Web Application
Audit

Before auditing an application, it is necessary to determine the scope of the security review with certain key aspects regarding it, which consist of, among others, the following:

• Application discovery.
• Identification of application entry points.
• Analysis of error codes.
• Platform identification.

Attacks that can be carried out against applications may be initiated through the analysis of the protocols implemented by them. Sometimes, security controls may not be implemented robustly enough, and at other times, the incorrect implementation of proprietary libraries for standard protocols also results in security vulnerabilities within the system.

Analysis of the infrastructure and architecture topology can reveal information such as source code, supported HTTP methods, administrative functionalities, authentication methods, or infrastructure configurations. At this point, the following tests are performed:

• SSL/TLS testing.
• Infrastructure configuration management testing.
• Application configuration management testing.
• File extension handling testing.
• Identification of old, backup, or unreferenced files.
• Access to administrative interfaces.
• HTTP method and XST testing.

Authentication: "is the act of establishing or confirming something (or someone) as authentic." An example of this process is the login process; to perform this analysis, the following tests are conducted:

• Transmission of credentials over an encrypted channel.
• User enumeration tests.
• Tests for predictable user account identification.
• Brute-force tests.
• Tests to bypass the authentication scheme.
• Session termination tests.
• Tests on CAPTCHA implementations.
• Multi-factor authentication tests.
• Race condition tests.

At the core of any web-based application lies the way it maintains state control and, therefore, interaction with the user. In the broadest sense, session management encompasses all controls over a user, from authentication to exiting the application.

• Testing the session management schema.
• Testing for cookie attributes.
• Testing for session fixation.
• Testing for exposed session variables.
• Testing for CSRF.

Authorization: "It is the concept of granting access to resources only to those permitted to use them." The goal of analyzing the authorization scheme is to understand how it works and, with that information, attempt to bypass the authorization mechanism. To this end, we perform the following tests:

• Tests for access to protected resources.
• Tests to bypass the authorization scheme.
• Privilege escalation tests.

Business rules may include rules that express business policies (such as products, pricing, or locations) or workflows based on ordered tasks for data transmission from one participant (a person or a software component) to another.

• Business rule testing.
• Testing for functionality abuse.

The main problem we encounter in applications is that input data validation is not performed properly before use, which causes most of them to be susceptible to attacks against the file system or buffer overflow attacks, among others, as they are affected by vulnerabilities. To carry out this analysis, the following tests are performed:

• XSS tests (stored, reflected, and DOM-based) / Cross Site Flashing.
• SQL injection / LDAP injection / ORM injection / XML injection / SSI injection / XPATH injection / IMAP/SMTP injection / code injection / OS command injection tests.
• Memory overflow tests.
• HTTP Splitting/Smuggling tests.

Denial of Service (DoS) aims to prevent a system from providing its usual activity to users. These malicious attacks can occur by depriving a system of critical resources, exploiting vulnerabilities, or through the abuse of functionality.

The goal at this point is to verify if the system is vulnerable to these types of threats; for this purpose, the following tests are carried out:

• User account lockout tests.
• Disk writing tests.
• Resource release tests.
• CPU-intensive SQL query tests.

An analysis of the implemented Web Services will be conducted to attempt to detect deficiencies. Access and security controls at the IP level, configuration, information leaks caused by deficiencies in error and exception management, implemented validation filters, as well as the existence of audit and logging controls will be reviewed.

• Information gathering tests.
• Tests on the XML structure.
• Tests of HTTP GET and REST parameters.
• Tests of attachments in SOAP.
• Replay tests on Web Services.

• High-level executive summary with the classification of the results.
• Details of all tests performed, specifying their objective.
• Results obtained in the different tests conducted, with step-by-step descriptions of the detection and exploitation process for each vulnerability.
• Recommendations to resolve the identified security issues in the most accurate way.
• Classification of security issues according to their danger level, including CVSS values. This will allow the company to develop an efficient action plan to resolve these security issues.
• Meeting aimed at explaining the results obtained in the audit and providing advice on possible solutions for the security issues found.