SDEV 460 Validation and Business

SDEV 460 Validation and Business
SDEV 460 – Homework 4
Input Validation and Business Logic Security Controls
Overview:
This homework will demonstrate your knowledge of testing security controls aligned with Input
validation and business logic. You will also use the recommended OWASP testing guide reporting format
to report your test findings.
Assignment: Total 100 points
Using the readings from weeks 7 and 8 as a baseline provide the following test and analysis descriptions
or discussion:
1. Testing for Reflected Cross site scripting (OTG-INPVAL-001)
 The OWASP site list multiple approaches and examples for blackbox testing reflected XSS
vulnerabilities. In your own words, describe Reflected Cross Site scripting. Then, List and
describe 4 different examples that could be used for testing. Be sure to conduct additional
research for each example to provide your own unique test example. This most likely means you
will need to conduct some research on Javascript to make sure your syntax is correct.
2. Testing for Stored Cross site scripting (OTG-INPVAL-002)
 The OWASP site list multiple approaches and examples for blackbox testing Stored XSS
vulnerabilities. In your own words, describe Stored Cross Site scripting. Then, List and describe 2
different examples that could be used for testing. Be sure to conduct additional research for
each example to provide your own unique test example. This most likely means you will need to
conduct some research on Javascript to make sure your syntax is correct.
3. Testing for SQL Injection (OTG-INPVAL-005)
 SQL Injection remains a problem in applications yet could easily fixed. The following SQL
statement is in an HTML form as code with the $ variables directly input from the user.
SELECT * FROM Students WHERE EMPLID=’$EMPLID’ AND EMAIL=’$email’
Would a form or application that includes this code be susceptible to SQL Injection? Why?
What specific tests would you perform to determine if the applications was vulnerable?
How would you fix this problem? Be specific be providing the exact code in a Language of your choice.
(e.g. Java, PHP, Python …)
4. Test business logic data validation (OTG-BUSLOGIC-001)
 While reviewing some Java code, an analysis provided the following code snippets that contain
logic errors. For each example, describe the issue and provide code that would fix the logical
error:
a.
2
int x; x = x 1; System.out.println(“X = ” x);
b.
for (i=1; i d) ; { System.out.println(“Z is bigger”); }
d.
String m1=”one”;
String m2=”two”;
if(m1 == m2) {
System.out.println(“M1 is equal to M2”);
}
e. The formula for the area of a trapezoid is:
A = (b1 b2)/2 * h
The following Java code is the implementation. Fix the logical error
double area;
double base1 = 2.3;
double base2 = 4.8;
double height = 12.5;
area = base1 base2/2.0 * height;
Demonstrate your fixed code work as anticipated with a couple different test
cases.
5. Test integrity checks (OTG-BUSLOGIC-003)
 Conduct some additional research on Business Logic errors related to OTG-BUSLOGIC-003. In
your own words describe and provide 2 unique examples of integrity checks. For your
examples, provide specific testing methods for each case.
6. Test defenses against Circumvention of Work Flows (OTG-BUSLOGIC-006)
3
 Conduct some additional research on Business Logic errors related to OTG-BUSLOGIC-006. In
your own words describe and provide 2 unique examples of circumvention of work flow. For
your examples, provide specific testing methods for each case.
You should document the results for the tests and your comments, and recommendations for improved
security for each security control tested in a word or PDF document. Discuss any issues found and
possible mitigations.
Deliverables:
You should submit your document by the due date. Your document should be well-organized, include all
references used and contain minimal spelling and grammar errors.
Grading Rubric:
Attribute Meets
Reflected Cross site scripting
10 points Describes Reflected Cross Site scripting. Then, Lists and describes 4 different examples that could be used for testing. Conducts additional research for each example to provide your own unique test example.
Stored Cross site scripting
10 points Describes Stored Cross Site scripting. Then, Lists and describes 2 different examples that could be used for testing. Conducts additional research for each example to provide your own unique test example.
SQL Injection 25 points Answers: would a form or application that includes this code be susceptible to SQL Injection? Why? Answers: What specific tests would you perform to determine if the applications was vulnerable? Answers: How would you fix this problem? Provides the exact code in a Language of your choice.
Business logic data validation
15 points For each example, describes the issue and provides code that would fix the logical error.
Integrity checks 10 points Conducts research on Business Logic errors related to OTG-BUSLOGIC-003. In your own words describes and provides 2 unique examples of integrity checks. Provides specific testing methods for each case.
Defenses against workflow intervention
10 points Conducts research on Business Logic errors related to OTG-BUSLOGIC-006. In your own words describes and provides 2 unique examples of circumvention of work flow. Provides specific testing methods for each case.
Documentation and Submission
20 points Your document should be well-organized, include all references used and contain minimal spelling and grammar errors.

Place your order
(550 words)

Approximate price: $22

Calculate the price of your order

550 words
We'll send you the first draft for approval by September 11, 2018 at 10:52 AM
Total price:
$26
The price is based on these factors:
Academic level
Number of pages
Urgency
Basic features
  • Free title page and bibliography
  • Unlimited revisions
  • Plagiarism-free guarantee
  • Money-back guarantee
  • 24/7 support
On-demand options
  • Writer’s samples
  • Part-by-part delivery
  • Overnight delivery
  • Copies of used sources
  • Expert Proofreading
Paper format
  • 275 words per page
  • 12 pt Arial/Times New Roman
  • Double line spacing
  • Any citation style (APA, MLA, Chicago/Turabian, Harvard)

Our guarantees

Delivering a high-quality product at a reasonable price is not enough anymore.
That’s why we have developed 5 beneficial guarantees that will make your experience with our service enjoyable, easy, and safe.

Money-back guarantee

You have to be 100% sure of the quality of your product to give a money-back guarantee. This describes us perfectly. Make sure that this guarantee is totally transparent.

Read more

Zero-plagiarism guarantee

Each paper is composed from scratch, according to your instructions. It is then checked by our plagiarism-detection software. There is no gap where plagiarism could squeeze in.

Read more

Free-revision policy

Thanks to our free revisions, there is no way for you to be unsatisfied. We will work on your paper until you are completely happy with the result.

Read more

Privacy policy

Your email is safe, as we store it according to international data protection rules. Your bank details are secure, as we use only reliable payment systems.

Read more

Fair-cooperation guarantee

By sending us your money, you buy the service we provide. Check out our terms and conditions if you prefer business talks to be laid out in official language.

Read more
Open chat
1
You can contact our live agent via WhatsApp! Via + 1 3234125597

Feel free to ask questions, clarifications, or discounts available when placing an order.

Order your essay today and save 30% with the discount code HAPPY