DevSecCon Tel Aviv 2018 - Integrated Security Testing by Morgan Roman

1. Join the conversation #DevSecCon
Integrated Security Testing
MORGAN ROMAN

2. Definitions
1. Selenium - Selenium automates browsers like
Chrome/Firefox/IE.
1. Integration Testing - Testing a full user workflow in an
application

3. After this presentation, you can:
1. Make existing tests find security bugs
2. Without false positives
3. With minimal changes

4. After this presentation, you can:
1. Make existing tests find security bugs
2. Without false positives
3. With minimal changes
QAs! Managers!
Test security while testing functionality!

5. After this presentation, you can:
1. Make existing tests find security bugs
2. Without false positives
3. With minimal changes
Penetration Testers! Security Engineers!
Find more bugs! Keep them fixed!

6. “Give me a place to stand and I will move the Earth”
- Archimedes

7. “Give me a place to stand and I will HACK THE PLANET!”
- Me

8. About Me
I started as a tester at DocuSign
Wrote integration tests for the API and web
interface
Currently work on the application security
team

9. When I was a tester...

10. And when I became a penetration tester...

11. And when I became a penetration tester...

12. Thousands of tests Proxy

13. Thousands of tests Proxy

14. What Web Application Scanners Do
Interpret
Responses
Login Send Payloads Give Report

15. What Web Application Scanners Do Badly
Interpret
Responses
Login Send Payloads Give Report
Doesn't understand business
logic!
Manual triage and
reproduction

16. What Web Application Scanners Do Badly
Interpret
Responses
Login Send Payloads Give Report
Doesn't understand
business logic!
Never even signed!!!
Manual triage and
reproduction

17. What Regular Testers Already Do
Modify the test to
hit all the test
cases
Find an idealized
workflow
Create an
automated
test
Find a bug
Use the previous
test to check if the
bug is fixed

18. What We Can Learn From Them
Modify the test to
hit all the test
cases
Find an idealized
workflow
Create an
automated
test
Find a bug
Use the previous
test to check if the
bug is fixed
Test lots of
scenarios!
Easy to reproduce!Get an actual user
workflow!

19. What a test can be used for
Modify the test to
hit all the test
cases
Find an idealized
workflow
Create an
automated
test
Find a bug
Use the previous
test to check if the
bug is fixed
Make all your strings:
<script>alert(1)</script>
Then send it to tons
of scenarios!
Show a failure if the
XSS alerts!
Anyone can
reproduce my bug!

20. Best Practice Issues

21. Workshop - Setup
• Please have ZAP Installed from
https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project
• Clone the repository from
https://github.com/distrustCaution/integrated-security-example
• Please install NodeJS v8.11.1
• If you are on Windows, you may need to add C:Program Filesnodejs
to your path.
• Run ‘npm install’
• Run ‘npm run integrationTest’

22. Workshop Part 1 – Survey the Test Code
• Go to test/integration_tests/test_ui.js and
test/integration_tests/test_api.js
• Mission – Learn how:

23. Workshop Part 1 – Survey the Test Code
• Go to test/integration_tests/test_ui.js and
test/integration_tests/test_api.js
• Mission – Learn how:
• The http client is set up
• The selenium web driver is set up
• How accounts are created
• How accounts authenticate
• How tests are run
• What the assertions are

24. Workshop Part 2 - ZAP and Passive Scan
• Go to the file: “test/workshop/find_passive_results.js”
• In that file, look for the browser setup script
• We’ll send it through ZAP’s proxy
• Then we’ll use ZAP’s reporter for basic output
• To run use: npm run workshopPassive
• For automating it, you can use the ZAP API
• A great article by one of the other speakers here (Omer Levi Hevroni) on how
to use custom rules: https://medium.com/@omerlh/how-to-scripting-owasp-
zap-with-javascript-1c1898b1e7e0

25. Look for cookies
Insecure cookies:
browser.driver.manage.all_cookies
Non-httpOnly cookies:
return document.cookie

26. Source: https://thehackernews.com/2017/10/coinhive-cryptocurrency-miner.html -

27. Source: https://thehackernews.com/2017/10/coinhive-cryptocurrency-miner.html -

28. Source: https://thehackernews.com/2017/10/coinhive-cryptocurrency-miner.html -
Dynamically
Load Scripts!

29. Source: https://thehackernews.com/2017/10/coinhive-cryptocurrency-miner.html -
JQUERY!Tests can just run:
window.performance.getEntries()

30. Workshop Part 2 – Looking for external scripts
• Go to the file: “test/workshop/find_external_scripts.js”
• To run use: npm run workshopExternal
• In selenium, try to get the results from:
“return window.performance.getEntries()” (try it in your browser first)
• We’ll filter it down to see if we get an error

31. Find Web App Bugs
Send Payload Run Test Check Payload

32. Find XSS the easy way
1. Create a payload ● <script>alert(1234)</script>

33. Find XSS the easy way
Create a payload ● <script>console.error(1234)</script>
PROTIP:
Alert will break tests

34. Find XSS the easy way
Create a payload
Use it
● <script>console.error(1234)</script>
● userName = “<script>...

35. Find XSS the easy way
Create a payload
Use it
Read it
● <script>console.error(1234)</script>
● userName = “<script>...
● Read selenium logs

36. Find Angular injection the easy way
Create a payload
Use it
Read it
● {{1234*1234}}
● userName = “{{1234*1234}}”
● Search the DOM for 188821744

37. Find Angular injection the easy way
Create a payload
Use it
Read it
● {{1234*1234}}
● userName = “{{1234*1234}}”
● Search the DOM for 188821744
PROTIP:
Big numbers
rarely collide

38. Workshop Part 4 – XSS
• Go to the file: “test/workshop/find_xss.js”
• To run use: npm run workshopXSS
• Generate a basic XSS payload: <script>console.error(1234)</script>
• Use “driver.manage().logs().get(webdriver.logging.Type.BROWSER)” to
get the browser logs
• Verify that your payload exists in the logs

39. Workshop Part 5 – Angular Injection
• Go to the file: “test/workshop/find_angular.js”
• To run use: npm run workshopAngular
• Generate a basic Angular Payload: {{2+2}}
• Look for it in the DOM with “return document.body.innerHTML”

40. Normal way to find SQL injection
Create a payload
Send it
Interpret it
● ‘ UNION SELECT 1
● userName = ‘ UNION SELECT 1
● Error!

41. Normal way to find SQL injection
Create a payload
Send it
Interpret it
● ‘ UNION SELECT 1
● userName = ‘ UNION SELECT 1
● Error!
What if it is too
early?

42. Easy way to find SQL injection
Create a payload
Send it
Break the test!
● ‘ UNION SELECT 12345
● userName = ‘ UNION SELECT 12...
● FAILURE!!

43. Workshop Part 6 – SQL Injection
• Go to the file: “test/workshop/find_sqli.js”
• To run use: npm run workshopSQLi
• Create a simple payload that could ‘break sql’ that contains characters
such as ‘, ”, or –
• Use it in the API tests, and see the failures you get back

44. Find XXE in test
Create a payload
Send it
Monitor the file for
reads
● <!DOCTYPE data SYSTEM
“file:///c:/myfile.txt">...
● userName = <!DOCTYPE data...
● ls –lu (bash) or
(gci filename).lastaccesstime (powershell)

45. Authorization Bugs

46. Finding Authorization Bugs in CRUD
1. Alice makes the resource
2. Alice modifies the resource
3. Alice shares the resource with Bob
4. Bob reads the resource

47. Finding Authorization Bugs in CRUD
1. Alice makes the resource
2. Alice Eve modifies the resource
3. Alice Eve shares the resource with Bob Eve
4. Bob Eve reads the resource

48. Finding Authorization Bugs in CRUD
1. Alice makes the resource
2. Alice Eve modifies the resource
3. Alice Eve shares the resource with Bob Eve
4. Bob Eve reads the resource
Preparation as
“Victim”
Authorization bypass
attempt as “Attacker”

49. Finding Authorization Bugs in CRUD
1. Alice makes the resource
2. Alice modifies the resource
3. Alice Eve shares the resource with Bob Eve
4. Bob Eve reads the resource
Preparation as
“Victim”
Authorization bypass
attempt as “Attacker”

50. Workshop Part 7 – Authorization
• Go to the file: “test/workshop/find_authz.js”
• To run use: npm run workshopAuthz
• See how to create an ‘Evil’ account
• Attempt to do the following by modifying the api test:
• Read someone else’s note
• Modify someone else’s note
• Share someone else’s note

51. Co-Worker:
“So… most of the time it finds nothing and
doesn’t tell you about it?”
Me:
“Exactly! I don’t want it to succeed, I want it
to try.”

52. “Give me a place to stand and I will move the Earth”
- Archimedes

53. ✓ Don’t break tests
✓ Tailor it to your company
✓ Testers can now look for security bugs
✓ Keep it maintanable
✓ Help fix bugs faster

54. Join the conversation #DevSecCon
Thank you!
For more information go to:
https://github.com/distrustCaution/integrated-security-example
My twitter:
@Hackimedes