Wstg: Testing for session integrity

[scalzava]

What would you like added?
In recent research work, we proposed testing strategies covering a wide range of session integrity vulnerabilities, i.e., session hijacking, session fixation and cross-site request forgery. Compared to traditional approaches, these testing strategies are: 1. More principled, being parametric with respect to assumptions on the attacker's capabilities and 2. Simpler to carry out than current recommendations of the OWASP Testing Guide.

I would be delighted to see our testing strategies being considered for inclusion in the OWASP Testing Guide. Besides the technical contribution, I think they are based on a sound methodology which would greatly benefit further editions of the testing guide. Full details about the proposal are available in the attached research paper.

esorics19.pdf

Would you like to be assigned to this issue?
Check the box if you will submit a PR to add the proposed content. Please read CONTRIBUTING.md.

• [ ] Assign me, please!

Though I'd love to contribute, my agenda does not allow me to do it at the time being. But if you are interested, I might try to make an effort in the future and possibly involve my coauthors in this.

[victoriadrake]

Thank you @scalzava! It would be great to have this contribution from the original authors, if you can find the time.

In the meantime, this one's up for grabs!

[scalzava]

Great to hear you are interested into this! I'll try to investigate whether some of my students is willing to pick this up. In the meanwhile, any interested contributor is warmly encouraged to have a look into the paper and start working on this. I'll be glad to provide extensive feedback, but I just lack the time to actively contribute to this myself at the time being :(

[Hsiang-Chih]

After comparing these two, I think, the existing testing guide has covered the session testing scenarios.
esorics19.pdf

Refer to - [4.6 Session Management Testing]
(https://github.com/OWASP/wstg/blob/cf65e4592678a3df267abc1fdca1e695e56355da/document/4-Web_Application_Security_Testing/06-Session_Management_Testing/README.md)

[scalzava]

Hi Hsiang-Chih, there are certainly connections between the two documents, most notably because the security best practices are well known. However, I also think there are two important differences, which should be considered for inclusion in the Testing Guide:

1. Focus on testing. The OWASP Testing Guide provides recommendations such as "all cookies should be marked Secure". Of course, this is a sound practice, yet many web apps in the wild do not comply with it for generic reasons and still achieve a reasonable degree of security, e.g., because security-critical cookies are indeed Secure. The ESORICS paper provides a systematic way to dynamically test for vulnerabilities, as opposed to just inspecting traffic, which would lead to false positives. See Sections 4.1 - 4.3 for the testing strategies.

2. Threat model. The testing strategies of the ESORICS paper have been designed w.r.t. a rigorous threat model including web attackers, network attackers and related-domain attackers. This is important to let site operators take informed decisions w.r.t. the threats they care about.

So, while the key ingredients are clearly the same, since this is how modern browsers work, I think the ESORICS paper still provides valuable information which should enter the OWASP Testing Guide. Any thought on this?

[ThunderSon]

@scalzava I am interested to see if you'll be able to tackle this topic. You mainly opposed the Cookie Attributes page. I read the paper, it's interesting that it discusses the different aspects of every attack, how to model and look at them, and the steps required to tackle it. How would you see this implemented in the project? I can try and help set this in and then see how it looks, or what could be improved. The content could definitely have a refresh if things are different.

Discussing this for a long time wouldn't result in any improvements (they're large chunks, so it's better to focus on topics and sections and see how relevant they are).

Let me know your thoughts and availability.

[scalzava]

@ThunderSon thanks for your interest!

My availability is fairly limited, but I can try to find some time and maybe a couple of students to help with this. If you can help kickstarting the process, I guess it's going to be easier for me. Providing content is not going to be super complicated, considered we already have a paper... the hard part is getting familiar with the TG and finding the right places to rework.

If you are available, we can discuss how to proceed by email, Skype or whatever suits you.

[ThunderSon]

Sure thing. Hit me up on [email protected] when possible.
I should be able to create a rough overview or plan in the coming days, unless anyone beats me to it :)

[ThunderSon]

Doing a closer review, @scalzava Session Hijacking is mentioned inside of the Session Fixation attack. That is definitely a place to expand this attack further! Threat models are a lovely addition that I am more than happy to welcome.

I'd say you were a bit rough in the way you reviewed the Secure attribute mention, despite you delivering a sane point. In 4.6.2, we clearly mentioned that based on the needs of the apps, the cookie attributes should be set (which is somewhat new maybe? I don't know when the paper was released).
Comment taken though, and the section 4.6.1 should definitely be reviewed.

For specifically the 3 attacks mentioned in the paper relating to session integrity, Session Hijacking, Fixation, and CSRF, these will all belong to section 4.6.
The team can definitely take this task on, yet, I would love it if you can push for one of the students to try and contribute. We will help them across the whole workflow, and even handle sections if that helps. We are interested in having more contributors than simply doing the work :smile:

Let me know what you think about this. This will definitely be part of version 5, could be released between 4.2 and 4.3 to be more specific.

[scalzava]

Hi, thanks for the extra feedback! I'll try to get a student in the loop :) I can also help, the only problem is finding some spare time... I'll drop you a line by email

[eleumasc]

Hi, I would join the contribution team for this issue.

[AlessiaMichelaDiCampi]

Hi, I would be happy to participate in the issue

[kingthorin]

Great, thank you both!

[kingthorin]

Done in: https://github.com/OWASP/wstg/pull/575