Explanation of Security Test report

The specific work scenario is described in the previous blog. I will not go into details here. I wrote this article because I remembered that the test report was informative and it is worth learning about some technical content of the report, writing this blog is a learning process.

This report was generated by the appscan8.6 scan and mainly divided into the following types:

Revision suggestions
N review possible solutions for hazardous character Injection
N always uses the SSL and post parameters when sending sensitive information.
N remove sensitive information from HTML comments
N remove email addresses from the Web site
N remove the internal IP address from the Web site
N remove the test script from the server
N remove the business logic and security logic from the client
N. Set the "AutoComplete" attribute to "off" correctly"
N download security patches for Web servers or applications
N add the "HTTPOnly" attribute to all session cookies
N verify that the parameter value is within its expected range and type. Do not output debugging error messages or exceptions
Consultation
N SQL blind Injection
N SQL Injection
N Cross-Site Scripting
N Authentication Bypass Using SQL Injection
N decrypted login requests
N link injection (facilitating cross-site Request Forgery)
N phishing through the framework
N Database Error modes discovered
N The HTTPOnly attribute is missing from the session cookie.
N automatically fill in HTML attributes that are not disabled for the password field
N html annotation Sensitive Information Leakage
N discovery email address mode
N discover possible server path leakage Modes
N internal IP address leakage Mode
N detected application test script
N client (JavaScript) Cookie reference
N application errors

Wait a few days. These two days are too difficult to handle, and your eyes hurt.

There are too many introductions in the appendix after the appscan Test Report, which is too hard to write. The application also has a white box Java code analysis report. The main problems are as follows:

Cross-site Scripting involving the backend
Read/write competition caused by single-instance Member Fields
Poor password management channel operations
Code correction: calls the equals method to a null object
Insecure Random Number
Httpresponse (splitting)
Bad J2EE practice: Save non-serializable objects in the session
Local file path operation