Using Web Security Scanners to Detect Vulnerabilities in Web - PowerPoint PPT Presentation

Using Web Security Scanners to Detect Vulnerabilities in Web Services Marco Vieira, Nuno Antunes , Henrique Madeira {mvieira, nmsa, henrique}@dei.uc.pt DSN 2009 CISUC Department of Informatics Engineering University of Coimbra

Outline  Contextualization  Research Goals  Methodology  Results  Conclusions and Future Work 2 Nuno Antunes DSN 2009, June 29 - July 2, Estoril, Portugal

Contextualization  Web services are increasingly becoming a strategic component in a wide range of organizations  Web services are so exposed that any existing vulnerability will most probably be uncovered/exploited  Both providers and consumers need to assess services’ security 3 Nuno Antunes DSN 2009, June 29 - July 2, Estoril, Portugal

Web Services 4 Nuno Antunes DSN 2009, June 29 - July 2, Estoril, Portugal

Web Services Security  Security threats  Hackers are moving their focus to applications’ code  Traditional security mechanisms (Firewall, IDS, encryption) cannot mitigate these attacks  Vulnerabilities like SQL Injection and XPath Injection are particularly relevant  Developers must  Apply best coding practices  Security testing! 5 Nuno Antunes DSN 2009, June 29 - July 2, Estoril, Portugal

Vulnerability Examples public String auth(String login, String pass) throw SQLException { String sql = "SELECT * FROM users WHERE "+ "username='" + login + "' AND "+ ' OR 1=1 -- "password='" + pass + "'"; ResultSet rs = statement.executeQuery(sql); "SELECT * FROM users WHERE username='' OR 1=1 -- ' AND (…) password= ''“; } public void delete(String str) throw SQLException{ String sql = "DELETE FROM table ' OR ''=' "WHERE id='" + str + "'"; statement.executeUpdate(sql); "DELETE FROM table WHERE id='' OR '' = ''"; } 6 Nuno Antunes DSN 2009, June 29 - July 2, Estoril, Portugal

Software Testing techniques  White-box testing:  The analysis of the application’s code  Black-box testing:  The analysis of application’s execution searching for vulnerabilities  Known as penetration testing  Gray-box testing:  Approaches that combine black box and white box 7 Nuno Antunes DSN 2009, June 29 - July 2, Estoril, Portugal

Web Security Scanners  Easy and widely-used way to test applications searching vulnerabilities  Use fuzzing techniques to attack applications  Perform thousands of tests in an automated way  What is the effectiveness of these tools?  Can programmers rely on these tools? 8 Nuno Antunes DSN 2009, June 29 - July 2, Estoril, Portugal

Research Goals  Study the effectiveness of the scanners  Identify common types of vulnerabilities  In the context of web service environments 9 Nuno Antunes DSN 2009, June 29 - July 2, Estoril, Portugal

Methodology  Apply leading commercial scanners in public web services  300 Web Services tested  Randomly selected  4 Scanners used (including two different versions of a brand) 10 Nuno Antunes DSN 2009, June 29 - July 2, Estoril, Portugal

Experimental Study  Preparation  Select services and scanners  Execution  Test the services using the scanners  Verification  Identify false positives  Analysis  Analysis and systematization of results 11 Nuno Antunes DSN 2009, June 29 - July 2, Estoril, Portugal

Scanners 12 Nuno Antunes DSN 2009, June 29 - July 2, Estoril, Portugal

Vulnerabilities Found  SQL injection  XPath Injection  Code Execution  Possible Parameter Based Buffer Overflow  Possible Username or Password Disclosure  Possible Server Path Disclosure 13 Nuno Antunes DSN 2009, June 29 - July 2, Estoril, Portugal

Overall results analysis VS1.1 VS1.2 VS2 VS3 Vulnerability Types # Vuln. # WS # Vuln. # WS # Vuln. # WS # Vuln. # WS 11 SQL Injection 217 38 225 38 25 5 35 XPath Injection 10 1 10 1 0 0 0 0 0 Code Execution 1 1 1 1 0 0 0 Possible Parameter Based 0 0 0 0 0 0 4 3 Buffer Overflow Possible Username or 3 0 0 0 0 0 0 47 Password Disclosure Possible Server Path 5 0 0 0 0 0 0 17 Disclosure Total 228 40 236 40 25 5 103 22 14 Nuno Antunes DSN 2009, June 29 - July 2, Estoril, Portugal

SQL Injection 225 VS1.2 15 Nuno Antunes DSN 2009, June 29 - July 2, Estoril, Portugal

SQL Injection VS1.1 19 198 27 VS1.2 16 Nuno Antunes DSN 2009, June 29 - July 2, Estoril, Portugal

SQL Injection VS1.1 19 172 26 3 6 24 VS3 VS1.2 17 Nuno Antunes DSN 2009, June 29 - July 2, Estoril, Portugal

SQL Injection VS1.1 19 VS2 2 1 171 21 1 5 3 5 24 VS3 VS1.2 18 Nuno Antunes DSN 2009, June 29 - July 2, Estoril, Portugal

SQL Injection VS1.1 19 ? VS2 2 1 171 21 1 5 3 5 24 VS3 VS1.2 19 Nuno Antunes DSN 2009, June 29 - July 2, Estoril, Portugal

False Positives examination  False positive when  the error/answer obtained is related to an application robustness problem.  the same problem occurs when the service is executed with valid inputs  Confirmed Vulnerabilities when  is possible to observe that a SQL command was invalidated by the “injected” values  the “injected” values lead to exceptions raised by the database server  is possible to access unauthorized resources 20 Nuno Antunes DSN 2009, June 29 - July 2, Estoril, Portugal

False Positives results 225 False Positives 200 37% 40% Doubtful 83 175 87 Confirmed Vulnerabilities 150 11,6% 6,5% 26 125 14 100 25,7% 75 14% 116 116 50 32% 9 25 5 8 21 17 0 VS1.1 VS1.2 VS2 VS3 21 Nuno Antunes DSN 2009, June 29 - July 2, Estoril, Portugal

SQL Injection without False Positives 142 VS1.2 22 Nuno Antunes DSN 2009, June 29 - July 2, Estoril, Portugal

SQL Injection without False Positives VS1.1 3 127 15 VS1.2 23 Nuno Antunes DSN 2009, June 29 - July 2, Estoril, Portugal

SQL Injection without False Positives VS1.1 3 2 103 24 VS3 15 VS1.2 24 Nuno Antunes DSN 2009, June 29 - July 2, Estoril, Portugal

SQL Injection without False Positives VS1.1 3 VS2 2 1 1 21 102 1 3 VS3 15 VS1.2 25 Nuno Antunes DSN 2009, June 29 - July 2, Estoril, Portugal

SQL Injection without False Positives ? VS1.1 3 VS2 2 1 1 21 102 1 3 VS3 15 VS1.2 26 Nuno Antunes DSN 2009, June 29 - July 2, Estoril, Portugal

Coverage analysis  Real number of vulnerabilities unavailable  It is possible to make a comparative analysis  Overestimated Coverage values!! Scanner # SQL Injection Vulnerabilities Coverage % VS1.1 130 87.2% VS1.2 142 95.3% VS2 25 16.8% VS3 26 17.4% Total 149 100% 27 Nuno Antunes DSN 2009, June 29 - July 2, Estoril, Portugal

Common Vulnerabilities SQL Injection (149) 1 10 1 16 Possible Server Path Disclosure (16) XPath Injection (10) Code Execution (1) 149 Possible Parameter Based Buffer Overflow (1) 28 Nuno Antunes DSN 2009, June 29 - July 2, Estoril, Portugal

Conclusions  A large number of vulnerabilities was observed  SQL Injection vulnerabilities are prevalent  Selecting a scanner for web services is a very difficult task  Different scanners detect different types of vulnerabilities  High false positives rates  Low coverage rates  Can we do better? 29 Nuno Antunes DSN 2009, June 29 - July 2, Estoril, Portugal

Preliminary work  Develop a new approach for vulnerabilities detection  Detect SQL Injection and XPath Injection vulnerabilities effectively  Generate workload and attackload  Analyze responses  Analyze vulnerabilities to avoid False positives 30 Nuno Antunes DSN 2009, June 29 - July 2, Estoril, Portugal

Preliminary Work Results 180 False Positives 160 Doubtful 140 Confirmed 120 86 93 100 80 14 60 25 13 13 40 1 0 52 47 47 4 20 4 21 17 0 VS1.1 VS1.2 VS2 VS3 VS.WS 31 Nuno Antunes DSN 2009, June 29 - July 2, Estoril, Portugal