right ladies and gents It's the final
one for today and it's actually I
understand the recorded uh presentation
so Focus your eyes on the screen when it
starts just to remind you after we've
finished
um we have uh beers for peers
and that will be uh some some beer
benches on the ground floor
to maintain a little October Oktoberfest
feeling for you so you can go down and
grab a beer after the presentation
finishes
apologies everyone that I cannot join
you today personally on this stage but
uh I hope to see you soon next year
hopefully so uh I'll be starting my
presentation now uh today my topic of
the talk will be what are we still
missing in web applications so uh I'll
start the presentation quickly few words
about myself as you're aware that my
name is and I'm working with the senior
security consultant in a UK based firm
and I was heavily involved in bug bounty
hunting programs back in 2012 and 13 and
awarded an honored by Google Microsoft
Facebook and there are a lot of
companies in the list I'm an oscp
certified and along with that I have
some known credentials as well and I've
been working as a penetration tester for
around eight years now which covers the
Network mobile applications and all the
other things then I do work to the
threat team inside of the work and I'm
quite enjoying that so uh I've been work
I I've worked and I've been working with
a financial industry Health industry and
all the other government Industries in
and all the other things that we can see
so now uh today my talk topic of the
talk will be the what are we still
missing the web applications let's move
with that okay as you're talking about
the major changes in the last top 10 uh
we have to take a look at 2017 and 2021
chart right now so if you can see that
the injections are the most important
thing in the 2017 now they're running
down to the uh some other number and
broken Access Controller the number one
thing in the uh was top 10 right now so
the main question arise that why we need
change so if we are talking about the
change everything needs to be changed
because there are a lot of new
technologies involving in the web
application mobile network and
everything is changing right so we need
to change the methodology as well
because there are two kind of
methodologies one was top 10 gave you
the methodology to test the web
application and the second one you think
by your own head because I've I was
heavily involved in the bug Bounty
program that uh I just told you you guys
about so we have to think uh very very
with the change perspective we cannot
follow that was top 10 and get the
Bounty so we have to try different
methodologies and do the things so these
changes needs to be implemented why I'll
tell you why uh there are aesthetic and
the dynamic scanners as you are very
well aware we we use this scanner to
scan the web application from the front
end and the back end as well source code
analysis what we are calling it there a
lot of tools that do the source code
analysis as well and the front end
scanner like for example if you use the
front end scanner if I name few of them
economics net spark and a few of them so
this kind of vulnerability that I am
going to talk about none of them gonna
uh find that not the static scanner not
the dynamic scanner see uh I'll explain
you why uh so I'll just explain you with
an example how the injections were done
and how they're protected now as you can
see over here uh the injection if we
just focus on the SQL injection right
now so in for uh SQL injections are uh
previously not protected by the
Frameworks MVC or or any kind of
framework I would like to talk about but
now the browser the Frameworks the the
patterns they're more defined they're
more intelligent and they can secure
your application before it goes to the
server end so if you talk about the uh
SQL injection for example so we can
secure it by the stored procedures
parameterize queries the correct
escaping input validation there are a
lot of them going on that we can secure
the SQL injections and so and so forth
other vulnerabilities if you talk about
the exercise so that can be mitigated by
the browsers itself on the front level
uh defense line but you can secure that
on the server end but right now we are
talking about a certain kind of
vulnerability that won't be protected
from the server and not the client and
but that is just uh in the hand of the
developers who are building that
publisher yes I am talking about the
business logic flaws yes ladies and
gentlemen the business logic flaws are
the only flaws that cannot be detected
by the dynamic or the static scanner but
there are few tricks and knobs uh you
can try that to automate the process but
that is not fully automated process so
what is the business logic flaws how we
gonna find that uh what impact does it
have on the application and what we are
looking forward so let's do it uh what
are the business logic flaws uh
vulnerabilities just in one word I'm
getting your data out of your
application or I'm just changing your
data without your permission so if
you're talking about the business this
logic law that is a very critical matter
how they arise negligence simple word by
the developers if you're not putting the
right access control on the right
controller or the view or anything else
if you're developing other product
platforms so negligence is the main key
for the business logic flaws and there
are a lot of people who did the bug
bounty hunting and they earn thousands
of dollar just for bypassing a logic or
a process see this is very simple I'll
explain it in a bit as well ABC and
you're skipping the B and you directly
jumping from a to c that's a business
logic flaw and you have to check in your
application right now as well so what's
the impact impact could be a disastrous
you can lose your data I can fetch all
the information from your system with a
local admin oh sorry a local user low
privileged user so if I can fetch and I
can redirect all the data from one end
to another end so I'm successfully doing
the business logic flow operation so
let's move forward
common vulnerabilities in the business
logic flaws what are the common
vulnerabilities and what are you looking
forward so one thing that is most
important thing that you trust your
client excessive trust in your client
site controls that I have asked email
they will provide me the email no that
won't be happening any above every time
trusted user won't always remain
trustworthy for example if I follow the
intent ABC and if I do ABC one two three
four five time but now I need to
manipulate your script and I'm just
jumping from a to c so I have to look
for all the combinations as a developer
that no user is trusted in my
application yeah so user won't always
follow the intended sequence that I just
explained that user won't always Supply
mandatory input as you explained that
you're asking for the numbers and I'm
providing you the spatial characters so
you have to look for that that what your
users are pro providing you and what
they are giving you from the front end
to be processed on the back end
so
now I'll be explaining a few examples
practical example that I have faced in
my uh tenure and these are already
patched and they're pretty old but
they're my live experience and the
Practical experience I want to share
with you with the example so first thing
if you talk about the Oracle one I would
like to just explain you over here I
published a CV in 2019 and that's
vulnerability was in the Oracle
financials and that was a fraud
management system fraud detection
basically system and it was implemented
in one of the banks in some other
country so uh what happened uh they
deployed the solution and they want to
do the penetration testing as a normal
vendor vvv initiated the testing so what
happens there were two users if I uh if
I can name them over here if you can see
that on this screen there were analyst
my and there's another analyst so the
problem is that I have one low
privileged user and a high privileged
user what I did it from the hyper
Village user I just copy and paste every
request and response from the server to
the client and I just saved that in a
file now what happens I log in with the
low privilege user and in the burp suit
what I did I just copy and paste and do
some tweaks that I'm not gonna explain
it over here because they are
confidential so I did some tweaking in
the request in the response of the
server and what happens it shows me all
the data that the higher privilege user
can see see now I can show you here if
you can see there's a analyst SC and
there is analyst my I just explained you
analyst and why was responsible for all
the things but now I can request the
same process same request same data
these are the pure pretty uh ND money
laundering application and I'm just
looking at the logs alerts and
everything in the application I've just
masked it down by the way so everything
is secure and confidential but the
problem is that I saved the request from
the high privileged user and applied
that to the low privileged user that's
how I bypass the application and uh they
publish the cve in 2019 and yeah I'm
pretty happy with that
so moving towards this second example I
mostly work for the banks and insurance
companies so uh there was a mobile
application for a bank and uh remember I
was saying that business logic flaws
cannot be detected by the static other
Dynamic scanners you have to work around
in your mind to change the methodology
and skip the good parts and just jump to
the bad parts right so this particular
example is a pretty much straightforward
to that example what kind of uh
methodology I applied on that let's have
a look at that so if you can see from
the left hand side first image pretty
normal username and password they're
requesting so my methodology and my way
of testing is that first of all I
provide all the valid credential to the
application username password OTP then I
manipulate them because once I see all
the requests and response that are valid
then I can play around right so capture
all the requests in response from the
server to the client and do the from the
client to the server as well because you
can uh just click on the verb so then
you can capture the server response so
pretty straightforward application right
username and password it sent the
passcode on the mobile application
mobile number that I have so
first time uh what I did I just put the
username and password then it provided
me the
OTP I provided the OTB in the Box as
well and it logged me so how did it
happen uh normal pretty straightforward
application username password OTP I'm in
so I logged out I log out again and when
I try to log in again with the wrong OTP
it says invalid OTB invalid passcode so
I try multiple options multiple options
a b c
um there is an image I posted in other
slide I'll show you that there's a
sequence check one two three one wrong
two wrong three wrong four boom on so
now what I did I just tried to use the
that approach username and password is
correct but I don't have a passcode so
what I did I tried zero zero zero zero
it read it says invalid passcode and it
redirect me back to my login screen now
what I did I just put a username and
password sword and I click login and it
bypass the OTP system and it showed me
my account
so that's how I bypass the logic without
any tool without any scanner without
doing anything on the system or scanning
or the coding process I just use
username and password
OTP OTP back and it just logged in
because there's a flaw in the
application it was checking for the
passcode for the one time only if that
is correct or wrong no matter the second
time you're coming your passcode is
finished and you can bypass that
application so that's how I bypass this
application so you have to look out for
the particular Minor Details in the
application as well that you cannot
Escape right
now let's have a look to another
application this also belongs to a
banking application and this is the
internet banking that we are talking
about and I bypassed this uh system as a
normally pretty standard way that I used
to do I I love bypassing the otps by the
way so in this example particular
example I bypass the OTP again and this
is a different bank uh all together so
how it happens uh let's have a look uh
first thing first you know my Approach
login pretty straightforward capture all
the requests in the response from the
client to the server and do this from
the server to the client and I just
capture everything and place it in a
notepad file I literally have 30 plus
tabs in the notepad plus plus at the
time when I was testing and still I have
a lot of tabs going on but I close them
because I don't see any potential so I
close them all so I restart again and
build that 3D tabs again in an hour so
there is a pro coach what I did I just
log in I just captured the details and
all the response and requests forcing if
you can see on the left hand side screen
there's image username and password and
the OTP I provided the right OTP that
was sent on my mobile application mobile
phone and if you can see on the right
hand side top uh right top there's an
image that log in DN and text OTP it
says four one three three four two
something like that right and it is a
valid OTP and in the bottom image you
can see it's redirecting me a certain
page of the internet banking now what I
feel uh I posted the right OTP so it's
root detecting me to another page what I
did I just tried to manipulate this
request this screen request I capture
this one that redirecting to certain
page I capture this one and I try to
manipulate it with the wrong OTP let's
see what happens now on the left hand
side you can see on the top left hand
side I provided the wrong OTP I provided
the wrong OTP on the middle image if you
can see and there is a line provided OTP
is incorrect as soon as it show me that
the next screen I just copy and paste it
that request that I've already saved
which was a valid response from the
server that yes we are redirecting you
to the dashboard or the home or the menu
screen something like that and I just
replace that and what happens it just
opened up me the dashboard of the
application and it's it is a banking
internet banking internet facing
application Android was very critical so
that was all NDS signed so we just
responded back to the uh client and they
fixed that the next day but this is our
methodology that we use to take the
screenshots and all the other things to
uh work on that to do the r d further
and we do the reporting as well after
that but we uh inform the client and fix
it on the next morning
so
so the problem with the business logic
flow is the security design flaw
remember that example I just bypass the
mobile operations with this particular
thing attempt one no attempt to no
attempt three yes you can go inside so I
bypass the mobile application with this
approach and yeah there's a design flaw
you have to be very careful what you are
putting in your Access Control list
while accessing every request in your
server and the client inside what you're
providing your clients is the thing that
you have to control on your server side
okay now let's talk about something
Automation and the scanning things
remember I was saying there is no
scanner to detect the business logic
flaw in the web application or the
mobile application now remember I was
saying that there are no scanner for the
business logic floor neither the dynamic
or the static scanners but the good news
is we have multiple plugins in the burp
suit as well one of them is auth metrics
displayed over here dot metrics to a lot
of thing and it saves your time while
testing the other thing in the
application what it does uh repeat the
workflow with a different user user
roles skip forward this tab in the
workflows for example ABCD ACD remember
that approach so it does it
automatically and you have to provide
two credential one with the lower and
one with the privileged so it can
manipulate the requests and do what
basically what we are doing manually
it's doing uh automatically on the web
application uh from the perp suit
perspective so there are a lot of things
I want to talk about how you're going to
plan your attack how you are going to
test your next application if you're a
penetration tester what to look for in
the source code to mitigate it so I
would like to talk about a lot of things
how you're gonna test it how you're
gonna secure it so first thing first
having full understanding of what the
application is supposed to do you have
to be uh take the understanding how the
application is working what are the
flaws of the application and the main
thing is the good thing is dividing and
modeling the workflows every feature of
the the application you have to design
and design the workflow of that then and
create the thread models of that as well
individual modules thread model is a
good approach rather than going for the
whole application and just making one
thread model so if you can just take a
look at what companies are involved in
this one so you can secure it precisely
right analyzing the control carried out
the parameter send the response is
returned every time you have to look out
for something in your web application
now as manager what you have to ask as a
developer as a security concern what you
have to ask if you are turning your data
to someone else who from womb to whom
with whom for whom my data is going
where it is going how much time will it
need to be returned and who is using how
by what means you're saying that I have
to send the request okay perfectly fine
how by what means API okay the API is
secure now it's running on the HTTP so
that's your flow is over here so most of
the apis that I have personally tested
there are HTTP and they are not they are
not protected enough right how much what
quantities are you talking about because
business logic flaws if you go to the
Portugal website that I've mentioned the
image of they have a lot of labs going
on if you go to the business logic Flow
app
um uh testing parameters so you'll see
there are a lot of applications and you
can do the Hands-On testing while doing
the business logic flaws in the current
application so uh
these are all the things that I just
want to say
um so my final word for the presentation
is that if you're a tester and if you
are more interested in the web
application and the mobile exam mainly
in the web applications do consider all
the requests and response never never
earn this estimate any request of the
response just capture and save it for a
while and then delete it no worries but
you have to try one by one everything
just capture a flow first of all right
correct uh legit user login then just
repeat that flow without the valid
credentials then you can see how your
servers are sponsing and your
application is working there are a lot
of things people confuse it with the
idor indirect object reference but
either is something else and you are
talking about we are talking about
something else
so with the snow thank you very much
everyone for your time and I hope to see
you soon uh hopefully and there are some
details if you want to contact me and
there's a barcode you can scan to go
reach me and yeah happy Hunting bye
polite Applause
um thanks that wraps it up for the day
two quick points uh you can gain CPE
credits at the isaca for attending this
conference and they have a stand on this
floor
outside on the right
and they'll be there tomorrow and go
grab yourselves a beer if you want but
don't drink too much because you have to
come back tomorrow