Web Vulnerability Assessments NEWDUG January, 2015.

Web Vulnerability AssessmentsNEWDUGJanuary, 2015

2

Agenda

• About• Web Vulnerability Assessments

– Types– SOW– Steps

• Tools• Demos• Goals

– Demonstrate Web VA, show techniques Pen-testers and Hackers use to find vulnerabilities in your sites

– Provide some techniques and tools to help secure your code

3

John Reynders

• Consultant with OpenSky Corp.• Seven years experience in Web Security:

– Program Development– Dynamic Testing– Static Analysis– Coding Standards– Web Application Firewalls

• Eight years of general Information Security experience

4

OpenSky - An Award Winning CompanyEverything starts with our people. Our success comes from their expertise and dedication to always “doing the right thing” for our clients. Our people• Expert resources: CRN Tech Elite 250 (2013) • Quality work environment: Top Workplace (2011, 2012, 2013)

Our people create top tier solutions• GRC Solution Award with client Shire Pharmaceuticals: OCEG (2013)

Our people and our solutions create lasting relationships and new partners• Multiple growth awards: Inc 500 (2012), CRN (2011, 2012), Marcum Tech Top 40 (2011,

2012)

5

GRC Services GRC Strategy GRC Maturity Assessment GRC Configuration and Custom

Development

Secure

Manage

Plan, Design & Migrate

Datacenter & Cloud Infrastructure Services Data Center and Cloud

Integration Network Infrastructure Virtualization Storage and Computing Infrastructure Applications End-User Computing

IT Risk Management & Security Services Assessment and Advisory Application Secure Coding Vulnerability Assessment

and Penetration Testing Security Program and

Framework Technology

Implementation and Engineering

Mobile Device and Virtualization Security

Technical Business Consulting IT Transformation and Strategy Technical Project Management IT Supplier & Sourcing Management IT Expense Management

Complete Solutions for Major Enterprises

6

Web Vulnerability Assessments

• Conducted against a contract with specific terms, most often called the Statement of Work (SOW)

• Specify in the SOW:– System to be tested (URL)

• Production or Non-Prod?

– Type and level of testing • Level of Automated and Manual testing• “Safe” Tests only?

– Hours for testing• Nights only?

– Whitelist IP addresses in WAF, IPS?– Special Concerns?– The more information the better the assessment

7

Web Vulnerability Assessments

• Types of Application Security Testing:– Dynamic Analysis Security Testing (DAST) “Black Box”

• Tests actual web site for vulnerabilities• Simulates what a real attacker would do

– Static Analysis Security Testing (SAST) “White Box”• Tests code for vulnerabilities • A real attacker would likely not have access to the code, this method is a

different approach to identifying potential security flaws.

– Hybrid “Glass Box”• Dynamic test against instrumented web server

– Manual testing can occur in each type• Talk covers Dynamic Testing

– Some tools perform static analysis of JavaScript

8

“Typical” Web Assessment Steps

• Recon– Site components and architecture– Open ports?

• Hack the server

• Manually crawl site with an Intercepting Proxy• Automated Scan of site• Results verification – False positives removal• Manual testing

– Things tools don’t do well• Business Logic• Privilege Escalation etc.

• Reporting

9

Recon

• Visit site• Site information

– Netcraft, Shodan etc.• Google Dorks

– Files, passwords, WSDL, Admin logons etc.• Port Scan

– Nmap, Nessus, Qualys– May perform an infrastrucuture vulnerability scan

• Missing patches, configuration issues etc.

• Check security configuration

10

Configuration Checkers

• Microsoft Web Application Configuration Analyzer– Needs Admin on Server, Checks SQL Server too– http://www.microsoft.com/en-ca/download/details.aspx?id=57

3• Check Your Headers

– http://cyh.herokuapp.com/cyh• SSL Labs

– https://www.ssllabs.com/ssltest/index.html• ASAFAWEB

– https://asafaweb.com/

11

Crawl Site with Intercepting Proxies

• Burp*– http://portswigger.net/

• Fiddler – http://www.telerik.com/fiddler

• Zed Attack Proxy (ZAP)– https://code.google.com/p/zaproxy/wiki/Downloads

* - Free and Professional versions

12

Intercepting Proxy

• Intercepting Proxy Man-in-the-Middles all traffic• Hackers and Testers can see all data transmitted• Hidden Fields => NOT a security feature

13

Burp

14

Burp – Analyze Request & Response

15

Scan Site – Dynamic Scanners

• Acunetix– http://www.acunetix.com/

• AppScan– http://www-03.ibm.com/software/products/en/appscan

• WebInspect– http://www8.hp.com/us/en/software-solutions/webinspect-dyn

amic-analysis-dast/• Burp & ZAP have scanning modules

16

AppScan

17

DEMO

18

Resources

OWASP - http://www.owasp.org/– Cheat Sheets

• https://www.owasp.org/index.php/Cheat_Sheets

– Testing Guide• https://

www.owasp.org/index.php/OWASP_Testing_Guide_v4_Table_of_Contents

WASC - http://www.webappsec.org/– Not updated recently but some good content

The Web Application Hacker's Handbook– http://

www.amazon.com/The-Web-Application-Hackers-Handbook/dp/1118026470

19

Contact InformationEmail: [email protected]

Web Site: http://www.openskycorp.com/