Guide Web Application Security How To Minimize Prevalent .

guide :Web Application Security —How to Minimize Prevalent Riskof AttacksTable of ContentsI. Summary2II. Primer on Web App Security2III. Types of Web App Vulnerabilities3IV. Detecting Web App Vulnerabilities5V. QualysGuard WAS AutomatesDetection of Vulnerabilities6IV. Protect Your Web Applications7V. About Qualys8

Web Application Security: How to Minimize Prevalent Risks of AttackSummaryVulnerabilities in web applications are now the largest vector of enterprise securityattacks. Last year, almost 55% of vulnerability disclosures affected web applications.1At year end, 74% of web application vulnerabilities had no available patch forremediation, according to that report. Stories about exploits that compromisesensitive data frequently mention culprits such as “cross-site scripting,” “SQLinjection,” and “buffer overflow.” Vulnerabilities like these fall often outside thetraditional expertise of network security managers. The relative obscurity of webapplication vulnerabilities thus makes them useful for attacks. As many organizationshave discovered, these attacks will evade traditional enterprise network defensesunless you take new precautions. To help you understand how to minimize theserisks, Qualys provides this guide as a primer to web application security. The guidesurveys typical web application vulnerabilities, compares options for detection, andintroduces the QualysGuard Web Application Scanning solution – a new on demandservice from Qualys that automates detection of the most prevalent vulnerabilitiesin custom web applications.Primer on Web Application SecurityAttacks on vulnerabilities in web applications began appearing almost from thebeginning of the World Wide Web, in the mid-1990s. Attacks are usually based onfault injection, which exploits vulnerabilities in a web application’s syntax andsemantics. Using a standard browser and basic knowledge of HTTP and HTML, anattacker attempts a particular exploit by automatically varying a Uniform ResourceIndicator (URI) link, which in turn could trigger an exploit such as SQL injection orcross-site scripting.http://example/foo.cgi?a 1http://example/foo.cgi?a 1’http://example/foo.cgi?a script SQL Injection Cross-site Scripting (XSS)Some attacks attempt to alter logical workflow. Attackers also execute these byautomatically varying a URI.http://example/foo.cgi?admin falsehttp://example/foo.cgi?admin true Increase privilegesA significant number of attacks exploit vulnerabilities in syntax and semantics. Youcan discover many of these vulnerabilities with an automated scanning tool.Logical vulnerabilities are very difficult to test with a scanning tool; these requiremanual inspection of web application source code analysis and security testing.Web application security vulnerabilities usually stem from programming errors witha web application programming language (e.g., Java, .NET, PHP, Python, Perl, andRuby), a code library, design pattern, or architecture.1IBM ISS X-Force 2008 Trend & Risk Report dreports/xforce-2008-annual-report.pdfpage 2

Web Application Security: How to Minimize Prevalent Risks of AttackThese vulnerabilities can be complex and may occur under many circumstances.Using a web application firewall might control effects of some exploits but will notresolve the underlying vulnerabilities.Types of Web Application VulnerabilitiesWeb applications may have any of two dozen types of vulnerabilities. Securityconsultants who do penetration testing may focus on finding top vulnerabilities,such as those in a list published by the Open Web Application Security Project(www.owasp.org). Other efforts to systematically organize web applicationvulnerabilities include six categories published by the Web Application SecurityConsortium (www.webappsec.org). The following descriptions of web vulnerabilitiesare modeled on the WASC schema.Authentication – stealing user account identitiesnnnBrute Force attack automates a process of trial and error to guess aperson’s username, password, credit-card number or cryptographic key.Insufficient Authentication permits an attacker to access sensitivecontent or functionality without proper authentication.Weak Password Recovery Validation permits an attacker to illegallyobtain, change or recover another user’s password.Authorization – illegal access to applicationsnnnnCredential / Session Prediction is a method of hijacking or impersonatinga user.Insufficient Authorization permits access to sensitive content orfunctionality that should require more access control restrictions.Insufficient Session Expiration permits an attacker to reuse old sessioncredentials or session IDs for authorization.Session Fixation attacks force a user’s session ID to an explicit value.page 3“Enterprise-class web applicationscanning solutions are broader, andshould include a wide range of testsfor major web application vulnerabilityclasses, such as SQL injection,cross-site scripting, and directorytraversals. The OWASP Top 10 is agood starting list of major vulnerabilities, but an enterprise class solutionshouldn’t limit itself to just one list orcategory of vulnerabilities. An enterprise solution should also be capableof scanning multiple applications,tracking results over time, providingrobust reporting (especially compliance reports), and providing reportscustomized for local requirements.Building a Web Application SecurityProgram WhitepaperSecurosis.com”

Web Application Security: How to Minimize Prevalent Risks of Attackpage 4Client-side Attacks – illegal execution of foreign codennContent Spoofing tricks a user into believing that certain content appearing on a web site is legitimate and notfrom an external source.Cross-site Scripting (XSS) forces a web site to echo attacker-supplied executable code, which loads into auser’s browser.Command Execution – hijacks control of web applicationnnBuffer Overflow attacks alter the flow of an application by overwriting parts of memory.Format String Attack alters the flow of an application by using string formatting library features to access othermemory space.nLDAP Injection attacks exploit web sites by constructing LDAP statements from user-supplied input.nOS Commanding executes operating system commands on a web site by manipulating application input.nSQL Injection constructs illegal SQL statements on a web site application from user-supplied input.nnSSI Injection (also called Server-side Include) sends code into a web application, which is later executed locallyby the web server.XPath Injection constructs XPath queries from user-supplied input.Information Disclosure – shows sensitive data to attackersnnnnDirectory Indexing is an automatic directory listing / indexing web server function that shows all files in arequested directory if the normal base file is not present.Information Leakage occurs when a web site reveals sensitive data such as developer comments or errormessages, which may aid an attacker in exploiting the system.Path Traversal forces access to files, directories and commands that potentially reside outside the webdocument root directory.Predictable Resource Location uncovers hidden web site content and functionality.

Web Application Security: How to Minimize Prevalent Risks of AttackLogical Attacks – interfere with application usagennnnAbuse of Functionality uses a web site’s own features and functionality toconsume, defraud or circumvent access control mechanisms.Denial of Service (DoS) attacks prevent a web site from serving normaluser activity.Insufficient Anti-automation is when a web site permits an attacker toautomate a process that should only be performed manually.Insufficient Process Validation permits an attacker to bypass orcircumvent the intended flow of an application.Detecting Web Application VulnerabilitiesThere is no “silver bullet” to detecting web application vulnerabilities. The strategyfor their detection is identical to the multi-layer approach used for security on anetwork. Detection and remediation of some vulnerabilities requires source codeanalysis, particularly for complex enterprise-scale web applications. Detection ofother vulnerabilities may also require on-site penetration testing. As mentionedearlier, the most prevalent web application vulnerabilities can also be detected withan automated scanner.An automated web application vulnerability scanner both supplements andcomplements manual forms of testing. It provides five key benefits:nLowers total cost of operations by automating repeatable testing processesnIdentifies vulnerabilities of syntax and semantics in custom web applicationsnPerforms authenticated crawlingnProfiles the target applicationnEnsures accuracy by effective reduction of false positives and false negativesA scanner does not have access to a web application’s source code, so the onlyway it can detect vulnerabilities is by performing likely attacks on the targetapplication. Time required for scanning varies, but doing a broad simulated attackon an application takes significantly longer than doing a network vulnerability scanagainst a single IP. A major requirement for a web application vulnerability scanneris comprehensive coverage of the target application’s functionality. Incompletecoverage will cause the scanner to overlook existing vulnerabilities.page 5“The number of vulnerabilities affecting Web applications has grown at astaggering rate. In 2008, vulnerabilities affecting Web server applicationsaccounted for 54 percent of all vulnerability disclosures and were oneof the primary factors in the overallgrowth of vulnerability disclosuresduring the year.”IBM X-Force 2008 Trend & Risk Report