Introduction to At a Glance:

Because we now have new opportu-

Testing Web
nities to communicate, we also have
new opportunities for misuse. Even
though every application is different,
there are some general industry-
standard risk areas for Web applica-

Application tions. This article addresses Web

security testing at the application
level.

Security by Tim Van Tongeren

Unlike most client-only applications, Web required should be based on the security profile. For other Web applications, only
based applications have viewable code, requirements, which should be defined by the system administrator can create user
access to the contents of the Web server, a requirements analyst, like other non- profiles. The registration process should
and information that can be intercepted. functional requirements. When there are be tested for potential security risks. For
Because of these new opportunities to no requirements or requirements are not example, if the user sets the password, it
communicate, there are also new opportu- complete, the tester can use the risk areas should be a required field. If the password
nities for misuse. identified in this article to raise concerns. is assigned by the system, there should be
Even though every application is different, business rules concerning generation,
Most of the security testing literature looks there are some general industry-standard delivery and first-use of passwords. For
at vulnerabilities of the network and Web risk areas for Web applications. The risk example, duplicate, identical users should
server, but this article discusses Web secu- areas that we will examine in this article not be allowed to register.
rity testing at the application level. Much are:
attention is given to the network and Web • User authentication The verification portion of the application
server, but sometimes the applications • User authorization should be tested to ensure that valid user
they are housing are not secure. • Security holes in the application and password combinations allow access
Additionally, when testing a Web applica- • Data access through the URL and that invalid user and password combi-
tion, the tester does not always know the • Altered client code nations do not allow access. There may be
network architecture, operating system, or other security requirements like a log file
Web server for each implementation of the User Authentication of failed logins, the disabling of profiles
application. Finally, the risk areas dis- In order to be identified as a user, so one after a certain number of incorrect logins,
cussed in this article allow average users can gain authority to perform tasks, some or the disabling of access after a certain
to stumble on secure information. These Web systems require users to register and number of failed logins. There should also
risk areas do not require a malicious user be verified via a login process. Generally, be verification of proper logout processes,
to run a Perl script or use network penetra- the users will login with a User ID and a including the handling of session timeouts,
tion tools; they can be exploited with the password. user requested logouts, and logouts by
browser and a text editor. navigating away from the site.
Before one can just log in to the applica-
The amount of security testing one should tion, their user profile must be created in Another potential security risk with logins
perform generally depends on the type of the system. For some Web applications, is when cookies are used. A cookie is
application under test. The level of testing the user can register and create an online information stored on the client machine

September/December 2001 http://www.testinginstitute.com Journal of Software Testing Professionals 41

with which the Web server can interact Using these scenarios, we can consolidate include a checkbox on the login screen to
(read and write privileges.) Cookies can them into test cases. Test Case 1 will incor- allow the user to tell the system to store the
store any information the user sends to the porate Scenario 1 and 2. Test Case 2 will username (e.g. “remember me”). In this
Web application, either entered by the user incorporate Scenario 3 and 2. Test Case 3 case, you will need to make sure that when
or automatically sent by the client brows- will incorporate Scenario 2 and 4. Test the box is checked, the cookie stores the
er. Additionally, cookies may store infor- Case 4 will incorporate Scenario 2 and 5. username, but when it’s not checked, the
mation derived by the server. cookie does not store the new username
Test Cases and that it retains the current default user-
Generally, cookies store things like names, 1. Log in with USERNAME1. Verify that name.
User IDs, passwords, and browsing trends. the cookie stores USERNAME1. Go back
By storing the authentication information to the site and verify that the cookie stored Also, when testing cookies, don’t forget to
on the client machine, the user does not USERNAME1 as the default username delete old ones if the test case requires the
need to enter the User ID and password at for that client. server to act as if this is a new visitor. In
each login. With these applications, the between execution of each of the test cases
system should be tested to ensure that 2. Log in with USERNAME1. Log out described in our example above, the cook-
cookie processing is secure. and verify that the cookie stored USER- ie should be deleted on the client machine,
NAME1. Return to the site and log in with as an initialization step, to ensure a clean
The most common way to ensure cookie USERNAME2. Verify that the cookie test.
security is with encryption. If not, the stores USERNAME2.
cookies.txt file could be read or altered. If User Authorization
a malicious user knew the structure of the 3. Log in with USERNAME1. Log out Once granted permission to access the
cookies used by the application, they and attempt to log in with USERNAME3 application, the user is allowed to perform
could check clients for the cookies and (which does not exist). Verify that the sys- tasks. Most Web applications have multi-
extract additional personal information tem gives a login error. Verify that the ple user groups or roles with different lev-
contained in them. Likewise, they could cookie stored USERNAME1. Go back to els of authority. Some of these groups may
create a cookie on their client to pose as the site and verify that it allows login with include the general public, registered
another user, and be allowed access to per- USERNAME1. members, moderators, and the administra-
form the tasks allowed for that user. tor. Members of each of these groups have
4. Log in with USERNAME1. Log out different privileges within the application.
User Authentication with and attempt to log in with USERNAME2 The definition of each group and access
Cookies and an incorrect password. Verify that the allowed to its members should be speci-
Let’s go through a sample test of cookies. system gives a login error. Verify that the fied in the requirements.
The cookie for this application stores the cookie stored USERNAME1. Go back to
username. There is also a requirement that the site and verify that it allows login with To verify that these rules are enforced by
the most recent successful login shall USERNAME1. the system, the tester will need to perform
become the default User ID for the com- positive and negative testing for each sys-
puter. Based on these requirements here To verify that the cookie stores the correct tem task with a user profile from each
are a few scenarios we can test: User ID the tester can take either a black- group. For example, let’s look at some
box or white-box approach. Using the security requirements for a message board
Scenarios black-box approach, the tester would use application. In order to perform a test from
1. Valid login the Web application to display the current Table 1, you should create a user in each of
2. Valid login, return to site and use User ID. Even if the password is not the user groups. Then for each user, test
cookie for authentication stored, the User ID may populate in the each of the authorities. (See Table 1.)
3. Valid login, valid login with different login field. The white-box approach to
username verification would have the tester verify If the system supports the functionality to
4. Invalid login due to unregistered the contents of the cookie file on the client change a user’s group, then additional test-
username machine. Since cookies are generally ing should be done to ensure that the
5. Invalid login due to incorrect pass- encrypted, this will require a separate pro- allowed actions are changed as well. In the
word for username gram that decrypts the contents of the above example, if a user is moved from
cookie for verification. the Moderator group to the Members
A variation on this application might group, he should no longer be able to

42 Journal of Software Testing Professionals http://www.testinginstitute.com September/December 2001

 User Group Read Message Post Message Delete Message Delete User
Public Allowed Prohibited Prohibited Prohibited
Members Allowed Allowed Prohibited Prohibited
Moderator Allowed Allowed Prohibited Prohibited
Administrator Allowed Allowed Allowed Allowed
Table 1: User groups and authorities for a message board application

delete a message. would be sent to the system’s command these parameters it submits a query for a
line and it would start deleting files. five-year set of data with the detailed view
Security holes in the The same principle applies to proprietary for the ticker of “MCD”. Each value is a
program applications. Buffer overflows and escape specific field in a pre-built query that is
During security testing, the tester should characters should not give access to the sent to a database. Then retrieving the
verify that the system is safeguarded operating system. To avoid this security information in the database, the applica-
against a command language invocation hole, test the application for escape char- tion builds a Web page. Based on the pre-
attack. This type of attack attempts to acters. Make sure that the system does not vious example, we can view the chart for
force the server to execute operating sys- rollover to the command line when the IBM, for example, by changing the
tem commands by using escape charac- application receives bad parameters. In the “MCD” to “IBM”.
ters, overflowing the buffer, or overriding above example, perhaps the application
parameters in the programs. The easiest should give a general error message www.server.com/5yr+DetailView+IBM
targets are the default programs included instead.
with a system since these vulnerabilities Now, let’s take this data access a step fur-
are well known. For example, there are Data access through the ther. Let’s say your current URL is this:
several CGI programs that come standard URL
on UNIX. Since anyone with UNIX has Another attack that can be made from the www.server.com/pgm.exe&Function=Re
access to them, malicious users can figure location field of a browser is parameter view&Order=1029343
out how to use or break them. With some tampering. When a malicious user uses
of these programs, if a bad character is this technique they modify the parameters This URL returned a page that reviewed a
sent as a parameter the program will exit of SQL statements in the URL to try to customer order #1029343. Now, what
and then the rest of the command, still in retrieve or modify data. would happen if the server did not verify
the buffer, is executed at the command commands before invoking them? For
line. You may have done something similar to example, if you changed the order num-
save time. Let’s say you are looking up ber, the system would allow you to see
So, let’s say that a backtick was an escape stock prices on a certain site. If you like other orders, as well as the order details.
character that exited a specific program viewing the 5-year chart for the stock per- What if you changed the Function from
named lookup.pl. This program would be formance, but the default chart is the 1- Review to Create, Update, or Delete?
working fine until it attempted to process year chart, you may just go up the URL
the backtick. Upon hitting the backtick and change the Year field. If you want to Some URLs are not that obvious but
character, the program would hit an error switch tickers you may just change it in unless the URL is encrypted it doesn’t take
condition where it failed over to the com- the URL rather than submitting a new very long to figure out the syntax. One
mand line. Everything after the backtick, request through the Submit button. For a preventative measure that sites can use is
still in the buffer, would be executed at the certain application, the URL for the five- passwords or entry codes that change
command line. Imagine what would hap- year, detailed chart of McDonalds might every second. If the command in the URL
pen if you typed in this URL: be: doesn’t have the code-of-the-second, it
www.server.com/cgi-bin/lookup.pl`rm-rf won’t perform the query.
www.server.com/5yr+DetailView+MCD
Other, less destructive attacks might only For a stock application, like we discussed
steal password files or other sensitive data. above, public users can usually view all of
But in this case, the command “rm-rf” When this specific application receives the data. However, with other applications

September/December 2001 http://www.testinginstitute.com Journal of Software Testing Professionals 43

users should not have access to all data in are altered, the application could write information about the system or login
the database. The server should verify the data improperly to the database, causing screens.
data before simply processing it. For lost or corrupted data. If the client is
example, what would the server do with changed allow mandatory fields to be After testing the security of the applica-
this URL? bypassed, a customer request may not be tion, the tester may need to validate the
fulfilled. security of third party applications with
www.server.com/pgm.exe&Function=Re which the main application interacts, the
view&Order=Hello! Each program on the Web server should Web server which hosts the application,
verify all data it receives: from clients, and the network on which the web server
After doing this on one Web server, the other programs on the Web server, and resides.
system presented an error screen that con- third party sources. If the program
tained a login to administer the database! assumes the data is correct and processes About the Author
The data entered caused a variable type it, there could be a security hole. Client Tim Van Tongeren is a senior quality
mismatch error, which rolled over to a code can be changed. Programs can be assurance analyst at WorldCom. He has
generic error-handling module. That mod- written to send malicious transactions to experience across the software develop-
ule pointed to a login page for the data- your program. ment lifecycle working on government
base, which may have been helpful during and private projects with several Fortune
development, but not in a production envi- To test this a tester can save the page to the 500 companies.
ronment. local drive. Then, modify the code to
attempt the desired query, bypass the
Altered Client Code client edits, or alter the price of an item.
Rather than having application parameters Finally, open the page in a browser. The
in the address, as described above, some page should make a call to the Web server
applications have parameters in the client as if it was the real page. If the server does
code. If one viewed the source code, they not catch the improper requests from the Call for Submissions
could see those parameters and attempt a altered client, there is probably a security
similar attack, called embedded SQL concern. JSTP is looking for articles reflecting
hijacking. real life experiences with any of the fol-
Conclusion lowing areas:
Data access that should be disallowed Many opportunities exist in Web applica-
might be allowed, but there are other prob- tions for security violations. The good • Testing
lems as well. Parameters such as item news is you are now aware of some of
prices in the client code can be altered. If those issues and are able to incorporate • Requirements
the server does not verify these fields, the them into your next test plan. With this
customer could purchase the item at the knowledge you should be better prepared • Bug Tracking and Reporting
wrong price. to test Web applications and to protect
your company’s software from unautho- • Incident Management
To make matters more complicated, veri- rized use.
fication logic can be inside the client code. • Configuration Management
In an effort to improve the performance of Testers wanting to learn more about Web
the Web server, developers may include all application security might also be interest- • Release Management
of the verification logic with the client ed in security risks due to improper error
rather than the server. Even so, the client handling. Overly descriptive error mes- • Risk Assessment
code could be altered. sages sometimes include data that can be
used for unauthorized use. Improper error • Test Process Measurements
Client-based verification logic such as handling sometimes results in login and Improvements
field lengths, data format, and mandatory screens or other point of access not meant
field verification are dangerous. If the field for the public user. Additionally, perform- For guidelines, please visit our Web
length edits are changed, a buffer overflow ance issues occasionally cause errors due site:
would be allowed and might crash the to simultaneous database updates or sys- www.testinginstitute.com
application. If the data format verifications tem crashes, which subsequently offer

44 Journal of Software Testing Professionals http://www.testinginstitute.com September/December 2001