Final edit
← Older revision
Revision as of 10:55, 13 May 2014
Line 3:
Line 3:
== Summary ==
== Summary ==
−
It is very common, and even recommended, for programmers to include detailed comments and metadata on their source code. However, comments and metadata included into the HTML code might reveal
, to a potential attacker,
internal information that should not be available to
them
. Comments and metadata review should be done in order to determine if any information is being leaked.
+
It is very common, and even recommended, for programmers to include detailed comments and metadata on their source code. However, comments and metadata included into the HTML code might reveal internal information that should not be available to
potential attackers
. Comments and metadata review should be done in order to determine if any information is being leaked.
+
== Test Objectives ==
== Test Objectives ==
−
Review webpage comments and metadata to better understand the application and to find any information leakage.
+
Review webpage comments and metadata to better understand the application and to find any information leakage
. HTML comments are also used by the developers to include debugging information about the application. Sometimes they forget about the comments and they leave them on in production. Testers should look for HTML comments which start with "<!--" and end with "-->"
.
−
HTML comments are also used by the developers to include debugging information about the application. Sometimes they forget about the comments and they leave them on in production. You should look for HTML comments which start with "<!--" and end with "-->".
== How to Test ==
== How to Test ==
−
=== Black Box
testing and example
===
+
=== Black Box
Testing
===
−
Check HTML source code for comments containing sensitive information
which
can help the attacker gain more insight about the application. It might be SQL code, usernames and passwords, internal IP addresses, or debugging information.
+
Check HTML source code for comments containing sensitive information
that
can help the attacker gain more insight about the application. It might be SQL code, usernames and passwords, internal IP addresses, or debugging information.
<pre>
<pre>
Line 31:
Line 31:
</pre>
</pre>
−
You could
even find something like this:
+
+
The tester may
even find something like this:
<pre>
<pre>
<!-- Use the DB administrator password for testing: f@keP@a$$w0rD -->
<!-- Use the DB administrator password for testing: f@keP@a$$w0rD -->
</pre>
</pre>
+
Check HTML version information for valid version numbers and Data Type Definition (DTD) URLs
Check HTML version information for valid version numbers and Data Type Definition (DTD) URLs
Line 43:
Line 45:
* "loose.dtd" -- loose DTD
* "loose.dtd" -- loose DTD
* "frameset.dtd" -- DTD for frameset documents
* "frameset.dtd" -- DTD for frameset documents
+
Some Meta tags do not provide active attack vectors but instead allow an attacker to profile an application to
Some Meta tags do not provide active attack vectors but instead allow an attacker to profile an application to
Line 48:
Line 51:
<META name="Author" content="Andrew Muller">
<META name="Author" content="Andrew Muller">
−
Some Meta tags alter HTTP response headers, such as http-equiv
which
sets an HTTP response header based on the the content attribute of a meta element, such as:
+
+
Some Meta tags alter HTTP response headers, such as http-equiv
that
sets an HTTP response header based on the the content attribute of a meta element, such as:
<META http-equiv="Expires" content="Fri, 21 Dec 2012 12:34:56 GMT">
<META http-equiv="Expires" content="Fri, 21 Dec 2012 12:34:56 GMT">
Line 72:
Line 76:
A common use for Meta tag is to specify keywords that a search engine may use to improve the quality of search results.
A common use for Meta tag is to specify keywords that a search engine may use to improve the quality of search results.
−
<META name="keywords" lang="en-us" content="OWASP, security, sunshine, lollipops">
+
<META name="keywords" lang="en-us" content="OWASP, security, sunshine, lollipops">
−
Although most
webservers
manage search engine indexing via the robots.txt file, it can also be managed by Meta tags. The tag below will advise robots to not index and not follow links on the HTML page containing the tag.
+
Although most
web servers
manage search engine indexing via the robots.txt file, it can also be managed by Meta tags. The tag below will advise robots to not index and not follow links on the HTML page containing the tag.
−
<META name="robots" content="none">
+
<META name="robots" content="none">
The Platform for Internet Content Selection (PICS) and Protocol for Web Description Resources (POWDER) provide infrastructure for associating meta data with Internet content.
The Platform for Internet Content Selection (PICS) and Protocol for Web Description Resources (POWDER) provide infrastructure for associating meta data with Internet content.
−
=== Gray Box
testing and example
===
+
=== Gray Box
Testing
===
Not applicable.
Not applicable.
+
==Tools==
==Tools==
Line 90:
Line 95:
* Eyeballs
* Eyeballs
* Curl
* Curl
+
== References ==
== References ==