Web Application - Vulnerability Testing

Question:

I am a software tester with 11 months experience. I want to explore security testing area and would like to know more about vulnerability testing more specifically about SQL injection attack. Also guide me as to how these testing can be performed manually.

By: Saran Satyan

Answer:

Vulnerability Testing is a practice area for security professionals. There is no simple or one solution that will work in all cases. One has to go through a structured approach to accomplish this testing. The high level steps include scoping, information gathering, tool selection, and then performing the scanning. Most of the vulnerabilities require in-depth knowledge on the internals of the web application like its design and architecture in addition to the tools and technology used in its build. Manual methods or techniques may not help in identifying most of the vulnerabilities.

As we all know, SQL query language is used to retrieve data from the databases and a technique to exploit the the query language to fetch unintentional data by injecting unexpected input data is referred to as SQL Injection attack. As an example, typical where clause in a query used to authenticate a user would be like where userid = <user_id> and password = <password>. The user id and password as entered by the user would be substituted in this where clause in run time before execution. Programmers adopt different techniques to dynamically bind the input variables to build the needed where clause. One such simple method of dynamically building the where clause is by concatenating the input data like "... where userid = " + user_id + " and password = " + password = ";" In this case for instance, if the user inputs the password with something followed by "or 1=1" then the where clause of the final query will look like where userid = user_id and password = password = password or 1=1; As we all know, this query when executed will retrieve all the rows in the user table because of the condition or 1=1.

Here is an article worth referring to know more about SQL injection attacks.You may also check out the following links to know more about vulnerability testing:

Web Application Security Testing Cheat Sheet
The world's most advanced Open Source vulnerability scanner and manager
Web application security: Testing for vulnerabilities

Hope you will find this response useful.

Website Scalability Test - JMeter Listeners

Question:


I am on a task to perform a scalability test of a website. I am new to JMeter and I want to know how to capture and analyze the test results using JMeter. More specifically I need to capture the response time of the pages that I would be testing.

By: Saran Sathyan


Answer:

You need to add a listener and configure to write the test results into a Log file. You have the option of using a csv or xml file format. You can do this visually, by right clicking on your test project shown in the left explorer bar and then add-> Listner->... JMeter provides many listeners and you may just choose either Simple Data Writer or View Results in a Table. In the resulting window, you will find options to specify the output file location and configure the data elements that you want to capture. JMeter captures two time fields, one being the elapsed time and the other being latency. While the latency indicates the time to the first response, the elapsed time indicates the total time to load the page completely. With this listener, all your test results will be logged, and you may use simple tools like excel or import into MS Access or such other database as you may be comfortable and then get the necessary summary data by grouping on appropriate fields.


Generally to assess the scalability of your website, you also need to monitor and collect stats from the server(s) on which your website is running at the same time your tests are run. You may have to engage your system administrators to help you in collecting the performance statistics on server resource utilization like, CPU, Memory, Network bandwidth, Disk IO, etc. As you simulate more load from JMeter, the utilization of the resources on the server will go up. The ideal approach is to plan to have multiple tests starting with 50 or 100 users and ramp up the load until you the resource utilization on the server hits the maximum (say 90%). This way you may also benchmark the site performance on the given server hardware and network bandwidth.

Your report should also report the server utilization details in addition to the page response time and the bytes received so as to make it useful for the report users to make further decisions. Also be aware that if you perform the load tests from one location, your test results might be biased as you may hit the bandwidth limitation on your end. Hope this helps.

For more details on JMeter listeners, check out the documentation available online at http://jmeter.apache.org/usermanual/listeners.html

Setting up Second Wi-Fi Router to LAN

Question:

My office has two sections operating on different floors of the building. We are using a Wi-Fi router for our office LAN & Internet access, but the range of this router is not enough to support the other floor area. We understand that connecting another router would need a different subnet and what we need is just a switch. Is there a way to have the second router setup to just function as switch?

By: Arun Viswa

Answer:

While there are specific devices that will meet this requirement, yes, this can be achieved using Wi-Fi routers as well (Some routers may have hardened the configuration and thus restricting this ability). The routers have the switching function within it and you just need to use the switching function alone. You can achieve this by configuring your second router as below: For this purpose, let us assume that your first router is setup to have your office network as 192.168.3.0 / 255.255.255.0 with a gateway address as 192.168.3.250 and DHCP Server enabled for a range of IP addresses.

1. Some routers automatically setup the WAN port upon connecting the network cable on the WAN port. And so, do not connect your network cable into any of the ports yet.
2. Just connect a PC or Laptop to one of the LAN ports(usually numbered) and just go to the LAN setup section using the web based setup portal. Usually this can be accessed using the URL http://192.168.0.1. Consult your router manual for the default IP and the admin credentials.
3. Disable the DHCP Server and assign a static LAN IP within the same subnet, that is outside the DHCP range of the primary router. In our case, let us assign 192.168.3.255 with the same subnet and gateway as that of the first router.
4. Now connect your LAN cable from the first router into another numbered LAN port(not the WAN port).
5. Make sure that your primary router's DHCP range is wide enough to support the number of computers and devices that you would be connecting from both the floors of your office.

Incidentally, if you setup your Wi-fi with the same SSID and security setup as that of your first wi-fi router, you have wi-fi roaming also working. i.e. your office wi-fi devices configured to connect to your first router will automatically connect to the second router when they move into the wi-fi range of second router. Please note that as I have indicated, some router's have pre-configured firmware restricting this kind of setup.

You can always reach me for further clarification on this.

How to take Screen Shot in Android Phone?

Question:

I have seen my friends taking and sharing screen images using their iPhone. While I think that this should be possible in Android Phones as well, I could not figure out how to take screen shots in my HTC One M7 running Android Jelly Bean.

By: Niranjan Babu

Answer:

Yes, Android natively supports taking screen shots in Ice Cream Sandwitch and Jelly Bean versions. It is not an explicit menu or a built in app though. The trick is that while you are at a screen that need to be framed, press and hold the Power button and the Volume Down button simultaneously. You may have to hold press and hold these buttons for about two seconds or little more, until you hear the camera click sound and visually see the screen being framed and saved into the Pictures/ScreenShots folder. Some specific vendor tweaked versions may have explicit touch buttons within certain applications.

For those who are using older Android versions like Gingerbread or earlier, then you are left with the option of using an application. You may search through the app store and find as many applications that facilitate taking screen shots. Beware that some of such apps may require you to root your OS, which is not recommended as certain manufacturer specific features may stop working once you root your phone.

Why Active / Active DC Design is not preferred by many yet?

Question:

We all know that Active / Active is always there as an option for a Data Center design. But We could not find many actual implementations out there. While everyone think that the Active / Active DC solution maximizes the DR investments, not many are getting in there. Can you highlight the challenges and issues that holds this option back?

By: David Matt

Response:

There are three key issues or challenges that when addressed will result in higher investment than expected and / or increase the complexity. The three challenges are explained further as below:

1. Network Latency - To be Active / Active, the data created in on DC should also be created in the other DC with least latency, so that the user requests land on either DC would happen to see the most current data. Though there are tools and technologies to offer active / active solution, they are constrained by a minimum network latency between the DCs. For instance, EMC offers VPLEX based active / active DC solution, but requires that the latency be 50 ms or less. Considering the speed of light and the availability of the optic fiber channels, theoretically, this is achievable within reasonable distance, but in practice, there are various other factor that would have impact on achieving the required latency consistently.
2. Network capacity - When we talk about active / active data centers, it is not just the database replication, it also requires the application state and associated data to be replicated in real time. More over, given the actual fluctuates, there is a need to provision for the peak time capacity so as to ensure that the latency does not go down in peak periods. Thus, the network capacity needs can easily be three times or even four times of that needed for an active /passive DC design.This need will straight away beat the assumed cost advantage of using the DR site for production as well.
3. Overall DR Capacity - Assuming that the DR site will also be active for read and write, there is a tendency size the Primary and DR sites to half or little over half of the planned production capacity so that both put together would meet the production demands. Now, in such a scenario, if the either of the site fails, the production capacity comes down to half leading to ineffective DR.

 Given the above key challenges and other related issues, organizations end up with Active / Passive DC solutions or a hybrid solution, where specific applications are partitioned to run out of specific Data Center.

Testing SOAP Webservice APIs

Question:

I am working on an integration project where the components that we build need to consume a set of Webservice APIs. While the vendor has shared the documentation and test accounts for us, I am curious if there would be a simple tool which help me to browse through the various methods and test the same on the fly. I know that we can quickly build a test driver using the proxy class for the given wsdl. However, a generic tool might be of great use as it saves time and it can be used for different services as well.

By: Kathiravan Venkatesan

Response:

As you have acknowledged, it is quite easy to quickly build a proxy component and then write simple methods around the exposed web methods to test the webservice APIs. And yes there are tools to test SOAP web services as well that can be used to test a multitude of service APIs. One such tool that I have used in the past is SoapUI by SmartBear, which has a professional and a free open source edition. The free version is good enough to browse through the various web methods and test them as well.

I would suggest you to explore the features of SoapUI to know more about the tool's capabilities. The usage is simple and straight forward. Once you create a new project the tool helps build a tree of web methods based on the wsdl of the service. You can create as many test data against each services and execute instantly to see the output as well Moreover, the test data can be dynamic from a wide range of external data sources. Thus this tool can be very handy for performing the functional testing of webservices.

In addition, the tool can be used to perform load testing and security testing as well. The tool can also supports simulation, i.e. mock the services, which will be very useful during the development stage. There is more to it and I would suggest you to explore, though some of the features are part of the pro version.

Image Drag, Drop and Zoom using HTML5 Canvas

Question:

How can I perform drag and drop of images and the zoom in and out of images using HTML5 Canvas element?

By Iyappan Ranganathan

Response:

There are many free Javascript libraries out there to accomplish many drag and drop and other image manipulation features. The one that I have used and satisfied with is KineticJS library. KineticJS exposes events and methods to manage multiple layers, shapes, images, grouping which in combination would help achieve your needs. Specifically the dragstart and dragend events will be the ones you would be interested to implement the drag and drop feature. For zoom in and out you should be using the setScale method.

Check out these links demonstrating the needed features:

HTML5 Canvas KineticJS Scale Animation Tutorial

HTML5 Canvas Drag and Drop an Image

As I said, there are many Javascript libraries and you may pick the one that best suits your needs.