{"id":418,"date":"2019-07-10T10:18:53","date_gmt":"2019-07-10T10:18:53","guid":{"rendered":"http:\/\/fip.r-a-w.org\/?p=418"},"modified":"2019-06-06T10:19:54","modified_gmt":"2019-06-06T10:19:54","slug":"kup-assessments-converting-requirements-to-specific-test-cases","status":"publish","type":"post","link":"https:\/\/fip.r-a-w.org\/?p=418","title":{"rendered":"KUP Assessments &#8211; Converting Requirements to Specific Test Cases"},"content":{"rendered":"\n<p>The following specific test cases were developed concurrency during the above development process. Additionally KUP_Gatehouse had functionality removed to new classes checking http_headers (interceptor class). The same for VERBchecker  <\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Resources and Private Pages \u2013 I.e tested from\noutside the application using a bash script and curl<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li> Verify all pages and resources by default require authentication except those specifically intended to be public (Principle of complete mediation). <\/li><li> Verify all authentication controls are enforced on the server side. &#8211; Curl and bash script &amp; Unit test on components. <\/li><li> Verify all authentication controls fail securely to ensure attackers cannot log in \u2013 Unit tests with exceptions.  <\/li><li> Client and authentication manager to inform encourage and discourage passwords using the following given in the post KUP Assessments Password Schema.<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"> KUP_Gatehouse<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li>\nSets up filters and interceptors\n\tfor incoming requests and outgoing responses\n\t<\/li><li>\nWhen username and password are\n\tboth set to clear return 203 &#8211; Non-Authoritative Information\n<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">HTTP_HeaderChecker<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li>\nAll sensitive data is sent to the server in the HTTP\n\tmessage body not the headers\n\tAny requests containing data other than that defined by the\n\tsystem in the header is rejected with a 400 response\n\t<\/li><li>\nX-XSS-Protection:\n\t1; mode=block header is in place\n\t<\/li><li>\nSets\n\tappropriate anti-caching headers as per the risk of the application,\n\tsuch as the following: Expires: Tue, 03 Jul 2001 06:00:00\n\tGMTLast-Modified: {now} GMTCache-Control: no-store, no-cache,\n\tmust-revalidate, max-age=0Cache-Control: post-check=0,\n\tpre-check=0Pragma: no-cache\n<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Verb_Checker<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li>\nOnly\n\taccept standard crud HTTP verbs (GET, POST, PUT, DELETE)\n<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">RequestThrottler<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li> Log if limits are reached <\/li><li> Must be an combination of IP address and username for authoring and IP address, browser and resource requested. <\/li><li> IP addresses \u2013 have exceptions for any monitoring tools or datacentre ranges (addresses that end web consumers should not be using). Also no limiting of yahoo, google etc.  <\/li><li> return 429 status code and advice in header <\/li><li> Is there an existing Throttling library?  <\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">KUP_Facade<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li> URL endpoints <\/li><li> Base URL: \/KUPassessments\/ <\/li><li> account\/create\/ <\/li><li> account\/update\/ <\/li><li> account\/assessment\/create\/ <\/li><li> account\/assessment\/{assessmentid} <\/li><li> account\/assessment\/update\/ <\/li><li> account\/assessment\/delete\/ <\/li><li> participant\/assessment\/{assessmentid} <\/li><li> Every HTTP response contains a content type header specifying a safe-character set (e.g., UTF-8, ISO 8859-1). <\/li><li> HTTP headers or any part of the HTTP response do not expose detailed version information of system components. <\/li><li> all API responses contain X-Content-Type-Options:nosniffandContent-Disposition:attachment;filename=&#8221;api.json&#8221;(or other appropriate filename for the content  type). <\/li><li> URL redirects and forwards only allow white listed destinations, or show a warning when redirecting to potentially untrusted content. <\/li><li> ID values stored on the device and retrievable by other applications, such as the UDID or IMEI number are not used as authentication tokens <\/li><li> Same encoding style is used between the client and the server <\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">URIsanitiser<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li>\nintercepts all parameters in the\n\turi\u2019s for os command injection attacks and returns a 406 error if\n\tany are found. Commands include chaining with <strong>&#8220;&amp;&#8221;,\n\t&#8220;&amp;&amp;&#8221;, &#8220;|&#8221;, &#8220;||&#8221;,<\/strong>\n\t<\/li><li>\nIntercepts\n\tfile inclusion attacks by stopping calls that have .txt .php or any\n\tfile extension and return a 406 error. \n\t\n\t<\/li><li>\nIntercepts\n\tLocal File Inclusion (LFI)\n\tattacks by looking for ..\/\n\tin a uri and returning a 406 error\n<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">KUP_Assessments<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li>\nActs a the link with the rest of\n\tthe application\n<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">PasswordRecovery<\/h2>\n\n\n\n<p>Sends an email to account with code and link that stays alive for\n5 minutes.<\/p>\n\n\n\n<p>When post request received must have live reset code\/soft token\nwith new password and confirmed new password. \n<\/p>\n\n\n\n<p>When the response to new password is\nsent it does not contain any account identifiable information or\npassword data (old or new). Either in successful response or failure<\/p>\n\n\n\n<p>Verify that the changing password\nfunctionality includes the old password, the new password, and a\npassword confirmation.<\/p>\n\n\n\n<p>When the response to updated password\nis sent it does not contain any account identifiable information or\npassword data (old or new). Either in successful response or failure.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Client Application<\/h2>\n\n\n\n<p>Verify that all password fields do not\necho the user\u2019s password when it is entered. ie. echo is set to\nfalse.<\/p>\n\n\n\n<p>Client asks for a token with the\ndetails of the request. Before sending POST, PUT or DELETE requests.\nRequest must provide type of request, length of request \n<\/p>\n\n\n\n<p>all forms containing sensitive\ninformation have disabled client side caching, including autocomplete\nfeatures.<\/p>\n\n\n\n<p>data stored in client side storage \u2013 such as HTML5 local storage, session storage, Indexed DB, regular cookies or Flash cookies \u2013 does not contain sensitive or PII).<\/p>\n\n\n\n<p>Do not use Flash, Active-X,\nSilverlight, NACL, client-sideJava or other client side technologies\nnot supported natively via W3C browser standards.<\/p>\n\n\n\n<p>ID values stored on the device and\nretrievable by other applications, such as the UDID or IMEI number\nare not used as authentication tokens.<\/p>\n\n\n\n<p>sensitive data is not stored\nunprotected on the device, even in system protected areas such as key\nchains.<\/p>\n\n\n\n<p>same encoding style is used between the\nclient and the server<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">AuthenticationManager<\/h2>\n\n\n\n<p>Returns true if username and password is correct. \n<\/p>\n\n\n\n<p>Locks account after 3 attempts (throw an exception)<\/p>\n\n\n\n<p>It does not reset lost passwords \n<\/p>\n\n\n\n<p>administrative interfaces are not accessible to un-trusted parties.  <\/p>\n\n\n\n<p>authors can only amend their own\nassessments<\/p>\n\n\n\n<p>authors can only add assessments in\ntheir own name.<\/p>\n\n\n\n<p>Failures in authentication  should be returned with access blocked, not with any reference to PAD or MAC errors,  software\/ framework versions and personal information<\/p>\n\n\n\n<p>Exceptions should return with access\nblocked.<\/p>\n\n\n\n<p>Any error\/exception results in a\nrefused access to requested service. \n<\/p>\n\n\n\n<p>The time for authentication to fail\nshould be the same I.e 5 seconds. \n<\/p>\n\n\n\n<p>Asks a HMAC service for a token when a post, put or delete request\nis to be made. This is returned to the client.  Request must provide\ntype of request, length of request. \n<\/p>\n\n\n\n<p>Content Security Policy V2 (CSP) is in\nuse in a way that either disables inline JavaScript or provides an\nintegrity check on inline Java Script with CSP noncing or hashing.<\/p>\n\n\n\n<p>Only Management accounts can access all\nassessments with full control to create, edit and delete assessments\nand accounts.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">iAccountCreator<\/h2>\n\n\n\n<p>Creates accounts with username, password and email address for resetting lost password.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">PasswordSchema<\/h2>\n\n\n\n<p>Password schema should enforce the password conditions identified in the resources and privacy pages unit tests.  <\/p>\n\n\n\n<p>Any error\/ exception must cause the result in a rejected password<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">HMACservice<\/h2>\n\n\n\n<p>compares a token with what has been sent and see if they are the\nsame. Returns true if so, otherwise returns false. The token is a\ndouble (2) nested hash e.g a json web token.<\/p>\n\n\n\n<p>Any exception\/error causes a refusal to issue a token. \n<\/p>\n\n\n\n<p>ID values stored on the device and\nretrievable by other applications, such as the UDID or IMEI number\nare not used as authentication tokens<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">IMACbuilder<\/h2>\n\n\n\n<p>Creates a token using HMACs construction based on a request that\nis expected. It takes a request type, length of message and returns a\ntoken<\/p>\n\n\n\n<p>decrypts a received token<\/p>\n\n\n\n<p>Should use GMC, CCM or EAX standards (Minimum FIPS 140-2) to encrypt which uses the HMACservice to build the MAC<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">AssessmentValidator<\/h2>\n\n\n\n<p>Verify that input\nvalidation routines are enforced<\/p>\n\n\n\n<p>Checks the input\nof participant and author and performs input validation, failures\nresult in request rejection and are logged.<\/p>\n\n\n\n<p>Rejects any\nassessment containing  SQL queries, HQL, OSQL, NOSQL, Xpath query\ntampering, XML External Entity attacks, and XML injection attacks in\nsubmitions from participants, authors and search requests. This\nincludes the assessment itself and any strings embedded in an\nassessment<\/p>\n\n\n\n<p>Sanitise html\nusing <a href=\"https:\/\/github.com\/OWASP\/java-html-sanitizer\">https:\/\/github.com\/OWASP\/java-html-sanitizer<\/a>\n<\/p>\n\n\n\n<p>Any exception or\nfailure in an AssessmentValidator returns a failed or invalid\nassessment and no further processing can take place. \n<\/p>\n\n\n\n<p>Content Security\nPolicy V2 (CSP) is in use in a way that either disables inline\nJavaScript or provides an integrity check on inline Java Script with\nCSP noncing or hashing.<\/p>\n\n\n\n<p>un-trusted file data submitted to the application is not used directly with file I\/O command, particularly to protect against path traversal, local file include, file mime type, and OS command injection vulnerabilities.<\/p>\n\n\n\n<p>No binary data is\nallowed. \n<\/p>\n\n\n\n<p>Only system schema\nand components are used \n<\/p>\n\n\n\n<p>does not execute\nuploaded data obtained from untrusted sources<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">iSanitiser \n<\/h2>\n\n\n\n<p> SQL queries, HQL, OSQL, NOSQL, Xpath query tampering, XML External Entity attacks, and XML injection attacks in submissions from participants, authors and search requests. This includes the assessment itself and any strings embedded in an assessment reports true or false if a given string contains a what the sanitiser is looking for.  <\/p>\n\n\n\n<h2 class=\"wp-block-heading\">AssessmentManager<\/h2>\n\n\n\n<p>Assessment instantiation is only done\nafter the assessment has been validated. Asks the assessmentValidator<\/p>\n\n\n\n<p>Assess the assessment based on components in the assessment it instantiates the components based on component name which implements an IassessmentComponent interface. Once the assessment is built the assess command is sent and an AssessmentResult is returned with a copy of the submitted assessment. <\/p>\n\n\n\n<h2 class=\"wp-block-heading\">iInputCheckFilter<\/h2>\n\n\n\n<p> All input is limited to an appropriate\nsize limit<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The following specific test cases were developed concurrency during the above development process. Additionally KUP_Gatehouse had functionality removed to new classes checking http_headers (interceptor class). The same for VERBchecker Resources and Private Pages \u2013 I.e tested from outside the application using a bash script and curl Verify all pages and resources by default require authentication &hellip; <a href=\"https:\/\/fip.r-a-w.org\/?p=418\" class=\"more-link\">Continue reading <span class=\"screen-reader-text\">KUP Assessments &#8211; Converting Requirements to Specific Test Cases<\/span> <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":366,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[2,3,5],"tags":[],"class_list":["post-418","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-decisions","category-oop-design","category-project"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"https:\/\/i0.wp.com\/fip.r-a-w.org\/wp-content\/uploads\/2019\/06\/KUPassessmentLogoDEcorated4-6-19.png?fit=1189%2C599&ssl=1","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p9NvWe-6K","jetpack_likes_enabled":true,"jetpack-related-posts":[],"_links":{"self":[{"href":"https:\/\/fip.r-a-w.org\/index.php?rest_route=\/wp\/v2\/posts\/418","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fip.r-a-w.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fip.r-a-w.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fip.r-a-w.org\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/fip.r-a-w.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=418"}],"version-history":[{"count":4,"href":"https:\/\/fip.r-a-w.org\/index.php?rest_route=\/wp\/v2\/posts\/418\/revisions"}],"predecessor-version":[{"id":422,"href":"https:\/\/fip.r-a-w.org\/index.php?rest_route=\/wp\/v2\/posts\/418\/revisions\/422"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/fip.r-a-w.org\/index.php?rest_route=\/wp\/v2\/media\/366"}],"wp:attachment":[{"href":"https:\/\/fip.r-a-w.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=418"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fip.r-a-w.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=418"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fip.r-a-w.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=418"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}