Information gathering

Before auditing an application, it is necessary to determine the scope on which the security review will be carried out with certain key aspects about it, which include, among others:

• Application discovery.
• Identification of application entry points.
• Analysis of error codes.
• Platform identification.

Protocol reverse engineering

Attacks against applications can start through analysis of the protocols implemented by them. Sometimes security controls may not be robust enough, and other times proprietary libraries of standard protocols are implemented incorrectly, which also implies security vulnerabilities in the system.

Infrastructure configuration analysis

Analyzing the infrastructure and architecture topology can reveal information such as source code, supported HTTP methods, administration features, authentication methods, or infrastructure configurations. At this stage, the following tests are developed:

• SSL/TLS tests.
• Configuration management tests in the infrastructure.
• Configuration management tests in the application.
• Tests on handling file extensions.
• Identification of old, backup, or unreferenced files.
• Access to administration interfaces.
• Tests on HTTP methods and XST.

Authentication scheme analysis

Authentication: the act of establishing or confirming something (or someone) as authentic. A common example is the login process. To perform this analysis, the following tests are carried out:

• Transmission of credentials through an encrypted channel.
• User enumeration tests.
• Tests to identify predictable user accounts.
• Brute force tests.
• Tests to bypass the authentication scheme.
• Session termination tests.
• Tests on CAPTCHA implementations.
• Multi-factor authentication tests.
• Race condition tests.

Session management analysis

At the core of any web-based application is how it maintains state control and thus user interaction. In the broadest sense, session management encompasses all controls over a user, from authentication to application exit.

• Session management scheme tests.
• Tests on cookie attributes.
• Session fixation tests.
• Tests on exposure of session variables.
• CSRF tests.

Authorization scheme analysis

Authorization: the concept of allowing access to resources only to those permitted to use them. The aim of analyzing the authorization scheme is to understand how it works and, with that information, attempt to evade the authorization mechanism. To do this, we perform the following tests:

• Tests for access to protected resources.
• Tests to bypass the authorization scheme.
• Privilege escalation tests.

Business rules analysis

Business rules can include rules that express business policies (such as products, prices, or locations) or workflows based on ordered tasks of data transmission from one participant (a person or software component) to another.

• Tests on business rules.
• Functionality abuse tests.

Data validation mechanism analysis

The main problem we encounter in applications is that input data is not properly validated before being used. This makes most of them sensitive to file system attacks or buffer overflow attacks, among others, due to vulnerabilities. To carry out this analysis, the following tests are performed:

• XSS tests (stored, reflected, and DOM-based) / Cross-Site Flashing.
• SQL code injection tests / LDAP injection / ORM injection / XML injection / SSI injection / XPATH injection / IMAP/SMTP injection / code injection / operating system command injection.
• Memory overflow tests.
• HTTP splitting/smuggling tests.

Denial of service (DoS) analysis

Denial of service aims to prevent a system from providing its usual activity to users. These malicious attacks can occur by depriving a system of critical resources, exploiting vulnerabilities, or through functionality abuse.

The goal here is to verify whether the system is vulnerable to this type of threat. To do this, the following tests are carried out:

• User account lockout tests.
• Disk write tests.
• Resource release tests.
• CPU-intensive SQL query tests.

Web services analysis

An analysis will be carried out on the implemented web services to try to detect deficiencies. Access and security controls at the IP level, configuration, information leaks due to deficiencies in error and exception management, implemented validation filters, as well as the existence of auditing and logging controls will be reviewed.

• Information gathering tests.
• Tests on XML structure.
• Tests of HTTP and REST GET parameters.
• Tests on attachments in SOAP.
• Replay tests in web services.