codEX Project Normalizing as the first step to improve |
| Introduction | News | Documentation | Download | Contact |
| Vulnerability Identification Vulnerabilities are given under some circumstances only. The vulnerability classes addressed within the codEX analysis are the following. Every vulnerability has some attributes which define the data source and destination, the control behaviour and the conditions.
By combining the control and data flow analysis it is possible to identify these vulnerabilities, their infection and attack vector [Ruef 2007]. According to the following code the varget test is an untrusted input from $_GET. It is first introduced within the control condition from 003:003:012 to 003:006:031. The real vulnerability can be identified within the code block from 005:011:070 to 007:015:116, where the untrusted data is re-used within an output command. The condition for a cross site scripting vulnerability is met and therefore the injection and attack vector in 006:014:113 determined.
The discussed vulnerability is only executable if the control structure forks to the else block. This is depending on the input itself which should not be equal 1. Because the malicious input data "<script>alert(document.cookie)<script>" fullfills this condition, a successfull attack is possible. Thus, a detailed analysis will bring up the following results for the analyzed PHP source code:
The other vulnerabilities were not found because of the following reasons. There is no SQL injection because no SQL function or database connection is used. All the data is static or comes from the user. A buffer overflow was also not found because PHP itself is not vulnerable to such attacks (however, the Zend engine might be). Furthermore a format string vulnerability was also not found because not such function was used. The cross site scripting vulnerability described before is the only found vulnerability within the discussed source code. At least, the (semi-)automated generation of an exploit would be possible. In this case of a cross site scripting attack within a web application the following link could be used to prove the vulnerability for sure. The proof is given if the access attempt to this URL brings up a JavaScript alert box which contains the used cookies for the target site (in this case an empty cookie set is expected because none of the were used within the code):
As you can see it is possible with codEX to determine vulnerability within a detailed source code analysis. It is not easy and requires many steps of abstraction and analysis. But in the end a very accurate statement about the real-world security of an application can be made. Technical security analysis can be brought to a new level of professionality. Bibliography Ruef, M. (2007), Die Kunst des Penetration Testing, C&L Verlag, Böblingen, ISBN-13 978-3936546491 [back] |