Difference between revisions of "CRV2 CrawlingCode"

From OWASP
Jump to: navigation, search
(Created page with "{{LinkBar | useprev=PrevLink | prev=Code Review Metrics | lblprev= | usemain=MainLink | main=OWASP Code Review Guide Table of Contents | lblmain=Table of Contents | usen...")
 
Line 14: Line 14:
 
The following sections shall cover the function of crawing code for Java/J2EE, .NET and Classic ASP.  This section is best used in conjunction with the [[Security Code Review Coverage|transactional analysis]] section also detailed in this guide.
 
The following sections shall cover the function of crawing code for Java/J2EE, .NET and Classic ASP.  This section is best used in conjunction with the [[Security Code Review Coverage|transactional analysis]] section also detailed in this guide.
  
==Searching for Key Indicators==  
+
===Searching for Key Indicators===
  
 
The basis of the code review is to locate and analyse areas of code which may have application security implications. Assuming the code reviewer has a thorough understanding of the code, what it is intended to do, and the context in which it is to be used, firstly one needs to sweep the code base for areas of interest.  
 
The basis of the code review is to locate and analyse areas of code which may have application security implications. Assuming the code reviewer has a thorough understanding of the code, what it is intended to do, and the context in which it is to be used, firstly one needs to sweep the code base for areas of interest.  
  
 
This can be done by performing a text search on the code base looking for keywords relating to APIs and functions. Below is a guide for .NET framework 1.1 & 2.0  
 
This can be done by performing a text search on the code base looking for keywords relating to APIs and functions. Below is a guide for .NET framework 1.1 & 2.0  
 +
  
 
==Searching for Code in .NET==  
 
==Searching for Code in .NET==  
Line 31: Line 32:
  
  
===HTTP Request Strings===
+
====HTTP Request Strings====
  
 
Requests from external sources are obviously a key area of a security code review. We need to ensure that all HTTP requests received are data validated for composition, max and min length, and if the data falls with the realms of the parameter white-list. Bottom-line is this is a key area to look at and ensure security is enabled.  
 
Requests from external sources are obviously a key area of a security code review. We need to ensure that all HTTP requests received are data validated for composition, max and min length, and if the data falls with the realms of the parameter white-list. Bottom-line is this is a key area to look at and ensure security is enabled.  
Line 46: Line 47:
  
  
==HTML Output==
+
====HTML Output====
  
 
Here we are looking for responses to the client. Responses which go unvalidated or which echo external input without data validation are key areas to examine. Many client side attacks result from poor response validation. XSS relies on this somewhat.  
 
Here we are looking for responses to the client. Responses which go unvalidated or which echo external input without data validation are key areas to examine. Many client side attacks result from poor response validation. XSS relies on this somewhat.  
Line 56: Line 57:
 
|}
 
|}
  
==SQL & Database==
+
====SQL & Database====
  
 
Locating where a database may be involved in the code is an important aspect of the code review. Looking at the database code will help determine if the application is vulnerable to SQL injection. One aspect of this is to verify that the code uses either SqlParameter, OleDbParameter, or OdbcParameter(System.Data.SqlClient). These are typed and treat parameters as the literal value and not executable code in the database.  
 
Locating where a database may be involved in the code is an important aspect of the code review. Looking at the database code will help determine if the application is vulnerable to SQL injection. One aspect of this is to verify that the code uses either SqlParameter, OleDbParameter, or OdbcParameter(System.Data.SqlClient). These are typed and treat parameters as the literal value and not executable code in the database.  
Line 74: Line 75:
 
|}
 
|}
  
==Cookies==
+
====Cookies====
  
 
Cookie manipulation can be key to various application security exploits, such as session hijacking/fixation and parameter manipulation. One should examine any code relating to cookie functionality, as this would have a bearing on session security.  
 
Cookie manipulation can be key to various application security exploits, such as session hijacking/fixation and parameter manipulation. One should examine any code relating to cookie functionality, as this would have a bearing on session security.  
Line 83: Line 84:
  
  
==HTML Tags==
+
====HTML Tags====
  
 
Many of the HTML tags below can be used for client side attacks such as cross site scripting. It is important to examine the context in which these tags are used and to examine any relevant data validation associated with the display and use of such tags within a web application.  
 
Many of the HTML tags below can be used for client side attacks such as cross site scripting. It is important to examine the context in which these tags are used and to examine any relevant data validation associated with the display and use of such tags within a web application.  
Line 95: Line 96:
 
|}
 
|}
 
   
 
   
===Input Controls===
+
====Input Controls====
  
 
The input controls below are server classes used to produce and display web application form fields. Looking for such references helps locate entry points into the application.  
 
The input controls below are server classes used to produce and display web application form fields. Looking for such references helps locate entry points into the application.  
Line 105: Line 106:
 
|}
 
|}
  
==WEB.Config==
+
====WEB.Config====
  
 
The .NET Framework relies on .config files to define configuration settings. The .config files are text-based XML files. Many .config files can, and typically do, exist on a single system. Web applications refer to a web.config file located in the application’s root directory. For ASP.NET applications, web.config contains information about most aspects of the application’s operation.  
 
The .NET Framework relies on .config files to define configuration settings. The .config files are text-based XML files. Many .config files can, and typically do, exist on a single system. Web applications refer to a web.config file located in the application’s root directory. For ASP.NET applications, web.config contains information about most aspects of the application’s operation.  
Line 119: Line 120:
 
|}
 
|}
  
==global.asax==
+
====global.asax====
  
 
Each application has its own Global.asax if one is required. Global.asax sets the event code and values for an application using scripts. One must ensure that application variables do not contain sensitive information, as they are accessible to the whole application and to all users within it.  
 
Each application has its own Global.asax if one is required. Global.asax sets the event code and values for an application using scripts. One must ensure that application variables do not contain sensitive information, as they are accessible to the whole application and to all users within it.  
Line 127: Line 128:
 
|}
 
|}
  
==Logging==
+
====Logging====
  
 
Logging can be a source of information leakage. It is important to examine all calls to the logging subsystem and to determine if any sensitive information is being logged. Common mistakes are logging userID in conjunction with passwords within the authentication functionality or logging database requests which may contains sensitive data.  
 
Logging can be a source of information leakage. It is important to examine all calls to the logging subsystem and to determine if any sensitive information is being logged. Common mistakes are logging userID in conjunction with passwords within the authentication functionality or logging database requests which may contains sensitive data.  
Line 135: Line 136:
 
|}
 
|}
  
==Machine.config==
+
====Machine.config====
  
 
Its important that many variables in machine.config can be overridden in the web.config file for a particular application.  
 
Its important that many variables in machine.config can be overridden in the web.config file for a particular application.  
Line 143: Line 144:
 
|}
 
|}
  
==Threads and Concurrency==
+
====Threads and Concurrency====
  
 
Locating code that contains multithreaded functions. Concurrency issues can result in race conditions which may result in security vulnerabilities. The Thread keyword is where new threads objects are created. Code that uses static global variables which hold sensitive security information may cause session issues. Code that uses static constructors may also cause issues between threads. Not synchronizing the Dispose method may cause issues if a number of threads call Dispose at the same time, this may cause resource release issues.  
 
Locating code that contains multithreaded functions. Concurrency issues can result in race conditions which may result in security vulnerabilities. The Thread keyword is where new threads objects are created. Code that uses static global variables which hold sensitive security information may cause session issues. Code that uses static constructors may also cause issues between threads. Not synchronizing the Dispose method may cause issues if a number of threads call Dispose at the same time, this may cause resource release issues.  
Line 151: Line 152:
 
|}
 
|}
 
   
 
   
==Class Design==
+
====Class Design====
  
 
Public and Sealed relate to the design at class level. Classes which are not intended to be derived from should be sealed. Make sure all class fields are Public for a reason. Don't expose anything you don't need to.  
 
Public and Sealed relate to the design at class level. Classes which are not intended to be derived from should be sealed. Make sure all class fields are Public for a reason. Don't expose anything you don't need to.  
Line 159: Line 160:
 
|}
 
|}
  
==Reflection, Serialization==
+
====Reflection, Serialization====
  
 
Code may be generated dynamically at runtime. Code that is generated dynamically as a function of external input may give rise to issues. If your code contains sensitive data, does it need to be serialized?
 
Code may be generated dynamically at runtime. Code that is generated dynamically as a function of external input may give rise to issues. If your code contains sensitive data, does it need to be serialized?
Line 169: Line 170:
 
|}
 
|}
  
==Exceptions & Errors==
+
====Exceptions & Errors====
  
 
Ensure that the catch blocks do not leak information to the user in the case of an exception. Ensure when dealing with resources that the finally block is used. Having trace enabled is not great from an information leakage perspective. Ensure customised errors are properly implemented.  
 
Ensure that the catch blocks do not leak information to the user in the case of an exception. Ensure when dealing with resources that the finally block is used. Having trace enabled is not great from an information leakage perspective. Ensure customised errors are properly implemented.  
Line 177: Line 178:
 
|}
 
|}
  
==Crypto==
+
====Crypto====
  
 
If cryptography is used then is a strong enough cipher used, i.e. AES or 3DES? What size key is used? The larger the better. Where is hashing performed? Are passwords that are being persisted hashed? They should be. How are random numbers generated? Is the PRNG "random enough"?  
 
If cryptography is used then is a strong enough cipher used, i.e. AES or 3DES? What size key is used? The larger the better. Where is hashing performed? Are passwords that are being persisted hashed? They should be. How are random numbers generated? Is the PRNG "random enough"?  
Line 187: Line 188:
 
|}
 
|}
  
==Storage==
+
====Storage====
  
 
If storing sensitive data in memory, I recommend one uses the following.  
 
If storing sensitive data in memory, I recommend one uses the following.  
Line 195: Line 196:
 
|}
 
|}
  
==Authorization, Assert & Revert==
+
====Authorization, Assert & Revert====
  
 
Bypassing the code access security permission? Not a good idea. Also below is a list of potentially dangerous permissions such as calling unmanaged code, outside the CLR.  
 
Bypassing the code access security permission? Not a good idea. Also below is a list of potentially dangerous permissions such as calling unmanaged code, outside the CLR.  
Line 209: Line 210:
 
|}
 
|}
 
   
 
   
==Legacy Methods==
+
====Legacy Methods====
  
 
''<TODO some context>''
 
''<TODO some context>''

Revision as of 04:57, 26 June 2013

«««« Main
(Table of Contents)
»»»»

Contents


Crawling code is the practice of scanning a code base of the review target in question. It is, in effect, looking for key pointers wherein a possible security vulnerability might reside. Certain APIs are related to interfacing to the external world or file IO or user management, which are key areas for an attacker to focus on. In crawling code we look for APIs relating to these areas. We also need to look for business logic areas which may cause security issues, but generally these are bespoke methods which have bespoke names and can not be detected directly, even though we may touch on certain methods due to their relationship with a certain key API.

We also need to look for common issues relating to a specific language; issues that may not be *security* related but which may affect the stability/availability of the application in the case of extraordinary circumstances. Other issues when performing a code review are areas such a simple copyright notice in order to protect one’s intellectual property. Generally these issues should be part of your companies Coding Guidelines, and should be enforceable during a code review (i.e. a reviewer can fail code review because the code violates something in the Coding Guidelines, regardless of whether or not the code would work in its current state, and regardless on whether the original developer agrees or not).

Crawling code can be done manually or in an automated fashion using automated tools. Crawling code manually is probably not effective, as (as can be seen below) there are plenty of indicators which can apply to a language. Tools as simple as grep or wingrep can be used. Other tools are available which would search for key words relating to a specific programming language. If you are using a particular review tool which allows you to specify strings to be highlighted in a review (e.g. Python based review tools using pygments syntax highlighter, or an in-house tool for which you can change the source code) then you could add the relevant string indicators from the lists below and have them highlighted to reviewers automatically.

The following sections shall cover the function of crawing code for Java/J2EE, .NET and Classic ASP. This section is best used in conjunction with the transactional analysis section also detailed in this guide.

Searching for Key Indicators

The basis of the code review is to locate and analyse areas of code which may have application security implications. Assuming the code reviewer has a thorough understanding of the code, what it is intended to do, and the context in which it is to be used, firstly one needs to sweep the code base for areas of interest.

This can be done by performing a text search on the code base looking for keywords relating to APIs and functions. Below is a guide for .NET framework 1.1 & 2.0


Searching for Code in .NET

Firstly one needs to be familiar with the tools one can use in order to perform text searching, following this one needs to know what to look for.

In this section we will assume you have a copy of Visual Studio (VS) .NET at hand. VS has two types of search "Find in Files" and a cmd line tool called Findstr.

To start off, one could scan thorough the code looking for common patterns or keywords such as "User", "Password", "Pswd", "Key", "Http", etc... This can be done using the "Find in Files" tool in VS or using findstring as follows:

findstr /s /m /i /d:c:\projects\codebase\sec "http" *.*


HTTP Request Strings

Requests from external sources are obviously a key area of a security code review. We need to ensure that all HTTP requests received are data validated for composition, max and min length, and if the data falls with the realms of the parameter white-list. Bottom-line is this is a key area to look at and ensure security is enabled.

request.accepttypes request.browser request.files request.headers request.httpmethod request.item
request.querystring request.form request.cookies request.certificate request.rawurl request.servervariables
request.url request.urlreferrer request.useragent request.userlanguages request.IsSecureConnection request.TotalBytes
request.BinaryRead InputStream HiddenField.Value TextBox.Text recordSet


HTML Output

Here we are looking for responses to the client. Responses which go unvalidated or which echo external input without data validation are key areas to examine. Many client side attacks result from poor response validation. XSS relies on this somewhat.

response.write <% = HttpUtility HtmlEncode UrlEncode
innerText innerHTML

SQL & Database

Locating where a database may be involved in the code is an important aspect of the code review. Looking at the database code will help determine if the application is vulnerable to SQL injection. One aspect of this is to verify that the code uses either SqlParameter, OleDbParameter, or OdbcParameter(System.Data.SqlClient). These are typed and treat parameters as the literal value and not executable code in the database.

exec sp_ select from insert update delete from where delete
execute sp_ exec xp_ exec @ execute @ executestatement executeSQL
setfilter executeQuery GetQueryResultInXML adodb sqloledb sql server
driver Server.CreateObject .Provider .Open ADODB.recordset New OleDbConnection
ExecuteReader DataSource SqlCommand Microsoft.Jet SqlDataReader ExecuteReader
GetString SqlDataAdapter CommandType StoredProcedure System.Data.sql

Cookies

Cookie manipulation can be key to various application security exploits, such as session hijacking/fixation and parameter manipulation. One should examine any code relating to cookie functionality, as this would have a bearing on session security.

System.Net.Cookie HTTPOnly document.cookie


HTML Tags

Many of the HTML tags below can be used for client side attacks such as cross site scripting. It is important to examine the context in which these tags are used and to examine any relevant data validation associated with the display and use of such tags within a web application.

HtmlEncode URLEncode <applet> <frameset> <embed> <frame> <html>
<iframe> <img> <style> <layer> <ilayer> <meta> <object>
<frame security <iframe security <body>

Input Controls

The input controls below are server classes used to produce and display web application form fields. Looking for such references helps locate entry points into the application.

htmlcontrols.htmlinputhidden webcontrols.hiddenfield webcontrols.hyperlink webcontrols.textbox webcontrols.label
webcontrols.linkbutton webcontrols.listbox webcontrols.checkboxlist webcontrols.dropdownlist

WEB.Config

The .NET Framework relies on .config files to define configuration settings. The .config files are text-based XML files. Many .config files can, and typically do, exist on a single system. Web applications refer to a web.config file located in the application’s root directory. For ASP.NET applications, web.config contains information about most aspects of the application’s operation.

requestEncoding responseEncoding trace authorization compilation CustomErrors
httpCookies httpHandlers httpRuntime sessionState maxRequestLength debug
forms protection appSettings ConfigurationSettings appSettings connectionStrings authentication mode
allow deny credentials identity impersonate timeout remote

global.asax

Each application has its own Global.asax if one is required. Global.asax sets the event code and values for an application using scripts. One must ensure that application variables do not contain sensitive information, as they are accessible to the whole application and to all users within it.

Application_OnAuthenticateRequest Application_OnAuthorizeRequest Session_OnStart Session_OnEnd

Logging

Logging can be a source of information leakage. It is important to examine all calls to the logging subsystem and to determine if any sensitive information is being logged. Common mistakes are logging userID in conjunction with passwords within the authentication functionality or logging database requests which may contains sensitive data.

log4net Console.WriteLine System.Diagnostics.Debug System.Diagnostics.Trace

Machine.config

Its important that many variables in machine.config can be overridden in the web.config file for a particular application.

validateRequest enableViewState enableViewStateMac

Threads and Concurrency

Locating code that contains multithreaded functions. Concurrency issues can result in race conditions which may result in security vulnerabilities. The Thread keyword is where new threads objects are created. Code that uses static global variables which hold sensitive security information may cause session issues. Code that uses static constructors may also cause issues between threads. Not synchronizing the Dispose method may cause issues if a number of threads call Dispose at the same time, this may cause resource release issues.

Thread Dispose

Class Design

Public and Sealed relate to the design at class level. Classes which are not intended to be derived from should be sealed. Make sure all class fields are Public for a reason. Don't expose anything you don't need to.

Public Sealed

Reflection, Serialization

Code may be generated dynamically at runtime. Code that is generated dynamically as a function of external input may give rise to issues. If your code contains sensitive data, does it need to be serialized?

Serializable AllowPartiallyTrustedCallersAttribute GetObjectData StrongNameIdentityPermission
StrongNameIdentity System.Reflection

Exceptions & Errors

Ensure that the catch blocks do not leak information to the user in the case of an exception. Ensure when dealing with resources that the finally block is used. Having trace enabled is not great from an information leakage perspective. Ensure customised errors are properly implemented.

catch finally trace enabled customErrors mode

Crypto

If cryptography is used then is a strong enough cipher used, i.e. AES or 3DES? What size key is used? The larger the better. Where is hashing performed? Are passwords that are being persisted hashed? They should be. How are random numbers generated? Is the PRNG "random enough"?

RNGCryptoServiceProvider SHA MD5 base64 xor
DES RC2 System.Random Random System.Security.Cryptography

Storage

If storing sensitive data in memory, I recommend one uses the following.

SecureString ProtectedMemory

Authorization, Assert & Revert

Bypassing the code access security permission? Not a good idea. Also below is a list of potentially dangerous permissions such as calling unmanaged code, outside the CLR.

.RequestMinimum .RequestOptional Assert Debug.Assert
CodeAccessPermission ReflectionPermission.MemberAccess SecurityPermission.ControlAppDomain SecurityPermission.UnmanagedCode
SecurityPermission.SkipVerification SecurityPermission.ControlEvidence SecurityPermission.SerializationFormatter SecurityPermission.ControlPrincipal
SecurityPermission.ControlDomainPolicy SecurityPermission.ControlPolicy

Legacy Methods

<TODO some context>

printf strcpy


«««« Main
(Table of Contents)
»»»»