|
Nettitude carries out Web Application Test to assess the following elements of the OWASP top 10.
A1: Injection
Injection flaws, such as SQL, XPATH, OS and LDAP injection occur when untrusted data is sent to
an interpreter as part of a command or query. An attacker can use these vulnerabilities to trick
interpreters into executing unintended commands or accessing unauthorized data.
A2: Cross-Site Scripting (XSS)
XSS flaws occur whenever an application takes untrusted data and sends it to a web browser without
proper validation and escaping. XSS allows attackers to execute scripts in a victim’s browser which
in turn can hijack user sessions, deface web sites, or redirect the user to malicious sites.
A3: Broken Authentication and Session Management
Application functions related to authentication and session management are often not implemented
correctly allowing attackers to compromise passwords, keys, session tokens, or exploit other
implementation flaws to assume other users’ identities.
A4: Insecure Direct Object References
A direct object reference occurs when a developer exposes a reference to an internal object,
such as a file, directory, or database key. Without an access control check or other protection,
attackers can manipulate these references to access unauthorized data.
A4: Insecure Direct Object References
A direct object reference occurs when a developer exposes a reference to an internal object,
such as a file, directory, or database key. Without an access control check or other protection,
attackers can manipulate these references to access unauthorized data.
A5: Cross-Site Request Forgery (CSRF)
A CSRF attack forces a logged-on victim’s browser to send a forged HTTP request, including the victim’s
session cookie and any other automatically included authentication information to a vulnerable web application.
This allows the attacker to force the victim’s browser to generate requests the vulnerable application thinks are
legitimate requests from the victim.
A6: Security Misconfiguration (CSRF)
A CSRF attack forces a logged-on victim’s browser to send a forged HTTP request, including the victim’s
session cookie and any other automatically included authentication information to a vulnerable web application.
This allows the attacker to force the victim’s browser to generate requests the vulnerable application thinks are
legitimate requests from the victim.
A7: Insecure Cryptographic Storage
Many web applications do not properly protect sensitive data, such as credit cards, SSNs, and authentication credentials,
with appropriate encryption or hashing. Attackers often try to steal or modify these types of data to conduct identity theft,
credit card fraud, or other similar crimes.
A8: Failure to Restrict URL Access
Many web applications check URL access rights before rendering protected links and buttons. However, applications need to
perform similar access control checks each time these pages are accessed, or attackers will be able to forge URLs to access
these hidden pages anyway.
A9: Insufficient Transport Layer Protection
Applications frequently fail to authenticate, encrypt, and protect the confidentiality and integrity of sensitive network traffic.
When they do, they sometimes support weak algorithms, use expired or invalid certificates, or do not use them correctly.
A10: Unvalidated Redirects and Forwards
Applications frequently fail to authenticate, encrypt, and protect the confidentiality and integrity of sensitive network traffic.
When they do, they sometimes support weak algorithms, use expired or invalid certificates, or do not use them correctly.
The OWASP Top 10 is a strong starting point for Web Application testing, but organisations should really look to go beyond this.
The underlying application logic needs to be tested. Web sites need to be assessed with different classes of users, to ensure that appropriate partitioning and access controls exist. Content Management Systems and Administrative functions should be assessed and a series of broader controls should be reviewed and tested.
|
