Testing for Error Code (OTG-ERR-001) - Revision history

Andrew Muller at 13:24, 8 August 2014

2014-08-08T13:24:50Z

Andrew Muller at 12:53, 8 August 2014

2014-08-08T12:53:44Z

Andrew Muller at 13:49, 7 August 2014

2014-08-07T13:49:37Z

Andrew Muller: Align with Common Numbering

2014-08-05T14:22:17Z

Align with Common Numbering

Show changes

Andrew Muller: Andrew Muller moved page Testing for Error Code (OWASP-IG-006) to Testing for Error Code (OTG-ERR-001): Align with Common Numbering

2014-07-31T14:40:14Z

Andrew Muller moved page Testing for Error Code (OWASP-IG-006) to Testing for Error Code (OTG-ERR-001): Align with Common Numbering

Irene Abezgauz: minor changes and additions

2014-04-22T21:38:24Z

minor changes and additions

Bill Sempf at 23:39, 10 April 2014

2014-04-10T23:39:50Z

Genis Dominguez: Adding information in the Summary, Web Server Error, Database Errors. Created Application Server Errors, Error Handling in Apache, Error Handling in Tomcat. Added 4 new tests in Black Box testing and edited 404 Not Found test. Added Tool ErrorMint.

2014-01-05T13:06:09Z

Adding information in the Summary, Web Server Error, Database Errors. Created Application Server Errors, Error Handling in Apache, Error Handling in Tomcat. Added 4 new tests in Black Box testing and edited 404 Not Found test. Added Tool ErrorMint.

Show changes

Andrew Muller at 05:21, 19 December 2012

2012-12-19T05:21:49Z

Andrew Muller at 05:11, 19 December 2012

2012-12-19T05:11:31Z

@@ Line 240: / Line 240: @@
 You don't have permission to access /<dir> on this server.
 </pre>
 ==Remediation==
@@ Line 364: / Line 379: @@
 </error-page>
 </pre>

@@ Line 41: / Line 41: @@
 Database errors are those returned by the Database System when there is a problem with the query or the connection. Each Database system, such as MySQL, Oracle or MSSQL, has their own set of errors. Those errors can provide sensible information such as Database server IPs, tables, columns and login details.
-In addition, there are many SQL Injection exploitation techniques that utilize detailed error messages from the database driver, for in depth information on this issue see [https://www.owasp.org/index.php/Testing_for_SQL_Injection_%28OTG-INPVAL-006%29 Testing for SQL Injection (OTG-INPVAL-006)] for more information.
+In addition, there are many SQL Injection exploitation techniques that utilize detailed error messages from the database driver, for in depth information on this issue see [[Testing for SQL Injection (OTG-INPVAL-005)]] for more information.
 Web server errors aren't the only useful output returned requiring security analysis. Consider the next example error message:

@@ Line 6: / Line 6: @@
 It's possible to cause these errors to be displayed by using a particular requests, either specially crafted with tools or created manually.
 These codes are very useful to penetration testers during their activities, because they reveal a lot of information about databases, bugs, and other technological components directly linked with web applications.
-Within this section we'll analyse the more common codes (error messages) and bring into focus the steps of vulnerability assessment.
 The most important aspect for this activity is to focus one's attention on these errors, seeing them as a collection of information that will aid in the next steps of our analysis. A good collection can facilitate assessment efficiency by decreasing the overall time taken to perform the penetration test.

@@ Line 9: / Line 9: @@
 The most important aspect for this activity is to focus one's attention on these errors, seeing them as a collection of information that will aid in the next steps of our analysis. A good collection can facilitate assessment efficiency by decreasing the overall time taken to perform the penetration test.
-Some errors cannot be provoked, but attackers can use search engines to locate the errors that disclose information on any site or in a specific site using the search engine filtering tools as described in [https://www.owasp.org/index.php/Testing:_Search_engine_discovery/reconnaissance_(OWASP-IG-002) 4.2.1 Conduct Search Engine Discovery and Reconnaissance for Information Leakage (OTG-INFO-001)]
+Attackers sometimes use search engines to locate errors that disclose information. Searches can be performed to find any erroneous sites as random victims, or it is possible to search for errors in a specific site using the search engine filtering tools as described in [https://www.owasp.org/index.php/Testing:_Search_engine_discovery/reconnaissance_(OWASP-IG-002) 4.2.1 Conduct Search Engine Discovery and Reconnaissance for Information Leakage (OTG-INFO-001)]
 == Description of the Issue ==
@@ Line 15: / Line 15: @@
 ===Web Server Errors===
-A common error that we can see during our search is the HTTP 404 Not Found.
+A common error that we can see during testing is the HTTP 404 Not Found.
 Often this error code provides useful details about the underlying web server and associated components. For example:
@@ Line 24: / Line 24: @@
 </pre>
-This error message can be generated by requesting a non-existant URL.
+This error message can be generated by requesting a non-existent URL.
 After the common message that shows a page not found, there is information about web server version, OS, modules and other products used.
 This information can be very important from an OS and application type and version identification point of view.
-Other HTTP response codes such as 400 Bad Request, 405 Method Not Allowed, 501 Method Not Implemented, 408 Request Time-out and 505 HTTP Version Not Supported can be forced by an attacker. When sending crafted requests, web servers provide one of these error codes depending on their HTTP implementation.
+Other HTTP response codes such as 400 Bad Request, 405 Method Not Allowed, 501 Method Not Implemented, 408 Request Time-out and 505 HTTP Version Not Supported can be forced by an attacker. When receiving specially crafted requests, web servers may provide one of these error codes depending on their HTTP implementation.
-Disclosed information in the Web Server errors is related to the information disclosed in the HTTP headers as described in the section [https://www.owasp.org/index.php/Fingerprint_Web_Server_(OTG-INFO-002) Fingerprint Web Server (OTG-INFO-002)].
+Testing for disclosed information in the Web Server error codes is related testing for information disclosed in the HTTP headers as described in the section [https://www.owasp.org/index.php/Fingerprint_Web_Server_(OTG-INFO-002) Fingerprint Web Server (OTG-INFO-002)].
 ===Application Server Errors===
-Application errors are those that are caused by server application in two different levels: errors generated by the server-side scripting language, such as PHP, ASP or JSP, or errors generated by the application hosted in the server. Applications can be expressly created for the site or packaged applications such as Wordpress, Drupal or PhpBB.
+Application errors are returned by the application itself, rather than the web server. These could be error messages from framework code (ASP, JSP etc.) or they could be specific errors returned by the application code.
+Detailed application errors typically provide information of server paths, installed libraries and application versions.
 ===Database Errors===
 Database errors are those returned by the Database System when there is a problem with the query or the connection. Each Database system, such as MySQL, Oracle or MSSQL, has their own set of errors. Those errors can provide sensible information such as Database server IPs, tables, columns and login details.
 Web server errors aren't the only useful output returned requiring security analysis. Consider the next example error message:
@@ Line 78: / Line 79: @@
 ===Error Handling in IIS and ASP .net===
-ASP .net is a common framework from Microsoft used for developing web applications. IIS is one of the commonly used web server. Errors occur in all applications, we try to trap most errors but it is almost impossible to cover each and every exception.
+ASP .net is a common framework from Microsoft used for developing web applications. IIS is one of the commonly used web servers. Errors occur in all applications, developers try to trap most errors but it is almost impossible to cover each and every exception (it is however possible to configure the web server to suppress detailed error messages from being returned to the user).
 IIS uses a set of custom error pages generally found in c:\winnt\help\iishelp\common to display errors like '404 page not found' to the user. These default pages can be changed and custom errors can be configured for IIS server. When IIS receives a request for an aspx page, the request is passed on to the dot net framework.
@@ Line 199: / Line 200: @@
-== Black Box testing and example ==
+== Black Box Testing Examples ==
 '''Test: 404 Not Found'''
@@ Line 226: / Line 228: @@
 '''Test:'''
 <pre>
-. Network problems
+Network problems leading to the application being unable to access the database server
 </pre>
 '''Result:'''
@@ Line 238: / Line 239: @@
 '''Test:'''
 <pre>
-. Authentication failed
+Authentication failure due to missing credentials
 </pre>
 '''Result:'''
@@ Line 348: / Line 348: @@
 ...
 </pre>
 '''Test:'''
 http://<host>/<dir>
 </pre>
@@ Line 371: / Line 367: @@
 == Tools ==
 * [1] ErrorMint - http://sourceforge.net/projects/errormint/ <br>
 == References ==

← Older revision		Revision as of 23:39, 10 April 2014
Line 379:		Line 379:
	* [4] [[http://httpd.apache.org/docs/2.2/mod/core.html#servertokens ServerTokens]] Apache ServerTokens Directive		* [4] [[http://httpd.apache.org/docs/2.2/mod/core.html#servertokens ServerTokens]] Apache ServerTokens Directive
	* [5] [[http://httpd.apache.org/docs/2.2/mod/core.html#serversignature ServerSignature]] Apache ServerSignature Directive		* [5] [[http://httpd.apache.org/docs/2.2/mod/core.html#serversignature ServerSignature]] Apache ServerSignature Directive
		+
		+	[[Category:OWASP .NET Project]]

← Older revision	Revision as of 14:40, 31 July 2014
(No difference)