Web apps vulnerability: Why & how to protect – The Basics

Businesses are concerned with the problem of penetration into their using web apps by unauthorized persons. Organization uses applications to provide better service to customers. But if these apps are compromised by unauthorized code then the business loses integrity.

Now a day, it is our big concern to protect our business apps from being compromised. The first step is to understand how and why apps are compromised.

Why the web apps are vulnerable?

Web codes are mainly HTML. HTML is a clear text language which is visible to anyone by visiting the sites. Hackers can easily modify the code and add functionalities that either act differently or obstruct existing functionality.

Hackers can penetrate code in the following ways:

Injection: The attacker injects malicious code into the web code. This malicious code is written to extract information from the client’s computer or device for unscrupulous use.

Cross Site Scripting (XSS):  Hacker inserts a script into the code that is run at the client’s site. This script may be for extracting information or providing misinformation in order to undermine competition.

Identity Theft: Here the attacker assumes the identity of the user and accesses important or sensitive data. The hacker then can use this data to cause inconvenience or loss to the user.

Direct Object Reference: This type of risk occurs when objects such as tables within a database are directly referenced in the URL. The hacker can use this object to access related objects within the database.

Insecure cryptography: Sensitive data such as credit card information, bank details, SSN etc. may be hacked by corrupt persons if they are stored, or travel over the internet, encoded in a simple and easy to break code.

Insufficient Layering: Applications that do not encrypt and decrypt data or authenticate users, or check certificates, may be used by hackers to gather personal data of the users.

How to avoid these risks

The above list is not full but does cover some major areas of vulnerability. Developers, web designers, SQA/Test staffs can counter these vulnerabilities by being aware of them and including code that will look out for malicious code.

Basic Security Practices for Web Applications:

• Applications use data entered into forms to access databases. If this data is validated before accessing the database, injections can frequently come to light. Proper validation can also detect malicious scripts entered into the code.

• Coders must assume that any data entered by users is untrusted. All inputs must be validated before use. Checking for type, length, format, and range are the common ways in which inputs are validated.

•  Identity thefts and broken authentications can be prevented by forcing a user to re-login even though he has not explicitly logged out. When a user logs in to a site an id is created. If this id is created using a predictable formula then hackers can pinch that identity and resend it to access client information. Generating random id is the best way to avoid risks of identity thefts.

• Randomizing ids can also mitigate attacks due to direct object reference. In fact, databases should never be directly accessed by user entered data. Applications should validate and clean data before accessing databases.

• Most importantly, the infrastructure used to run applications including hardware, software, OS and other components must be secured.

 So, we need to concern about above listed practice to avoid vulnerability of our business apps.  

Penetration Testing: Some basic things that we need to perform

Now a day we are very concern about the security of our systems. So, we need to perform Penetration Testing for our systems. Penetration testing is also known as Pen Test. Penetration testing is the process to identify security vulnerabilities in an application by evaluating the system or network with various malicious techniques. Purpose of this test is to secure important data from outsiders like hackers who can have unauthorized access to system. Once vulnerability is identified it is used to exploit system in order to gain access to sensitive information.

Penetration is not the functional testing. In Pentest our goal is to find security holes in the system. Below are some generic test cases and not necessarily applicable for all applications.

• Check if web application is able to identify spam attacks on contact forms used in the website.
• Proxy server – Check if network traffic is monitored by proxy appliances. Proxy server makes it difficult for hackers to get internal details of the network thus protecting the system from external attacks.
• Spam email filters – Verify if incoming and outgoing email traffic is filtered and unsolicited emails are blocked. Many email clients come with in-build spam filters which needs to be configured as per your needs. These configuration rules can be applied on email headers, subject or body.
• Firewall – Make sure entire network or computers are protected with Firewall. Firewall can be a software or hardware to block unauthorized access to system. Firewall can prevent sending data outside the network without your permission.
• Try to exploit all servers, desktop systems, printers and network devices.
• Verify that all usernames and passwords are encrypted and transferred over secured connection like https.
• Verify information stored in website cookies. It should not be in readable format.
• Verify previously found vulnerabilities to check if the fix is working.
• Verify if there is no open port in network.
• Verify all telephone devices.
• Verify WIFI network security.
• Verify all HTTP methods. PUT and Delete methods should not be enabled on web server.
• Password should be at least 8 characters long containing at least one number and one special character.
• Username should not be like “admin” or “administrator”.
• Application login page should be locked upon few unsuccessful login attempts.
• Error messages should be generic and should not mention specific error details like “Invalid username” or “Invalid password”.
• Verify if special characters, html tags and scripts are handled properly as an input value.
• Internal system details should not be revealed in any of the error or alert messages.
• Custom error messages should be displayed to end user in case of web page crash.
• Verify use of registry entries. Sensitive information should not be kept in registry.
• All files must be scanned before uploading to server.
• Sensitive data should not be passed in urls while communicating with different internal modules of the web application.
• There should not be any hard coded username or password in the system.
• Verify all input fields with long input string with and without spaces.
• Verify if reset password functionality is secure.
• Verify application for SQL Injection.
• Verify application for Cross Site Scripting.
• Important input validations should be done at server side instead of JavaScript checks at client side.
• Critical resources in the system should be available to authorized persons and services only.
• All access logs should be maintained with proper access permissions.
• Verify user session ends upon log off.
• Verify that directory browsing is disabled on server.
• Verify that all applications and database versions are up to date.
• Verify url manipulation to check if web application is not showing any unwanted information.
• Verify memory leak and buffer overflow.
• Verify if incoming network traffic is scanned to find Trojan attacks.
• Verify if system is safe from Brute Force Attacks – a trial and error method to find sensitive information like passwords.
• Verify if system or network is secured from DoS (denial-of-service) attacks. Hacker can target network or single computer with continuous requests due to which resources on target system gets overloaded resulting in denial of service for legit requests.

These are just the basic test scenarios to get started with Pentest. There are hundreds of advanced penetration methods which can be done either manually or with the help of automation tools.

Finally as a penetration tester you should collect and log all vulnerabilities in the system. Don’t ignore any scenario considering that it won’t be executed by end users.