This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "Testing for Stack Traces (OTG-ERR-002)"

From OWASP
Jump to: navigation, search
(Created page with "{{Template:OWASP Testing Guide v4}} == Brief Summary == Stack traces are not vulnerabilities by themselves, but they often reveal information that is interesting to an attac...")
 
Line 6: Line 6:
  
 
== Description of the Issue ==
 
== Description of the Issue ==
 +
 +
If the application responds with stack traces that are not managed it could reveals potentially useful information for an attacker. This information could then be used, by the attacker, to bring successive attacks.
 +
Provide debugging information as a result of operations that generate errors is considered a bad practice due to the fact that relative paths to the point where the application is installed or how objects are referenced internally are shown to the user which can draw benefit for a successive attack.
  
 
== Black Box testing and example ==
 
== Black Box testing and example ==
Line 11: Line 14:
 
There are a variety of techniques that will cause exception messages to be sent in an HTTP response. Note that in most cases this will be an HTML page, but exceptions can be sent as part of SOAP or REST responses too.
 
There are a variety of techniques that will cause exception messages to be sent in an HTTP response. Note that in most cases this will be an HTML page, but exceptions can be sent as part of SOAP or REST responses too.
  
Some tools, such as [[OWASP ZAP]] and Burp proxy will automatically detect these exceptions in the response stream as you are doing other penetration and testing work.
+
Some tools, such as [[OWASP_Zed_Attack_Proxy_Project|OWASP ZAP]] and Burp proxy will automatically detect these exceptions in the response stream as you are doing other penetration and testing work.
  
 
== Gray Box testing and example ==
 
== Gray Box testing and example ==

Revision as of 16:51, 6 March 2014

This article is part of the new OWASP Testing Guide v4.
Back to the OWASP Testing Guide v4 ToC: https://www.owasp.org/index.php/OWASP_Testing_Guide_v4_Table_of_Contents Back to the OWASP Testing Guide Project: https://www.owasp.org/index.php/OWASP_Testing_Project

Brief Summary

Stack traces are not vulnerabilities by themselves, but they often reveal information that is interesting to an attacker. Attackers attempt to generate these stack traces by tampering with the input to the web application with malformed HTTP requests and other input data.

Description of the Issue

If the application responds with stack traces that are not managed it could reveals potentially useful information for an attacker. This information could then be used, by the attacker, to bring successive attacks. Provide debugging information as a result of operations that generate errors is considered a bad practice due to the fact that relative paths to the point where the application is installed or how objects are referenced internally are shown to the user which can draw benefit for a successive attack.

Black Box testing and example

There are a variety of techniques that will cause exception messages to be sent in an HTTP response. Note that in most cases this will be an HTML page, but exceptions can be sent as part of SOAP or REST responses too.

Some tools, such as OWASP ZAP and Burp proxy will automatically detect these exceptions in the response stream as you are doing other penetration and testing work.

Gray Box testing and example

Search the code for the calls that cause an exception to be rendered to a String or output stream. For example, in Java this might be code in a JSP that looks like:

<% e.printStackTrace( new PrintWriter( out ) ) %>

In some cases, the stack trace will be specifically formatted into HTML, so be careful of accesses to stack trace elements.

Search the configuration to verify error handling configuration and the use of default error pages. For example, in Java this configuration can be found in web.xml.

References

  • [1] [RFC2616] Hypertext Transfer Protocol -- HTTP/1.1