Robustness checks

Email address validation
========================

The following email addresses were used:
  1 robustness                  no at sign
  2 robustness@nothing          no top level domain
  3 robustness@com              no second-level domain
  4 robustness@nothing.fog      non-existent top level domain
  5 robustness@atf2tk74mpm.com  non-existent domain

Notes:
  * Validity of top level domain taken from list at http://data.iana.org/TLD/tlds-alpha-by-domain.txt
  * Domain atf2tk74mpm.com tested on 2007-05-18 using whois

SQL injection
=============

* improper handling of quotes
* displaying server error messages when SQL fails
* numeric fields with sql code (no quotes required)

The following values were used to test SQL injection vulnerability:
 abc"def)ghi
 abc'def)ghi

Session stealing
================

Checked how sessions were handled when turning off cookies in the browser.


------------------------------------------------------------
Results
------------------------------------------------------------

=======
Summary
=======

Email addresses:

 * Team 6 had complete email validation ("smart" check: inc. valid domain check)
 * Teams 2, 3, 7, 8 had partial validation ("dumb" check: something@something.something)
 * Teams 1, 4, 5, 9 had no email validation whatsoever


SQL injection:

 * Teams 6, 7, 8, 9 appear to have no problems whatsoever
 * Teams 1, 2, 3, 5 raise SQL errors with certain input. SQL injection may nevertheless be impossible.
 * Team 4 stores sometimes only half of the string, indicating that SQL may be possible (further investigation required)


Session handling without cookies:

* Teams 1, 2, 7, 8 did not allow login without cookies 
  (hijack impossible)
* Team 5 crashed on login without cookies
  (hijack therefore impossible)
* Team 9 did not show anything without cookies
  (login and hijack therefore impossible)
* Teams 3, 4, 6 put session information in the link addresses
  (allowed a session hijack)

The sections below contain the details for the email and SQL injection
tests:

======
TEAM 1
======
Email addresses:
  1) Accepted
  2) Accepted
  3) Accepted
  4) Accepted
  5) Accepted
  * Absolutely no email validation appears to be functioning.

SQL injection:
  * Able to enter both abc"def)ghi and abc'def)ghi for all fields in registration (including drop-down fields)
  * Login works correctly
  * Search fails, but may be unrelated (harmless sql injection also fails).

======
TEAM 2:
======
Email addresses:
  1) Rejected
  2) Rejected
  3) Rejected
  4) Accepted
  5) Accepted

SQL injection:
  * Registration: SQL syntax error on submit, an integer field expected by
    database, string submitted. Database query shown on error. This also
    happens when one of the Enneagram fields are missing. The failure
    apprently happens during 'cleanup', thus an actual SQL injection may not
    be possible.
  * Login does not produce an SQL error (but nothing happens)

======
TEAM 3:
======
Email addresses:
  1) Rejected
  2) Rejected
  3) Rejected
  4) Accepted
  5) Accepted

SQL injection:
  * Able to enter both abc"def)ghi and abc'def)ghi for all non-drop-down fields in registration
  * Login works correctly
  * Using in a drop down field in the search caused an exception because a number was expected. 
    This was apparently raised before it reached an SQL query.

======
TEAM 4:
======
Email addresses:
  1) Accepted
  2) Accepted
  3) Accepted
  4) Accepted
  5) Accepted
  * Absolutely no email validation appears to be functioning.

SQL injection:
  * only the first three characters of abc"def)ghi are stored for certain fields 
    (life motto, secondary life motto, GPS, possibly more).
    With abc'def)ghi, everything is stored. This may indicate that an injection is possible.
  * login works with both strings

======
TEAM 5:
======
Email addresses:
  1) Accepted
  2) Accepted
  3) Accepted
  4) Accepted
  5) Accepted

SQL injection:
  * Able to enter both abc'def)ghi and abc"def)ghi for all non-drop-down fields in registration
    - Database SQL error when GPS not submitted (shows SQL query information and source code)
    - All values are escaped before database query
    - Entering non numeric data for a drop-down list causes database error, showing source code
  * Login works correctly
  * Search works correctly

======
TEAM 6:
======
Email addresses:
  1) Rejected
  2) Rejected
  3) Rejected
  4) Rejected
  5) Rejected
  * A valid, existing email address works correctly

SQL injection:
  * Able to enter both abc'def)ghi and abc"def)ghi for all fields in registration
    - All values are escaped before database query
  * Login works correctly
  * Search works correctly

======
TEAM 7:
======
Email addresses:
  1) Rejected
  2) Rejected
  3) Rejected
  4) Accepted
  5) Accepted

SQL injection:
  * Able to enter both abc'def)ghi and abc"def)ghi for all fields in registration
    - All values are escaped before database query
  * Login works correctly
  * Search works correctly

======
TEAM 8:
======
Email addresses:
  1) Rejected
  2) Rejected
  3) Rejected
  4) Accepted
  5) Accepted

SQL injection:
  * Able to enter both abc'def)ghi and abc"def)ghi for all fields in registration
    - All values are escaped before database query
  * Login works correctly
  * Search works correctly

======
TEAM 9:
======
Email addresses:
  1) Accepted
  2) Accepted
  3) Accepted
  4) Accepted
  5) Accepted

SQL injection:
  * Able to enter both abc'def)ghi and abc"def)ghi for all fields in registration
    - All values are escaped before database query
  * Login works correctly
  * No strings involved in searching

