The following specific test cases were developed concurrency during the above development process. Additionally KUP_Gatehouse had functionality removed to new classes checking http_headers (interceptor class). The same for VERBchecker
Resources and Private Pages – I.e tested from outside the application using a bash script and curl
- Verify all pages and resources by default require authentication except those specifically intended to be public (Principle of complete mediation).
- Verify all authentication controls are enforced on the server side. – Curl and bash script & Unit test on components.
- Verify all authentication controls fail securely to ensure attackers cannot log in – Unit tests with exceptions.
- Client and authentication manager to inform encourage and discourage passwords using the following given in the post KUP Assessments Password Schema.
KUP_Gatehouse
- Sets up filters and interceptors for incoming requests and outgoing responses
- When username and password are both set to clear return 203 – Non-Authoritative Information
HTTP_HeaderChecker
- All sensitive data is sent to the server in the HTTP message body not the headers Any requests containing data other than that defined by the system in the header is rejected with a 400 response
- X-XSS-Protection: 1; mode=block header is in place
- Sets appropriate anti-caching headers as per the risk of the application, such as the following: Expires: Tue, 03 Jul 2001 06:00:00 GMTLast-Modified: {now} GMTCache-Control: no-store, no-cache, must-revalidate, max-age=0Cache-Control: post-check=0, pre-check=0Pragma: no-cache
Verb_Checker
- Only accept standard crud HTTP verbs (GET, POST, PUT, DELETE)
RequestThrottler
- Log if limits are reached
- Must be an combination of IP address and username for authoring and IP address, browser and resource requested.
- IP addresses – have exceptions for any monitoring tools or datacentre ranges (addresses that end web consumers should not be using). Also no limiting of yahoo, google etc.
- return 429 status code and advice in header
- Is there an existing Throttling library?
KUP_Facade
- URL endpoints
- Base URL: /KUPassessments/
- account/create/
- account/update/
- account/assessment/create/
- account/assessment/{assessmentid}
- account/assessment/update/
- account/assessment/delete/
- participant/assessment/{assessmentid}
- Every HTTP response contains a content type header specifying a safe-character set (e.g., UTF-8, ISO 8859-1).
- HTTP headers or any part of the HTTP response do not expose detailed version information of system components.
- all API responses contain X-Content-Type-Options:nosniffandContent-Disposition:attachment;filename=”api.json”(or other appropriate filename for the content type).
- URL redirects and forwards only allow white listed destinations, or show a warning when redirecting to potentially untrusted content.
- ID values stored on the device and retrievable by other applications, such as the UDID or IMEI number are not used as authentication tokens
- Same encoding style is used between the client and the server
URIsanitiser
- intercepts all parameters in the uri’s for os command injection attacks and returns a 406 error if any are found. Commands include chaining with “&”, “&&”, “|”, “||”,
- Intercepts file inclusion attacks by stopping calls that have .txt .php or any file extension and return a 406 error.
- Intercepts Local File Inclusion (LFI) attacks by looking for ../ in a uri and returning a 406 error
KUP_Assessments
- Acts a the link with the rest of the application
PasswordRecovery
Sends an email to account with code and link that stays alive for 5 minutes.
When post request received must have live reset code/soft token with new password and confirmed new password.
When the response to new password is sent it does not contain any account identifiable information or password data (old or new). Either in successful response or failure
Verify that the changing password functionality includes the old password, the new password, and a password confirmation.
When the response to updated password is sent it does not contain any account identifiable information or password data (old or new). Either in successful response or failure.
Client Application
Verify that all password fields do not echo the user’s password when it is entered. ie. echo is set to false.
Client asks for a token with the details of the request. Before sending POST, PUT or DELETE requests. Request must provide type of request, length of request
all forms containing sensitive information have disabled client side caching, including autocomplete features.
data stored in client side storage – such as HTML5 local storage, session storage, Indexed DB, regular cookies or Flash cookies – does not contain sensitive or PII).
Do not use Flash, Active-X, Silverlight, NACL, client-sideJava or other client side technologies not supported natively via W3C browser standards.
ID values stored on the device and retrievable by other applications, such as the UDID or IMEI number are not used as authentication tokens.
sensitive data is not stored unprotected on the device, even in system protected areas such as key chains.
same encoding style is used between the client and the server
AuthenticationManager
Returns true if username and password is correct.
Locks account after 3 attempts (throw an exception)
It does not reset lost passwords
administrative interfaces are not accessible to un-trusted parties.
authors can only amend their own assessments
authors can only add assessments in their own name.
Failures in authentication should be returned with access blocked, not with any reference to PAD or MAC errors, software/ framework versions and personal information
Exceptions should return with access blocked.
Any error/exception results in a refused access to requested service.
The time for authentication to fail should be the same I.e 5 seconds.
Asks a HMAC service for a token when a post, put or delete request is to be made. This is returned to the client. Request must provide type of request, length of request.
Content Security Policy V2 (CSP) is in use in a way that either disables inline JavaScript or provides an integrity check on inline Java Script with CSP noncing or hashing.
Only Management accounts can access all assessments with full control to create, edit and delete assessments and accounts.
iAccountCreator
Creates accounts with username, password and email address for resetting lost password.
PasswordSchema
Password schema should enforce the password conditions identified in the resources and privacy pages unit tests.
Any error/ exception must cause the result in a rejected password
HMACservice
compares a token with what has been sent and see if they are the same. Returns true if so, otherwise returns false. The token is a double (2) nested hash e.g a json web token.
Any exception/error causes a refusal to issue a token.
ID values stored on the device and retrievable by other applications, such as the UDID or IMEI number are not used as authentication tokens
IMACbuilder
Creates a token using HMACs construction based on a request that is expected. It takes a request type, length of message and returns a token
decrypts a received token
Should use GMC, CCM or EAX standards (Minimum FIPS 140-2) to encrypt which uses the HMACservice to build the MAC
AssessmentValidator
Verify that input validation routines are enforced
Checks the input of participant and author and performs input validation, failures result in request rejection and are logged.
Rejects any assessment containing SQL queries, HQL, OSQL, NOSQL, Xpath query tampering, XML External Entity attacks, and XML injection attacks in submitions from participants, authors and search requests. This includes the assessment itself and any strings embedded in an assessment
Sanitise html using https://github.com/OWASP/java-html-sanitizer
Any exception or failure in an AssessmentValidator returns a failed or invalid assessment and no further processing can take place.
Content Security Policy V2 (CSP) is in use in a way that either disables inline JavaScript or provides an integrity check on inline Java Script with CSP noncing or hashing.
un-trusted file data submitted to the application is not used directly with file I/O command, particularly to protect against path traversal, local file include, file mime type, and OS command injection vulnerabilities.
No binary data is allowed.
Only system schema and components are used
does not execute uploaded data obtained from untrusted sources
iSanitiser
SQL queries, HQL, OSQL, NOSQL, Xpath query tampering, XML External Entity attacks, and XML injection attacks in submissions from participants, authors and search requests. This includes the assessment itself and any strings embedded in an assessment reports true or false if a given string contains a what the sanitiser is looking for.
AssessmentManager
Assessment instantiation is only done after the assessment has been validated. Asks the assessmentValidator
Assess the assessment based on components in the assessment it instantiates the components based on component name which implements an IassessmentComponent interface. Once the assessment is built the assess command is sent and an AssessmentResult is returned with a copy of the submitted assessment.
iInputCheckFilter
All input is limited to an appropriate size limit
