Difference between revisions of "Review webpage comments and metadata for information leakage (OTG-INFO-005)"

From OWASP
Jump to: navigation, search
(4 intermediate revisions by 2 users not shown)
Line 1: Line 1:
 
{{Template:OWASP Testing Guide v4}}
 
{{Template:OWASP Testing Guide v4}}
  
== Brief Summary ==
+
== Summary ==
  
 +
== Test Objectives ==
  
== Description of the Issue ==  
+
== How to Test ==
  
 
+
=== Black Box testing and example ===
== Black Box testing and example ==
+
  
 
Check HTML version information for valid version numbers and Data Type Definition (DTD) URLs
 
Check HTML version information for valid version numbers and Data Type Definition (DTD) URLs
Line 21: Line 21:
 
  <META name="Author" content="Andrew Muller">
 
  <META name="Author" content="Andrew Muller">
  
A potentially dangerous Meta tag is http-equiv which sets an HTTP response header based on the the content attribute of a meta element, such as:
+
Some Meta tags alter HTTP response headers, such as http-equiv which sets an HTTP response header based on the the content attribute of a meta element, such as:
  
 
  <META http-equiv="Expires" content="Fri, 21 Dec 2012 12:34:56 GMT">
 
  <META http-equiv="Expires" content="Fri, 21 Dec 2012 12:34:56 GMT">
Line 46: Line 46:
  
 
<META name="keywords" lang="en-us" content="OWASP, security, sunshine, lollipops">
 
<META name="keywords" lang="en-us" content="OWASP, security, sunshine, lollipops">
 +
 +
Although most webservers manage search engine indexing via the robots.txt file, it can also be managed by Meta tags. The tag below will advise robots to not index and not follow links on the HTML page containing the tag.
 +
 +
<META name="robots" content="none">
  
 
The Platform for Internet Content Selection (PICS) and Protocol for Web Description Resources (POWDER) provide infrastructure for associating meta data with Internet content.
 
The Platform for Internet Content Selection (PICS) and Protocol for Web Description Resources (POWDER) provide infrastructure for associating meta data with Internet content.
Line 53: Line 57:
  
  
== Gray Box testing and example ==  
+
=== Gray Box testing and example ===  
 
Not applicable.  
 
Not applicable.  
 +
 +
==Tools==
 +
 +
* Wget
 +
* Browser "view source" function
 +
* Eyeballs
 +
* Curl
  
 
== References ==
 
== References ==
Line 64: Line 75:
  
 
[3] http://www.w3.org/TR/html5/ HTML version 5
 
[3] http://www.w3.org/TR/html5/ HTML version 5
 
 
'''Tools'''
 
* Wget
 
* Browser "view source" function
 
* Eyeballs
 

Revision as of 08:52, 28 July 2013

This article is part of the new OWASP Testing Guide v4. 
At the moment the project is in the REVIEW phase.

Back to the OWASP Testing Guide v4 ToC: https://www.owasp.org/index.php/OWASP_Testing_Guide_v4_Table_of_Contents Back to the OWASP Testing Guide Project: http://www.owasp.org/index.php/OWASP_Testing_Project

Contents


Summary

Test Objectives

How to Test

Black Box testing and example

Check HTML version information for valid version numbers and Data Type Definition (DTD) URLs

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
  • "strict.dtd" -- default strict DTD
  • "loose.dtd" -- loose DTD
  • "frameset.dtd" -- DTD for frameset documents

Some Meta tags do not provide active attack vectors but instead allow an attacker to profile an application to

<META name="Author" content="Andrew Muller">

Some Meta tags alter HTTP response headers, such as http-equiv which sets an HTTP response header based on the the content attribute of a meta element, such as:

<META http-equiv="Expires" content="Fri, 21 Dec 2012 12:34:56 GMT">

which will result in the HTTP header:

Expires: Fri, 21 Dec 2012 12:34:56 GMT

and

<META http-equiv="Cache-Control" content="no-cache">

will result in

Cache-Control: no-cache

Test to see if this can be used to conduct injection attacks (e.g. CRLF attack). It can also help determine the level of data leakage via the browser cache.

A common (but not WCAG compliant) Meta tag is the refresh.

<META http-equiv="Refresh" content="15;URL=https://www.owasp.org/index.html">

A common use for Meta tag is to specify keywords that a search engine may use to improve the quality of search results.

<META name="keywords" lang="en-us" content="OWASP, security, sunshine, lollipops">

Although most webservers manage search engine indexing via the robots.txt file, it can also be managed by Meta tags. The tag below will advise robots to not index and not follow links on the HTML page containing the tag.

<META name="robots" content="none">

The Platform for Internet Content Selection (PICS) and Protocol for Web Description Resources (POWDER) provide infrastructure for associating meta data with Internet content.

examples


Gray Box testing and example

Not applicable.

Tools

  • Wget
  • Browser "view source" function
  • Eyeballs
  • Curl

References

Whitepapers

[1] http://www.w3.org/TR/1999/REC-html401-19991224 HTML version 4.01

[2] http://www.w3.org/TR/2010/REC-xhtml-basic-20101123/ XHTML (for small devices)

[3] http://www.w3.org/TR/html5/ HTML version 5