Popularity of web applications has also led to an increase in web application attacks. Organizations are increasingly using dynamic web technologies to implement web applications, which may contain sensitive user information, confidential user data or financial information. Each and every web application is vulnerable and it can be seen in 3 ways.
1. Application Vulnerability
2. Platform Vulnerability
3. OS Vulnerability
Hacker will try to attack on any of above mentioned vulnerabilities and try to exploit them. They might either sell all the information or make them public. So it is very critical for every company to ensure that their web applications are Hack Proof and Secure.
OK, how can I be sure that my web application is secure?
To get surety about whether your application is secure or not, timely web application audit and application security testing is required. You need to make sure whether your application follows standard defined for various industries or not. For example your web application is dealing with payment card industry then you should make sure that your application adheres to PCI DSS standards.
What will be tested as part of Application Security and why they will be inside application?
As part of application security testing one should test for:
1. Injection flaws which includes SQL injection, OS injection, and LDAP injection. Injections are possible when one send data in command line or by tempering (either URL or any Input field). If your application is vulnerable to such attacks then you application is at HIGH risk and you should mitigate them as soon as you can. Injection attacks are A1 level for Application Security as per OWASP TOP 10 — 2010.
2. Cross Site Scripting or XSS flaws, this will occur due to improper validation of user input. Cross site scripting will have reflected and non reflected type and which may lead to hijack sessions, redirect the user to other website or deface web sites. Cross site scripting is at A2 level for OWASP TOP 10 – 2010
3. Broken Authentication and Session Management is one of the most critical from user security stands point. One can log on to application without giving proper authentication tokens. Attacker will try to compromise application with hijacked sessions, stolen tokens. Broken Authentication and Session Management is at A3 level for OWASP TOP 10 -2010
4. Cross Site Request Forgery or CSRF attack is generally done on forged HTTP request. Attacker will force victim browser to send requests the vulnerable application and it will be treated as normal requests from the victim. CSRF attacks are at A4 level for OWASP TOP 10
5. Forwards and Redirects without validation, Web applications are sending user data without validating to another sites or accepting data from another site without validating them and this may lead to make your site zombie for malwares. This vulnerability stands at A-10 OWASP TOP 10
6. Security Misconfiguration, As mentioned in early of this blog security misconfiguration can be handled by applying security to Application by writing secure code, by applying patch and regular updates to mitigate security holes from platform and OS. Apart from this one can implement Application Firewall to overcome this issue. Security Misconfiguration is at A6 level for OWASP TOP -10 2010
7. Insecure Storage, Many times user data is stored in clear text and if attacker gets success in braking first layer of security that is Authentication he can easily view/access the clear text data. Insecure Cryptographic Storage is at A7 level for OWASP TOP — 10 2010
8. Failure to Restrict URL Access, when attacker is able to access authenticated pages without logging on to the system this scenario will happen. A web application should not allow user to directly access any authenticated pages. This vulnerability stands at A-8 for OWASP TOP 10 – 2010
9. Insufficient Transport Layer Protection, when ever user’s sensitive data is being passed, they should be routed through secure channel only. It is preferred to user TLS or SSL security to be implemented. This stands at A-9 for OWASP TOP 10 — 2010
10. Insecure Direct Object Reference, many times developers unknowingly exposing direct reference to the object which may be any DLL or executables on server and attacker will access those files directly with/without by passing the authentication mechanism. This vulnerability stands at A-4 for OWASP TOP 10 2010.
I got idea about web application testing, but who will do it for me?
If you are looking for web application testing/ web application penetration testing company then you are at the right place. We have developed our own web application security testing model which will help you to make your application secure and more over you will get notification about new threats and how you can mitigate them.
As part of application penetration testing we do testing for Parameter Injection, SQL Injection, Cross Site Scripting, Directory Traversal, Parameter Overflow, Parameter Tempering, Buffer Overflow and Path Manipulation using Manual and Automation processes.
Contact Us for more information regarding our web application security testing.
For more details about OWASP TOP 10 : http://www.owasp.org