Avaliações de Segurança

Para executar os testes de vulnerabilidades nas aplicações web o Sistema RedeSegura utiliza o navegador virtual do N-Stalker WAS, com suporte para processamento de Java Script e Remote Scripting – Ajax, entre outras características, tais como:

Verificações de “Cross-site Scripting”, “HTML Injection”, “SQL Injection”, “Buffer Overflow”, falha de integridade na manipulação de dados, e Manipulação arbitrária de parâmetros;

Banco de assinaturas de ataques HTTP com mais de 39.000 assinaturas de avaliação de ataques, compatível com o CVE (Common Vulnerabilities and Exposures);

Detecção de incongruências na geração de códigos HTML para o navegador, problemas de compatibilidade e confidencialidade (falta de criptografia para senhas, ou métodos inseguros de envio de dados, etc.);

Outros módulos de ataques adicionados freqüentemente pelo laboratório de pesquisas da N-Stalker (WSI Labs);

Identificação e levantamento de objetos da aplicação, como formulários, e-mails, campos ocultos, o que permite avaliar a qualidade das entregas do desenvolvedor.

Os testes do Sistema RedeSegura utilizam diversas técnicas de avaliação de segurança para identificar vulnerabilidades nas aplicações web, todas sustentadas pela tecnologia N-Stalker, o que inclui:

Web Engine
divlar

N-Stalker Web Spider Module

Custom Design Errorsdivlar

Cross-site Script Injection Module
Database Tampering – SQL Injection Module, including:
– Direct mode
– Blind mode
Buffer & Integer Overflow attack Module
Format String attack Module
File & Directories Tampering Module, including:
– Backup Files Discovery
– Configuration Files Discovery
– Password Files Discovery
– Information Leakage Discovery
Parameter Tampering Module, including:
– Special Parameter Addition attacks
– Boolean Parameter Tampering attacks
– Hidden Parameter Discovery
– Parameter Deletion attacks
– Remote Eecution attacks
– File & Directory traversal attacks
– Header Splitting & CRLF Injection attacks
– Remote File Include PHP-based attacks
Check for Suspicious Values in Web Form Hidden Fields
Custom Signature Check (via Signature Editor)

Web Server Exposuredivlar

Web Server Infrastructure Analysis Module, including:
– Web Server & Platform version vulnerabilities
– SSL encryption and .509 certificate vulnerabilities
– HTTP Method Discovery Module
– HTTP Fingerprint Module, including:
– Web Server Fingerprint Module
– Web Server technology Discovery Module
– Directory Brute-Force
– HTTP Protocol vulnerabilities

Web Signature Attacksdivlar

Web Attack Signatures Module, including:
– IIS CGI Decode Test
– IIS Etended Unicode Test
– IIS File Parsing Test
– FrontPage Security Test
– Lotus Domino Security Test
– General CGI Security Test
– HTTP Devices Security Test (routers, switches)
– Windows-based CGI Security Test
– PHP Web Application Security Test
– ASP Web Application Security Test
– J2EE Web Application Security Test
– Coldfusion Web Application Security Test
Attack templates such as:
– Complete, OWASP, SANS/FBI Top10, Top20

Confidentiality Exposure Checksdivlar

Look for Web forms vulnerabilities, including:
– Password cache feature
– Insecure method for sending data
– Lack of Encryption for sensitive data
– Insecure location to send data (leakage)
Information Leakage module, including:
– Find directory listing
– Find available objects to download
– Find meta-tag leakage
– Find sensitive keywords in comments and scripts
Compliance analysis, including:
– Find Copyright statements
– Find content rating statements
– Find custom content on web pages and forms

Cookie Exposure Checksdivlar

Cookie Security Analysis Module, including:
– Find weakness in cookie information
– Find cookies sent without encryption
– Find information leakage in cookie information
– Find cookies vulnerable to malicious client-side script

File & Directory Exposure Checksdivlar

Search for backup files
Search for information leakage files
Search for configuration files
Search for password files