Difference between revisions of "Testing for AJAX Vulnerabilities (OWASP-AJ-001)"

Revision as of 20:22, 4 November 2006 (view source) Anushshetty (talk | contribs) (→‎Description of the Issue) ← Older edit		Revision as of 21:07, 4 November 2006 (view source) Anushshetty (talk | contribs) (→‎Attacks and Vulnerabilities) Newer edit →
Line 9:		Line 9:
	Secondly in the case of accessing an AJAX page on a non-SSL connection, the subsequent XMLHttpRequest calls are also not SSL encrypted. Hence the login data is traversing the wire in clear text. Using secure channels HTTPS/SSL which the modern day browsers support is an easiest way to prevent such attacks from happening.</p>		Secondly in the case of accessing an AJAX page on a non-SSL connection, the subsequent XMLHttpRequest calls are also not SSL encrypted. Hence the login data is traversing the wire in clear text. Using secure channels HTTPS/SSL which the modern day browsers support is an easiest way to prevent such attacks from happening.</p>
		+
		+	XMLHttpRequest(XHR) objects retrieve the information of all the servers on the web. This could lead to various other attacks like SQL Injection, Cross Site Scripting(XSS) etc.
	<p>		<p>
	<br>		<br>
−	'''Hijacking'''<br>AJAX applications drastically increases the attack surface of these programs by throwing in more additional ways to potentially inject malicious content. Filtering user input correctly is, as always, the single most important safeguard for a web application; this is an area that traditional web applications have regularly failed to handle correctly.<br>	+	'''Hijacking'''<br>AJAX applications drastically increases the attack surface of these programs by throwing in more additional ways to potentially inject malicious content. Filtering user input correctly is, as always, the single most important safeguard for a web application; this is an area that traditional web applications have regularly failed to handle correctly.<br><br>
		+	'''SQL Injection'''<br>SQL Injection attacks are remote attacks on the database by allowing the attacker to modify the data on the database. <br> A typical SQL Injection attack could be as follows<br>
		+
		+	*'''''Example 1'''''
		+	<pre>
		+	SELECT id FROM users WHERE name='' OR 1=1 AND pass='' OR 1=1 LIMIT 1;
		+	</pre>
		+	This query will always return one row (unless the table is empty) and it is likely to be the first entry in the table. For many applications, that entry is the administrative login; the one with the most privileges.<br>
		+
		+	*'''''Example 2'''''
		+	<pre>
		+	SELECT id FROM users WHERE name='' AND pass=''; DROP TABLE users;
		+	</pre>
		+	The above query helps in dropping all the tables and destructs the database.
		+
	== Black Box testing and example ==		== Black Box testing and example ==
	'''Testing for Topic X vulnerabilities:''' <br>		'''Testing for Topic X vulnerabilities:''' <br>

---

Revision as of 21:07, 4 November 2006

Brief Summary

Asynchronous Javascript and XML (AJAX) is one of the latest techniques used by web application developers to provide a user experience similar to that of a local application. Since Ajax is still a new term, not much of a thought has been given towards its ecurity implications.

Attacks and Vulnerabilities

XMLHttpRequest Vulnerabilities
AJAX uses XMLHttpRequest(XHR) object for all the back-end work.A client sends a request to a specific URL on the same server as the original page and can receive any kind of reply from the server. These replies are often snippets of HTML, but can also be XML, Javascript Object Notation (JSON), image data or anything else that Javascript can process.

Secondly in the case of accessing an AJAX page on a non-SSL connection, the subsequent XMLHttpRequest calls are also not SSL encrypted. Hence the login data is traversing the wire in clear text. Using secure channels HTTPS/SSL which the modern day browsers support is an easiest way to prevent such attacks from happening.

XMLHttpRequest(XHR) objects retrieve the information of all the servers on the web. This could lead to various other attacks like SQL Injection, Cross Site Scripting(XSS) etc.

Hijacking
AJAX applications drastically increases the attack surface of these programs by throwing in more additional ways to potentially inject malicious content. Filtering user input correctly is, as always, the single most important safeguard for a web application; this is an area that traditional web applications have regularly failed to handle correctly.

SQL Injection
SQL Injection attacks are remote attacks on the database by allowing the attacker to modify the data on the database.
A typical SQL Injection attack could be as follows

• Example 1

SELECT id FROM users WHERE name='' OR 1=1 AND pass='' OR 1=1 LIMIT 1;

This query will always return one row (unless the table is empty) and it is likely to be the first entry in the table. For many applications, that entry is the administrative login; the one with the most privileges.

• Example 2

SELECT id FROM users WHERE name='' AND pass=''; DROP TABLE users;

The above query helps in dropping all the tables and destructs the database.

Black Box testing and example

Testing for Topic X vulnerabilities:
...
Result Expected:
...

Gray Box testing and example

Testing for Topic X vulnerabilities:
...
Result Expected:
...

References

Whitepapers
...
Tools
...

---

OWASP Testing Guide v2

Here is the OWASP Testing Guide v2 Table of Contents OWASP Testing Guide v2 Table of Contents

This article is a stub. You can help OWASP by expanding it or discussing it on its Talk page.