Glass Box Testing: Thinking Inside the Box Omri Weisman Manager, Security Research Group IBM Rational

Glass Box Testing 2 © 2011 IBM Corporation Omri Weisman  Manager, Security Research Group  IBM Rational  9 years working on AppScan technologies, web application security, and static analysis  21 patents pending  2 published papers

Glass Box Testing 3 © 2011 IBM Corporation IBM 100 YEARS

Glass Box Testing 4 © 2011 IBM Corporation

Glass Box Testing 5 © 2011 IBM Corporation Agenda  Black box challenges  Glass box scanning  Architecture  Summary

Glass Box Testing 6 © 2011 IBM Corporation Black Box Challenge – Hidden Logic

Glass Box Testing 7 © 2011 IBM Corporation Black Box Challenge – Non-reflected Injection

Glass Box Testing 8 © 2011 IBM Corporation  SQL injection found – where to fix it? Black Box Challenge – Remediation

Glass Box Testing 9 © 2011 IBM Corporation

Glass Box Testing 10 © 2011 IBM Corporation

Glass Box Testing 11 © 2011 IBM Corporation No clear indication for an SQL Injection. Need to go deeper...

Glass Box Testing 12 © 2011 IBM Corporation Finally got it!

Glass Box Testing 13 © 2011 IBM Corporation Agenda  Black box challenges  Glass box scanning  Architecture  Summary

Glass Box Testing 14 © 2011 IBM Corporation What is glass box? VIDEO

Glass Box Testing 15 © 2011 IBM Corporation What is Glass Box?  Main idea: 1.Position server-side agents 2.Collect valuable server-side information 3.Report back to black-box scanner 4.Use data to enhance scan  Game-changing enhancement of black-box scanning  accuracy  coverage  reporting  … Using internal agents to guide application scanning

Glass Box Testing 16 © 2011 IBM Corporation Information Available to Glass Box  Web app runtime activities  Application structure, environment, technology, components  Configuration files  Source code information  Log files  File-system activities  Registry accesses  Network traffic  DB access

Glass Box Testing 17 © 2011 IBM Corporation Things You Can Do With Glass Box  Coverage  Hidden parameters/backdoors  Non-reflected issues  File upload  Denial-of-service  Exploit generation  Consolidation  Correlation  Auto-configuration  False positives  Static analysis  Deal with non-standard validation

Glass Box Testing 18 © 2011 IBM Corporation Main Challenges – Glass Box to the Rescue  Coverage challenge (hidden logic)  The debug parameter was uncovered and reported back  Hence, The Cross-Site Scripting is exposed! Psst… You can use the “debug” param!

Glass Box Testing 19 © 2011 IBM Corporation Main Challenges – Glass Box to the Rescue (Cont.)  Detection of non-reflected issues  Glass Box instrumentation operates at runtime, at the code level  Non-reflected security issue identified! Fingerprint identified in SQL Injection sink! Runtime monitored sink

Glass Box Testing 20 © 2011 IBM Corporation Main Challenges – Glass Box to the Rescue (Cont.)  Limited security issue information  An SQL Injection issue, this time identified with the aid of glass box

Glass Box Testing 21 © 2011 IBM Corporation Agenda  Black box challenges  Glass box scanning  Architecture  Summary

Glass Box Testing 22 © 2011 IBM Corporation Architecture Black-box Scanner Target web app HTTP(S) HTTP(S) Agent(s ) AgentRules Control & Reporting Control & Reporting Glass box Component Target Server Glass box Engine

Glass Box Testing 23 © 2011 IBM Corporation Glass Box Timeline Start End Scanner Server Deploy Assistant Explore Start Glass Box Magic 2 2 Glass Box Test Enhance 7 7 Glass Box Explore Enhance New Param Re-explore 6 6 Test Started 8 8 Report Findings GET / GET /page?p=1... These are the params you missed GET /page?p=G’123B... I’ve found these issues...

Glass Box Testing 24 © 2011 IBM Corporation OWASP Top 10 - BB Injection (SQL,..) A1 XSS A2 Broken Auth. A3 Insecure Object Reference A4 CSRF A5 Security Misconfig A6 Insecure Crypto A7 URL Restriction A8 Insufficient Transport layer Protection A9 Unvalidated Redirects & Forwards A10 black-box

Glass Box Testing 25 © 2011 IBM Corporation OWASP Top 10 - GB Injection (SQL,..) A1 XSS A2 Broken Auth. A3 Insecure Object Reference A4 CSRF A5 Security Misconfig A6 Insecure Crypto A7 URL Restriction A8 Insufficient Transport layer Protection A9 Unvalidated Redirects & Forwards A10 black-box + glass-box ONLY TECHNOLOGY to effectively find issues in ALL the categories of OWASP top 10

Glass Box Testing 26 © 2011 IBM Corporation Agenda  Black box challenges  Glass box scanning  Architecture  Summary

Glass Box Testing 27 © 2011 IBM Corporation Summary  Glass box is a new technology, that is all about using internal agents to guide application scanning  Glass box significantly enhances every aspect of black box scanning:  Exploration, testing, exploitation, reporting  Glass box isn’t just a feature-set...  It is a new way of thinking  With nearly endless potential Image: Meawpong3405 / FreeDigitalPhotos.net

Glass Box Testing 28 © 2011 IBM Corporation Smarter security for a smarter planet