0

As per latest OWASP Guidelines (2019) - a security assessor has to test against application platform configuration dubbed as OTG-CONFIG-002 in OWASP Testing Guide v4.

Since OWASP is a Security Principle Guide rather than being a security checklist which is meant to be validated & restricted to those steps only - I'm trying to figure out how I can prepare a step wise security test case against Test Application Platform Configuration

I understand I am supposed to look for sensitive exposure of log files in directories, unprotected web server component(s) & such - however is their any reference to a tool which could be used in order for me to establish that goal?

Example: Suppose an external attacker is attempting to cause triggered errors via input validation violation(s) & these errors might just be logged for reference purposes - how do I attempt to figure out (using a security tool, opensource security tools, google hacking, etc) how/where logs are being stored?

Is there a way to figure those out?

Note:

  1. Our sysadmins do not provide us with a know-about of where log is stored/located
  2. Our sysadmins do not provide us with the logging software(s) being used in the webserver
  • It makes perfect sense in case this is either a black-box or gray-box security assessment that this information is not given. Usually, this is by the client's choice. What type of security test was agreed upon during the intake process? – Jeroen Jul 5 at 20:51
  • Given it's blackbox either way - is their anyway an existing security tool helps finding out information - since few log management on applications are exposed to presentation level!? Let me know if I'm missing something. Figuring out a security tool shall help alot. Or probably such tool hasn't yet been developed yet? – Shritam Bhowmick Jul 9 at 17:29
  • 1
    Generally, log files are not exposed from the web root. Attacks such as local file inclusions or remote command executions could show you the log files by guessing its location. Hope this helps. – Jeroen Jul 9 at 17:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.