This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Testing for Storing too Much Data in Session (OWASP-DS-008)"
Weilin Zhong (talk | contribs) |
|||
| Line 1: | Line 1: | ||
| − | {{Template:OWASP Testing Guide}} | + | [[http://www.owasp.org/index.php/Web_Application_Penetration_Testing_AoC Up]]<br> |
| + | {{Template:OWASP Testing Guide v2}} | ||
Care must be taken not to store too much data in a user session object. Storing too much information, such as large quantities of data retrieved from the database, in the session can also cause denial of service issues. This problem is exacerbated if session data is also tracked prior to a login. | Care must be taken not to store too much data in a user session object. Storing too much information, such as large quantities of data retrieved from the database, in the session can also cause denial of service issues. This problem is exacerbated if session data is also tracked prior to a login. | ||
| Line 24: | Line 25: | ||
* Control of access to seasonal facilities: Impossibility of invoke and access application facilities outside the established periods. For example with a Human Resource application, the evaluation process facility only works from January to May and the rest of the year it must be not active. [ ] | * Control of access to seasonal facilities: Impossibility of invoke and access application facilities outside the established periods. For example with a Human Resource application, the evaluation process facility only works from January to May and the rest of the year it must be not active. [ ] | ||
| − | + | {{Category:OWASP Testing Project AoC}} | |
[[category:Denial of Service Attack]] | [[category:Denial of Service Attack]] | ||
Revision as of 21:37, 12 November 2006
[Up]
OWASP Testing Guide v2 Table of Contents
Care must be taken not to store too much data in a user session object. Storing too much information, such as large quantities of data retrieved from the database, in the session can also cause denial of service issues. This problem is exacerbated if session data is also tracked prior to a login.
Testing Black Box
This is again a difficult case to test in a pure black box setting. Likely places will be where a large number of records are retrieved from a database based on data provided by the user during their normal application use. Good candidates may also include functionality related to viewing pages of a larger record set a portion at a time. The developer may have chosen to cache the records in the session instead of returning to the database for the next block of data. If this is suspected, create a script to automate the creation of many new sessions with the server and run the request that is suspected of caching the data within the session for each one. Let the script run for a while, and then observe the responsiveness of the application for new sessions. It may be possible that a Virtual Machine (VM) or even the server itself will begin to run out of memory because of this attack.
Testing White Box
Look within the code to observe what data is being stored within a user session object. Any locations where large amounts of data either submitted directly by the user or returned from the database are placed into the session should be marked as a potential problem.
Other References
De Vries, S. (2004, April 1). Application denial of service (DoS) attacks. Retrieved August 11, 2005, from http://www.corsaire.com/white-papers/040405-application-level-dos-attacks.pdf
- Looking for fields that take a number as input that may control a number of objects or rows to create on the server, so that sending one large number may DoS app.
- Misuse of CPU-intensive operations? (Imagine a SQL query that draws from million of records and any user can execute it as whim, it might be legitimate, there's no flooding, but the web server cannot cope with say, 5 parallel requests)
Access Control
- Authorization process [ ]
- Parameter analysis [ ]
- Bypassing logon process [ ]
- Control of access to seasonal facilities: Impossibility of invoke and access application facilities outside the established periods. For example with a Human Resource application, the evaluation process facility only works from January to May and the rest of the year it must be not active. [ ]
OWASP Testing Guide v2
Here is the OWASP Testing Guide v2 Table of Contents
