The open window
A shop locks its front door every night. But a back window stays open.
A thief needs only one open window. Software is the same. One weak place is enough.
Security testing looks for the weak places before a thief does.
Key words
| Word | What it means | Example |
|---|---|---|
| Security testing | Tests that look for weak places a thief could use. | Is the password safe? |
| Vulnerability | A weak place in software that an attacker could use. | A password in the code |
| Vulnerability scanning | A tool that checks the software for known weak places. | A scanner finds an old part with a known fault |
| Static analysis | Checking the code by reading it, without running it. | Search the code for a password |
| Dynamic analysis | Checking the software while it runs. | Type strange text into a form |
| Integration analysis | Checking the safety of the joins between parts. | Is data checked when it moves from one part to another? |
| Database | A store of organised data. | A list of users |
| Attacker | A person who tries to break in or do harm. | A thief online |
| Hard-coded | Written inside the code and not kept safely elsewhere. | password = "abc" |
The cells students fill in are left blank in this preview.
Four security tests
| Test | How it works | Does the code run? | Example |
|---|---|---|---|
| Vulnerability scanning | A tool checks for known weak places | Sometimes | Finds an old part with a known fault |
| Static analysis | A person or tool reads the code | No | Finds a password written in the code |
| Dynamic analysis | We use the running software | Yes | Types strange text into the login box |
| Integration analysis | We check where parts join | Yes | Is data checked when it goes from the page to the database? |
The cells students fill in are left blank in this preview.
Static analysis: spot the problems
password = "letmein123"
def check(text):
return eval(text)
site = "http://my-shop.example"
print("This code was only read, not trusted.")
# Read the code. There are 3 problems. Do not run it to find them.
# Line 1: a password in the code.
# Line 4: eval runs any text as code.
# Line 6: http is not secure.
Never write a password in code
data-callouts.warning.label
Code is copied and shared. Anyone who reads the code can see the password. Keep passwords in a safe place outside the code.
Dynamic analysis
With dynamic analysis we use the running software, like an attacker would.
We type unusual things into forms. We try very long text. We try to open a page without logging in. We watch what the software does.
A famous weak place
A database answers questions written in SQL (the language of databases).
Some programs put what you typed straight into the question. Then you can change the question. SQL injection means that your own text becomes part of the question. Run the code and see how it works.
Try it: why odd input matters
name = "Sam"
query = "SELECT * FROM users WHERE name = '" + name + "'"
print(query)
# Now change the name to: x' OR '1'='1
# Run again. The question now matches every user.
# This is why a tester tries odd input.
The one rule
data-callouts.warning.label
The next lab runs a shop that is weak on purpose. Attack it, and nothing else. It is your own private copy. Never try these things on a site that is not yours. In the UK that is a crime under the Computer Misuse Act 1990.
Before you start
data-callouts.note.label
Press Start the lab on the bar at the top of this lesson. Wait until it says it is running. Each Run button types its command into your lab terminal.
Lab 1. Static analysis: read the code
The shop is a small program. Show its code and read it. Do not run anything yet. Find the line that starts with rows. It joins your search text to the SQL question with a plus sign (+). That is a weak place, and you found it by reading.