Security Testing

About the Tutorial

Security Testing is performed to reveal security flaws in the system in order to protect data
and maintain functionality.

This tutorial explains the core concepts of Security Testing and related topics with simple
and useful examples.

Audience
This tutorial has been prepared for beginners to help them understand the basics of security
testing.

Prerequisites
Before proceeding with this tutorial, you should have a basic understanding of software
testing and its related concepts.

Copyright & Disclaimer

 Copyright 2017 by Tutorials Point (I) Pvt. Ltd.

All the content and graphics published in this e-book are the property of Tutorials Point (I)
Pvt. Ltd. The user of this e-book is prohibited to reuse, retain, copy, distribute or republish
any contents or a part of contents of this e-book in any manner without written consent of
the publisher.

We strive to update the contents of our website and tutorials as timely and as precisely as
possible, however, the contents may contain inaccuracies or errors. Tutorials Point (I) Pvt.
Ltd. provides no guarantee regarding the accuracy, timeliness or completeness of our
website or its contents including this tutorial. If you discover any errors on our website or
in this tutorial, please notify us at contact@[Link]

i
 Security Testing

Table of Contents
About the Tutorial ....................................................................................................................................... i

Audience ..................................................................................................................................................... i

Prerequisites ............................................................................................................................................... i

Copyright & Disclaimer ................................................................................................................................ i

Table of Contents ....................................................................................................................................... ii

1. SECURITY TESTING ─ OVERVIEW.............................................................................................1

What is Security Testing? ........................................................................................................................... 1

Example ..................................................................................................................................................... 1

2. SECURITY TESTING ─ PROCESS................................................................................................2

Penetration Test – Workflow ..................................................................................................................... 2

Footprinting ............................................................................................................................................... 3

Footprinting – Steps ................................................................................................................................... 3

Scanning ..................................................................................................................................................... 4

Enumeration .............................................................................................................................................. 5

Exploitation ................................................................................................................................................ 6

3. SECURITY TESTING ─ MALICIOUS SOFTWARE .........................................................................8

Malwares ................................................................................................................................................... 8

Preventive Measures.................................................................................................................................. 8

Anti-Malware Software .............................................................................................................................. 9

4. SECURITY TESTING ─ HTTP PROTOCOL BASICS......................................................................10

HTTP Protocol .......................................................................................................................................... 10

Basic Features .......................................................................................................................................... 10

Architecture ............................................................................................................................................. 11

HTTP Parameters...................................................................................................................................... 11

ii
 Security Testing

HTTP Messages ........................................................................................................................................ 14

HTTP Requests ......................................................................................................................................... 16

HTTP Responses ....................................................................................................................................... 20

HTTP Methods.......................................................................................................................................... 23

HTTP Status Codes.................................................................................................................................... 30

HTTP Header Fields .................................................................................................................................. 33

Client Request Headers ............................................................................................................................ 37

Server Response Headers ......................................................................................................................... 44

Entity Headers .......................................................................................................................................... 47

HTTP Security ........................................................................................................................................... 50

5. SECURITY TESTING ─ HTTPS PROTOCOL BASICS ....................................................................53

When is HTTPS Required? ........................................................................................................................ 53

Basic Working of HTTPS............................................................................................................................ 53

6. SECURITY TESTING ─ ENCODING AND DECODING ................................................................55

What is Encoding and Decoding? ............................................................................................................. 55

7. SECURITY TESTING ─ CRYPTOGRAPHY ..................................................................................61

What is Cryptography? ............................................................................................................................. 61

How Encryption Works? ........................................................................................................................... 61

Cryptography Techniques......................................................................................................................... 61

8. SECURITY TESTING ─ SAME ORIGIN POLICY ..........................................................................63

What is Same Origin Policy? ..................................................................................................................... 63

Example ................................................................................................................................................... 63

Same Origin policy Exceptions for IE ........................................................................................................ 63

iii
 Security Testing

9. SECURITY TESTING ─ TESTING COOKIES................................................................................64

What is a Cookie? ..................................................................................................................................... 64

Properties of Cookies ............................................................................................................................... 64

Cookie Contents ....................................................................................................................................... 64

Types of Cookies ...................................................................................................................................... 64

Testing Cookies ........................................................................................................................................ 65

Viewing and Editing Cookies .................................................................................................................... 65

10. SECURITY TESTING ─ HACKING WEB APPLICATIONS .............................................................67

Web Application - PenTesting Methodologies .......................................................................................... 67

OWASP Top 10 ......................................................................................................................................... 67

Application - Hands On............................................................................................................................. 68

Web Proxy................................................................................................................................................ 69

Configuring Burp Suite ............................................................................................................................. 70

11. SECURITY TESTING ─ TESTING INJECTION .............................................................................73

Web Application - Injection ...................................................................................................................... 73

Examples .................................................................................................................................................. 74

Preventing SQL Injection .......................................................................................................................... 76

12. SECURITY TESTING ─ TESTING BROKEN AUTHENTICATION ...................................................77

Preventing Mechanisms ........................................................................................................................... 80

13. SECURITY TESTING ─ TESING CROSS-SITE SCRIPTING ............................................................81

Types of XSS ............................................................................................................................................. 81

Example ................................................................................................................................................... 82

Preventive Mechanisms ........................................................................................................................... 85

iv
 Security Testing

14. SECURITY TESTING ─ INSECURE DIRECT OBJECT REFERENCES ..............................................86

Example ................................................................................................................................................... 86

Preventive Mechanisms ........................................................................................................................... 89

15. SECURITY TESTING ─ SECURITY MISCONFIGURATION ...........................................................90

Example ................................................................................................................................................... 90

Preventive Mechanisms ........................................................................................................................... 92

16. SECURITY TESTING ─ TESTING SENSITIVE DATA EXPOSURE ..................................................93

Example ................................................................................................................................................... 93

Preventive Mechanisms ........................................................................................................................... 94

17. SECURITY TESTING ─ MISSING FUNCTION LEVEL ACCESS CONTROL .....................................95

Example ................................................................................................................................................... 95

Preventive Mechanisms ........................................................................................................................... 97

18. SECURITY TESTING ─ CROSS-SITE REQUEST FORGERY (CSRF)................................................98

Example ................................................................................................................................................... 98

Preventive Mechanisms ......................................................................................................................... 100

19. SECURITY TESTING ─ COMPONENTS WITH VULNERABILITIES .............................................101

Example ................................................................................................................................................. 101

Preventive Mechanisms ......................................................................................................................... 102

20. SECURITY TESTING ─ UNVALIDATED REDIRECTS AND FORWARDS ......................................103

Example ................................................................................................................................................. 103

Preventive Mechanisms ......................................................................................................................... 104

21. SECURITY TESTING ─ AJAX SECURITY ..................................................................................105

Example ................................................................................................................................................. 105

Preventive Mechanisms ......................................................................................................................... 109

v
 Security Testing

22. SECURITY TESTING ─ WEB SERVICE SECURITY.....................................................................110

Preventive Mechanisms ......................................................................................................................... 112

23. SECURITY TESTING ─ TESTING BUFFER OVERFLOWS ..........................................................113

Example ................................................................................................................................................. 113

Preventive Mechanisms ......................................................................................................................... 117

24. SECURITY TESTING ─ TESTING DENIAL OF SERVICE .............................................................118

Symptoms of DoS ................................................................................................................................... 118

Preventive Mechanisms ......................................................................................................................... 119

25. SECURITY TESTING ─ MALICIOUS FILE EXECUTION .............................................................120

Example ................................................................................................................................................. 120

Preventive Mechanisms ......................................................................................................................... 122

26. SECURITY TESTING – AUTOMATION TOOLS ........................................................................123

Open Source Tools ................................................................................................................................. 123

Specific Tool Sets .................................................................................................................................... 124

Commercial Black Box Testing tools ....................................................................................................... 125

Free Source Code Analyzers ................................................................................................................... 125

Commercial Source Code Analyzers ....................................................................................................... 127

vi
 Security Testing
1. Security Testing ─ Overview

Security testing is very important to keep the system protected from malicious activities on
the web.

What is Security Testing?

Security testing is a testing technique to determine if an information system protects data
and maintains functionality as intended. Security testing does not guarantee complete
security of the system, but it is important to include security testing as a part of the testing
process.

Security testing takes the following six measures to provide a secured environment:

 Confidentiality - It protects against disclosure of information to unintended

recipients.

 Integrity - It allows transferring accurate and correct desired information from

senders to intended receivers.

 Authentication - It verifies and confirms the identity of the user.

 Authorization - It specifies access rights to the users and resources.

 Availability - It ensures readiness of the information on requirement.

 Non-repudiation - It ensures there is no denial from the sender or the receiver for
having sent or received the message.

Example
Spotting a security flaw in a web-based application involves complex steps and creative
thinking. At times, a simple test can expose the most severe security risk. You can try this
very basic test on any web application:

1. Log into the web application using valid credentials.

2. Log out of the web application.

3. Click the BACK button of the browser.

4. Verify if you are asked to log in again or if you are able go back to the logged in page
again.

1
 Security Testing
2. Security Testing ─ Process

Security testing can be seen as a controlled attack on the system, which uncovers security
flaws in a realistic way. Its goal is to evaluate the current status of an IT system. It is also
known as penetration test or more popularly as ethical hacking.

Penetration test is done in phases and here in this chapter, we will discuss the complete
process. Proper documentation should be done in each phase so that all the steps necessary
to reproduce the attack are available readily. The documentation also serves as the basis
for the detailed report customers receive at the end of a penetration test.

Penetration Test – Workflow

Penetration test includes four major phases:

 Foot Printing
 Scanning
 Enumeration
 Exploitation

These four steps are re-iterated multiple times which goes hand in hand with the normal
SDLC.

2
 Security Testing

Footprinting
Footprinting is the process of gathering the blueprint of a particular system or a network
and the devices that are attached to the network under consideration. It is the first step
that a penetration tester uses to evaluate the security of a web application.

After footprinting, a penetration tester can understand the pulse of a hacker. It is good to
understand the complete system before testing its modules.

Footprinting – Steps
 Information gathering
 Determining the range of the network
 Identifying active machines
 Identifying open ports and access points
 OS fingerprinting
 Fingerprinting services
 Mapping the network

Tools Used in Footprinting

Following are the common set of tools used in footprinting:

 Whois
 SmartWhois
 NsLookup
 Sam Spade

Other Techniques Used in Footprinting

Footprinting may also involve collecting information such as:

 Company contact names, email addresses, and phone numbers

 Company deals and other parties involved
 News on mergers and acquisitions
 Links to other company-related sites
 Company's privacy policies

3
 Security Testing

Flow Diagram

Scanning
Scanning is the second step that is performed after footprinting. It involves scanning open
ports, fingerprinting the operating system, and uncovering services on ports. The ultimate
goal of scanning is to find open ports through external or internal network scanning, pinging
machines, determining network ranges, and port scanning individual systems.

Tools Used in Scanning

Following are the common set of tools/resources used in Scanning:

 NMap
 Ping
 Traceroute
 Superscan
 Netcat
 NeoTrace

4
 Security Testing

Flow Diagram

Enumeration
Enumeration is the next step after scanning. The goal of enumeration is to get a complete
picture of the target. In this phase, a penetration tester tries to identify valid user accounts
or poorly-protected shared resources using active connections to systems.

Techniques Used in Enumeration

Following are the common set of procedures used in Enumeration:

 Identifying vulnerable user accounts

 Obtaining Active Directory information
 Using snmputil for Simple Network Management Protocol enumeration
 Employing Windows DNS queries
 Establishing null sessions and connections

5
 Security Testing

Flow Diagram

Exploitation
Exploitation is the last phase where a security tester actively exploits the security
weaknesses present in the system under consideration. Once the attack is successful, it is
possible to penetrate more systems in the domain, because the penetration testers then
have the access to more potential targets that were not available before.

Techniques Used in Exploitation

The types of exploitation are segregated into three different categories:

1. Attack against WEB-SERVERS

o SQL Injection
o Cross-site Scripting
o Code Injection
o Session Hijacking
o Directory Traversal

2. Attack against NETWORKS

o Man in the Middle Attack

o Spoofing
o Firewall Traversal

6
 Security Testing

o WLAN
o ARP Poisoning

3. Attack against SERVICES

o Buffer Overflows
o Format Strings
o Dos
o Authentication flaws

Flow Diagram

7
 Security Testing
3. Security Testing ─ Malicious Software

Malicious software (malware) is any software that gives partial to full control of the system
to the attacker/malware creator.

Malwares
Various forms of malware are listed below:

 Virus – A virus is a program that creates copies of itself and inserts these copies
into other computer programs, data files, or into the boot sector of the hard-disk.
Upon successful replication, viruses cause harmful activity on infected hosts such as
stealing hard-disk space or CPU time.

 Worm - A worm is a type of malware which leaves a copy of itself in the memory of
each computer in its path.

 Trojan - Trojan is a non-self-replicating type of malware that contains malicious

code, which upon execution results in loss or theft of data or possible system harm.

 Adware – Adware, also known as freeware or pitchware, is a free computer software

that contains commercial advertisements of games, desktop toolbars, and utilities.
It is a web-based application and it collects web browser data to target
advertisements, especially pop-ups.

 Spyware - Spyware is infiltration software that anonymously monitors users which

enables a hacker to obtain sensitive information from the user's computer. Spyware
exploits users and application vulnerabilities that is quite often attached to free online
software downloads or to links that are clicked by users.

 Rootkit - A rootkit is a software used by a hacker to gain admin level access to a

computer/network which is installed through a stolen password or by exploiting a
system vulnerability without the victim's knowledge.

Preventive Measures
The following measures can be taken to avoid presence of malware in a system:

 Ensure the operating system and applications are up to date with patches/updates.

 Never open strange e-mails, especially ones with attachments.

 When you download from the internet, always check what you install. Do not simply
click OK to dismiss pop-up windows. Verify the publisher before you install
application.

 Install anti-virus software.

8
 Security Testing

 Ensure you scan and update the antivirus programs regularly.

 Install firewall.

 Always enable and use security features provided by browsers and applications.

Anti-Malware Software
The following software help remove the malwares from a system:

 Microsoft Security Essentials

 Microsoft Windows Defender
 AVG Internet Security
 Spybot - Search & Destroy
 Avast! Home Edition for personal use
 Panda Internet Security
 MacScan for Mac OS and Mac OS X

9
 Security Testing
4. Security Testing ─ HTTP Protocol Basics

Understanding the protocol is very important to get a good grasp on security testing. You
will be able to appreciate the importance of the protocol when we intercept the packet data
between the webserver and the client.

HTTP Protocol
The Hypertext Transfer Protocol (HTTP) is an application-level protocol for distributed,
collaborative, hypermedia information systems. This is the foundation for data
communication for the World Wide Web since 1990. HTTP is a generic and stateless protocol
which can be used for other purposes as well using extension of its request methods, error
codes, and headers.

Basically, HTTP is a TCP/IP based communication protocol, which is used to deliver data
such as HTML files, image files, query results etc. over the web. It provides a standardized
way for computers to communicate with each other. HTTP specification specifies how clients’
requested data are sent to the server, and how servers respond to these requests.

Basic Features
There are following three basic features which make HTTP a simple yet powerful protocol:

 HTTP is connectionless: The HTTP client, i.e., the browser initiates an HTTP
request. After making a request, the client disconnects from the server and waits for
a response. The server processes the request and re-establishes the connection with
the client to send the response back.

 HTTP is media independent: Any type of data can be sent by HTTP as long as both
the client and server know how to handle the data content. This is required for client
as well as server to specify the content type using appropriate MIME-type.

 HTTP is stateless: HTTP is a connectionless and this is a direct result that HTTP is
a stateless protocol. The server and client are aware of each other only during a
current request. Afterwards, both of them forget about each other. Due to this nature
of the protocol, neither the client nor the browser can retain information between
different requests across the web pages.

HTTP/1.0 uses a new connection for each request/response exchange whereas HTTP/1.1
connection may be used for one or more request/response exchanges.

10
 Security Testing

Architecture
The following diagram shows a very basic architecture of a web application and depicts
where HTTP resides:

The HTTP protocol is a request/response protocol based on the client/server architecture

where web browser, robots, and search engines etc. act as HTTP clients and the web server
acts as a server.

 Client - The HTTP client sends a request to the server in the form of a request
method, URI, and protocol version, followed by a MIME-like message containing
request modifiers, client information, and possible body content over a TCP/IP
connection.

 Server - The HTTP server responds with a status line, including the protocol version
of the message and a success or error code, followed by a MIME-like message
containing server information, entity meta information, and possible entity-body
content.

HTTP – Disadvantages
 HTTP is not a completely secured protocol.

 HTTP uses port 80 as default port for communication.

 HTTP operates at the application Layer. It needs to create multiple connections for
data transfer, which increases administration overheads.

 No encryption/digital certificates are required for using HTTP.

HTTP Parameters
We will discuss here a few important HTTP Protocol Parameters and their syntax that are
required in constructing the request and response messages while writing HTTP client or
server programs. We will cover the complete usage of these parameters in subsequent
chapters while explaining the message structure for HTTP requests and responses.

11
 Security Testing

HTTP Version
HTTP uses a <major>.<minor> numbering scheme to indicate versions of the protocol.
The version of an HTTP message is indicated by an HTTP-Version field in the first line. Here
is the general syntax of specifying HTTP version number:

HTTP-Version = "HTTP" "/" 1*DIGIT "." 1*DIGIT

Example

HTTP/1.0

or

HTTP/1.1

Uniform Resource Identifiers (URI)

URI is simply formatted, case-insensitive string containing name, location etc. to identify a
resource. For example, a website name, a web service etc. A general syntax of URI used for
HTTP is as follows:

URI = "http:" "//" host [ ":" port ] [ abs_path [ "?" query ]]

Here, if the port is empty or not given, port 80 is assumed for HTTP and an
empty abs_path is equivalent to an abs_path of "/". The characters other than those in
the reserved and unsafe sets are equivalent to their ""%" HEX HEX" encoding.

Example
Following two URIs are equivalent:

[Link]
[Link]
[Link]

Date/Time Formats
All HTTP date/time stamps must be represented in Greenwich Mean Time (GMT), without
exception. HTTP applications are allowed to use any of the following three representations
of date/time stamps:

Sun, 06 Nov 1994 08:49:37 GMT ; RFC 822, updated by RFC 1123
Sunday, 06-Nov-94 08:49:37 GMT ; RFC 850, obsoleted by RFC 1036
Sun Nov 6 08:49:37 1994 ; ANSI C's asctime() format

12
 Security Testing

Character Sets
You use character set to specify the character sets that the client prefers. Multiple character
sets can be listed separated by commas. If a value is not specified, the default is US-ASCII.

Example
The following character sets are valid:

US-ASCII

or

ISO-8859-1

or

ISO-8859-7

Content Encodings
Content encoding values indicate that an encoding algorithm is used to encode the content
before passing it over the network. Content encodings are primarily used to allow a
document to be compressed or otherwise usefully transformed without losing the identity.

All content-coding values are case-insensitive. HTTP/1.1 uses content-coding values in the
Accept-Encoding and Content-Encoding header fields.

Example
The following are valid encoding schemes:

Accept-encoding: gzip

or

Accept-encoding: compress

or

Accept-encoding: deflate

13
 Security Testing

Media Types
HTTP uses Internet Media Types in the Content-Type and Accept header fields in order to
provide open and extensible data typing and type negotiation. All the Media-type values are
registered with the Internet Assigned Number Authority ((IANA). The following general
syntax specifies media type:

media-type = type "/" subtype *( ";" parameter )

The type, subtype, and parameter attribute names are case- insensitive.

Example

Accept: image/gif

Language Tags
HTTP uses language tags within the Accept-Language and Content-Language fields. A
language tag is composed of 1 or more parts: A primary language tag and a possibly empty
series of subtags:

language-tag = primary-tag *( "-" subtag )

White space is not allowed within the tag and all tags are case-insensitive.

Example
Example tags include:

en, en-US, en-cockney, i-cherokee, x-pig-latin

Where any two-letter primary-tag is an ISO-639 language abbreviation and any two-letter
initial subtag is an ISO-3166 country code.

HTTP Messages
HTTP is based on client-server architecture model and a stateless request/response protocol
that operates by exchanging messages across a reliable TCP/IP connection.

An HTTP "client" is a program (Web browser or any other client) that establishes a
connection to a server for the purpose of sending one or more HTTP request messages. An
HTTP "server" is a program (generally a web server like Apache Web Server or Internet
Information Services IIS etc.) that accepts connections in order to serve HTTP requests by
sending HTTP response messages.

HTTP makes use of the Uniform Resource Identifier (URI) to identify a given resource and
to establish a connection. Once connection is established, HTTP messages are passed in a
format similar to that used by Internet mail [RFC5322] and the Multipurpose Internet Mail
Extensions (MIME) [RFC2045]. These messages are consisted of requests from client to
server and responses from server to client which will have following format:

14
 Security Testing

HTTP-message = <Request> | <Response> ; HTTP/1.1 messages

HTTP request and HTTP response use a generic message format of RFC 822 for transferring
the required data. This generic message format consists of following four items:

 A Start-line

 Zero or more header fields followed by CRLF

 An empty line (i.e., a line with nothing preceding the CRLF) indicating the end of the
header fields

 Optionally a message-body

Following section will explain each of the entities used in HTTP message.

Message Start-Line
A start-line will have the following generic syntax:

start-line = Request-Line | Status-Line

We will discuss Request-Line and Status-Line while discussing HTTP Request and HTTP
Response messages respectively. For now let's see the examples of start line in case of
request and response:

GET /[Link] HTTP/1.1 (This is Request-Line sent by the client)

HTTP/1.1 200 OK (This is Status-Line sent by the server)

Header Fields
HTTP header fields provide required information about the request or response, or about
the object sent in the message body. There are following four types of HTTP message
headers:

 General-header: These header fields have general applicability for both request
and response messages.

 Request-header: These header fields are applicability only for request messages.

 Response-header: These header fields are applicability only for response

messages.

 Entity-header: These header fields define metainformation about the entity-body

or, if nobody is present

All the above-mentioned headers follow the same generic format and each of the header
field consists of a name followed by a colon (:) and the field value as follows:

message-header = field-name ":" [ field-value ]

15
 Security Testing

Following are the examples of various header fields:

User-Agent: curl/7.16.3 libcurl/7.16.3 OpenSSL/0.9.7l zlib/1.2.3

Host: [Link]
Accept-Language: en, mi
Date: Mon, 27 Jul 2009 12:28:53 GMT
Server: Apache
Last-Modified: Wed, 22 Jul 2009 19:15:56 GMT
ETag: "34aa387-d-1568eb00"
Accept-Ranges: bytes
Content-Length: 51
Vary: Accept-Encoding
Content-Type: text/plain

Message Body
The message body part is optional for an HTTP message but if it is available then it is used
to carry the entity-body associated with the request or response. If the entity body is
associated, then usually Content-Type and Content-Length headers lines specify the nature
of the body associated.

A message body is the one which carries actual HTTP request data (including form data and
uploaded etc.) and HTTP response data from the server (including files, images, etc.).
Following is a simple content of a message body:

<html>
<body>
<h1>Hello, World!</h1>
</body>
</html>

HTTP Requests
An HTTP client sends an HTTP request to a server in the form of a request message which
includes following format:

 A Request line

 Zero or more header (General|Request|Entity) fields followed by CRLF

 An empty line (a line with nothing preceding the CRLF) indicating the end of the
header fields

 Optionally a message-body

16
 Security Testing

Following section explains each of the entities used in HTTP message.

Message Request-Line
The Request-Line begins with a method token, followed by the Request-URI, the protocol
version, and ending with CRLF. The elements are separated by space SP characters.

Request-Line = Method SP Request-URI SP HTTP-Version CRLF

Let us discuss each of the parts mentioned in Request-Line.

Request Method
The request Method indicates the method performed on the resource identified by the
given Request-URI. The method is case-sensitive and should always be mentioned in
uppercase. The following methods are supported in HTTP/1.1:

S. No. Method and Description

GET
It is used to retrieve information from the given server using a given URI.
1
Requests using GET should only retrieve data and should have no other effect
on the data.

HEAD
2
It is same as GET, but only transfers the status line and header section.

POST
3 It is used to send data to the server. For example, customer information, file
uploading, etc. using HTML forms.

PUT
4 It replaces all current representations of the target resource with the uploaded
content.

DELETE
5
It removes all current representations of the target resource given by URI.

CONNECT
6
It establishes a tunnel to the server identified by a given URI.

OPTIONS
7
It describes the communication options for the target resource.

TRACE
8
It performs a message loop-back test along the path to the target resource.

17
 Security Testing

Request-URI
The Request-URI is a Uniform Resource Identifier that identifies the resource upon which a
request has to be applied. Following are the most commonly used forms to specify a URI:

Request-URI = "*" | absoluteURI | abs_path | authority

S. No. Method and Description

The asterisk * is used when HTTP request does not apply to a particular
resource, but to the server itself. It is only allowed when the method does not
1 necessarily apply to a resource.
For example, OPTIONS * HTTP/1.1

The absoluteURI is used when HTTP request is being made to a proxy. The
proxy is requested to forward the request or service it from a valid cache, and
2 return the response.

For example, GET [Link] HTTP/1.1

The most common form of Request-URI is that used to identify a resource on

an origin server or gateway. For example, a client wishing to retrieve the
resource above directly from the origin server would create a TCP connection
to port 80 of the host "[Link]" and send the lines:

3
GET /pub/WWW/[Link] HTTP/1.1
Host: [Link]

Note: The absolute path cannot be empty. If none is present in the original
URI, it must be given as "/" (the server root)

Request Header Fields

The request-header fields allow the client to pass additional information about the request,
and about the client itself, to the server. These fields act as request modifiers and the
following important Request-header fields are available which can be used based on
requirement:

 Accept-Charset
 Accept-Encoding
 Accept-Language
 Authorization
 Expect
 From
 Host
 If-Match

18
 Security Testing

 If-Modified-Since
 If-None-Match
 If-Range
 If-Unmodified-Since
 Max-Forwards
 Proxy-Authorization
 Range
 Referer
 TE
 User-Agent

You can introduce your custom fields in case you are going to write your own custom Client
and Web Server.

Request Message Examples

Now let us put it all together to form an HTTP request to fetch [Link] page from the
web server running on [Link]:

GET /[Link] HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE5.01; Windows NT)
Host: [Link]
Accept-Language: en-us
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

Here we are not sending any request data to the server because we are fetching a plan
HTML page from the server. Connection is a general-header and rest all headers are request
headers. Following is another example where we send form data to the server using request
message body:

POST /cgi-bin/[Link] HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE5.01; Windows NT)
Host: [Link]
Content-Type: application/x-www-form-urlencoded
Content-Length: length
Accept-Language: en-us
Accept-Encoding: gzip, deflate
Connection: Keep-Alive
licenseID=string&content=string&/paramsXML=string

19
 Security Testing

Here, the given URL /cgi-bin/[Link] is used to process the passed data and accordingly
a response is retuned. The content-type tells the server that passed data is simple web
form data and length is actual length of the data put in the message body. The following
example shows how you can pass plan XML to your web server:

POST /cgi-bin/[Link] HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE5.01; Windows NT)
Host: [Link]
Content-Type: text/xml; charset=utf-8
Content-Length: length
Accept-Language: en-us
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

<?xml version="1.0" encoding="utf-8"?>

<string xmlns="[Link]

HTTP Responses
After receiving and interpreting a request message, a server responds with an HTTP
response message:

A Status-line

Zero or more header (General|Response|Entity) fields followed by CRLF

An empty line (i.e., a line with nothing preceding the CRLF) indicating the end
of the header fields

Optionally a message-body

The following section explains each of the entities used in an HTTP message:

Message Status-Line
The Status-Line consists of the protocol version followed by a numeric status code and its
associated textual phrase. The elements are separated by space SP characters.

Status-Line = HTTP-Version SP Status-Code SP Reason-Phrase CRLF

20
 Security Testing

Let us discuss each of the part mentioned in Status-Line.

HTTP Version
A server supporting HTTP version 1.1 returns the following version information:

HTTP-Version = HTTP/1.1

Status Code
The Status-Code element is a 3-digit integer where first digit of the Status-Code defines the
class of response and the last two digits do not have any categorization role. There are five
values for the first digit:

S. No. Value and Description

1xx: Informational
1
This means request received and continuing process.

2xx: Success
2
This means the action was successfully received, understood, and accepted.

3xx: Redirection
3
This means further action must be taken in order to complete the request.

4xx: Client Error

4
This means the request contains bad syntax or cannot be fulfilled

5xx: Server Error

5
The server failed to fulfill an apparently valid request

HTTP status codes are extensible and HTTP applications are not required to understand the
meaning of all the registered status codes.

Response Header Fields

The response-header fields allow the server to pass additional information about the
response which cannot be placed in the Status-Line. These header fields give information
about the server and about further access to the resource identified by the Request-URI.

 Accept-Ranges
 Age
 ETag
 Location
 Proxy-Authenticate
 Retry-After
 Server
 Vary
 WWW-Authenticate

21
 Security Testing

You can introduce your custom fields in case you wish to write your own custom Web Client
and Server.

Response Message Examples

Now let us put it all together to form an HTTP response for a request to fetch [Link] page
from the web server running on [Link]

HTTP/1.1 200 OK
Date: Mon, 27 Jul 2009 12:28:53 GMT
Server: Apache/2.2.14 (Win32)
Last-Modified: Wed, 22 Jul 2009 19:15:56 GMT
Content-Length: 88
Content-Type: text/html
Connection: Closed

<html>
<body>
<h1>Hello, World!</h1>
</body>
</html>

Following is an example of HTTP response message shows error condition when the web
server could not find a requested page:

HTTP/1.1 404 Not Found

Date: Sun, 18 Oct 2012 10:36:20 GMT
Server: Apache/2.2.14 (Win32)
Content-Length: 230
Connection: Closed
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">

<html>
<head>
<title>404 Not Found</title>
</head>
<body>
<h1>Not Found</h1>

22
 Security Testing

<p>The requested URL /[Link] was not found on this server.</p>

</body>
</html>

Following is an example of HTTP response message showing error condition when the web
server encountered a wrong HTTP version in a given HTTP request:

HTTP/1.1 400 Bad Request

Date: Sun, 18 Oct 2012 10:36:20 GMT
Server: Apache/2.2.14 (Win32)
Content-Length: 230
Content-Type: text/html; charset=iso-8859-1
Connection: Closed

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">

<html>
<head>
<title>400 Bad Request</title>
</head>
<body>
<h1>Bad Request</h1>
<p>Your browser sent a request that this server could not understand.<p>
<p>The request line contained invalid characters following the protocol
string.<p>
</body>
</html>

HTTP Methods
The set of common methods for HTTP/1.1 is defined below and this set can be expanded
based on requirement. These method names are case sensitive and they must be used in
uppercase.

S. No. Method and Description

GET
It is used to retrieve information from the given server using a given URI.
1
Requests using GET should only retrieve data and should have no other effect
on the data.

23
 Security Testing

HEAD
2
It is same as GET, but only transfers the status line and header section.

POST
3 It is used to send data to the server. For example, customer information, file
uploading etc. using HTML forms.

PUT
4 It replaces all current representations of the target resource with the uploaded
content.

DELETE
5
It removes all current representations of the target resource given by URI.

CONNECT
6
It establishes a tunnel to the server identified by a given URI.

OPTIONS
7
It describes the communication options for the target resource.

TRACE
8
It performs a message loop-back test along the path to the target resource.

GET Method
It retrieves data from a web server by specifying parameters in the URL portion of the
request. This is the main method used for document retrieval. The following example makes
use of GET method to fetch [Link]:

GET /[Link] HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE5.01; Windows NT)
Host: [Link]
Accept-Language: en-us
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

The following server response is issued against the above GET request:

HTTP/1.1 200 OK
Date: Mon, 27 Jul 2009 12:28:53 GMT
Server: Apache/2.2.14 (Win32)
Last-Modified: Wed, 22 Jul 2009 19:15:56 GMT
ETag: "34aa387-d-1568eb00"

24
 Security Testing

Vary: Authorization,Accept
Accept-Ranges: bytes
Content-Length: 88
Content-Type: text/html
Connection: Closed

<html>
<body>
<h1>Hello, World!</h1>
</body>
</html>

HEAD Method
It is functionally similar to GET, except that the server replies with a response line and
headers, but no entity-body. The following example makes use of HEAD method to fetch
header information about [Link]:

HEAD /[Link] HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE5.01; Windows NT)
Host: [Link]
Accept-Language: en-us
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

The following server response is issued against the above GET request:

HTTP/1.1 200 OK
Date: Mon, 27 Jul 2009 12:28:53 GMT
Server: Apache/2.2.14 (Win32)
Last-Modified: Wed, 22 Jul 2009 19:15:56 GMT
ETag: "34aa387-d-1568eb00"
Vary: Authorization,Accept
Accept-Ranges: bytes
Content-Length: 88
Content-Type: text/html
Connection: Closed

You can notice that the server does not send any data after header.

25
 Security Testing

POST Method
It is used when you want to send some data to the server. For example, file update, form
data etc. The following simple example makes use of POST method to send a form data to
the server which is processed by a [Link] and finally a response is returned:

POST /cgi-bin/[Link] HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE5.01; Windows NT)
Host: [Link]
Content-Type: text/xml; charset=utf-8
Content-Length: 88
Accept-Language: en-us
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

<?xml version="1.0" encoding="utf-8"?>

<string xmlns="[Link]

Server side script [Link] processes the passed data and sends the following response:

HTTP/1.1 200 OK
Date: Mon, 27 Jul 2009 12:28:53 GMT
Server: Apache/2.2.14 (Win32)
Last-Modified: Wed, 22 Jul 2009 19:15:56 GMT
ETag: "34aa387-d-1568eb00"
Vary: Authorization,Accept
Accept-Ranges: bytes
Content-Length: 88
Content-Type: text/html
Connection: Closed

<html>
<body>
<h1>Request Processed Successfully</h1>
</body>
</html>

PUT Method

26
 Security Testing

The PUT method is used to request the server to store the included entity-body at a location
specified by the given URL. The following example requests server to save the given entity-
boy in [Link] at the root of the server:

PUT /[Link] HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE5.01; Windows NT)
Host: [Link]
Accept-Language: en-us
Connection: Keep-Alive
Content-type: text/html
Content-Length: 182

<html>
<body>
<h1>Hello, World!</h1>
</body>
</html>

The server stores the given entity-body in [Link] file and sends the following response
back to the client:

HTTP/1.1 201 Created

Date: Mon, 27 Jul 2009 12:28:53 GMT
Server: Apache/2.2.14 (Win32)
Content-type: text/html
Content-length: 30
Connection: Closed

<html>
<body>
<h1>The file was created.</h1>
</body>
</html>

DELETE Method

27
 Security Testing

The DELETE method is used to request the server to delete file at a location specified by the
given URL. The following example requests server to delete the given file [Link] at the
root of the server:

DELETE /[Link] HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE5.01; Windows NT)
Host: [Link]
Accept-Language: en-us
Connection: Keep-Alive

The server deletes the mentioned file [Link] and sends the following response back to
the client:

HTTP/1.1 200 OK
Date: Mon, 27 Jul 2009 12:28:53 GMT
Server: Apache/2.2.14 (Win32)
Content-type: text/html
Content-length: 30
Connection: Closed

<html>
<body>
<h1>URL deleted.</h1>
</body>
</html>

CONNECT Method
It is used by the client to establish a network connection to a web server over HTTP. The
following example requests a connection with a web server running on host
[Link]:

CONNECT [Link] HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE5.01; Windows NT)

The connection is established with the server and the following response is sent back to the
client:

HTTP/1.1 200 Connection established

Date: Mon, 27 Jul 2009 12:28:53 GMT
Server: Apache/2.2.14 (Win32)

28
 Security Testing

OPTIONS Method
It is used by the client to find out what are the HTTP methods and other options supported
by a web server. The client can specify a URL for the OPTIONS method, or an asterisk (*)
to refer to the entire server. The following example requests a list of methods supported by
a web server running on [Link]:

OPTIONS * HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE5.01; Windows NT)

The server sends information based on the current configuration of the server, for example:

HTTP/1.1 200 OK
Date: Mon, 27 Jul 2009 12:28:53 GMT
Server: Apache/2.2.14 (Win32)
Allow: GET,HEAD,POST,OPTIONS,TRACE
Content-Type: httpd/unix-directory

TRACE Method
It is used to echo the contents of an HTTP Request back to the requester which can be used
for debugging purpose at the time of development. The following example shows the usage
of TRACE method:

TRACE / HTTP/1.1
Host: [Link]
User-Agent: Mozilla/4.0 (compatible; MSIE5.01; Windows NT)

The server will send the following message in response of the above request:

HTTP/1.1 200 OK
Date: Mon, 27 Jul 2009 12:28:53 GMT
Server: Apache/2.2.14 (Win32)
Connection: close
Content-Type: message/http
Content-Length: 39

TRACE / HTTP/1.1
Host: [Link]
User-Agent: Mozilla/4.0 (compatible; MSIE5.01; Windows NT)

29
 Security Testing

HTTP Status Codes

The Status-Code element in a server response, is a 3-digit integer where first digit of the
Status-Code defines the class of response and the last two digits do not have any
categorization role. There are five values for the first digit:

S. No. Code and Description

1xx: Informational
1
It means the request was received and it is in process.

2xx: Success
2
It means the action was successfully received, understood, and accepted.

3xx: Redirection
3
It implies further action must be taken in order to complete the request.

4xx: Client Error

4
It means the request contains incorrect syntax or cannot be fulfilled.

5xx: Server Error

5
It means the server failed to fulfill an apparently valid request.

HTTP status codes are extensible and HTTP applications are not required to understand the
meaning of all the registered status codes. The following list contains all the status codes:

1xx: Information
Message Description

100 Continue Only a part of the request is received by the server, but as long as it has
not been rejected, the client should continue with the request.

101 Switching The server switches protocol.

Protocols

2xx: Successful
Message Description

200 OK The request is OK.

201 Created The request is complete, and a new resource is created.

202 Accepted The request is accepted for processing, but the processing is not complete.

30
 Security Testing

203 Non- The information in the entity header is from a local or third-party copy,
authoritative not from the original server.
Information

204 No A status code and header are given in the response, but there is no entity-
Content body in the reply.

205 Reset The browser should clear the form used for this transaction for additional
Content input.

206 Partial The server is returning partial data of the size requested. It is used in
Content response to a request specifying aRange header. The server must specify
the range included in the response with the Content-Range header.

3xx: Redirection
Message Description

300 Multiple A link list. The user can select a link and go to that location. Maximum
Choices five addresses are available.

301 Moved
The requested page has moved to a new URL.
Permanently

302 Found The requested page has moved temporarily to a new URL.

303 See Other The requested page can be found under a different URL.

This is the response code to an If-Modified-Since or If-None-

304 Not
Match header, where the URL has not been modified since the specified
Modified
date.

The requested URL must be accessed through the proxy mentioned in

305 Use Proxy
the Location header.

This code was used in a previous version. It is no longer used, but the
306 Unused
code is reserved

307
Temporary The requested page has moved temporarily to a new URL.
Redirect

31
 Security Testing

4xx: Client Error

Message Description

400 Bad The server did not understand the request.

Request

401 The requested page needs a username and a password.

Unauthorized

402 Payment You cannot use this code yet.

Required

403 Forbidden Access is forbidden to the requested page.

404 Not Found The server cannot find the requested page.

405 Method The method specified in the request is not allowed.

Not Allowed

406 Not The server can only generate a response that is not accepted by the
Acceptable client.

407 Proxy You must authenticate with a proxy server before this request can be
Authentication served.
Required

408 Request The request took longer than the server was prepared to wait.
Timeout

409 Conflict The request could not be completed because of a conflict.

410 Gone The requested page is no longer available.

411 Length The "Content-Length" is not defined. The server will not accept the
Required request without it.

412 The precondition given in the request evaluated is false by the server.
Precondition
Failed

413 Request The server will not accept the request, because the request entity is too
Entity Too large.
Large

32
 Security Testing

414 Request- The server will not accept the request, because the URL is too long. It
url Too Long occurs when you convert a "post" request to a "get" request with a long
query information.

415 The server will not accept the request, because the media type is not
Unsupported supported.
Media Type

416 Requested The requested byte range is not available and is out of bounds.
Range Not
Satisfiable

417 The expectation given in an Expect request-header field could not be met
Expectation by this server.
Failed

5xx: Server Error

Message Description

500 Internal The request was not completed. The server met an unexpected
Server Error condition.

501 Not The request was not completed. The server did not support the
Implemented functionality required.

502 Bad The request was not completed. The server received an invalid response
Gateway from the upstream server.

503 Service The request was not completed. The server is temporarily overloading
Unavailable or down.

504 Gateway
The gateway has timed out.
Timeout

505 HTTP
Version Not The server does not support the "http protocol" version.
Supported

HTTP Header Fields

HTTP header fields provide required information about the request or response, or about
the object sent in the message body. There are four types of HTTP message headers:

 General-header: These header fields have general applicability for both request and
response messages.

 Client Request-header: These header fields are applicability only for request
messages.

33
 Security Testing

 Server Response-header: These header fields are applicability only for response
messages.

 Entity-header: These header fields define meta information about the entity-body
or, if body is not present.

General Headers
Let us now go through the general headers in detail.

Cache-control
The Cache-Control general-header field is used to specify directives that must be obeyed by
all caching system. The syntax is as follows:

Cache-Control : cache-request-directive|cache-response-directive

An HTTP clients or servers can use the Cache-control general header to specify parameters
for the cache or to request certain kinds of documents from the cache. The caching directives
are specified in a comma-separated list. For example:

Cache-control: no-cache

There are following important cache request directives which can be used by the client in
its HTTP request:

S. No. Cache Request Directive and Description

no-cache
1 A cache must not use the response to satisfy a subsequent request without
successful revalidation with the origin server.

no-store
2 The cache should not store anything about the client request or server
response.

max-age = seconds
3 Indicates that the client is willing to accept a response whose age is no
greater than the specified time in seconds.

max-stale [ = seconds ]
Indicates that the client is willing to accept a response that has exceeded its
4
expiration time. If seconds are given, it must not be expired by more than
that time.

min-fresh = seconds
5 Indicates that the client is willing to accept a response whose freshness
lifetime is no less than its current age plus the specified time in seconds.

no-transform
6
Do not convert the entity-body.

34
 Security Testing

only-if-cached
7 Do not retrieve new data. The cache can send a document only if it is in the
cache, and should not contact the origin-server to see if a newer copy exists.

There are following important cache response directives which can be used by the server in
its HTTP response:

S. No. Cache Request Directive and Description

public
1
Indicates that the response may be cached by any cache.

private
2 Indicates that all or part of the response message is intended for a single user
and must not be cached by a shared cache.

no-cache
3 A cache must not use the response to satisfy a subsequent request without
successful revalidation with the origin server.

no-store
4
The cache should not store anything about the client request or server response.

no-transform
5
Do not convert the entity-body.

must-revalidate
6 The cache must verify the status of stale documents before using it and expired
one should not be used.

proxy-revalidate
7 The proxy-revalidate directive has the same meaning as the must- revalidate
directive, except that it does not apply to non-shared user agent caches.

max-age = seconds
8 Indicates that the client is willing to accept a response whose age is no greater
than the specified time in seconds.

s-maxage = seconds
The maximum age specified by this directive overrides the maximum age
9
specified by either the max-age directive or the Expires header. The s-maxage
directive is always ignored by a private cache.

Connection
The Connection general-header field allows the sender to specify options that are desired
for that particular connection and must not be communicated by proxies over further
connections. Following is the simple syntax of using a connection header:

Connection : "Connection"

HTTP/1.1 defines the "close" connection option for the sender to signal that the connection
will be closed after completion of the response. For example:

35
 Security Testing

Connection: close

By default, HTTP 1.1 uses persistent connections, where the connection does not
automatically close after a transaction. HTTP 1.0, on the other hand, does not have
persistent connections by default. If a 1.0 client wishes to use persistent connections, it
uses the keep-alive parameter as follows:

Connection: keep-alive

Date
All HTTP date/time stamps MUST be represented in Greenwich Mean Time (GMT), without
exception. HTTP applications are allowed to use any of the following three representations
of date/time stamps:

Sun, 06 Nov 1994 08:49:37 GMT ; RFC 822, updated by RFC 1123
Sunday, 06-Nov-94 08:49:37 GMT ; RFC 850, obsoleted by RFC 1036
Sun Nov 6 08:49:37 1994 ; ANSI C's asctime() format

Here first format is the most preferred one.

Pragma
The Pragma general-header field is used to include implementation-specific directives that
might apply to any recipient along the request/response chain. For example:

Pragma: no-cache

The only directive defined in HTTP/1.0 is the no-cache directive and is maintained in HTTP
1.1 for backward compatibility. No new Pragma directives will be defined in the future.

Trailer
The Trailer general field value indicates that the given set of header fields is present in the
trailer of a message encoded with chunked transfer-coding. Following is the simple syntax
of using a Trailer header field:

Trailer : field-name

Message header fields listed in the Trailer header field must not include the following header
fields:

 Transfer-Encoding
 Content-Length
 Trailer

Transfer-Encoding
The Transfer-Encoding general-header field indicates what type of transformation has been
applied to the message body in order to safely transfer it between the sender and the

36
 Security Testing

recipient. This is not the same as content-encoding because transfer-encodings are a

property of the message, not of the entity-body. The following syntax shows using Transfer-
Encoding header field:

Transfer-Encoding: chunked

All transfer-coding values are case-insensitive.

Upgrade
The Upgrade general-header allows the client to specify what additional communication
protocols it supports and would like to use if the server finds it appropriate to switch
protocols. For example:

Upgrade: HTTP/2.0, SHTTP/1.3, IRC/6.9, RTA/x11

The Upgrade header field is intended to provide a simple mechanism for transition from
HTTP/1.1 to some other, incompatible protocol

Via
The Via general-header must be used by gateways and proxies to indicate the intermediate
protocols and recipients. For example, a request message could be sent from an HTTP/1.0
user agent to an internal proxy code-named "fred", which uses HTTP/1.1 to forward the
request to a public proxy at [Link], which completes the request by forwarding it to
the origin server at [Link]. The request received by [Link] would then
have the following Via header field:

Via: 1.0 fred, 1.1 [Link] (Apache/1.1)

The Upgrade header field is intended to provide a simple mechanism for transition from
HTTP/1.1 to some other, incompatible protocol

Warning
The Warning general-header is used to carry additional information about the status or
transformation of a message which might not be reflected in the message. A response may
carry more than one Warning header.

Warning : warn-code SP warn-agent SP warn-text SP warn-date

Client Request Headers

Accept
The Accept request-header field can be used to specify certain media types which are
acceptable for the response. Following is the general syntax:

Accept: type/subtype [q=qvalue]

37
 Security Testing

Multiple media types can be listed separated by commas and the optional qvalue represents
an acceptable quality level for accept types on a scale of 0 to 1. Following is an example:

Accept: text/plain; q=0.5, text/html, text/x-dvi; q=0.8, text/x-c

This would be interpreted as text/html and text/x-c are the preferred media types, but if
they do not exist, then send the text/x-dvi entity, and if that does not exist, send the
text/plain entity.

Accept-Charset
The Accept-Charset request-header field can be used to indicate what character sets are
acceptable for the response. Following is the general syntax:

Accept-Charset: character_set [q=qvalue]

Multiple character sets can be listed separated by commas and the optional qvalue
represents an acceptable quality level for nonpreferred character sets on a scale of 0 to 1.
Following is an example:

Accept-Charset: iso-8859-5, unicode-1-1; q=0.8

The special value "*", if present in the Accept-Charset field, matches every character set
and if no Accept-Charset header is present, the default is that any character set is
acceptable.

Accept-Encoding
The Accept-Encoding request-header field is similar to Accept, but restricts the content-
codings that are acceptable in the response. Following is the general syntax:

Accept-Encoding: encoding types

Following are examples:

Accept-Encoding: compress, gzip

Accept-Encoding:
Accept-Encoding: *
Accept-Encoding: compress;q=0.5, gzip;q=1.0
Accept-Encoding: gzip;q=1.0, identity; q=0.5, *;q=0

Accept-Language
The Accept-Language request-header field is similar to Accept, but restricts the set of
natural languages that are preferred as a response to the request. Following is the general
syntax:

38
 Security Testing

Accept-Language: language [q=qvalue]

Multiple languages can be listed separated by commas and the optional qvalue represents
an acceptable quality level for nonpreferred languages on a scale of 0 to 1. Following is an
example:

Accept-Language: da, en-gb;q=0.8, en;q=0.7

Authorization
The Authorization request-header field value consists of credentials containing the
authentication information of the user agent for the realm of the resource being requested.
Following is the general syntax:

Authorization : credentials

The HTTP/1.0 specification defines the BASIC authorization scheme, where the authorization
parameter is the string of username:password encoded in base 64. Following is an
example:

Authorization: BASIC Z3Vlc3Q6Z3Vlc3QxMjM=

The value decodes into is guest:guest123 where guest is user ID and guest123 is the
password.

Cookie
The Cookie request-header field value contains a name/value pair of information stored for
that URL. Following is the general syntax:

Cookie: name=value

Multiple cookies can be specified separated by semicolons as follows:

Cookie: name1=value1;name2=value2;name3=value3

Expect
The Expect request-header field is used to indicate that particular server behaviors are
required by the client. Following is the general syntax:

Expect : 100-continue | expectation-extension

If a server receives a request containing an Expect field that includes an expectation-

extension that it does not support, it must respond with a 417 (Expectation Failed) status.

From
The From request-header field contains an Internet e-mail address for the human user who
controls the requesting user agent. Following is a simple example:

39
 Security Testing

From: webmaster@[Link]

This header field may be used for logging purposes and as a means for identifying the source
of invalid or unwanted requests.

Host
The Host request-header field is used to specify the Internet host and port number of the
resource being requested. Following is the general syntax:

Host : "Host" ":" host [ ":" port ] ;

A host without any trailing port information implies the default port, which is 80. For
example, a request on the origin server for [Link] would be:

GET /pub/WWW/ HTTP/1.1

Host: [Link]

If-Match
The If-Match request-header field is used with a method to make it conditional. This header
request the server to perform the requested method only if given value in this tag matches
the given entity tags represented by ETag. Following is the general syntax:

If-Match : entity-tag

An asterisk (*) matches any entity, and the transaction continues only if the entity exists.
Following are possible examples:

If-Match: "xyzzy"
If-Match: "xyzzy", "r2d2xxxx", "c3piozzzz"
If-Match: *

If none of the entity tags match, or if "*" is given and no current entity exists, the server
must not perform the requested method, and must return a 412 (Precondition Failed)
response.

If-Modified-Since
The If-Modified-Since request-header field is used with a method to make it conditional. If
the requested URL has not been modified since the time specified in this field, an entity will
not be returned from the server; instead, a 304 (not modified) response will be returned
without any message-body. Following is the general syntax:

If-Modified-Since : HTTP-date

An example of the field is:

If-Modified-Since: Sat, 29 Oct 1994 19:43:31 GMT

40
 Security Testing

If none of the entity tags match, or if "*" is given and no current entity exists, the server
must not perform the requested method, and must return a 412 (Precondition Failed)
response.

If-None-Match
The If-None-Match request-header field is used with a method to make it conditional. This
header request the server to perform the requested method only if one of the given value
in this tag matches the given entity tags represented by ETag. Following is the general
syntax:

If-None-Match : entity-tag

An asterisk (*) matches any entity, and the transaction continues only if the entity does not
exist. Following are possible examples:

If-None-Match: "xyzzy"
If-None-Match: "xyzzy", "r2d2xxxx", "c3piozzzz"
If-None-Match: *

If-Range
The If-Range request-header field can be used with a conditional GET to request only the
portion of the entity that is missing, if it has not been changed, and the entire entity if it
has changed. Following is the general syntax:

If-Range : entity-tag | HTTP-date

Either an entity tag or a date can be used to identify the partial entity already received. For
example:

If-Range: Sat, 29 Oct 1994 19:43:31 GMT

Here if the document has not been modified since the given date, the server returns the
byte range given by the Range header otherwise, it returns all of the new document.

If-Unmodified-Since
The If-Unmodified-Since request-header field is used with a method to make it conditional.
Following is the general syntax:

If-Unmodified-Since : HTTP-date

If the requested resource has not been modified since the time specified in this field, the
server should perform the requested operation as if the If-Unmodified-Since header were
not present. For example:

If-Unmodified-Since: Sat, 29 Oct 1994 19:43:31 GMT

41
 Security Testing

If the request normally would result in anything other than a 2xx or 412 status, the If-
Unmodified-Since header should be ignored.

Max-Forwards
The Max-Forwards request-header field provides a mechanism with the TRACE and OPTIONS
methods to limit the number of proxies or gateways that can forward the request to the
next inbound server. Following is the general syntax:

Max-Forwards : n

The Max-Forwards value is a decimal integer indicating the remaining number of times this
request message may be forwarded. This is useful for debugging with the TRACE method,
avoiding infinite loops. For example:

Max-Forwards : 5

The Max-Forwards header field may be ignored for all other methods defined in HTTP
specification.

Proxy-Authorization
The Proxy-Authorization request-header field allows the client to identify itself (or its user)
to a proxy which requires authentication. Following is the general syntax:

Proxy-Authorization : credentials

The Proxy-Authorization field value consists of credentials containing the authentication

information of the user agent for the proxy and/or realm of the resource being requested.

Range
The Range request-header field specifies the partial range(s) of the content requested from
the document. Following is the general syntax:

Range: bytes-unit=first-byte-pos "-" [last-byte-pos]

The first-byte-pos value in a byte-range-spec gives the byte-offset of the first byte in a
range. The last-byte-pos value gives the byte-offset of the last byte in the range; that is,
the byte positions specified are inclusive. You can specify a byte-unit as bytes Byte offsets
start at zero. Following are a simple examples:

- The first 500 bytes

Range: bytes=0-499

- The second 500 bytes

Range: bytes=500-999

- The final 500 bytes

42
 Security Testing

Range: bytes=-500

- The first and last bytes only

Range: bytes=0-0,-1

Multiple ranges can be listed, separated by commas. If the first digit in the comma-
separated byte range(s) is missing, the range is assumed to count from the end of the
document. If the second digit is missing, the range is byte n to the end of the document.

Referer
The Referer request-header field allows the client to specify the address (URI) of the
resource from which the URL has been requested. Following is the general syntax:

Referer : absoluteURI | relativeURI

Following is a simple example:

Referer: [Link]

If the field value is a relative URI, it should be interpreted relative to the Request-URI.

TE
The TE request-header field indicates what extension transfer-coding it is willing to accept
in the response and whether or not it is willing to accept trailer fields in a chunked transfer-
coding. Following is the general syntax:

TE : t-codings

The presence of the keyword "trailers" indicates that the client is willing to accept trailer
fields in a chunked transfer-coding and it is specified either of the ways:

TE: deflate
TE:
TE: trailers, deflate;q=0.5

If the TE field-value is empty or if no TE field is present, the only transfer-coding is chunked.

A message with no transfer-coding is always acceptable.

User-Agent
The User-Agent request-header field contains information about the user agent originating
the request. Following is the general syntax:

User-Agent : product | comment

43
 Security Testing

Example:

User-Agent: Mozilla/4.0 (compatible; MSIE5.01; Windows NT)

Server Response Headers

They are a given:

Accept-Ranges
The Accept-Ranges response-header field allows the server to indicate its acceptance of
range requests for a resource. Following is the general syntax:

Accept-Ranges : range-unit | none

For example, a server that accept byte-range requests may send

Accept-Ranges: bytes

Servers that do not accept any kind of range request for a resource may send:

Accept-Ranges: none

This will advise the client not to attempt a range request.

Age
The Age response-header field conveys the sender's estimate of the amount of time since
the response (or its revalidation) was generated at the origin server. Following is the general
syntax:

Age : delta-seconds

Age values are non-negative decimal integers, representing time in seconds. Following is a
simple example:

Age: 1030

An HTTP/1.1 server that includes a cache must include an Age header field in every response
generated from its own cache.

ETag
The ETag response-header field provides the current value of the entity tag for the
requested variant. Following is the general syntax:

ETag : entity-tag

44
 Security Testing

Following are simple examples:

ETag: "xyzzy"
ETag: W/"xyzzy"
ETag: ""

Location
The Location response-header field is used to redirect the recipient to a location other than
the Request-URI for completion. Following is the general syntax:

Location : absoluteURI

Following is a simple example:

Location: [Link]

The Content-Location header field differs from Location in that the Content-Location
identifies the original location of the entity enclosed in the request.

Proxy-Authenticate
The Proxy-Authenticate response-header field must be included as part of a 407 (Proxy
Authentication Required) response. Following is the general syntax:

Proxy-Authenticate : challenge

Retry-After
The Retry-After response-header field can be used with a 503 (Service Unavailable)
response to indicate how long the service is expected to be unavailable to the requesting
client. Following is the general syntax:

Retry-After : HTTP-date | delta-seconds

Following are two simple examples:

Retry-After: Fri, 31 Dec 1999 23:59:59 GMT

Retry-After: 120

In the latter example, the delay is 2 minutes.

Server
The Server response-header field contains information about the software used by the origin
server to handle the request. Following is the general syntax:

Server : product | comment

Following is a simple example:

45
 Security Testing

Server: Apache/2.2.14 (Win32)

If the response is being forwarded through a proxy, the proxy application must not modify
the Server response-header.

Set-Cookie
The Set-Cookie response-header field contains a name/value pair of information to retain
for this URL. Following is the general syntax:

Set-Cookie: NAME=VALUE; OPTIONS

Set-Cookie response header comprises the token Set-Cookie:, followed by a comma-

separated list of one or more cookies. Here are possible values you can specify as options:

S. No. Options and Description

Comment=comment
1
This option can be used to specify any comment associated with the cookie.

Domain=domain
2
The Domain attribute specifies the domain for which the cookie is valid.

Expires=Date-time
3 The date the cookie will expire. If this is blank, the cookie will expire when the
visitor quits the browser

Path=path
4
The Path attribute specifies the subset of URLs to which this cookie applies.

Secure
5
This instructs the user agent to return the cookie only under a secure connection.

Following is an example of a simple cookie header generated by the server:

Set-Cookie: name1=value1,name2=value2; Expires=Wed, 09 Jun 2021 10:18:14 GMT

Vary
The Vary response-header field specifies that the entity has multiple sources and may
therefore vary according to specified list of request header(s). Following is the general
syntax:

Vary : field-name

You can specify multiple headers separated by commas and a value of asterisk "*" signals
that unspecified parameters not limited to the request-headers. Following is a simple
example:

46
 Security Testing

Vary: Accept-Language, Accept-Encoding

Here, the field names are case-insensitive.

WWW-Authenticate
The WWW-Authenticate response-header field must be included in 401 (Unauthorized)
response messages. The field value consists of at least one challenge that indicates the
authentication scheme(s) and parameters applicable to the Request-URI. Following is the
general syntax:

WWW-Authenticate : challenge

WWW- Authenticate field value as it might contain more than one challenge, or if more than
one WWW-Authenticate header field is provided, the contents of a challenge itself can
contain a comma-separated list of authentication parameters. Following is a simple
example:

WWW-Authenticate: BASIC realm="Admin"

Entity Headers

Allow
The Allow entity-header field lists the set of methods supported by the resource identified
by the Request-URI. Following is the general syntax:

Allow : Method

You can specify multiple method separated by commas. Following is a simple example:

Allow: GET, HEAD, PUT

This field cannot prevent a client from trying other methods.

Content-Encoding
The Content-Encoding entity-header field is used as a modifier to the media-type. Following
is the general syntax:

Content-Encoding : content-coding

The content-coding is a characteristic of the entity identified by the Request-URI. Following

is a simple example:

Content-Encoding: gzip

If the content-coding of an entity in a request message is not acceptable to the origin server,
the server should respond with a status code of 415 (Unsupported Media Type).

47
 Security Testing

Content-Language
The Content-Language entity-header field describes the natural language(s) of the intended
audience for the enclosed entity. Following is the general syntax:

Content-Language : language-tag

Multiple languages may be listed for content that is intended for multiple audiences.
Following is a simple example:

Content-Language: mi, en

The primary purpose of Content-Language is to allow a user to identify and differentiate

entities according to the user's own preferred language.

Content-Length
The Content-Length entity-header field indicates the size of the entity-body, in decimal
number of OCTETs, sent to the recipient or, in the case of the HEAD method, the size of the
entity-body that would have been sent had the request been a GET. Following is the general
syntax:

Content-Length : DIGITS

Following is a simple example:

Content-Length: 3495

Any Content-Length greater than or equal to zero is a valid value.

Content-Location
The Content-Location entity-header field may be used to supply the resource location for
the entity enclosed in the message when that entity is accessible from a location separate
from the requested resource's URI. Following is the general syntax:

Content-Location: absoluteURI | relativeURI

Following is a simple example:

Content-Location: [Link]

The value of Content-Location also defines the base URI for the entity.

Content-MD5
The Content-MD5 entity-header field may be used to supply an MD5 digest of the entity, for
checking the integrity of the message upon receipt. Following is the general syntax:

Content-MD5 : md5-digest using base64 of 128 bit MD5 digest as per RFC 1864

48
 Security Testing

Following is a simple example:

Content-MD5 : 8c2d46911f3f5a326455f0ed7a8ed3b3

The MD5 digest is computed based on the content of the entity-body, including any content-
coding that has been applied, but not including any transfer-encoding applied to the
message-body.

Content-Range
The Content-Range entity-header field is sent with a partial entity-body to specify where in
the full entity-body the partial body should be applied. Following is the general syntax:

Content-Range : bytes-unit SP first-byte-pos "-" last-byte-pos

Examples of byte-content-range-spec values, assuming that the entity contains a total of

1234 bytes:

- The first 500 bytes:

Content-Range : bytes 0-499/1234

- The second 500 bytes:

Content-Range : bytes 500-999/1234

- All except for the first 500 bytes:

Content-Range : bytes 500-1233/1234

- The last 500 bytes:

Content-Range : bytes 734-1233/1234

When an HTTP message includes the content of a single range, this content is transmitted
with a Content-Range header, and a Content-Length header showing the number of bytes
actually transferred. For example,

HTTP/1.1 206 Partial content

Date: Wed, 15 Nov 1995 06:25:24 GMT
Last-Modified: Wed, 15 Nov 1995 04:58:08 GMT
Content-Range: bytes 21010-47021/47022
Content-Length: 26012
Content-Type: image/gif

Content-Type

49
 Security Testing

The Content-Type entity-header field indicates the media type of the entity-body sent to the
recipient or, in the case of the HEAD method, the media type that would have been sent
had the request been a GET. Following is the general syntax:

Content-Type : media-type

Following is an example:

Content-Type: text/html; charset=ISO-8859-4

Expires
The Expires entity-header field gives the date/time after which the response is considered
stale. Following is the general syntax:

Expires : HTTP-date

Following is an example:

Expires: Thu, 01 Dec 1994 16:00:00 GMT

Last-Modified
The Last-Modified entity-header field indicates the date and time at which the origin server
believes the variant was last modified. Following is the general syntax:

Last-Modified: HTTP-date

Following is an example:

Last-Modified: Tue, 15 Nov 1994 12:45:26 GMT

HTTP Security
HTTP is used for a communication over the internet, so application developers, information
providers, and the users should be aware of the security limitations in HTTP/1.1. This
discussion does not include definitive solutions to the problems mentioned here but it does
make some suggestions for reducing security risks.

Leakage of Personal Information

HTTP clients are often privy to large amounts of personal information such as the user's
name, location, mail address, passwords, encryption keys etc. Hence as a user you need to
be very careful to prevent unintentional leakage of this information via the HTTP protocol to
other sources.

 All the confidential information should be stored at server side in encrypted form.

50
 Security Testing

 Revealing the specific software version of the server might allow the server machine
to become more vulnerable to attacks against software that is known to contain
security holes.

 Proxies which serve as a portal through a network firewall should take special
precautions regarding the transfer of header information that identifies the hosts
behind the firewall.

 The information sent in the Form field might conflict with the user's privacy interests
or their site's security policy. Hence it should not be transmitted without the user
being able to disable, enable, and modify the contents of the field.

 Clients should not include a Referer header field in a non-secure HTTP request if the
referring page was transferred with a secure protocol.

 Authors of services which use the HTTP protocol should not use GET based forms for
the submission of sensitive data, because this will cause this data to be encoded in
the Request-URI.

File and Path Names Based Attack

The document should be restricted to the documents returned by HTTP requests to be only
those that were intended by the server administrators.

For example, UNIX, Microsoft Windows, and other operating systems use .. as a path
component to indicate a directory level above the current one. On such a system, an HTTP
server MUST disallow any such construct in the Request-URI if it would otherwise allow
access to a resource outside those intended to be accessible via the HTTP server.

DNS Spoofing
Clients using HTTP rely heavily on the Domain Name Service, and are thus generally prone
to security attacks based on the deliberate mis-association of IP addresses and DNS names.
The clients need to be cautious in assuming the continuing validity of an IP number/DNS
name association.

If HTTP clients cache the results of host name lookups in order to achieve a performance
improvement, they must observe the TTL information reported by DNS. If HTTP clients do
not observe this rule, they could be spoofed when a previously-accessed server's IP address
changes.

Location Headers and Spoofing

If a single server supports multiple organizations that do not trust one another, then it MUST
check the values of Location and Content- Location headers in responses that are generated
under control of said organizations to make sure that they do not attempt to invalidate
resources over which they have no authority.

Authentication Credentials

51
 Security Testing

Existing HTTP clients and user agents typically retain authentication information indefinitely.
HTTP/1.1 does not provide a method for a server to direct clients to discard these cached
credentials, which is a big security risk.

It is recommended to make the use of password protection in screen savers, idle time-outs,
and other methods which mitigate the security problems inherent in this problem.

Proxies and Caching

HTTP proxies are men-in-the-middle, and represent an opportunity for man-in-the-middle
attacks. Proxies have access to security-related information, personal information about
individual users and organizations, and proprietary information belonging to users and
content providers.

Proxy operators should protect the systems on which proxies run as they would protect any
system that contains or transports sensitive information.

Caching proxies provide additional potential vulnerabilities, since the contents of the cache
represent an attractive target for malicious exploitation. Therefore, cache contents should
be protected as sensitive information.

52
 Security Testing
5. Security Testing ─ HTTPS Protocol Basics

HTTPS (Hypertext Transfer Protocol over Secure Socket Layer) or HTTP over SSL is a web
protocol developed by Netscape. It is not a protocol but it is just the result of layering the
HTTP on top of SSL/TLS (Secure Socket Layer/Transport Layer Security).

In short, HTTPS = HTTP + SSL

When is HTTPS Required?

When we browse, we normally send and receive information using HTTP protocol. So this
leads anyone to eavesdrop on the conversation between our computer and the web server.
Many a times we need to exchange sensitive information which needs to be secured and to
prevent unauthorized access.

Https protocol used in the following scenarios

 Banking Websites
 Payment Gateway
 Shopping Websites
 All Login Pages
 Email Apps

Basic Working of HTTPS

 Public key and signed certificates are required for the server in HTTPS Protocol.

 Client requests for the https:// page

 When using an https connection, the server responds to the initial connection by
offering a list of encryption methods the webserver supports.

 In response, the client selects a connection method, and the client and server
exchange certificates to authenticate their identities.

 After this is done, both webserver and client exchange the encrypted information
after ensuring that both are using the same key, and the connection is closed.

 For hosting https connections, a server must have a public key certificate, which
embeds key information with a verification of the key owner's identity.

 Almost all certificates are verified by a third party so that clients are assured that
the key is always secure.

53
Security Testing

54
 Security Testing
6. Security Testing ─ Encoding and Decoding

What is Encoding and Decoding?

Encoding is the process of putting a sequence of characters such as letters, numbers and
other special characters into a specialized format for efficient transmission.

Decoding is the process of converting an encoded format back into the original sequence of
characters. It is completely different from Encryption which we usually misinterpret.

Encoding and decoding are used in data communications and storage. Encoding should NOT
be used for transporting sensitive information.

URL Encoding
URLs can only be sent over the Internet using the ASCII character-set and there are
instances when URL contains special characters apart from ASCII characters, it needs to be
encoded. URLs do not contain spaces and are replaced with a plus (+) sign or with %20.

ASCII Encoding
The Browser (client side) will encode the input according to the character-set used in the
web-page and the default character-set in HTML5 is UTF-8.

Following table shows ASCII symbol of the character and its equal Symbol and finally its
replacement which can be used in URL before passing it to the server:

ASCII Symbol Replacement

Encode with %xx where xx is the hexadecimal representation of

< 32
the character.

32 space + or %20

33 ! %21

34 " %22

35 # %23

36 $ %24

37 % %25

38 & %26

55
 Security Testing

39 ' %27

40 ( %28

41 ) %29

42 * *

43 + %2B

44 , %2C

45 - -

46 . .

47 / %2F

48 0 0

49 1 1

50 2 2

51 3 3

52 4 4

53 5 5

54 6 6

55 7 7

56 8 8

57 9 9

58 : %3A

59 ; %3B

60 < %3C

56
 Security Testing

61 = %3D

62 > %3E

63 ? %3F

64 @ %40

65 A A

66 B B

67 C C

68 D D

69 E E

70 F F

71 G G

72 H H

73 I I

74 J J

75 K K

76 L L

77 M M

78 N N

79 O O

80 P P

81 Q Q

82 R R

57
 Security Testing

83 S S

84 T T

85 U U

86 V V

87 W W

88 X X

89 Y Y

90 Z Z

91 [ %5B

92 \ %5C

93 ] %5D

94 ^ %5E

95 _ _

96 ` %60

97 a a

98 b b

99 c c

100 d d

101 e e

102 f f

103 g g

104 h h

58
 Security Testing

105 i i

106 j j

107 k k

108 l l

109 m m

110 n n

111 o o

112 p p

113 q q

114 r r

115 s s

116 t t

117 u u

118 v v

119 w w

120 x x

121 y y

122 z z

123 { %7B

124 | %7C

125 } %7D

126 ~ %7E

59
 Security Testing

127 %7F

Encode with %xx where xx is the hexadecimal representation of

> 127
the character

60
 Security Testing
7. Security Testing ─ Cryptography

What is Cryptography?
Cryptography is the science to encrypt and decrypt data that enables the users to store
sensitive information or transmit it across insecure networks so that it can be read only by
the intended recipient.

Data which can be read and understood without any special measures is called plaintext,
while the method of disguising plaintext in order to hide its substance is called encryption.

Encrypted plaintext is known as cipher text and process of reverting the encrypted data
back to plain text is known as decryption.

 The science of analyzing and breaking secure communication is known as

cryptanalysis. The people who perform the same also known as attackers.

 Cryptography can be either strong or weak and the strength is measured by the time
and resources it would require to recover the actual plaintext.

 Hence an appropriate decoding tool is required to decipher the strong encrypted

messages.

 There are some cryptographic techniques available with which even a billion
computers doing a billion checks a second, it is not possible to decipher the text.

 As the computing power is increasing day by day, one has to make the encryption
algorithms very strong in order to protect data and critical information from the
attackers.

How Encryption Works?

A cryptographic algorithm works in combination with a key (can be a word, number, or
phrase) to encrypt the plaintext and the same plaintext encrypts to different cipher text
with different keys.

Hence, the encrypted data is completely dependent couple of parameters such as the
strength of the cryptographic algorithm and the secrecy of the key.

Cryptography Techniques
Symmetric Encryption – Conventional cryptography, also known as conventional
encryption, is the technique in which only one key is used for both encryption and
decryption. For example, DES, Triple DES algorithms, MARS by IBM, RC2, RC4, RC5, RC6.

Asymmetric Encryption – It is Public key cryptography that uses a pair of keys for
encryption: a public key to encrypt data and a private key for decryption. Public key is

61
 Security Testing

published to the people while keeping the private key secret. For example, RSA, Digital
Signature Algorithm (DSA), Elgamal.

Hashing – Hashing is ONE-WAY encryption, which creates a scrambled output that cannot
be reversed or at least cannot be reversed easily. For example, MD5 algorithm. It is used
to create Digital Certificates, Digital signatures, Storage of passwords, Verification of
communications, etc.

62
 Security Testing
8. Security Testing ─ Same Origin Policy

Same Origin Policy (SOP) is an important concept in the web application security model.

What is Same Origin Policy?

As per this policy, it permits scripts running on pages originating from the same site which
can be a combination of the following:

 Domain
 Protocol
 Port

Example
The reason behind this behavior is security. If you have [Link] in one window and
[Link] in another window, then you DO NOT want a script from [Link] to access or
modify the contents of [Link] or run actions in context of gmail on your behalf.

Below are webpages from the same origin. As explained before, the same origin takes
domain/protocol/port into consideration.

 [Link]
 [Link]
 [Link]

Below are webpages from a different origin.

 [Link] domain)
 [Link] (another domain)
 [Link] (another protocol)
 [Link] (another port)

Same Origin policy Exceptions for IE

Internet Explorer has two major exceptions to SOP.

 The first one is related to 'Trusted Zones'. If both domains are in highly trusted zone
then the Same Origin policy is not applicable completely.

 The second exception in IE is related to port. IE does not include port into Same
Origin policy, hence the [Link] and [Link] are
considered from the same origin and no restrictions are applied.

63
 Security Testing
9. Security Testing ─ Testing Cookies

What is a Cookie?
A cookie is a small piece of information sent by a web server to store on a web browser so
that it can later be read by the browser. This way, the browser remembers some specific
personal information. If a Hacker gets hold of the cookie information, it can lead to security
issues.

Properties of Cookies
Here are some important properties of cookies:

 They are usually small text files, given ID tags that are stored on your computer's
browser directory.

 They are used by web developers to help users navigate their websites efficiently
and perform certain functions.

 When the user browses the same website again, the data stored in the cookie is sent
back to the web server to notify the website of the user’s previous activities.

 Cookies are unavoidable for websites that have huge databases, need logins, have
customizable themes.

Cookie Contents
The cookie contains the following information:

 The name of the server the cookie was sent from.

 The lifetime of the cookie.
 A value - usually a randomly generated unique number.

Types of Cookies
 Session Cookies - These cookies are temporary which are erased when the user
closes the browser. Even if the user logs in again, a new cookie for that session is
created.

 Persistent cookies - These cookies remain on the hard disk drive unless user wipes
them off or they expire. The Cookie's expiry is dependent on how long they can last.

64
 Security Testing

Testing Cookies
Here are the ways to test the cookies:

 Disabling Cookies: As a tester, we need to verify the access of the website after
disabling cookies and to check if the pages are working properly. Navigating to all
the pages of the website and watch for app crashes. It is also required to inform the
user that cookies are required to use the site.

 Corrupting Cookies: Another testing to be performed is by corrupting the cookies.

In order to do the same, one has to find the location of the site's cookie and manually
edit it with fake / invalid data which can be used access internal information from
the domain which in turn can then be used to hack the site.

 Removing Cookies: Remove all the cookies for the website and check how the
website reacts to it.

 Cross-Browser Compatibility: It is also important to check that cookies are being

written properly on all supported browsers from any page that writes cookies.

 Editing Cookies: If the application uses cookies to store login information then as
a tester we should try changing the user in the cookie or address bar to another valid
user. Editing the cookie should not let you log in to a different users account.

Viewing and Editing Cookies

Modern browsers support viewing/editing of the cookies inform within the Browser itself.
There are plugins for mozilla/chrome using which we are able to perform the edit
successfully.

 Edit cookies plugin for Firefox

 Edit This cookie plugin for chrome

The steps should be performed to Edit a cookie:

 Download the plugin for Chrome.

 Edit the cookie value just by accessing the 'edit this cookie' plugin from chrome as
shown below.

65
Security Testing

66
 Security Testing
10. Security Testing ─ Hacking Web Applications

There are various methodologies/approaches which we can make use of as a reference for
performing an attack.

Web Application - PenTesting Methodologies

One can take into account the following standards while developing an attack model.

Among the following list, OWASP is the most active and there are a number of contributors.
We will focus on OWASP Techniques which each development team takes into consideration
before designing a web app.
PTES - Penetration Testing Execution Standard
OSSTMM - Open Source Security Testing Methodology Manual
OWASP Testing Techniques - Open Web Application Security Protocol

OWASP Top 10
The Open Web Application Security Protocol team released the top 10 vulnerabilities that
are more prevalent in web in the recent years. Below is the list of security flaws that are
more prevalent in a web based application.

67
 Security Testing

Application - Hands On
In order to understand each one of the techniques, let us work with a sample application.
We will perform the attack on 'WebGoat', the J2EE application which is developed explicitly
with security flaws for learning purposes.

The complete details about the webgoat project can be located at

[Link] Download the
WebGoat Application, Navigate to [Link]
(WebGoat-6.0) and go to downloads section.
To install the downloaded application, first ensure that you do not have any application
running on Port 8080. It can be installed just using a single command - java -jar WebGoat-
[Link]. For more details, visit WebGoat Installation

Post Installation, you should be able to access the application by navigating to

[Link] and the page would be displayed as shown below.

We can use the credentials of guest or admin as displayed in the login page.

68
 Security Testing

Web Proxy
In order to intercept the traffic between client (Browser) and Server (System where
Webgoat Application is hosted in our case), we need to use a web proxy. We will use Burp
Proxy that can be downloaded from [Link]

It is sufficient if you download the free version of burp suite as shown below.

69
 Security Testing

Configuring Burp Suite

Burp Suite is a web proxy which can intercept each packet of information sent and received
by the browser and webserver. This helps us to modify the contents before the client sends
the information to the Web-Server.

1. The App is installed on port 8080 and Burp is installed on port 8181 as shown below.
Launch Burp suite and make the following settings in order to bring it up in port 8181
as shown below.

2. We should ensure that the Burp is listening to Port#8080 where the application is
installed so that Burp suite can intercept the traffic. This settings should be done on the
scope tab of the Burp Suite as shown below.

70
 Security Testing

3. Then make your browser proxy settings to listen to the port 8181 (Burp Suite port).
Thus we have configured the Web proxy to intercept the traffic between the client
(browser) and the server (Webserver) as shown below:

71
 Security Testing

4. The snapshot of the configuration is shown below with a help of a simple workflow
diagram as shown below

72
 Security Testing
11. Security Testing ─ Testing Injection

Injection technique consists of injecting a SQL query or a command using the input fields
of the application.

Web Application - Injection

A successful SQL injection can read, modify sensitive data from the database, and can also
delete data from a database. It also enables the hacker to perform administrative operations
on the database such as shutdown the DBMS/dropping databases.

Let us understand Threat Agents, Attack Vectors, Security Weakness, Technical Impact and
Business Impacts of this flaw with the help of simple diagram.

73
 Security Testing

Examples
The application uses untrusted data in the construction of the following vulnerable SQL call:

String query = "SELECT * FROM EMP WHERE EMPID='" + [Link]("id") +

"'";

Hands On
1. Navigate to the SQL Injection area of the application as shown below.

2. As given in the exercise, we use String SQL Injection to bypass authentication. Use SQL
injection to log in as the boss ('Neville') without using the correct password. Verify that
Neville's profile can be viewed and that all functions are available (including Search, Create,
and Delete).

3. We will Inject a SQL such that we are able to bypass the password by sending the
parameter as 'a'='a' or 1=1

74
 Security Testing

4. Post Exploitation, we are able to login as Neville who is the Admin as shown below.

75
 Security Testing

Preventing SQL Injection

There are plenty of ways to prevent SQL injection. When developers write the code, they
should ensure that they handle special characters accordingly. There are cheat
sheets/prevention techniques available from OWASP which is definitely a guide for
developers.

 Using Parameterized Queries

 Escaping all User Supplied Input
 Enable Least Privilege for the database for the end users

76
 Security Testing
12. Security Testing ─ Testing Broken Authentication

When authentication functions related to the application are not implemented correctly, it
allows hackers to compromise passwords or session ID's or to exploit other implementation
flaws using other users credentials.

Let us understand Threat Agents, Attack Vectors, Security Weakness, Technical Impact and
Business Impacts of this flaw with the help of simple diagram.

Example

An e-commerce application supports URL rewriting, putting session IDs in the

URL:

[Link]

An authenticated user of the site forwards the URL to their friends to know about the
discounted sales. He e-mails the above link without knowing that the user is also giving
away the session IDs. When his friends use the link, they use his session and credit card.

77
 Security Testing

Hands ON
1. Login to Webgoat and navigate to 'Session Management Flaws' Section. Let us bypass
the authetication by spoofing the cookie. Below is the snapshot of the scenario.

2. When we login using the credentials webgoat/webgoat, we find from Burp Suite that the
JSESSION ID is C8F3177CCAFF380441ABF71090748F2E while the
AuthCookie=65432ubphcfx upon successful authentication.

78
 Security Testing

3. When we login using the credentials aspect/aspect, we find from Burp Suite that the
JSESSION ID is C8F3177CCAFF380441ABF71090748F2E while the
AuthCookie=65432udfqtb upon successful authentication.

4. Now we need to analyze the AuthCookie Patterns. The first half '65432' is common for
both authentications. Hence we are now interested in analyzing the last part of the
authcookie values such as - ubphcfx for webgoat user and udfqtb for aspect user
respectively.

5. If we take a deep look at the AuthCookie values, the last part is having the same length
as that of user name. Hence it is evident that the username is used with some encryption
method. Upon trial and errors/brute force mechanisms, we find that after reversing the

79
 Security Testing

user name, webgoat; we end up with taogbew and then the before alphabet character
is what being used as AuthCookie. i.e ubphcfx.

6. If we pass this cookie value and let us see what happens. Upon authenticating as user
webgoat, change the AuthCookie value to mock the user Alice by finding the AuthCookie
for the same by performing step#4 and step#5.

Preventing Mechanisms
 Develop a strong authentication and session management controls such that it meets
all the authentication and session management requirements defined in OWASP’s
Application Security Verification Standard.

 Developers should ensure that they avoid XSS flaws that can be used to steal session
IDs.

80
 Security Testing
13. Security Testing ─ Tesing Cross-site Scripting

Cross-site Scripting (XSS) happens whenever an application takes untrusted data and sends
it to the client (browser) without validation. This allows attackers to execute malicious
scripts in the victim's browser which can result in user sessions hijack, defacing web sites
or redirect the user to malicious sites.

Let us understand Threat Agents, Attack Vectors, Security Weakness, Technical Impact and
Business Impacts of this flaw with the help of simple diagram.

Types of XSS
 Stored XSS - Stored XSS also known as persistent XSS occurs when user input is
stored on the target server such as database/message forum/comment field etc.
Then the victim is able to retrieve the stored data from the web application.

 Reflected XSS - Reflected XSS also known as non-persistent XSS occurs when user
input is immediately returned by a web application in an error message/search result
or the input provided by the user as part of the request and without permanently
storing the user provided data.

 DOM Based XSS - DOM Based XSS is a form of XSS when the source of the data is
in the DOM, the sink is also in the DOM, and the data flow never leaves the browser.

81
 Security Testing

Example
The application uses untrusted data in the construction without validation. The special
characters ought to be escaped.

[Link]

The attacker modifies the query parameter in their browser to:

[Link] from XSS"</h3>

Hands ON
1. Login to Webgoat and navigate to cross-site scripting (XSS) Section. Let us execute a
Stored Cross-site Scripting (XSS) attack. Below is the snapshot of the scenario.

2. As per the scenario, let us login as Tom with password 'tom' as mentioned in the scenario
itself. Click 'view profile' and get into edit mode. Since tom is the attacker, let us inject
Java script into those edit boxes.

<script> alert("HACKED")</script>

82
 Security Testing

3. As soon as the update is over, tom receives an alert box with the message "hacked"
which means that the app is vulnerable.

83
 Security Testing

4. Now as per the scenario, we need to login as jerry (HR) and check if jerry is affected by
the injected script.

5. After logging in as Jerry, select 'Tom' and click 'view profile' as shown below.

84
 Security Testing

While viewing tom's profile from Jerry's account, he is able to get the same message box.

6. This message box is just an example, but the actual attacker can perform much more
than just displaying a message box.

Preventive Mechanisms
 Developers have to ensure that they escape all untrusted data based on the HTML
context such as body, attribute, JavaScript, CSS, or URL that the data is placed into.

 For those applications that need special characters as input, there should be robust
validation mechanisms in place before accepting them as valid inputs.

85
 Security Testing
14. Security Testing ─ Insecure Direct Object References

A direct object reference is likely to occur when a developer exposes a reference to an

internal implementation object, such as a file, directory, or database key without any
validation mechanism which allows attackers to manipulate these references to access
unauthorized data.

Let us understand Threat Agents, Attack Vectors, Security Weakness, Technical Impact and
Business Impacts of this flaw with the help of simple diagram.

Example
The App uses unverified data in a SQL call that is accessing account information.

String sqlquery = "SELECT * FROM useraccounts WHERE account = ?";

PreparedStatement st = [Link](sqlquery, �);
[Link]( 1, [Link]("acct"));
ResultSet results = [Link]( );

86
 Security Testing

The attacker modifies the query parameter in their browser to point to Admin.

[Link]

Hands ON
1. Login to Webgoat and navigate to access control flaws Section. The goal is to retrieve
the [Link] by navigating to the path where it is located. Below is the snapshot
of the scenario.

2. The path of the file is displayed in 'the current directory is' field -
C:\Users\userName$\.extract\webapps\WebGoat\lesson_plans\en and we also know
that the [Link] file is kept under C:\xampp\tomcat\conf

3. We need to traverse all the way out of the current directory and navigate from C:\
Drive. We can perform the same by intercepting the traffic using Burp Suite.

87
 Security Testing

4. If the attempt is successful, it displays the [Link] with the message

"Congratulations. You have successfully completed this lesson."

88
 Security Testing

Preventive Mechanisms
Developers can use the following resources/points as a guide to prevent insecure direct
object reference during development phase itself.

 Developers should use only one user or session for indirect object references.
 It is also recommended to check the access before using a direct object reference
from an untrusted source.

89
 Security Testing
15. Security Testing ─ Security Misconfiguration

Security Misconfiguration arises when Security settings are defined, implemented, and
maintained as defaults. Good security requires a secure configuration defined and deployed
for the application, web server, database server, and platform. It is equally important to
have the software up to date.

Example
Some classic examples of security misconfiguration are as given:

 If Directory listing is not disabled on the server and if attacker discovers the same
then the attacker can simply list directories to find any file and execute it. It is also
possible to get the actual code base which contains all your custom code and then
to find any serious flaws in the application.

 App server configuration allows stack traces to be returned to users, potentially

exposing underlying flaws. Attackers grab those extra information that the error
messages provide which is enough for them to penetrate.

90
 Security Testing

 App servers usually come with sample apps that are not well secured. If not removed
from production server would result in compromising your server.

Hands ON
1. Launch Webgoat and navigate to insecure configuration section and let us try to solve
that challenge. Snapshot of the same is provided below:

2. We can try out as many options as we can think of. All we need to find the URL of config
file and we know that the developers follow kind of naming convention for config files.
It can be anything that is listed below. It is usually done by BRUTE force technique.

o [Link]
o config
o [Link]
o conf

3. Upon trying various options, we find that '[Link] is

successful. The following page is displayed if the attempt is successful:

91
 Security Testing

Preventive Mechanisms
 All environments such Development, QA, and production environments should be
configured identically using different passwords used in each environment that
cannot be hacked easily.

 Ensure that a strong application architecture is being adopted that provides effective,
secure separation between components.

 It can also minimize the possibility of this attack by running automated scans and
doing audits periodically.

92
 Security Testing
16. Security Testing ─ Testing Sensitive Data Exposure

As the online applications keep flooding the internet in day by day, not all applications are
secured. Many web applications do not properly protect sensitive user data such as credit
cards information/Bank account info/authentication credentials. Hackers might end up
stealing those weakly protected data to conduct credit card fraud, identity theft, or other
crimes.

Let us understand Threat Agents, Attack Vectors, Security Weakness, Technical Impact and
Business Impacts of this flaw with the help of simple diagram.

Example
Some of the classic examples of security misconfiguration are as given:

 A site simply does not use SSL for all authenticated pages. This enables an attacker
to monitor network traffic and steal the user’s session cookie to hijack the users
session or accessing their private data.

 An application stores the credit card numbers in an encrypted format in a database.

Upon retrieval they are decrypted allowing the hacker to perform a SQL injection
attack to retrieve all sensitive info in a clear text. This can be avoided by encrypting

93
 Security Testing

the credit card numbers using a public key and allowed back-end applications to
decrypt them with the private key.

Hands ON
1. Launch WebGoat and navigate to "Insecure Storage" Section. Snapshot of the same is
displayed below.

2. Enter the username and password. It is time to learn different kind of encoding and
encryption methodologies that we discussed previously.

Preventive Mechanisms
 It is advised not to store sensitive data unnecessarily and should be scraped as soon
as possible if it is no more required.

 It is important to ensure that we incorporate strong and standard encryption

algorithms are used and proper key management is in place.

 It can also be avoided by disabling autocomplete on forms that collect sensitive data
such as password and disable caching for pages that contain sensitive data.

94
 Security Testing
17. Security Testing ─ Missing Function Level Access
Control

Most of the web applications verify function level access rights before making that
functionality accessible to the user. However, if the same access control checks are not
performed on the server, hackers are able to penetrate into the application without proper
authorization.

Let us understand Threat Agents, Attack Vectors, Security Weakness, Technical Impact and
Business Impacts of this flaw with the help of simple diagram.

Example
Here is a classic example of Missing Function Level Access Control:

The hacker simply forces target URLs. Usually admin access requires authentication,
however, if the application access is not verified, then an unauthenticated user can access
admin page.

95
 Security Testing

' Below URL might be accessible to an authenticated user

[Link]

' A NON Admin user is able to access admin page without authorization.
[Link]

Hands ON
1. Let us login as account manager by first going through the list of users and their access
privileges.

2. Upon trying various combinations we can find out that Larry has access to resource
account manager.

96
 Security Testing

Preventive Mechanisms
 The authentication mechanism should deny all access by default, and provide access
to specific roles for every function.

 In a workflow based application, verify the users’ state before allowing them to
access any resources.

97
 Security Testing
18. Security Testing ─ Cross-Site Request Forgery (CSRF)

A CSRF attack forces an authenticated user (victim) to send a forged HTTP request, including
the victim's session cookie to a vulnerable web application, which allows the attacker to
force the victim's browser to generate request such that the vulnerable app perceives as
legitimate requests from the victim.

Let us understand Threat Agents, Attack Vectors, Security Weakness, Technical Impact and
Business Impacts of this flaw with the help of simple diagram.

Example
Here is a classic example of CSRF:

1. Let us say, the vulnerable application sends a state changing request as a plain text
without any encryption.

[Link]
43243

98
 Security Testing

2. Now the hacker constructs a request that transfers money from the victim's account to
the attacker's account by embedding the request in an image that is stored on various
sites under the attacker's control:

<img
src="[Link]
t=attackersAcct#" width="0" height="0" />

Hands ON
1. Let us perform a CSRF forgery by embedding a Java script into an image. The snapshot
of the problem is listed below.

2. Now we need to mock up the transfer into a 1x1 image and make the victim to click on
the same.

99
 Security Testing

3. Upon submitting the message, the message is displayed as highlighted below.

4. Now if the victim clicks the following URL, the transfer is executed, which can be found
intercepting the user action using burp suite. We are able to see the transfer by spotting
it in Get message as shown below:

5. Now upon clicking refresh, the lesson completion mark is shown.

Preventive Mechanisms
 CSRF can be avoided by creating a unique token in a hidden field which would be
sent in the body of the HTTP request rather than in an URL, which is more prone to
exposure.

Forcing the user to re-authenticate or proving that they are users in order to protect
CSRF. For example, CAPTCHA.

100
 Security Testing
19. Security Testing ─ Components with Vulnerabilities

This kind of threat occurs when the components such as libraries and frameworks used
within the app almost always execute with full privileges. If a vulnerable component is
exploited, it makes the hacker’s job easier to cause a serious data loss or server takeover.

Let us understand Threat Agents, Attack Vectors, Security Weakness, Technical Impact and
Business Impacts of this flaw with the help of simple diagram.

Example
The following examples are of using components with known vulnerabilities:

 Attackers can invoke any web service with full permission by failing to provide an
identity token.

 Remote-code execution with Expression Language injection vulnerability is

introduced through the Spring Framework for Java based apps.

101
 Security Testing

Preventive Mechanisms
 Identify all components and the versions that are being used in the webapps not just
restricted to database/frameworks.

 Keep all the components such as public databases, project mailing lists etc. up to
date.

 Add security wrappers around components that are vulnerable in nature.

102
 Security Testing
20. Security Testing ─ Unvalidated Redirects and
Forwards

Most web applications on the internet frequently redirect and forward users to other pages
or other external websites. However, without validating the credibility of those pages,
hackers can redirect victims to phishing or malware sites, or use forwards to access
unauthorized pages.

Let us understand Threat Agents, Attack Vectors, Security Weakness, Technical Impact and
Business Impacts of this flaw with the help of simple diagram.

Example
Some classic examples of Unvalidated Redirects and Forwards are as given:

1. Let us say the application has a page - [Link], which takes a parameter redirectrul.
The hacker adds a malicious URL that redirects users which performs phishing/installs
malware.

[Link]

103
 Security Testing

2. All web application used to forward users to different parts of the site. In order to achieve
the same, some pages use a parameter to indicate where the user should be redirected
if an operation is successful. The attacker crafts an URL that passes the application's
access control check and then forwards the attacker to administrative functionality for
which the attacker has not got the access.

[Link]

Preventive Mechanisms
 It is better to avoid using redirects and forwards.
 If it is unavoidable, then it should be done without involving user parameters in
redirecting the destination.

104
 Security Testing
21. Security Testing ─ Ajax Security

Asynchronous Javascript and XML (AJAX) is one of the latest techniques used to develope
web application inorder to give a rich user experience. Since it is a new technology, there
are many security issues that are yet to be completed established and below are the few
security issues in AJAX.

 The attack surface is more as there are more inputs to be secured.

 It also exposes the internal functions of the applications.
 Failure to protect authentication information and sessions.
 There is a very narrow line between client-side and server-side, hence there are
possibilities of committing security mistakes.

Example
Here is an example for AJAX Security:

In 2006, a worm infected yahoo mail service using XSS and AJAX that took advantage of a
vulnerability in Yahoo Mail's onload event handling. When an infected email was opened,
the worm executed its JavaScript, sending a copy to all the Yahoo contacts of the infected
user.

Hands ON
1. We need to try to add more rewards to your allowed set of reward using XML injection.
Below is the snapshot of the scenario.

105
 Security Testing

2. Make sure that we intercept both request and response using Burp Suite. Settings of the
same as shown below.

106
 Security Testing

3. Enter the account number as given in the scenario. We will be able to get a list of all
rewards that we are eligible for. We are eligible for 3 rewards out of 5.

4. Now let us click 'Submit' and see what we get in the response XML. As shown below the
three rewards that are we are eligible are passed to us as XML.

107
 Security Testing

5. Now let us edit those XMLs and add the other two rewards as well.

6. Now all the rewards would be displayed to the user for them to select. Select the ones
that we added and click 'Submit'.

7. The following message appears saying, "* Congratulations. You have successfully
completed this lesson."

108
 Security Testing

Preventive Mechanisms
Client side:

 Use .innerText instead of .innerHtml.

 Do not use eval.
 Do not rely on client logic for security.
 Avoid writing serialization code.
 Avoid building XML dynamically.
 Never transmit secrets to the client.
 Do not perform encryption in client side code.
 Do not perform security impacting logic on client side.

Server side:

 Use CSRF protection.

 Avoid writing serialization code.
 Services can be called by users directly.
 Avoid building XML by hand, use the framework.
 Avoid building JSON by hand, use an existing framework.

109
 Security Testing
22. Security Testing ─ Web Service Security

In modern web-based applications, the usage of web services is inevitable and they are
prone for attacks as well. Since the web services request fetch from multiple websites
developers have to take few additional measures in order to avoid any kind of penetration
by hackers.

Hands ON
1. Navigate to web services area of Webgoat and go to WSDL Scanning. We need to now
get credit card details of some other account number. Snapshot of the scenario is as
mentioned below.

2. If we select the first name, the 'getFirstName' function call is made through SOAP
request xml.

110
 Security Testing

3. By opening the WSDL, we are can see that there is a method to retrieve credit card
information as well 'getCreditCard'. Now let us tamper the inputs using Burp suite as
shown below:

4. Now let us modify the inputs using Burp suite as shown below:

111
 Security Testing

5. We can get the credit card information of other users.

Preventive Mechanisms
 Since SOAP messages are XML-based, all passed credentials have to be converted
to text format. Hence one has to be very careful in passing the sensitive information
which has to be always encrypted.

 Protecting message integrity by implementing the mechanisms like checksum

applied to ensure packet's integrity.

 Protecting message confidentiality - Asymmetric encryption is applied to protect the

symmetric session keys, which in many implementations are valid for one
communication only and are discarded subsequently.

112
 Security Testing
23. Security Testing ─ Testing Buffer Overflows

A buffer overflow arises when a program tries to store more data in a temporary data
storage area (buffer) than it was intended to hold. Since buffers are created to contain a
finite amount of data, the extra information can overflow into adjacent buffers, thus
corrupting the valid data held in them.

Example
Here is a classic examples of buffer overflow. It demonstrates a simple buffer overflow that
is caused by the first scenario in which relies on external data to control its behavior. There
is no way to limit the amount of data that user has entered and the behavior of the program
depends on the how many characters the user has put inside.

...
char bufr[BUFSIZE];
gets(bufr);
...

Hands ON
1. We need to login with name and room number to get the internet access. Here is the
scenario snapshot.

113
 Security Testing

2. We will also enable "Unhide hidden form fields" in Burp Suite as shown below:

114
 Security Testing

3. Now we send an input in name and room number field. We also try and inject a pretty
big number in the room number field.

4. The hidden fields are displayed as shown below. We click accept terms.

115
 Security Testing

5. The attack is successful such that as a result of buffer overflow, it started reading the
adjacent memory locations and displayed to the user as shown below.

6. Now let us login using the data displayed. After logging, the following message is
displayed:

116
 Security Testing

Preventive Mechanisms
 Code Reviewing
 Developer training
 Compiler tools
 Developing Safe functions
 Periodical Scanning

117
 Security Testing
24. Security Testing ─ Testing Denial of Service

Denial of Service (DoS) attack is an attempt by hackers to make a network resource

unavailable. It usually interrupts the host, temporary or indefinitely, which is connected to
the internet. These attacks typically target services hosted on mission critical web servers
such as banks, credit card payment gateways.

Symptoms of DoS
 Unusually slow network performance.
 Unavailability of a particular web site.
 Inability to access any web site.
 Dramatic increase in the number of spam emails received.
 Long term denial of access to the web or any internet services.
 Unavailability of a particular website.

Hands ON
1. Launch WebGoat and navigate to 'Denial of Service' section. The snapshot of the
scenario is given below. We need to login multiple times there by breaching maximum
DB thread pool size.

2. First we need to get the list of valid logins. We use SQL Injection in this case.

118
 Security Testing

3. If the attempt is successful, then it displays all valid credentials to the user.

4. Now login with each one of these user in at least 3 different sessions in order to make
the DoS attack successful. As we know that DB connection can handle only two threads,
by using all logins it will create three threads which makes the attack successful.

Preventive Mechanisms
 Perform thorough input validations. Avoid highly CPU consuming operations.
 It is better to separate data disks from system disks.

119
 Security Testing
25. Security Testing ─ Malicious File Execution

Developers often directly use or concatenate potentially vulnerable input with file or assume
that input files are genuine. When the data is not checked properly, this can lead to the
vulnerable content being processed or invoked by the web server.

Example
Some of the classic examples include:

 Upload .jsp file into web tree.

 Upload .gif to be resized.
 Upload huge files.
 Upload file containing tags.
 Upload .exe file into web tree.

Hands ON
1. Launch WebGoat and navigate to Malicious file execution section. The snapshot of the
scenario is given below:

2. In order to complete this lesson, we need to upload [Link] in the above said location.

3. Let us create a jsp file such that the [Link] file is created on executing the jsp. The
Naming of the jsp has no role to play in this context as we are executing the content of
the jsp file.

120
 Security Testing

<HTML> <% [Link] file = new

[Link]("C:\\Users\\username$\\.extract\\webapps\\WebGoat\\mfe_target\\g
[Link]"); [Link](); %> </HTML>

4. Now upload the jsp file and copy the link location of the same after upload. The upload
is expecting an image, but we are uploading a jsp.

5. By navigating to the jsp file, there will not be any message to the user.

6. Now refresh the session where you have uploaded the jsp file and you will get the
message saying, "* Congratulations. You have successfully completed the lesson".

121
 Security Testing

Preventive Mechanisms
 Secure websites using website permissions.
 Adopt countermeasures for web application security.
 Understand the Built-In user and group accounts in IIS 7.0.

122
 Security Testing
26. Security Testing – Automation Tools

There are various tools available to perform security testing of an application. There are few
tools that can perform end-to-end security testing while some are dedicated to spot a
particular type of flaw in the system.

Open Source Tools

Some open source security testing tools are as given:

S. No. Tool Name

Zed Attack Proxy

1 Provides Automated Scanners and other tools for spotting security flaws.
[Link]

OWASP WebScarab
2 Developed in Java for Analysing Http and Https requests.
[Link]

OWASP Mantra
3 Supports multi-lingual security testing framework
[Link]

Burp Proxy
Tool for Intercepting & Modyfying traffic and works with work with custom SSL
4
certificates.
[Link]

Firefox Tamper Data

Use tamperdata to view and modify HTTP/HTTPS headers and post
5
parameters
[Link]

Firefox Web Developer Tools

The Web Developer extension adds various web developer tools to the
6
browser.
[Link]

Cookie Editor
Lets user to add, delete, edit, search, protect and block cookies
7
[Link]
US

123
 Security Testing

Specific Tool Sets

The following tools can help us spot a particular type of vulnerability in the system:

S. No. Link

DOMinator Pro - Testing for DOM XSS

1
[Link]

OWASP SQLiX - SQL Injection

2
[Link]

Sqlninja - SQL Injection

3
[Link]

SQLInjector - SQL Injection

4
[Link]

sqlpowerinjector - SQL Injection

5
[Link]

SSL Digger - Testing SSL

6
[Link]

THC-Hydra - Brute Force Password

7
[Link]

Brutus - Brute Force Password

8
[Link]

Ncat - Brute Force Password

9
[Link]

OllyDbg - Testing Buffer Overflow

10
[Link]

Spike - Testing Buffer Overflow

11
[Link]

Metasploit - Testing Buffer Overflow

12
[Link]

124
 Security Testing

Commercial Black Box Testing tools

Here are some of the commercial black box testing tools that help us spot security issues in
the applications that we develop.

S. No. Tool

NGSSQuirreL
1 [Link]
security-software/squirrel-vulnerability-scanner/

IBM AppScan
2
[Link]

Acunetix Web Vulnerability Scanner

3
[Link]

NTOSpider
4
[Link]

SOAP UI
5
[Link]

Netsparker
6
[Link]

HP WebInspect
7 [Link]
center/hp-webinspect

Free Source Code Analyzers

S. No. Tool

OWASP Orizon
1
[Link]

OWASP O2
2
[Link]

125
 Security Testing

SearchDiggity
3
[Link]

FXCOP
4
[Link]

Splint
5
[Link]

Boon
6
[Link]

W3af
7
[Link]

FlawFinder
8
[Link]

FindBugs
9
[Link]

126
 Security Testing

Commercial Source Code Analyzers

These analyzers examine, detect, and report the weaknesses in the source code, which are
prone to vulnerabilities:

S. No. Tool

Parasoft C/C++ test

1
[Link]

HP Fortify
2 [Link]
center/hp-fortify-static-code-analyzer

Appscan
3
[Link]

Veracode
4
[Link]

Armorize CodeSecure
5
[Link]

GrammaTech
6
[Link]

127