A8:2021 Software and Data Integrity Failures

Below we document the steps to test the A8:2021 Software and Data Integrity Failures security risk only. Use this test to:

  • Launch exploits for known insecure deserialization vulnerabilities affecting common frameworks and applications.
  • Leverage insecure deserialization issues to pivot to the underlying server.

Please note that you can combine tests and run more than one on a specific target or set of targets.

  1. On the Risk Types dialogs of the Wizard, select A8 - Software and Data Integrity Failures.

  2. Click Next until you are past the Risk Types selection. For the following steps ONLY A8 - Software and Data Integrity Failures and its related options are selected.

    If you selected Look for Sensitive Information in documents, this dialog displays to configure.

    Authentication tests configuration

    You can instruct Core Impact to Search for credit card numbers or Search for social security numbers in any documents it finds.

    Additionally, add a Custom Search Pattern to help Core Impact find specific data - enter an extended regular expression and that would be run across all the HTML pages that the wizard is targeting.

    Check the Apply search filters inside Microsoft Office, OpenOffice and PDF Documents option if you want the test to search inside of documents that are linked from the HTML pages.

    Check the Save documents matching search filters option if you want Core Impact to save any documents where it locates sensitive data. Then provide a path where the documents should be saved.

    Press Next to continue.

  3. The final dialog—Session Management—displays.

    Session Management

    To configure a module to avoid testing pages that could terminate the session, use the ellipsis () button. By default, the Session arguments avoid list module will be enabled for this purpose. Click the Clear button if you do not want any module to perform this function.

  4. Click the Finish button to begin the test.

If the WebApps Attack and Penetration is successful, it will execute exploits for known insecure deserialization vulnerabilities based on the web application fingerprint performed during the Information Gathering phase.

Return to WebApps Attack and Penetration.