Application Security Audit Checklist Template

In this article, the Application Security Audit Checklist Template will cover. In today’s technology landscape, organizations are supported by web applications that act as essential enablers to streamlining operations. While these applications enable automation, wider collaboration, and ease of sharing data.

They also act as vectors that are prone to malicious attacks. Besides this, as modern applications rely on loosely connected components and services in constant communication, security becomes a complex, time-consuming challenge.

While Offensive360 Foundation seeks to help organizations develop secure applications by issuing guidelines on available tools, techniques, and documentation. The Application Security Checklist is one of the Offensive360 repositories that offer guidance to assess, identify, as well as remediate web security issues. So, this article delves into various vulnerabilities of web applications and outlines Offensive360’s guidance on testing such vulnerabilities.

Selecting the Right Application Security Tests

Offensive360’s Application Security Audit Checklist is an essential guide to promote repeatable as well as methodological testing for dynamic apps. Similarly, the following section delves into the workflow and specific activities involved in web app security testing.

Application Security Testing Workflow

However, a typical application security testing strategy is based on a collection of several common steps:

• Gathering comprehensive information of the application and its platform to assess related technologies as well as vulnerabilities
• Exploiting the system to test the severity of discovered vulnerabilities
• Ranking vulnerabilities based on the outcome of exploits as well as risks
• Using vulnerability risk data to re-assess application security posture
• Successful exploitations to be escalated for required mitigation

This is an excerpt from Offensive360’s 2021 Application Security Trend Report.

Application Security Audit Checklist

The OWASP Application Security Audit Checklist list helps achieve an iterative and systematic approach of evaluating existing security controls alongside active analysis of vulnerabilities. Below is a list of key processes and items to review when verifying the effectiveness of application security controls:

1. Information Gathering

A successful web application security strategy fundamentally begins with an understanding of the interactions between the web server, users, and applications. While application deployment platforms vary, key vulnerabilities in infrastructure configuration act as a common weak link for threat actors to initiate an attack.

Some key application security information gathering activities include:

• Manual site exploration
•  Crawling for hidden content
•  Checking for files that store as well as expose content
•  Scanning caches on search engines of public sites
• Web application fingerprinting
• Identification of user roles
• Identification of application entry points
• Related applications
• Identifying ports as well as hostnames
• Identifying third-party hosted content

2. Configuration Deployment and Management 

A web server ecosystem is intrinsically complex with highly connected, heterogeneous services and components working together. Reviewing and managing the configuration of the server is, as a result, a very crucial aspect for maintaining robust security across multiple layers of an application.

Securing various configuration items of an application involves:

• Checking for commonly used URLs
•  Testing network infrastructure configuration
•  Enumerating administrator interfaces
•  Checking supported HTTP methods as well as Cross-Site Tracing (XST)
•  Reviewing old unreferenced and backup files for sensitive information ▢ Testing for Strict-Transport-Security
•  Testing file permissions
•  For non-production data in live environments as well as production data in dev/test environments
•  Testing for content security
•  Evaluating subdomain takeover
• Analyzing client-side code for sensitive data

3. Identity and Access Management (IAM) 

Firstly, Securing organizational data involves defining appropriate access privileges and roles of the application’s users/administrators. Secondly, each individual (user, app, or device) gets a single digital identity (also referred to as tokens) that can be monitored, maintained, and modified throughout their data access sessions. Assessing the robustness of IAM for application security typically involves testing the following:

• Role definitions
•  User registration processes
•  Account provisioning processes
• Account enumeration as well as guessable user accounts
• Weak or unenforced username policies

4. Authentication Testing

Authentication enforces application security by enabling the webserver to verify that a network entity is who they claim to be. before As attackers tend to develop unique techniques to bypass authentication schemes. Not every authentication method guarantees effective security controls as well as requires a continuous assessment process. Assessing authentication security involves the regular testing of: 

• Default credentials
• Vulnerabilities of the “Remember Password” feature
•  Browser cache vulnerabilities
•  Weak password policies
• Credentials transported over an unencrypted channel

Testing for sensitive information sent via unencrypted channels involves checking whether credentials are encrypted or encoded, and sent as HTTP headers using a curl command of the form:

1
 $ curl -kis http://darwin.com/restricted/
2
 HTTP/1.1 401 Authorization Required
3
Date: Fri, 28 Aug 2021 00:00:00 GMT
4
WWW-Authenticate: Basic realm="Restricted Area"
5
Accept-Ranges: bytes Vary:
6
Accept-Encoding Content-Length: 162
7
Content-Type: text/html
8
<html><head><title>401 Authorization Required</title></head>
09
<body bgcolor=white> <h1>401 Authorization Required</h1>  Invalid login credentials!  
10
</body></html>

5. Session Management

Once a user is authenticated, their interaction with the server is managed within a session. Improperly managed sessions open doors for attackers to compromise access mechanisms by assuming those to be identities of legitimate users.

More so, such compromised accesses are often taken advantage of by attack vectors that escalate privileges and penetrate deeper into the system. To avoid vulnerabilities within a session, the following processes are recommended to be tested as a best practice:

• Analyzing session tokens for cookie flags
•  Checking session cookie durations
•  Examining termination after a relative timeout
•  For the possibility of single-user multiple sessions
•  Testing for consistent session management
• Testing cookies for randomness

6. Cryptography 

Cryptography ensures the secure exchange of information by using algorithms that transform human-readable data into a ciphertext-encrypted output. While doing so, the process establishes trust between the web server as well as network entities using security keys, making it an important mechanism for maintaining application security. Testing cryptography for maintaining application security involves:

• Checking for sensitive as well as unencrypted data
•  Testing for the usage of wrong algorithms
•  Testing algorithm strength
•  Analyzing functions for randomness
• Checking for the appropriate usage of salting

7. Client-Side Testing 

Since full-blown attacks carried out on the perimeter are usually challenged by effective organizational security efforts, threat actors tend to favor smaller, repeated attacks to gain initial access to web servers. To mitigate such approaches, client-side or internal testing involves examining vulnerabilities on applications installed on an endpoint that communicates with the webserver.

Client-side testing reveals weak points that can be exploited using the access rights of authorized users, and includes testing the following:

• Cross-Site Scripting (XSS)
•  JavaScript execution
•  Client-side URL redirects
•  Cross-Site Flashing (XSF)
•  Web sockets and web messaging
• Cross-Site Script Inclusion (XSSI)

8. Error Handling

OWASP encourages developers to include error handling mechanisms as well as messages that enable them to fix issues of user access. Improper error handling can expose sensitive information such as database dumps, error codes, and stack traces that can be exploited by attack vectors to gain access.

Testing error handling mechanisms can be done through:

• Server behavior for resource requests that are unavailable
• HTTP RFC for breaking ambush requests
•  Observing server behavior when requested for files/folders that do not exist
•  Identifying the application’s data entry points
• Listing as well as understanding the services configured to respond with error messages

9. Data Validation 

Any information entering a web server’s network edge should be tested as well as verified to ensure that it is in an acceptable format. Data validation testing includes:

• Examining special files
•  Testing file upload validation mechanisms
•  Testing for rich user content validation
•  Assessing content security policy
• Evaluating the list of regular expressions

10. Business Logic 

Similarly, the hackers mostly leverage an application’s original programmed flow to orchestrate breaches and penetration attacks. As a result, it is recommended to assess the business and application’s configuration to identify vulnerabilities in code or business logic that could be used for potential exploits.

Business logic testing includes:

• For feature misuse
• For non-repudiation
• Trust relationships
• Data integrity
• Duty segregation

Application Security Audit Checklist Conclusion

In conclusion, administering robust security is of utmost importance. OWASP updates its checklist based on the changing security landscape and mistakes of organizations that caused vulnerabilities. However, the Offensive360 Top Application Testing Checklist offers a repository of potential vulnerabilities for developers to help enforce security across all layers of a workflow’s pipeline.

Therefore the project includes multiple resources and activities that aid organizations to ensure web applications and their underlying components don’t serve as a gateway for malicious actors. Finally, the checklist also helps teams formalize their web application security efforts while minimizing the scope of risk in case of an attack.