9 Secure Code Review Best Practices For Your Web Application

Secure Sockets Layer (SSL)/Transport Layer Security (TLS) protocols are used for end-to-end security hardening of network traffic. Developers often deploy TLS/SSL for encrypting authentication services but overlook implementing it on external internet traffic, other network layers, or the web service. As a result of such network component misconfiguration, session IDs and credential data remain exposed and are potentially susceptible to interception, redirection, and injection by attack vectors.

SSRF vulnerabilities often arise from implementations where our web application needs to use third-party services. Sometimes you will just be given a version number, like in this case, but other times you may need owasp top 10 proactive controls to dig through the HTML source or even take a lucky guess on an exploit script. But realistically, if it is a known vulnerability, there’s probably a way to discover what version the application is running.

Web Application Testing v/s API Testing

The experience and knowledge of a security analyst or code reviewer is indispensable in the secure code review of a web application. For example, in tasks where the code review needs their ability to identify application logic issues. APIs, which allow developers to connect their application to third-party services like Google Maps, are great time-savers. However, some APIs rely on insecure data transmission methods, which attackers can exploit to gain access to usernames, passwords, and other sensitive information.

With its tens of thousands of members and hundreds of chapters, OWASP is considered highly credible, and developers have come to count on it for essential web application security, and API security guidance. Scanning for, remediating, and protecting against the vulnerabilities described in the OWASP Top Ten list is a good starting place for web application DevSecOps. These vulnerabilities are some of the most common and high-impact vulnerabilities in web applications, and their visibility makes them common targets of cyber threat actors. If you have any questions about these secure code review best practices or need any help with your secure code review, please contact us. Automation tools enable streamlined processes with minimal human intervention allowing them to focus on more complex tasks that require logical or business analysis.

Task 4 : Broken Access Control (IDOR Challenge)

For starters, simply by using our Universal Login offering, you are effectively delegating all the work of making your login pages secure and resilient to attacks. The outcome of threat modeling is documentation that outlines secure design recommendations and requirements for the system under consideration. This helps identify potential vulnerabilities earlier in the software development lifecycle. In more recent times, NoSQL Injection has become a factor when using NoSQL databases such as Mongo.

Regarding passwords, validating for weak or well-known passwords using a common password list and hashing the user’s password using a strong hashing algorithm (such as Bcrypt or PBKDF2) take the protection a step further. Many times, what happens is that developers forget to sanitise the input(username & password) given by the user in the code of their application, which can make them vulnerable to attacks like SQL injection. However, we will focus on a vulnerability that happens because of a developer’s mistake but is very easy to exploit, i.e. re-registration of an existing user. One example of such a vulnerability was allegedly used when Patreon got hacked in 2015. Five days before Patreon was hacked, a security researcher reported to Patreon that he had found an open debug interface for a Werkzeug console.

CWE Data

Now that we have a version number and a software name, we can use Exploit-DB to try and find an exploit for this particular version. Security Misconfigurations are distinct from the other Top 10 vulnerabilities because they occur when security could have been appropriately configured but was not. Even if you download the latest up-to-date software, poor configurations could make your installation vulnerable. Once the attacker has a foothold on the web server, they can start the usual enumeration of your systems and look for ways to pivot around. That is a big hint for the challenge, so let’s briefly cover some of the syntax we would use to query a flat-file database. While automated tools are more efficient than their human counterparts in performing time-intensive tasks such as searching for vulnerable code patterns within a massive codebase, they fall short in a variety of other aspects.

• For most cryptographic modes, it is recommended to leverage a cryptographically secure random number generator (CSRNG) to ensure the generated random number is extremely hard to predict and abused by attack vectors.
• Integrating directly into development tools, workflows, and automation pipelines, Snyk makes it easy for teams to find, prioritize, and fix security vulnerabilities in code, dependencies, containers, and infrastructure as code.
• Function-level authorization vulnerabilities occur when users access administrative endpoints and execute sensitive actions because they lack authorization.
• SQL and NoSQL injection attacks are just a subset of a broad category of injection attacks, which also includes Command, Expression Language, and LDAP.
• One example of such a vulnerability was allegedly used when Patreon got hacked in 2015.
• If this is the case, then an attacker exploiting the vulnerability can use the vulnerable web application to send a request crafted by the attacker to the indicated URL.

Data will be normalized to allow for level comparison between Human assisted Tooling and Tooling assisted Humans. On the other hand, a salt is a function added to a string to ensure that hash values are always unique. Adding the same salt function to the original string always results in a different hash, keeping functions, such as passphrases and sensitive data, hidden from exploits. Caching helps improve server performance by storing a local copy of the server’s response. The content of a server response can be intercepted and abused by anyone accessing the web/browser’s cache storing the copy of the response. As a security best practice, it is recommended to disable caching for all such server responses that contain private and sensitive data.

Task 9 : 3. Injection

Insufficient logging and ineffective integration of the security systems allow attackers to pivot to other systems and maintain persistent threats. When a web application fetches a remote resource without validating the user-supplied URL, an SSRF fault occurs. Even if the program is secured by a firewall, VPN, or another sort of network access control list, an attacker can force it to send a forged request to an unexpected location. Although deserialization is difficult to exploit, penetration testing or the use of application security tools can reduce the risk further. Additionally, do not accept serialized objects from untrusted sources and do not use methods that only allow primitive data types.

There are different logging levels to ensure the most important logs are backed up. For example, you may choose to back up fatal and error and logs while not backing up debug or informational ones. Implement DAST and SCA scans to detect and remove issues with implementation errors before code is deployed. At a high level, we plan to perform a level of data normalization; however, we will keep a version of the raw data contributed for future analysis.