Information Gathering

Before auditing an application, it is necessary to determine the scope on which the security review will be performed with certain key aspects about it, which consists, among others, of the following:

• Application discovery.
• Identification of entry points to the application.
• Error code analysis.
• Platform identification.

Protocol Reverse Engineering

Attacks that can be carried out against applications may start through the analysis of the protocols implemented by them. Sometimes security controls may not be implemented robustly enough, and other times proprietary libraries of standard protocols are implemented incorrectly, which also imply security vulnerabilities in the system.

Infrastructure Configuration Analysis

The analysis of the infrastructure and the topology of the architecture can reveal information such as source code, supported HTTP methods, administration functionalities, authentication methods, or infrastructure configurations. At this point, the following tests are developed:

• SSL/TLS tests.
• Configuration management tests in the infrastructure.
• Configuration management tests in the application.
• Tests on file extension handling.
• Identification of old, backup, or unreferenced files.
• Access to administration interfaces.
• Tests on HTTP methods and XST.

Authentication Scheme Analysis

Authentication: “is the act of establishing or confirming something (or someone) as authentic”. An example of this process is the login process. To carry out this analysis, the following tests are performed:

• Transmission of credentials through an encrypted channel.
• User enumeration tests.
• Tests for identifying predictable user accounts.
• Brute force tests.
• Tests to bypass the authentication scheme.
• Session termination tests.
• Tests on CAPTCHA implementations.
• Multi-factor authentication tests.
• Race condition tests.

Session Management Analysis

At the core of any web-based application is the way it maintains state control and, therefore, user interaction. In the broadest sense, session management encompasses all controls over a user, from authentication to leaving the application.

• Session management scheme tests.
• Tests on cookie attributes.
• Session fixation tests.
• Tests on exposure of session variables.
• CSRF tests.

Authorization Scheme Analysis

Authorization: “is the concept of allowing access to resources only to those permitted to use them”. The aim of analyzing the authorization scheme is to understand its functioning and, with that information, attempt to evade the authorization mechanism. To do this, we carry out the following tests:

• Tests for accessing protected resources.
• Tests to bypass the authorization scheme.
• Privilege escalation tests.

Business Rules Analysis

Business rules may include rules that express business policies (such as products, prices, or locations) or workflows based on ordered tasks of data transmission from one participant (a person or a software component) to another.

• Tests on business rules.
• Functionality abuse tests.

Data Validation Mechanism Analysis

The main problem we encounter in applications is that input data validation is not carried out properly before using them. This causes most to be susceptible to attacks against the file system or buffer overflow attacks, among others, due to vulnerabilities. To carry out this analysis, the following tests are performed:

• XSS tests (stored, reflected, and DOM-based) / Cross Site Flashing.
• SQL code injection tests / LDAP injection / ORM injection / XML injection / SSI injection / XPATH injection / IMAP/SMTP injection / code injection / operating system command injection.
• Memory overflow tests.
• HTTP Splitting/Smuggling tests.

Denial-of-Service Analysis

Denial of service (DoS) aims to prevent a system from providing normal activity to users. These malicious attacks can occur by depriving a system of critical resources, exploiting vulnerabilities, or through functionality abuse.

The aim here is to verify whether the system is vulnerable to this type of threat; to do so, the following tests are carried out:

• User account lockout tests.
• Disk write tests.
• Resource release tests.
• CPU-intensive SQL query tests.

Web Services Analysis

An analysis will be carried out on the implemented Web Services to try to detect deficiencies. Access and security controls at the IP level, configuration, information leaks caused by deficiencies in error and exception management, implemented validation filters, as well as the existence of audit and logging controls will be reviewed.

• Information gathering tests.
• Tests on XML structure.
• Tests on HTTP and REST GET parameters.
• Tests on attachments in SOAP.
• Replay tests in Web Services.