Input Validation and Business Logic Security Controls Solution

Input Validation and Business Logic Security Controls

Table of Contents

Order ID# 45178248544XXTG457	Plagiarism Level: 0-0.5%	Writer Classification: PhD competent
Style: APA/MLA/Harvard/Chicago	Delivery: Minimum 3 Hours	Revision: Permitted
Sources: 4-6	Course Level: Masters/University College	Guarantee Status: 96-99%

Instructions

Input Validation and Business Logic Security Controls

SDEV 460 – Homework 4

Input Validation and Business Logic Security Controls

Overview:

This homework will demonstrate your knowledge of testing security controls aligned with Input

validation and business logic. You will also use the recommended OWASP testing guide reporting format

to report your test findings.

Assignment: Total 100 points

Using the readings from weeks 7 and 8 as a baseline provide the following test and analysis descriptions

or discussion:

Testing for Reflected Cross site scripting (OTG-INPVAL-001)

The OWASP site list multiple approaches and examples for blackbox testing reflected XSS

vulnerabilities. In your own words, describe Reflected Cross Site scripting. Then, List and

describe 4 different examples that could be used for testing. Be sure to conduct additional

research for each example to provide your own unique test example. This most likely means you

will need to conduct some research on Javascript to make sure your syntax is correct.

Testing for Stored Cross site scripting (OTG-INPVAL-002)

The OWASP site list multiple approaches and examples for blackbox testing Stored XSS

vulnerabilities. In your own words, describe Stored Cross Site scripting. Then, List and describe 2

different examples that could be used for testing. Be sure to conduct additional research for

each example to provide your own unique test example. This most likely means you will need to

conduct some research on Javascript to make sure your syntax is correct.

Testing for SQL Injection (OTG-INPVAL-005)

SQL Injection remains a problem in applications yet could easily fixed. The following SQL

statement is in an HTML form as code with the $ variables directly input from the user.

SELECT * FROM Students WHERE EMPLID=’$EMPLID’ AND EMAIL=’$email’

Would a form or application that includes this code be susceptible to SQL Injection? Why?

What specific tests would you perform to determine if the applications was vulnerable?

How would you fix this problem? Be specific be providing the exact code in a Language of your choice.

(e.g. Java, PHP, Python …)

Test business logic data validation (OTG-BUSLOGIC-001)

While reviewing some Java code, an analysis provided the following code snippets that contain

logic errors. For each example, describe the issue and provide code that would fix the logical

error:

a.

2

int x; x = x + 1; System.out.println(“X = ” + x);

b.

for (i=1; i<=5; i++) ; { System.out.println(“Number is ” + i); }

c.

if ( z > d) ; { System.out.println(“Z is bigger”); }

d.

String m1=”one”;

String m2=”two”;

if(m1 == m2) {

System.out.println(“M1 is equal to M2”);

}

1. The formula for the area of a trapezoid is:

A = (b1+b2)/2 * h

The following Java code is the implementation. Fix the logical error

double area;

double base1 = 2.3;

double base2 = 4.8;

double height = 12.5;

area = base1 + base2/2.0 * height;

Demonstrate your fixed code work as anticipated with a couple different test

cases.

Test integrity checks (OTG-BUSLOGIC-003)

Conduct some additional research on Business Logic errors related to OTG-BUSLOGIC-003. In

your own words describe and provide 2 unique examples of integrity checks. For your

examples, provide specific testing methods for each case.

Test defenses against Circumvention of Work Flows (OTG-BUSLOGIC-006)

3

Conduct some additional research on Business Logic errors related to OTG-BUSLOGIC-006. In

your own words describe and provide 2 unique examples of circumvention of work flow. For

your examples, provide specific testing methods for each case.

You should document the results for the tests and your comments, and recommendations for improved

security for each security control tested in a word or PDF document. Discuss any issues found and

possible mitigations.

Deliverables:

You should submit your document by the due date. Your document should be well-organized, include all

references used and contain minimal spelling and grammar errors.

Grading Rubric:

Attribute Meets

Reflected Cross site scripting

10 points Describes Reflected Cross Site scripting. Then, Lists and describes 4 different examples that could be used for testing. Conducts additional research for each example to provide your own unique test example.

Stored Cross site scripting

10 points Describes Stored Cross Site scripting. Then, Lists and describes 2 different examples that could be used for testing. Conducts additional research for each example to provide your own unique test example.

SQL Injection 25 points Answers: would a form or application that includes this code be susceptible to SQL Injection? Why? Answers: What specific tests would you perform to determine if the applications was vulnerable? Answers: How would you fix this problem? Provides the exact code in a Language of your choice.

Business logic data validation

15 points For each example, describes the issue and provides code that would fix the logical error.

Integrity checks 10 points Conducts research on Business Logic errors related to OTG-BUSLOGIC-003. In your own words describes and provides 2 unique examples of integrity checks. Provides specific testing methods for each case.

Defenses against workflow intervention

10 points Conducts research on Business Logic errors related to OTG-BUSLOGIC-006. In your own words describes and provides 2 unique examples of circumvention of work flow. Provides specific testing methods for each case.

Documentation and Submission

20 points Your document should be well-organized, include all references used and contain minimal spelling and grammar errors.

Input Validation and Business Logic Security Controls

RUBRIC
Excellent Quality 95-100%	Introduction 45-41 points The background and significance of the problem and a clear statement of the research purpose is provided. The search history is mentioned.		Literature Support 91-84  points The background and significance of the problem and a clear statement of the research purpose is provided. The search history is mentioned.			Methodology 58-53 points Content is well-organized with headings for each slide and bulleted lists to group related material as needed. Use of font, color, graphics, effects, etc. to enhance readability and presentation content is excellent. Length requirements of 10 slides/pages or less is met.
Average Score 50-85%	40-38 points More depth/detail for the background and significance is needed, or the research detail is not clear. No search history information is provided.		83-76  points Review of relevant theoretical literature is evident, but there is little integration of studies into concepts related to problem. Review is partially focused and organized. Supporting and opposing research are included. Summary of information presented is included. Conclusion may not contain a biblical integration.			52-49  points Content is somewhat organized, but no structure is apparent. The use of font, color, graphics, effects, etc. is occasionally detracting to the presentation content. Length requirements may not be met.
Poor Quality 0-45%	37-1 points The background and/or significance are missing. No search history information is provided.		75-1 points Review of relevant theoretical literature is evident, but there is no integration of studies into concepts related to problem. Review is partially focused and organized. Supporting and opposing research are not included in the summary of information presented. Conclusion does not contain a biblical integration.			48-1 points There is no clear or logical organizational structure. No logical sequence is apparent. The use of font, color, graphics, effects etc. is often detracting to the presentation content. Length requirements may not be met
You Can Also Place the Order at www.perfectacademic.com/orders/ordernow or www.crucialessay.com/orders/ordernow Input Validation and Business Logic Security Controls

Input Validation and Business Logic Security Controls

PLACE THE ORDER WITH US TODAY AND GET A PERFECT SCORE!!!