- [Narrator] In this lesson,
we will cover several insecure code practices
that attackers can exploit,
and that you can leverage
during the penetration testing engagement.
The first one is that often developers include information
in source code that could provide too much information
and that might be leveraged by an attacker.
For instance, there may be details about a system passwords
or API credentials, or other sensitive information
that an attacker actually can find and use.
Now MITRE created a standard
called the common weakness enumerator
and that stands for you know, CWE,
and CWE list identifiers that are actually given
to security malpractices, or the underlying
weaknesses that actually introduce
these type of vulnerabilities.
There's one in specifically for information
exposure through comments, that is CWE-615.
And I'm covering, or I'm showing the link here
in the screen, and also the link for
the overall information about CWE.
Now, the other one that I want to cover is the lack of error
handling and overly verbose error handling as well.
Basically, improper error handling is a type of weakness
and malpractice that can actually
provide information to an attacker
to help him or her to perform
additional attacks on the system.
Basically, things like error messages like error codes,
and database dumps, and stack traces can provide
a lot of information that an attacker can use
to learn about potential flaws in the application
that could be further exploited in the system.
Now our best practice is actually to handle error messages
that in a way, that provides meaningful information
to a user, and diagnostic information to developers,
and support staff, but no useful information to an attacker.
The other thing that we still find
in many different implementations
is actually hard coded credentials.
And hard coded credentials are catastrophic flaws
that an attacker can definitely leverage
to completely compromise an application
or the underlying system.
Now, one last concept that I want
to cover here is the use of APIs.
So, Application Programming Interfaces,
because they're actually used everywhere,
but the insecure implementations of those APIs.
In a large number of modern applications
use some type of API to allow
other systems to interact with the application.
The bad thing here is that many APIs lack adequate controls,
or are difficult to monitor as well.
So the breadth and the complexity
of those APIs make it very difficult
to automate effective security testing.
Now, there are a few methods
of technologies behind modern APIs.
They're, you know, the traditional SOAP-based APIs,
those are actually less popular nowadays,
But, that's SOAP stands for Simple Object Access Protocol,
And it's an XML-based specification.
There's also Representational State Transfer, or REST APIs.
These API standards actually easier than SOAP.
It actually uses JSON instead of XML,
and it uses standards like Swagger,
and the open API specification
to document and encourage adoption.
Now, there's also graphQL APIs,
and graphQL is actually a query language
for APIs that provides many developer tools.
It's actually gaining a little bit
of popularity nowadays, is now used for
many mobile applications, and online dashboards as well.
Now, API documentation can provide you
with a great level of detail that can be
very valuable for you to actually perform a pen testing,
right, and perform pen testing
against a specific modern applications.
Now those documentations like Swagger documents,
the Web Service Description Language, or WSDL documents,
and WADL documents, a Web Application Description Language
can definitely allow you to
gain a footprint and to understand better
of how the API is actually constructed,
and how the application is actually behaving.
Now, whenever you're performing a pen test against an API,
it is very important to collect
full request by using a proxy, like Burp Suite
and the OWASP Zed Attack Proxy.
Now, it is important to make sure
that the proxy is actually able
to collect the full API request,
not just the URLs, because REST, SOAP,
and other API services use more than just GET parameters.
So it is very important that you
actually know that and pay attention to that.