Application Security Testing(1)_Lecture Script

Instructions for setting up Virtual Machines (VMs) have been sent out. This setup is crucial for hands-on labs, allowing students to simulate various environments for application testing.
It is necessary for upcoming application vulnerability assessment exercises, which will help students gain practical skills in identifying and mitigating security risks.
Emphasis on using tools strictly for educational purposes, not malicious hacking. Understanding ethical guidelines is fundamental to ensure students appreciate the importance of responsibility in cybersecurity practices, and that they always have the necessary permissions before testing any systems.

The primary purpose of application security testing is to identify vulnerabilities that could potentially be exploited by malicious actors.
Distinction between the roles of the red team (attacking) and blue team (defending): The red team actively seeks to penetrate systems exploiting vulnerabilities, while the blue team focuses on defensive measures to protect those systems from threats.

Vulnerability Assessments

Definition and methodology of vulnerability assessments:
- Non-intrusive methods are crucial and require authorization before scanning systems to respect privacy and security protocols. It is essential to ask for permission before conducting tests to avoid legal repercussions.
- Maintain a host list to avoid boundary violations, allowing teams to focus their efforts and ensuring that all systems scanned are within the agreed scope.
Types of scans include:
- Authenticated Scan: Provides deeper insights due to elevated permissions granted to the scanning tool, allowing for a comprehensive analysis of vulnerabilities.
- Unauthenticated Scan: Emulates an external attacker's viewpoint, helping to understand how systems could be attacked from outside.
Challenges include:
- Scanning cloud services, which often have dynamic environments and unique configurations that complicate vulnerability assessments.
- Containerized services changing frequently, necessitating adaptable testing methodologies that keep pace with infrastructure changes.
- Continuous updates needed for vulnerability databases to ensure that teams are aware of the latest threats and can quickly address them.

Reporting and Documentation

Importance of reporting:
- Essential for justifying application deployment or necessary fixes, helping stakeholders understand the need for security measures.
- Aids documentation of levels of risk accepted by the business, allowing for informed decision-making processes regarding risk management.
- Must include detailed vulnerability findings and remediation strategies, serving as a historical record to inform future assessments and demonstrate compliance during audits.

Access and use of the NVD for baseline vulnerability data: Students should familiarize themselves with how to query and interpret data within the NVD to assist in their assessments.
Familiarize with Common Vulnerabilities and Exposures (CVE) system, scoring system, and assessment criteria, including:
- Base Score, representing the intrinsic qualities of a vulnerability.
- Impact Score, gauging the potential consequences of exploitation.
- Modified Impact Score, evaluating how different factors might affect severity in particular environments.
- Temporal Score, considering factors like exploitability and remediation maturity that change over time.

Defining Scope: Clearly determine applications and systems to test, ensuring all stakeholders agree on the parameters to avoid scope creep during testing.
Reconnaissance: Gather data about target systems, including technical details and potential social engineering tactics that can be employed to gain additional insights.
Discovery: Identify live hosts, services, and existing vulnerabilities, utilizing various tools to scan networks and identify weaknesses.
Exploitation: Validate vulnerabilities found by attempting to exploit them, demonstrating the impact of identified vulnerabilities directly.
Reporting: Document assessment outcomes and proposed fixes in a clear, structured manner that is accessible for both technical and non-technical stakeholders.

Types of Penetration Tests

Black Box: Tester has no prior knowledge about the application; tests imitate a real-world attacker who has no inside information.
White Box: Tester has complete access to source code and architecture, allowing for a thorough analysis from a developer's perspective.
Gray Box: Limited knowledge, such as user credentials granted to the tester, combining aspects of both techniques to evaluate vulnerabilities effectively.

Common Vulnerabilities:
1. Buffer Overflows: Allow attackers to overwrite memory boundaries leading to unauthorized code execution.
1. Race Conditions: Lead to inconsistent states, particularly harmful in high-concurrency situations.
2. Input Validation Attacks: Result from failure to sanitize user input, examples include SQL Injection and Cross-site scripting (XSS), which can be devastating.

SQL Injection Attack

Demonstrated via manipulation of user input that alters SQL commands. For instance, consider the basic SQL format: SELECT * FROM users WHERE username = '$username' AND password = '$password'. An attacker could exploit by injecting ' OR '1'='1 into the username field, thereby bypassing authentication checks and gaining unauthorized access to user accounts.

Authentication Risks: Highlighted by weak password storage practices, insecure reset mechanisms that fail to verify the user’s identity effectively.
Authorization Bypasses: Occur when restricted resources can be accessed without meeting proper checks, leading to potential data breaches and exploitation of sensitive information.

Avoid creating custom algorithms; instead, rely on established secure frameworks that have been professionally vetted for safety.
Regularly update cryptographic methods, such as replacing vulnerable libraries and implementing stronger encryption protocols to mitigate new threats.

Conclusion

Importance of continuous security assessments: Organizations must regularly evaluate their security posture to adapt to emerging threats in the landscape.
Following ethical guidelines is critical, including obtaining permission for security testing to avoid ethical violations and legal implications.
Never perform tests on live production systems without express consent and a proper safety net in place, ensuring that risks are minimized and operations remain uninterrupted.