenzic Hailstorm, Acunetix, Sandcat, Jsky, Netsparker, Burpsuite, Vega, Grendel Scan, ParosPro, Paros Proxy, iScan

Old, Backup and Unreferenced files

IBM AppScan, WebInspect, Acunetix, Burp W3AF, ZAP, Syhunt Suite Professional, NTOSpider, Syhunt Mini, Wapiti, WATOBO, Dynamic, QualysGuard WAS, Netsparker, Andiparos, Paros Proxy ScantoSecure, N-Stalker

www.gallop.net | Gallop is #1 Independent Testing and Quality Engineering Services Company in North America.

Authentication Security Testing Authentication is the process of attempting to verify the digital identity of the sender of a communication. The sender could be a user, process or device. A common example of such a process is the logon process but authentication happens every time when we use our computers. Much of the authentication that happens is transparent to the user and handled via computer. Testing the authentication schema means understanding how the authentication process works and use that information to circumvent the authentication mechanism. As a Penetration Tester, it is valuable to be able to gain the trust of a system and bypass security as an authorized entity.

The most common method by which people confirm their identity is something they know such as a password.

Testing for Authentication usually includes Understanding if data travels unencrypted from the web browser to the server Collecting a set of valid user names and then trying brute force testing Trying the default username and password of the deployed application/server Retrieving a valid user account and password Bypassing the authentication schema by tampering with requests and tricking the application

THE ENTERPRISE SECURITY INFRASTRUCTURE MARKET IS PROJECTED TO GROW AT AN APPROXIMATE COMPOUNG ANNUAL GROWTH RATE (CAGR) OF

10.9% INTO 2014 AS COMPANIES CONTINUE TO EXPAND THE TECHNOLOGIES THEY USE TO IMPROVE THEIR OVERALL SECURITY.

Testing the “Remember Password” and “Password Reset” functions Testing the logout and caching functions CAPTCHA validation Evaluating the strength of a “Multiple Factors Authentication System” like OTP (One Time Password) Testing for race condition, a situation difficult to test for Sample Scanning Tools A list of scanning tools that can identify vulnerabilities related to authentication are as follows:

Vulnerability Type Bypassing Authentication Schema

Open Source / Free Tools Nessus, WebScarab, WebGoat

Commercial Tools IBM AppScan, WebInspect, Cenzic Hailstorm, NTOSpider, Grendel Scan

www.gallop.net | Gallop is #1 Independent Testing and Quality Engineering Services Company in North America.

Session Management Security Testing Authentication and Session Management takes care of all aspects of handling user authentication and managing active sessions. HTTP is a stateless protocol and hence even simple logic requires a user’s multiple requests to be associated with each other across a ‘session’. With regards to web applications, a session is the length of time users spend on a website. It is always advisable to manage authorized sessions duration prudently. The goal of a penetration tester is to identify accounts that are permitted access to sessions with high-level privileges and unlimited time to access the web application.

Testing for Session Management usually includes Understanding the existing Session Management schema Understanding if cookies are protected

AS MUCH AS 60% OF IMPORTANT CORPORATE DATA RESIDES ON DESKTOP & LAPTOP COMPUTERS THAT ARE NOT PROPERLY PROTECTED. Accessing another user’s account through the active session (Session Fixation) Retrieving Session Tokens whilst in transit between the Client browser and the application server Forcing an unknowing user to execute unwanted actions (Cross Site Request Forgery) Sample Scanning Tools A list of scanning tools that can identify vulnerabilities related to sessions are as follows:

Vulnerability Open Source / Free Type Tools Session Identifier Complexity Analysis

W3AF, Nessus, Sandcat, Jsky, Webscarab

Commercial Tools Cenzic Hailstorm, NTO Spider, Sandcat, Burpsuite, Grendel Scan

Authorization Security Testing Authorization is the concept of allowing access to resources only to those permitted to use them. While Authentication is about establishing and verifying user identity, Authorization is about permissions. Is a user allowed to perform the operation it is invoking? Testing for Authorization means understanding how the authorization process works and using that information to circumvent the authorization.

www.gallop.net | Gallop is #1 Independent Testing and Quality Engineering Services Company in North America.

Testing for Authorization usually includes Executing a path traversal attack and access reserved information Bypassing the authorization schema Escalation of privileges within the application by users Sample Scanning Tools A list of scanning tools that can identify vulnerabilities related to authorization are as follows:

Vulnerability Type

Open Source / Free Tools

Commercial Tools

Path Traversal

W3AF, IronWASP, ZAP, arachni, SkipFish, Wapiti, Vega, WATOBO, safe3wvs, WebSecurify

IBM AppScan, WebInspect, Acunetix, Burp Suite Professional, NTO Spider, Syhunt Dynamic, WAS, Netsparker, ScantoSecure, Jsky, N-Stalker, Ammonite, ParosPro

Privilege Escalation

Webscarab

IBM AppScan, WebInspect, Cenzic Hailstorm, NTOSpider

Business Logic Security Testing Business logic can have security flaws that allow users to do something that isn’t allowed by the business. For example, can users make a purchase for a negative amount of money? Attacks on the business logic of an application are dangerous, difficult to detect and are usually specific to the application. This type of vulnerability cannot be detected by a vulnerability scanner and relies upon the skills and creativity of the penetration tester. There are no scanning tools that can identify vulnerabilities related to business logic as it is more context driven.

Data Validation Security Testing One security weakness that leads to almost all of the vulnerabilities in web application such as XSS, SQL Injection etc. is erroneous data from external entity. The data from external entity can be tampered with by an attacker or unknowingly given by user and hence it is important to filter and sanitize all input data by the application before it is trusted and processed. Data Validation Testing is the task of testing all possible forms of input, to understand if the application scrutinizes all data correctly or not.

Data Validation testing usually includes Making the victim load the offending URI (Reflected Cross-site Scripting) Storing malicious code into the web page (Stored Cross-site Scripting) Controlling a DOM element (DOM Cross-site Scripting) Vulnerabilities like DOM based Cross-site Scripting in flawed Flash application Injecting SQL query via the input data (SQL Injection)

www.gallop.net | Gallop is #1 Independent Testing and Quality Engineering Services Company in North America.

Manipulating input parameters and pass it to internal search, add and modify functions (LDAP Injection) Injecting a particular XML document into the application (XML Injection) Injecting code into HTML pages (SSI Injection) Injecting data into the application so that it executes user-controlled XPath queries (XPath Injection) Injecting arbitrary IMAP/SMTP commands into the mail servers (IMAP / SMTP Injection) Injecting data into the application that will be later executed by the web server (Code Injection) Injecting an OS command through an HTTP request (OS Commanding) Understanding different types of buffer overflow vulnerabilities (HTTP splitting and HTTP smuggling) Sample Scanning Tools A list of scanning tools that can identify vulnerabilities related to data input from external entities are as follows:

Vulnerability Type

Open Source / Free Tools

Commercial Tools

Buffer Overow

W3AF, Nessus, Sandcat

IBM AppScan, WebInspect, Accunetix, Sandcat

Format String

W3AF, Nessus

IBM AppScan, WebInspect, Cenzic Hailstorm, SkipFish, Vega

Code Injection

Sandcat, arachini, Uber Web Security Scanner

IBM AppScan, Cenzic Hailstorm, Acunetix, SandcatCS, SkipFish, Netsparker

DOM Based Cross W3AF, Watobo, arachini Site Scripting

IBM AppScan, Cenzic Hailstorm, Acunetix, NTO Spider

HTTP Splitting / Smuggling

IBM AppScan, WebInspect, Cenzic WebGoat, W3AF, Nessus, Hailstorm Professional, Acunetix, SandcatCS, arachini, Wapiti, ZAP, NTOSpider, Sandcat Pro, Jsky, PowerFuzzer, Andiparos, Paros Netsparker, Burpsuite, Vega, Proxy, Web Securify, WebScarab Grendel Scan, ParosPro

IMAP/SMTP Injection

W3AF, Sandcat CS

IBM AppScan, Acunetix, Sandcat

LDAP Injection

W3AF, SandcatCS,arachini, Wapiti, Power Fuzzer,Uber Web Security Scanner

IBM AppScan, WebInspect, Cenzic Hailstorm Professional, Acunetix, Sandcat Pro, Jsky, Burp Suite

www.gallop.net | Gallop is #1 Independent Testing and Quality Engineering Services Company in North America.

OS Commanding

W3AF, Nessus, Sandcat, arachni, Wapiti, PowerFuzzer, Oedipus

IBM AppScan, WebInspect, Cenzic Hailstorm, Acunetix, NTO Spider, Sandcat, SkipFish, Jsky, Netsparker, Burpsuite, Vega

Reflected Cross Site Scripting

W3AF, IronWASP, ZAP, arachni, Syhunt Mini (Sandcat Mini), SkipFish, Wapiti, Sandcat, Vega, Grendel Scan, WATOBO, Andiparos, PowerFuzzer, Paros Proxy, Oedipus, Uber Web Security Scanner, Jsky, safe3wvs, WebSecurify, Grabber, Netsparker, WebCruiser, Proxy Strike, Acunetix WVS, WebScarab, N-Stalker, XSSer, Gamja, Secubat,

IBM AppScan, WebInspect, Acunetix, Burp Suite Professional, NTO Spider, Syhunt Dynamic, QualysGuard WAS, Netsparker, ScantoSecure, Jsky, N-Stalker, Ammonite, ParosPro, WebCruiser

SQL Injection

W3AF, IronWASP, ZAP, arachni, Syhunt Mini (Sandcat Mini), SkipFish, Wapiti, Sandcat, Vega, Grendel Scan, WATOBO, Andiparos, PowerFuzzer, Paros Proxy, Oedipus, Uber Web Security Scanner, Jsky, safe3wvs, WebSecurify, Grabber, Netsparker, WebCruiser, Proxy Strike, SQLiX, sqlmap, Gamja, Mini Mysqlator, Secubat, WSTool, DSSS, aidSQL,Scrawlr, LoverBoy, SQLID, VulnDetector, openAcunetix, Priamos, Gamja, Secubat, XCobra, safe3wvs, iScan

IBM AppScan, WebInspect, Acunetix, Burp Suite Professional, NTO Spider, Syhunt Dynamic, QualysGuard WAS, Netsparker, ScantoSecure, Jsky, N-Stalker, Ammonite, ParosPro, WebCruiser

SSI Injection

W3AF, Nessus, ZAP, Andiparos, Paros Proxy, Proxy Strike

IBM AppScan, WebInspect, Cenzic Hailstorm, ParosPro

Stored Cross Site Scripting

W3AF, Nessus, Wapiti, PowerFuzzer, XSSploit

IBM AppScan, WebInspect, Cenzic Hailstorm, Acunetix, NTO Spider, SkipFish, Netsparker, BurpSuite

XML Injection

Nessus, Uber Web Security Scanner

IBM AppScan, SkipFish, BurpSuite, Vega

Xpath Injection

W3AF, SandcatCS, Sandcat, arachni, Wapiti, Powerfuzzer, WebCruiser

IBM AppScan, WebInspect, Acunetix, SkipFish, Sandcat, Jsky, WebCruiser

Cross Site Scripting

W3AF, IronWASP, ZAP, arachni, Syhunt Mini (Sandcat Mini), SkipFish, Wapiti, Vega

IBM AppScan, WebInspect, Acunetix, Burp Suite Professional, NTO Spider, Syhunt Dynamic, Netsparker, ScantoSecure, Jsky, N-Stalker, Ammonite

www.gallop.net | Gallop is #1 Independent Testing and Quality Engineering Services Company in North America.

Unvalidated Redirects and Forwards

W3AF, IronWASP, ZAP, arachni, SkipFish

IBM AppScan, WebInspect, Acunetix, Burp Suite Professional, NTO Spider, QualysGuard WAS, Netsparker, ScantoSecure, NStalker

Denial of Service Security Testing One of the most common and simplest forms of attack on a system is Denial of Service (DoS) attack. This attack does not attempt to intrude to the system or to obtain sensitive information. It simply aims to prevent legitimate users from accessing the system. DoS attacks can be on individual machines, on the network that connects the machines or all the machines simultaneously. It is based on the fact that any device has operational limits. Any computer system, web server or network can handle a finite load and simply overloading the system with requests will block serving the requests of legitimate users. In this section, focus will be attacks against availability that can be launched by just one malicious user on a single machine.

Denial of Service (DoS) testing usually includes Forcing the underlying database to carry out CPU intensive queries by using several wildcards Locking valid user accounts by repeatedly attempting to log in with a wrong password Causing DoS attack by overflowing one or more data structure of the target application Exhausting server resources by making it allocate a very high number of objects Forcing the application to loop through a code segment that needs high computing resources Filling the target disks by log data Understanding if the application properly releases resources (memory or files) after their usage Allocating a big amount of data into a user session object Sample Scanning Tools A list of scanning tools that can identify vulnerabilities related to DoS attacks are as follows:

Vulnerability Type

Open Source / Free Tools

Regular W3AF, Nessus, Wapiti, Expression Denial safe3wvs, WebSecurify of Service

Commercial Tools WebInspect

www.gallop.net | Gallop is #1 Independent Testing and Quality Engineering Services Company in North America.

ACCORDING TO GARTNER ONE LAPTOP IS STOLEN EVERY 53 SECONDS Web Service Security Testing Web services are exposed to net like any other service but can be used on HTTP, FTP, SMTP and MQ among other transport protocols. The Web Services Framework utilizes the HTTP protocol in conjunction with XML, SOAP, REST, WSDL and UDDI technologies. The vulnerabilities in web services are similar to other vulnerabilities, such as SQL injection, information disclosure and leakage but Web Services also have unique XML / parser related vulnerabilities.

Web service security testing usually includes Understanding the Web service entry point and the communication schema Invoking an operation that is not used in a standard SOAP Request Sending very large or malformed XML messages Attacking the Web service by passing malicious content on the HTTP GET string Attacking binary files (executables, malware etc.) to Web service if it accepts attachments Conducting man-in-the-middle of the attack Sample Scanning Tools A list of scanning tools that can identify vulnerabilities related to web service security are as follows:

Vulnerability Type

Open Source / Free Tools

Commercial Tools

XML Content Level

WebScarab, Metasploit

-

XML Structural

Webscarab

-

AJAX Security Testing AJAX uses XMLHttpRequest object and JavaScript to make asynchronous requests to the web server, parsing the responses and then updating the page DOM and CSS. AJAX application is more complicated because processing is done on both the client side and the server side. This complexity is avoided by having framework but that also results in situations where developers do not fully understand where the code will execute, and can lead to a situation where it is difficult to properly assess the risk associated with particular applications or features.

www.gallop.net | Gallop is #1 Independent Testing and Quality Engineering Services Company in North America.

AJAX applications have similar vulnerabilities like SQL injection, data validation etc. that a traditional web application can have. In addition, AJAX application can be vulnerable to new classes of attack such as Cross Site Request Forgery (XSRF). Testing AJAX applications can be challenging due to different encoding or serialization scheme used by developers while submitting POST data and make it difficult for testing tools to reliably create automated test requests. The use of web proxy tool is extremely helpful for analyzing the traffic.

Sample Scanning Tools A list of scanning tools that can identify vulnerabilities related to AJAX are as follows:

Vulnerability Type AJAX Vulnerabilities

Open Source / Free Tools OWASP Sprajax, safe2wvs, Sandcat, W3AF

Commercial Tools Acunetix, Hailstorm, WebInspect, Watchre, N-Stalker, Grabber, IBM AppScan, Jsky, Netsparker, NTOSpider, ParosPro, Sandcat

75% OF IT RISKS IMPACT CUSTOMERS SATISFACTION AND BRAND REPUTATION

Disclaimer This white paper is issued for information only. Gallop declines all responsibility for any errors and any loss or damage resulting from use of the contents of this White Paper. Gallop also declines responsibility for any infringement of any third party’s Intellectual Property Rights but will be pleased to acknowledge any IPR and correct any infringement of which it is advised.

About the White Paper At Gallop, innovation is a continuous endeavor to ensure the best services in every engagement. As part of the Security Testing R&D, Gallop consolidates and communicates information that enriches Software Testing as a discipline.

The content is an incorporation of inputs and observations from Security Testing experts and business leaders with cross vertical experience in addressing some of the most complex and most gigantic software testing challenges. While the white paper details the standard procedures of Security testing, the procedures mentioned in the white paper have been simplified to cater to a wider audience for general reference.

For more details write to contact@gallop.net

www.gallop.net | Gallop is #1 Independent Testing and Quality Engineering Services Company in North America.

Software Testing Specialists

Corporate Head Quarters 630 Freedom Business Center, 3rd Floor, King of Prussia, PA 19406 Email: contact@gallop.net Phone: +1 610 768 7736 Fax: +1 610 768 7775

39899 Balentine Drive, Suite 200, Newark, CA 94560 Email: contact@gallop.net Phone: +1 610 768 7736 Fax: +1 610 768 7775

Global Test Engineering Center 6th Floor, Orion Block, “The V” Ascendas, Plot no. 17, Software Units Layout Madhapur, Hyderabad 500081, India Email: contact@gallop.net Phone: +1 610 768 7736 Fax: +1 610 768 7775

About Gallop Gallop Solutions is North America’s largest independent global software testing services & quality management company with 2000+ career testers out of which 600+ are based out of USA. Our test engineering & Assurance services are backed by intellectual property (ETAS) to deliver improved business outcomes to clients. More than 50 of the Fortune companies have relied on Gallop’s specialist independent software testing services for more than a decade and have achieved significant market acceleration, and return on investments in their software quality initiatives. Headquartered in Philadelphia, USA, the company maintains advanced global test engineering delivery center facilities in India. Gallop is a recognized innovator and thought leader in the software testing space and constantly invests in software testing / Quality R&D initiatives.

For Other Information contact@gallop.net

#1 Independent Software Testing Services Company in North America facebook.com/gallopinc

youtube.com/c/GallopSolutionsInc

twitter.com/galloptech

linkedin.com/company/gallop-solutions

pinterest.com/gallopsolutions

gallop.net/blog

www.gallop.net | Gallop is a 100% subsidiary of Cigniti Technologies, Global Leaders in Independent Software Testing Services.