Review webpage comments and metadata for information leakage (OTG-INFO-005)

Summary
It is very common, and even recommended, for programmers to include detailed comments and metadata on their source code. However, comments and metadata included into the HTML code might reveal, to a potential attacker, internal information that should not be available to them. Comments and metadata review should be done in order to determine if any information is being leaked.

Test Objectives
Review webpage comments and metadata to better understand the application and to find any information leakage.

Black Box testing and example
Check HTML version information for valid version numbers and Data Type Definition (DTD) URLs

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">


 * "strict.dtd" -- default strict DTD
 * "loose.dtd" -- loose DTD
 * "frameset.dtd" -- DTD for frameset documents

Some Meta tags do not provide active attack vectors but instead allow an attacker to profile an application to



Some Meta tags alter HTTP response headers, such as http-equiv which sets an HTTP response header based on the the content attribute of a meta element, such as:



which will result in the HTTP header:

Expires: Fri, 21 Dec 2012 12:34:56 GMT

and



will result in

Cache-Control: no-cache

Test to see if this can be used to conduct injection attacks (e.g. CRLF attack). It can also help determine the level of data leakage via the browser cache.

A common (but not WCAG compliant) Meta tag is the refresh.



A common use for Meta tag is to specify keywords that a search engine may use to improve the quality of search results.



Although most webservers manage search engine indexing via the robots.txt file, it can also be managed by Meta tags. The tag below will advise robots to not index and not follow links on the HTML page containing the tag.



The Platform for Internet Content Selection (PICS) and Protocol for Web Description Resources (POWDER) provide infrastructure for associating meta data with Internet content.

examples

Gray Box testing and example
Not applicable.

Tools

 * Wget
 * Browser "view source" function
 * Eyeballs
 * Curl