How to effectively test and locate application security holes?

Question

I am facing a serious problem with hackers and/ or crackers on the site developed for a city hall. I did tests with SQL MAP on every page of the website. I tested the ftp lock, searched for injected files inside the site, searched for viruses, Malwares and backdoors and so far nothing...

Then I came up with this question, how to test the application effectively and locate the security flaws related exclusively to the application?

I think that in order to not get so wide the question could be focused only in relation to the WEB environment... if the person who answers the question thinks it can cover all the content it will be very welcome too :D

I would also like it to be possible for the answer to be very generic and to apply to any form of development (within the limitations of languages)

Information on the application:
Language: PHP
Database: Mysql Database: Mysql
Connections: mysql_connect (not my fault)

Focus of Attack: Database

Common problems
Script injection for page redirection
Image injection into news and highlights
File injection for backdoor

Items that do not cause problems(no attempts)
Attacks of Dos
Attacks by Brute-Force

Corrections in first instance
Exchange of database credentials
Administrator password exchange (current hash -> df8bce1285196dddc104c22f15665dac)

I had already asked What the code below (written by a Cracker) does? and had posted the code of one of the files that were already injected into the site...

I scanned the ftp and made sure that there is no malicious file inside it...

All gets and posts are validated as follows

if(isset($_GET['t'])){
    $ids = (int)mysql_real_escape_string($_GET['t']);
    if(!is_numeric($ids)){
        $ids = '1';
    }   
} else {
    $ids = '1'; 
}

Answer 1

According to your description of the most common problems, I would divide the attention on two fronts:

Script injection for page redirection

Image injection into news and highlights

This is a sign that user inputs are not being sanitized properly. But in this case, I’m not referring to properly formatting SQL (something that Prepared statements would help), but rather to correctly escape the HTML.

In a web application there are several points where an input provided by the user is shown back to it as part of a page. Even if this entry is correctly "escaped" when entering into the bank, it does not mean that it is safe to be embedded into a page. For example, there are no invalid SQL characters in the string <script>alert(1);</script>. But if a user has entered that in a text field, which should be included in a results page is <script>alert(1);</script>

(data to be returned with values of a input are not safe either. Ex.: teste"><img src="foo)

Escape content before sending to bank prevents SQL Injection. To prevent against JS Injection (or HTML Injection) it is also necessary to sanitize the content that exits the bank. I would concentrate my efforts in this sense, because its "symptoms" are not characteristic of a problem in data entry/queries (e.g., information leak), but in the exit of the same.

File injection for backdoor

As far as my knowledge goes, this is not something that can be caused by failures in the bank, but rather in the upload files. A common situation is a website that allows you to upload images, but that only validates the file extension - not its content.

In that case, I don’t have enough knowledge to even make a guess, so I’m gonna abstain from giving an opinion. The presence of a harmful file by itself does not seem enough to install a backdoor (for that would also be necessary some form of shell Injection, but I’m not sure). But I may be quite wrong...

---

P.S. I don’t believe it’s related to your problem, but when I saw that your system was using mysql_real_escape_string I got the flea behind my ear - although I can’t guarantee anything. I suggest that post on security.SE for more details (read the comments). At first, a correct and consistent use of this function should be good enough, but there are details to consider, for example this one that caught my attention:

I think the commonly misinterpreted aspect is that the values escaped with mysql_real_escape_string are only intended to be used in a literal for Mysql strings. There are common cases where the mysql_real_escape_string is used for data that is not placed in a literal for strings, but for something else, like an identifier, a keyword, a literal for integers, etc.

In his example specific I don’t see this as a problem - because after using this function you still convert to int and check if it’s numerical, then as far as I know (Disclaimer: I have no experience with PHP) the vulnerability is not there. Anyway, check if there are other uses for this function that may present problems.

Answer 2

If you have no idea which exploit is being used, starting at the lowest level layer: the database.

• Identify the patterns. 'Invasions' always happen at the same time? Is there any similar content among the records that are affected? The source IP is always the same?
• Make a Cleanup on the bank based on the patterns found. (Beware of false positives.)
• Create triggers that prevent the recording in the database of records that match the patterns found. Create a specific error code for this Trigger.
• Monitor your application and log all pages where a call to the bank generated the error code you created.
• Locate, on the affected pages, the fragile points used by exploit, and eliminate them.