Testing for Stack Traces (OTG-ERR-002) - Revision history

Asterix: /* Black Box testing */ Corrected typo - final ")" at the end of first bullet.

2015-01-21T16:14:26Z

‎Black Box testing: Corrected typo - final ")" at the end of first bullet.

Andrew Muller at 13:53, 7 August 2014

2014-08-07T13:53:29Z

Jane O'Connor: Added Andrew's changes.

2014-08-01T20:39:39Z

Added Andrew's changes.

Andrew Muller: Andrew Muller moved page Testing for Stack Traces (OWASP-IG-XXX) to Testing for Stack Traces (OTG-ERR-002): Align with Common Numbering

2014-07-31T14:40:35Z

Andrew Muller moved page Testing for Stack Traces (OWASP-IG-XXX) to Testing for Stack Traces (OTG-ERR-002): Align with Common Numbering

Jane O'Connor: Final edit

2014-05-17T17:53:06Z

Final edit

Irene Abezgauz: minor changes and additions

2014-04-22T21:26:18Z

minor changes and additions

Davide Danelon at 16:51, 6 March 2014

2014-03-06T16:51:53Z

Jeff Williams: Created page with "{{Template:OWASP Testing Guide v4}} == Brief Summary == Stack traces are not vulnerabilities by themselves, but they often reveal information that is interesting to an attac..."

2013-07-10T18:40:32Z

Created page with "{{Template:OWASP Testing Guide v4}} == Brief Summary == Stack traces are not vulnerabilities by themselves, but they often reveal information that is interesting to an attac..."

New page

{{Template:OWASP Testing Guide v4}}

== Brief Summary ==

Stack traces are not vulnerabilities by themselves, but they often reveal information that is interesting to an attacker. Attackers attempt to generate these stack traces by tampering with the input to the web application with malformed HTTP requests and other input data.

== Description of the Issue ==

== Black Box testing and example ==

There are a variety of techniques that will cause exception messages to be sent in an HTTP response. Note that in most cases this will be an HTML page, but exceptions can be sent as part of SOAP or REST responses too.

Some tools, such as [[OWASP ZAP]] and Burp proxy will automatically detect these exceptions in the response stream as you are doing other penetration and testing work.

== Gray Box testing and example ==

Search the code for the calls that cause an exception to be rendered to a String or output stream. For example, in Java this might be code in a JSP that looks like:

<pre><% e.printStackTrace( new PrintWriter( out ) ) %></pre>

In some cases, the stack trace will be specifically formatted into HTML, so be careful of accesses to stack trace elements.

Search the configuration to verify error handling configuration and the use of default error pages. For example, in Java this configuration can be found in web.xml.

== References ==

* [1] [[http://www.ietf.org/rfc/rfc2616.txt?number=2616 RFC2616]] Hypertext Transfer Protocol -- HTTP/1.1

@@ Line 15: / Line 15: @@
 Some tests to try include:
-*invalid input (such as input that is not consistent with application logic.
+*invalid input (such as input that is not consistent with application logic).
 *input that contains non alphanumeric characters or query syntax.
 *empty inputs.
@@ Line 27: / Line 27: @@
 Some tools, such as [[OWASP_Zed_Attack_Proxy_Project|OWASP ZAP]] and Burp proxy will automatically detect these exceptions in the response stream as you are doing other penetration and testing work.
 === Gray Box Testing ===

@@ Line 9: / Line 9: @@
 ==How to Test==
-== Black Box testing and example ==
+=== Black Box testing ===
 There are a variety of techniques that will cause exception messages to be sent in an HTTP response. Note that in most cases this will be an HTML page, but exceptions can be sent as part of SOAP or REST responses too.
@@ Line 29: / Line 29: @@
-== Gray Box Testing ==
+=== Gray Box Testing ===
 Search the code for the calls that cause an exception to be rendered to a String or output stream. For example, in Java this might be code in a JSP that looks like:

@@ Line 7: / Line 7: @@
 == Description of the Issue ==
-If the application responds with stack traces that are not managed it could reveals potentially useful information for an attacker. This information could then be used, by the attacker, to bring successive attacks.
+If the application responds with stack traces that are not managed it could reveal information useful to attackers. This information could then be used in further attacks. Providing debugging information as a result of operations that generate errors is considered a bad practice due to multiple reasons. For example it may contain information on internal workings of the application such as relative paths of the point where the application is installed or how objects are referenced internally.
 == Black Box testing and example ==
 There are a variety of techniques that will cause exception messages to be sent in an HTTP response. Note that in most cases this will be an HTML page, but exceptions can be sent as part of SOAP or REST responses too.
 Some tools, such as [[OWASP_Zed_Attack_Proxy_Project|OWASP ZAP]] and Burp proxy will automatically detect these exceptions in the response stream as you are doing other penetration and testing work.

@@ Line 1: / Line 1: @@
 {{Template:OWASP Testing Guide v4}}
-== Brief Summary ==
+== Summary ==
 Stack traces are not vulnerabilities by themselves, but they often reveal information that is interesting to an attacker. Attackers attempt to generate these stack traces by tampering with the input to the web application with malformed HTTP requests and other input data.
 If the application responds with stack traces that are not managed it could reveal information useful to attackers. This information could then be used in further attacks. Providing debugging information as a result of operations that generate errors is considered a bad practice due to multiple reasons. For example, it may contain information on internal workings of the application such as relative paths of the point where the application is installed or how objects are referenced internally.
+==How to Test==
 == Black Box testing and example ==
@@ Line 42: / Line 40: @@
 Search the configuration to verify error handling configuration and the use of default error pages.  For example, in Java this configuration can be found in web.xml.
 == References ==
 * [1] [[http://www.ietf.org/rfc/rfc2616.txt?number=2616 RFC2616]] Hypertext Transfer Protocol -- HTTP/1.1

← Older revision	Revision as of 14:40, 31 July 2014
(No difference)