Testing for Sensitive Information Sent via Unencrypted Channels (WSTG-CRYP-03)
Last updated
Last updated
WSTG-CRYP-03
Sensitive data must be protected when it is transmitted through the network. If data is transmitted over HTTPS or encrypted in another way the protection mechanism must not have limitations or vulnerabilities, as explained in the broader article and in other OWASP documentation:
.
.
.
As a rule of thumb if data must be protected when it is stored, this data must also be protected during transmission. Some examples for sensitive data are:
Information used in authentication (e.g. Credentials, PINs, Session identifiers, Tokens, Cookies…)
Information protected by laws, regulations or specific organizational policy (e.g. Credit Cards, Customers data)
If the application transmits sensitive information via unencrypted channels - e.g. HTTP - it is considered a security risk. Attackers can take over accounts by . Some examples are Basic authentication which sends authentication credentials in plain-text over HTTP, form based authentication credentials sent via HTTP, or plain-text transmission of any other information considered sensitive due to regulations, laws, organizational policy or application business logic.
Examples for Personal Identifying Information (PII) are:
Social security numbers
Bank account numbers
Passport information
Healthcare related information
Medical insurance information
Student information
Credit and debit card numbers
Driver's license and State ID information
Identify sensitive information transmitted through the various channels.
Assess the privacy and security of the channels used.
Another typical example is authentication forms which transmit user authentication credentials over HTTP. In the example below one can see HTTP being used in the action attribute of the form. It is also possible to see this issue by examining the HTTP traffic with an interception proxy.
If the web application has features that allow a user to change an account or call a different service with credentials, verify all of those interactions use HTTPS. The interactions to test include the following:
Forms that allow users to handle a forgotten password or other credentials
Forms that allow users to edit credentials
Forms that require the user to authenticate with another provider (for example, payment processing)
Use one of the following techniques to search for sensitive information.
Checking if password or encryption key is hardcoded in the source code or configuration files.
grep -r –E "Pass | password | pwd |user | guest| admin | encry | key | decrypt | sharekey " ./PathToSearch/
Checking if logs or source code may contain phone number, email address, ID or any other PII. Change the regular expression based on the format of the PII.
grep -r " {2\}[0-9]\{6\} " ./PathToSearch/
Use HTTPS for the whole web site and redirect any HTTP requests to HTTPS.
Various types of information that must be protected, could be transmitted by the application in clear text. To check if this information is transmitted over HTTP instead of HTTPS, capture traffic between a client and web application server that needs credentials. For any message containing sensitive data, verify the exchange occurred using HTTPS. See more information about insecure transmission of credentials or .
A typical example is the usage of Basic Authentication over HTTP. When using Basic Authentication, user credentials are encoded rather than encrypted, and are sent as HTTP headers. In the example below the tester uses to test for this issue. Note how the application uses Basic authentication, and HTTP rather than HTTPS.
The Session ID Cookie must be transmitted over protected channels. If the cookie does not have the set, it is permitted for the application to transmit it unencrypted. Note below the setting of the cookie is done without the Secure flag, and the entire log in process is performed in HTTP and not HTTPS.