Téléchargez le document

This audit provides an assessment with respect to a set of control points on the components of a Web application, and produces a report highlighting all found vulnerabilities.

Scope and procedure

The analysis is based on the components of a Web application:

• URLs, deduced by an automated exploration of the site,
• Scripts parameters, which combinatorial values produced all test cases,
• JavaScript code, cookies, comments listed during site exploration,
• Inactive links and pages voluntarily excluded from the analysis are also recorded, making the components coverage as complete as possible.

Due to the systematic exploration of all sequences on each page, most accessible pages are processed: their content is analyzed and their parameters are tested.

NOTE: In the case of pages only accessible through a particular procedure (eg : add to cart, provide payment information and confirm the order), scripts for reaching these pages should be provided.

Modules and checkpoints

Tests performed on the Web application's components depend on the modules selected for the evaluation, each of which is composed of several checkpoints.

Among available modules :

• "Server structure intrusion" module
  The directory structure, names and file contents are revealed by these attacks. They may disclose non-public parts of the site containing development files, trace or debug.   
• "Database takeover" module
  These attacks aim to exploit queries made between the web application and the database to introduce additional queries. The purpose of these commands is to explore the contents of the database and retrieve a list of customers and their data, the history of their orders, the contents of the catalog business. Moreover, orders of modification or deletion can also be introduced, with more destructive effects.
• "Identity theft" module
  These are attacks aimed at obtaining personal data from a user. Their purpose is to gain identification in place of a user without a password, or discover it along with other personal information. Finally, details of the user's operations during a session are also achievable by such attacks.

Each control point (several thousands are tested in all available modules) focuses on assessing the vulnerability of components for a very precise attack.
For example, a particular type of attack "Brute Force" is an attempt by a malicious user to access the application by sending a large number of possible passwords and / or usernames.

Since this technique requires a lot of connection attempts, an application that does not limit the number of unsuccessful connection requests is vulnerable to these attacks.

This checkpoint is able to assess whether the application has established such a protection mechanism.

Evaluation Report

The evaluation report is an HTML report providing:

• a presentation of results in two ways: by levels of performance, or control points
• a natural and quick navigation to important elements

The performance level navigation introduces a rating system for all levels of components, starting from the highest level (application) for which an overall score is calculated, to the lower components, which have the same rating system.
This approach provides a single overall level for the application (in terms of vulnerability to attacks), and a quick and effective exploration of the factors responsible for good or bad overall performance.

The control points navigation can also find good and bad elements, this time guiding the exploration by the type of attacks.
By selecting a particular module, then a specific checkpoint, it is possible to target the vulnerable components of a particular type of attack.

For more information, send an email to This e-mail address is being protected from spambots. You need JavaScript enabled to view it or fill in the information request.

Objective

Research of possible programming errors in source files.

Justification

Some uses of the specificities of a language can lead to the introduction of bugs in the code (during the development or the maintenance phase). Their early localization allows to avoid many potential defects and to spare time during the validation and software exploitation phases.

Languages

C, C++ …

Controls

Search for the following defects:
•    Instructions without effect
•    Unreachable code
•    Empty bloc in a test
•   « break » missing in a « switch » branch
•   « default » missing in a « switch »
•    Use of the return of a procedure
•    Confusion between assignment and test
•    Comparisons of real numbers for equality or difference

Tool used

IBM Rational Logiscope RuleChecker

Material