Using Watir-WebDriver or Capybara For Web Application Vulnerability Unit Testing

Back in October, I gave a Security B-Sides presentation filled with demos showing how to construct and execute unit tests for web application security vulnerabilities.  The goal was to:

1. Allow QA teams or developers to execute unit tests to demonstrate that a web application vulnerability remains fixed 1 day, 1 week, 1 month, or even 1 year from the date it was remediated (For example, security unit tests run as part of a continuous integration process).
2. Provide a mechanism for security teams to demonstrate a vulnerability instance to web application stakeholders.  One that can be run by the stakeholders themselves, as many times as needed, with little or no knowledge of security testing techniques.
3. Allow security testers to write testing tools or scripts that interact directly with the browser, eliminating many false positives occurring due to the inability to execute JavaScript or other similar browser dependent components.

The presentation slides and unit test scripts are available below.  Before trying out the unit tests, make sure you have the OWASP Broken Web Application Virtual Machine downloaded and running.  Next, install Ruby, Watir-WebDriver, RSpec, escape_utils, and Capybara.

To install everything on Windows, here's what I did:
1. Install Ruby (1.9.x) (http://rubyinstaller.org/downloads/)
2. Install Watir (http://watir.com/installation/#win)
Get an admin command prompt
gem update --system
gem install watir
gem install watir-webdriver

3. Install RSpec and escape_utils gem install rspec
gem install escape_utils

4. Install Capybara
gem install capybara

To run the test cases, use the following commands:
rspec -f d "OWASP Broken WebApps RSpec.rb"
rspec -f d "OWASP Broken WebApps Capybara.rb"

Presentation Materials:

• Using Watir & Ruby for Web Application Vulnerability Unit Testing
• OWASP Broken WebApps Capybara.rb
• OWASP Broken WebApps RSpec.rb

Security B-Sides Kansas City Presentation

Security B-Sides Kansas City is happening Wednesday, October 26, 2011.  I will be presenting there at 10AM.  The topic is using Watir-WebDriver (a browser automation framework/driver) and Ruby to perform web application security unit testing.  While doing the research, I also got a chance to use another framework, Capybara, so I included examples from it as well.  The presentation will mostly consist of demos.  I will discuss what Watir-WebDriver is, alternate frameworks and languages to use, and how to apply them to web application security unit testing.  Then, I will walk through specific examples/demos showing how to use the frameworks to exploit/unit test vulnerabilities in the OWASP Broken Web Applications Project/VMware image.  The unit testing framework I chose is RSpec. I have demos ready for the following issues:

• SQL Injection
• error message based
• matching contents of a union select over the application usernames/passwords
• Cross-site Scripting
• Reflected - URL Based
• Reflected - Using a custom POST request
• Stored
• Autocomplete
• Session Fixation
• Open Redirect
• Enumerating authorization/access controls
• Information Disclosure through HTTP headers

After the presentation, I can provide anyone that asks with completed unit tests for all of the vulnerabilities listed above for both Ruby/Watir-WebDriver and Ruby/Capybara, using RSpec as the unit testing framework.  To run these demos at home, simply download and run the OWASP Broken Web Application VMware image using VMware Player.

OWASP AppSec Ireland and DC

OWASP AppSec Ireland is a week away! If you happen to be in Dublin, Ireland next Friday, come by and say "Hi!" I will be presenting "Microsoft's Security Development Lifecycle for Agile Development".  More information is available here:

http://www.owasp.org/index.php/OWASP_IRELAND_2010#Agenda_and_Presentations_-_September_17

I was also accepted to speak at OWASP AppSec DC on November 10th or 11th. This will be the first time I will give the SDL-Agile presentation at a conference in the United States!  The conference home page is: http://www.owasp.org/index.php/OWASP_AppSec_DC_2010

OWASP AppSec Research 2010 Stockholm Conference Videos Posted!

The presentation videos from the OWASP AppSec Research 2010 Conference in Stockholm, Sweden are now available!

My Presentation slides can be found here:

• http://www.owasp.org/images/4/44/OWASP_AppSec_Research_2010_Microsoft_SDL_Agile_by_Coblentz.pdf

A video of the presentation is also available:

• http://owasp.blip.tv/file/3918259/

The rest of the videos and presentation slides can be found here:

• http://www.owasp.org/index.php/OWASP_AppSec_Research_2010_-_Stockholm,_Sweden#tab=June_23
• http://www.owasp.org/index.php/OWASP_AppSec_Research_2010_-_Stockholm,_Sweden#tab=June_24

Martin Holst Swende and Alan Davidson, members of the organizing committee, took pictures at the OWASP AppSec Research 2010 Conference.  Those pictures can be found here:

• http://www.flickr.com/photos/holiman/sets/72157624428046528/
• http://www.flickr.com/photos/51810233@N04/sets/72157624316862061/
• http://www.flickr.com/photos/51810233@N04/sets/72157624438812472/
• http://www.flickr.com/photos/51810233@N04/sets/72157624441596030/

I will be giving this presentation again at the OWASP AppSec Ireleand 2010 Conference on September 17, 2010 (http://www.owasp.org/index.php/OWASP_IRELAND_2010) .

OWASP AppSec Research 2010 Pictures

The OWASP AppSec Research 2010 Conference in Stockholm, Sweden ended today. I took a quite a few pictures and I thought I would post a couple of them. Please enjoy!

Aula Magna (Conference Venue)

Track 1

Day 1 Keynote with Chris Evans, Google

Day 2 Keynote with Steve Lipner, Microsoft

Gala Dinner at Stockholm City Hall

Conference Closing Remarks and Thanks

I'm Presenting at OWASP AppSec Research 2010 Conference

The OWASP AppSec Research 2010 conference is being held on June 23rd and 24th 2010 in Stockholm, Sweden.  I will be speaking on the 24th at 11:10 AM on "Microsoft's Security Development Lifecycle for Agile Development".  Here is a link to the schedule for June 24th:
http://www.owasp.org/index.php/OWASP_AppSec_Research_2010_-_Stockholm,_Sweden#tab=June_24

I hope to see lots of people there!

.NET User Group Presentation - Microsoft SDL-Agile

I had a great time giving my Microsoft SDL-Agile v2 presentation last night at the Kansas City .NET User Group Meeting.  Several people asked for the slides, so I made them available as a PDF document here: Microsoft SDL-Agile Presentation - Nick Coblentz V2 2010-03-23.pdf

Many also wanted links to the tools I mentioned during the presentation.  Here is a list of those tools:

• SDL Process Guidance 4.1a (includes SDL-Agile towards the bottom of the document
• CAT.NET v2, Web Protection Library (Includes Anti-XSS Library and Security Runtime Engine), and the Web Application Configuration Analyzer 
• web.config security analyzer
• Microsoft FxCop 1.36
• Microsoft Code Analysis Tool .NET (CAT.NET) v1 CTP - 32 bit (Old version of CAT.NET)
• Microsoft Code Analysis Tool .NET (CAT.NET) v1 CTP - 64 bit (Old version of CAT.NET)
• BinScope Binary Analyzer
• MiniFuzz File Fuzzer
• MSF-Agile plus Security Development Lifecycle Process Template for VSTS 2008
• Microsoft SDL Process Template For Visual Studio Team System
• Microsoft SDL Threat Modeling Tool

Finally, here are links to the code used to demonstrate the Web Protection Library:

• Default.aspx
• Default.aspx.cs
• Default.aspx.designer.cs
• Web.config

Please feel free to email me with any questions or comments about the presentation.

Microsoft SDL-Agile Presentation Slides

I wanted to thank everyone who came to the OWASP Kansas City Chapter meeting tonight. I had fun presenting.

A copy of the slides are available here: OWASP Kansas City, Microsoft SDL-Agile Presentation

Unfortunately the animations don't work in the PDF version, but I would be happy to present at other meetings, user groups, or for a group of developers/managers within a company. If you are interested, please feel free to email me. My contact information is listed in the sidebar of this blog.

OWASP Presentation on Dec. 10: Microsoft SDL-Agile

I will be giving an OWASP presentation on December 10th over the Microsoft Security Development Lifecycle for Agile Development. The presentation will be about 45 minutes and is scheduled to begin at 6PM in Regnier Center Room 270 at JCCC.

Here is the original announcement from the OWASP Kansas City List: https://lists.owasp.org/pipermail/owasp-kansascity/2009-November/000085.html