Web Application Assessments

With the uptake of cloud computing and the advancements in browser technology, web applications and web services have become a core component of many business processes, and therefore a lucrative target for attackers. Over 70% of websites and web applications however, contain vulnerabilities that could lead to the theft of sensitive corporate data, credit cards, customer information and Personally Identifiable Information. Infinity forensics examines your web applications from a coding and implementation flaw perspective, and also looks at other issues like SQL injection and cross-site-scripting (XSS), involving active exploitation of vulnerabilities in order to gain access.

 Scope and Methodology

  • Host and service Vulnerability check.
  • Assess on web applications for vulnerabilities that can lead to unauthorized access or data exposure
  • Application configuration and network communication discovery.
  • Manual & automatics testing of logins, credentials, sessions/cookies, and application behavior.

Infinity Forensics uses tools from Acunetix , Rapid 7 ,  HP Fortify for security assessments, as well as a standards based approach from Open Web Application Security Project Top 10 (OWASP Top 10) and  SANS Top 25 Most Dangerous Programming Errors (CWE/SANS).

 

OWASP Top 10 (Open Web Application Security Project)

 

A1

Injection

A2

Broken Authentication and Session Management (XSS)

A3

Cross Site Scripting (XSS)

A4

Insecure Direct Object References

A5

Security Misconfiguration

A6

Sensitive Data Exposure

A7

Missing Function Level Access Control

A8

Cross Site Request Forgery (CSRF)

A9

Using Components with Known Vulnerabilities

A10

Unvalidated Redirects and Forwards

 

SANS Top 25 Most Dangerous Programming Errors (CWE/SANS)

Insecure Interaction between Components

These weaknesses are related to insecure ways in which data is sent and received between separate components, modules, programs, processes, threads, or systems.

CWE ID

Name

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-434

Unrestricted Upload of File with Dangerous Type

CWE-352

Cross-Site Request Forgery (CSRF)

CWE-601

URL Redirection to Untrusted Site ('Open Redirect')

Risky Resource Management

The weaknesses in this category are related to ways in which software does not properly manage the creation, usage, transfer, or destruction of important system resources.

CWE ID

Name

CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-494

Download of Code Without Integrity Check

CWE-829

Inclusion of Functionality from Untrusted Control Sphere

CWE-676

Use of Potentially Dangerous Function

CWE-131

Incorrect Calculation of Buffer Size

CWE-134

Uncontrolled Format String

CWE-190

Integer Overflow or Wraparound

Porous Defenses

The weaknesses in this category are related to defensive techniques that are often misused, abused, or just plain ignored.

CWE ID

Name

CWE-306

Missing Authentication for Critical Function

CWE-862

Missing Authorization

CWE-798

Use of Hard-coded Credentials

CWE-311

Missing Encryption of Sensitive Data

CWE-807

Reliance on Untrusted Inputs in a Security Decision

CWE-250

Execution with Unnecessary Privileges

CWE-863

Incorrect Authorization

CWE-732

Incorrect Permission Assignment for Critical Resource

CWE-327

Use of a Broken or Risky Cryptographic Algorithm

CWE-307

Improper Restriction of Excessive Authentication Attempts

CWE-759

Use of a One-Way Hash without a Salt