Bypass Testing of Web Applications Jeff Offutt George Mason - PowerPoint PPT Presentation

Bypass Testing of Web Applications Jeff Offutt George Mason University Professor of Software Engineering www.cs.gmu.edu/~offutt

My bypass testing playmates Ye Wu Vasileios Papadimitriou Joann J. Ordille Xiaochen Du Qingxian Wang Upsorn Praphamontripong Hong Huang November 2020 Jeff Offutt 2 of 30

Deploying software • Bundled : Pre-installed on computer • Shrink-wrap : Bought and installed by end-users • Contract : Purchaser pays developer to develop and install, usually for a fixed price • Embedded : Installed on a hardware device, usually with no direct communication with user • Web : Executed across the Internet through HTTP 3 November 2020 Jeff Offutt of 30

Problem parameters HTTP is a stateless protocol • – Each request is independent of previous requests Servers have little information about where a request • comes from Web site software is extremely loosely coupled • – Coupled through the Internet – separated by space – Coupled to diverse hardware devices – Written in diverse software languages November 2020 Jeff Offutt 4 of 30

Web application input validation Bad Data Check data • Corrupts data base • Crashes server Check data • Security violations Sensitive Data Client Server Malicious Data Can “bypass” data checking November 2020 Jeff Offutt 5 of 30

Bypass testing • Users can easily “ bypass ” client-side constraint enforcement • Bypass testing constructs tests to intentionally violate constraints : – Eases test automation – Validates input validation – Checks robustness – Evaluates security J Offutt, Y Wu, X Du, and H Huang. Bypass Testing of Web Applications. IEEE International Symposium on Software Reliability Engineering, November 2004 6 November 2020 Jeff Offutt of 30

Simple example web page User Name: Age: Version to purchase: Small Medium Large $150 $250 $500 November 2020 Jeff Offutt 7 of 30

Proper behavior Invalid data, please correct … User Name: Age: Alan<Turing 500 Username should Age should be be plain text only. between 18 and 150. Version to purchase: Small Medium Large $150 $250 $500 November 2020 Jeff Offutt 8 of 30

Abbreviated HTML <form> <input type=“text” name=“username” size=20> <input type=“text” name=“age” size=3 maxlength=3> <p> Version to purchase: … <input type=“radio” name=“version” value=“150” Checked> <input type=“radio” name=“version” value=“250”> <input type=“radio” name=“version” value=“500”> <input type="submit" onClick="return checkInfo(this.form)"> <input type=“hidden” isLoggedIn=“no”> </form> November 2020 Jeff Offutt 9 of 30

Bypass behavior Extremely loose coupling … combined with the stateless protocol … allows users to easily bypass client-side checking Users can save and modify the HTML November 2020 Jeff Offutt 10 of 30

Saved & modified HTML <form> <input type=“text” name=“username” size=20> <input type=“text” name=“age” size=3 maxlength=3> Allows an input with arbitrary age, <p> Version to purchase: no checking, cost=$25 … … ‘<‘ can crash an XML parser <input type=“radio” name=“version” value=“150” Checked> Text fields can have SQL statements <input type=“radio” name=“version” value=“250”> <input type=“radio” name=“version” value=“500”> 25 <input type="submit" onClick="return checkInfo(this.form)"> yes <input type=“hidden” isLoggedIn=“no”> </form> November 2020 Jeff Offutt 11 of 30

In-class exercise 1 Saved and modified HTML Open the HTML file: https://cs.gmu.edu/~offutt/calculate.html 1. Save it to your computer: i. <ctrl>-u in your browser ii. Copy and paste to your local computer 2. Open the HTML file in your computer 3. Identify elements that could be “bypassed” November 2020 Jeff Offutt 12 of 30

Applying bypass testing Validating input data on the client is like asking your opponent to hold your shield in a sword fight • Analyze HTML to extract form elements • Model constraints imposed by HTML and JavaScript • Rules for data generation : – From client-side constraints – Typical security violations – Common input mistakes November 2020 Jeff Offutt 13 of 30

Client-side constraint rules Violate size restrictions on strings Introduce values not included in static choices • Radio boxes • Select (drop-down) lists Violate hard-coded values Use values that JavaScripts flag as errors Change “transfer mode” (get, post, …) Change destination URLs November 2020 Jeff Offutt 14 of 30

Server-side constraint rules Data type conversion Data format validation Inter-field constraint validation Inter-request data fields (cookies, hidden) November 2020 Jeff Offutt 15 of 30

Example security violation rules Potential Illegal Character Symbol Empty String Commas , Single and double quotes ’ or ” Tag symbols Tag symbols < and > Directory paths .. ../ Strings starting with forward slash / Strings starting with a period . Ampersands & Control character NIL, newline Characters with high bit set 254 and 255 Script symbols < javascript > or < vbscript > November 2020 Jeff Offutt 16 of 30

In-class exercise 2 What can happen? Run this program: https://cs.gmu.edu:8443/offutt/jsp/gradecalculate.jsp Look at the source (<ctrl>-u) and identify client-side validation rules November 2020 Jeff Offutt 17 of 30

Research validation of bypass testing • Autobypass : A web application that accepts a URL and generates input data for the HTML form fields – Also accepts any needed login data – MS thesis by Vasileios Papadimitriou • Built on top of HttpUnit (which extends JUnit) – Parses HMTL pages – Identifies formsand their fields – Creates bypass test cases – Submitstest cases to the application’s server Generate Parse Set default Review test vases interface values results & run tests November 2020 Jeff Offutt 18 of 30

Types of client input validation • Client side input validation is performed by HTML form controls, their attributes, and client side scripts • Validation types are categorized as HTML and scripting – HTML supports syntactic validation – Client scripting can perform both syntactic and semantic validation HTML constraints Scripting constraints • Length (max input characters) • Data Type (e.g. integer check) • Value (preset values) • Data Format (e.g. ZIP code format) • Transfer Mode (GET or POST) • Data Value (e.g. age value range) • Field Element (preset fields) • Inter-Value (e.g. credit # + exp. date) • Target URL (links with values) • Invalid Characters (e.g. <,../,&) November 2020 Jeff Offutt 19 of 30

Example interface: yahoo registration form Preset Transfer Mode Preset Values (HTML) in form definition (HTML) Limited Length (HTML) URL with preset Values (HTML) Inter Value validation (script) Preset number of Fields Data Value , Type , & Format (HTML) validation (script) November 2020 Jeff Offutt 20 of 30

Real-world examples atutor.ca nytimes.com bankofamerica.com Atalker Us-markets ATM locator, Site search demo.joomla.or mutex.gmu.edu comcast.com Login form Poll, Users Service availability phpMyAdmin yahoo.com ecost.com Main page, Notepad, Composer, Detail submit, Set Theme, Search reminder, Shopping cart control Weather Search SQL Query, google.com DB Stats barnesandnoble.com Froogle, Language tools brainbench.com Cart manager, Pure black-box testing pageflakes.com Book search/results Submit Request means Info, New user Registration amazon.com no source (or permission) needed myspace.com wellsfargolife.com Item dispatch, Events & Music Quote search Handle buy Search November 2020 Jeff Offutt 21 of 30

Results v J Offutt, V Papadimitriou, and U Praphamontripong. A Case Study on Bypass Testing of Web Applications. Empirical Software Engineering, 19(1):69-104, February 2014 November 2020 Jeff Offutt 22 of 30

In-class exercise 3 Construct bypass tests for gradeCalculate Encode your tests using URL rewriting Example valid test, 2 courses courseCount=2 courseName1=C1 courseName2=C2 courseGrade1=A courseGrade2=B courseCredit1=3 courseCredit2=3 Expected output: GPA=3.5 https://cs.gmu.edu:8443/offutt/jsp/gradecalculate.jsp?courseCount= 2&courseName1=xx&courseGrade1=A&courseCredit1=3&courseNam e2=yy&courseGrade2=B&courseCredit2=3 November 2020 Jeff Offutt 23 of 30

Industrial case study • Inventionsfrom scientists are slow to move into industrial practice • We investigated whether the obstacles are : – Technical difficulties of applying to industrial use – Social barriers – Businessconstraints • Applied bypass testing through the research arm of a software company November 2020 Jeff Offutt 24 of 30