Web Insecurity And Browser Exploitation
•Transferir como PPTX, PDF•
1 gostou•551 visualizações
A 2 hour seminar in Munich, 20th January 2010
![http://www.integratingweb.com http://antisnatchor.com Who am I? ,[object Object]](data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7)
Recomendados
Recomendados
Mais conteúdo relacionado
Mais procurados
Mais procurados (20)
Destaque
Destaque (18)
Semelhante a Web Insecurity And Browser Exploitation
Semelhante a Web Insecurity And Browser Exploitation (20)
Último
Último (20)
Web Insecurity And Browser Exploitation
- 1. 1 Web Insecurity and Browser Exploitation brought to you by Michele “AntiSnatchOr” Orrù and Integrating Web LTD 20th January 2009
- 3. Bachelor Degree in Internet Sciences
- 4. Owner of http://antisnatchor.com security advisory blog
- 5. JEE developerOutline 2 of 59
- 7. Practical demonstrations of some vulnerable Real World web applications (my totally independent security research)
- 8. Understand the impact of these threats on the most valuable web-app assets
- 9. Practical screen-casts that show how attackers exploit common flows
- 10. Browser exploitation discussionSeminar outline 3 of 59
- 12. CWE-116: Improper Encoding or Escaping of Output
- 13. CWE-209: Error Message Information Leak
- 14. CWE-89: Failure to Preserve SQL Query Structure (SQL injection)
- 15. CWE-79: Failure to Preserve Web Page Structure (XSS)
- 16. CWE-352: Cross-Site Request Forgery (XSRF)What we will discuss 4 of 59
- 18. Improper Input Validation can lead to security vulnerabilities when attackers can modify input in unexpected ways for the application
- 19. The only way to protect our applications is by understanding that all input can be maliciousCWE-20: Improper Input Validation 5 of 59
- 22. DNS based website blacklist can be bypassed by providing a forged request with a custom HTTP headerHttp request: GET / HTTP/1.1 X-DecoyHost: www.milw0rm.org Host: www.blocked.org CWE-20: Example 7 of 59
- 24. Whitelist approachinstead of blacklist (you are certainly going to miss some character encoding variants)
- 25. WebApp case: use a WebApp Firewall (ModSecurity/F5) or an Input Validation Framework for your language.CWE-20: Mitigation 8 of 59
- 26. http://www.integratingweb.com http://antisnatchor.com CWE-20: MitigationModSecurity CWE-20: Mitigation with ModSecurity 9 of 59
- 28. Authentication
- 29. Access Control
- 30. Input Validation
- 31. Output Encoding
- 32. Cryptography
- 33. Error handling/loggingCWE-20:MITIGATION OWASP ESAPI 10 of 59
- 35. Developed by skilled hackers (Mario Heiderich - .mario on sla.ckers.org)
- 36. Try their demo with your nasty attack vectors here: http://demo.php-ids.org
- 37. Integrated as a module in Drupal, works with the powerful Zend Framework (http://forum.php-ids.org/comments.php?DiscussionID=113)11 of 59
- 39. Even if input has been filtered, application output could not be safe: it need to be encoded too
- 40. Common examples: HTML/JavaScript injection on web based applicationsCWE-116: Improper Encoding of Output 12 of 59
- 45. Always encode application output, especially if it contains previously user-supplied input
- 46. WebApp firewall and ESAPI/PHPIDS (you lazy developers :-))CWE-116: Mitigation 15 of 59
- 48. This information is used in the Penetration Testing phase called “Reconnaissance”
- 49. Even these little secrets can greatly simplify a more concerted attack that yields much bigger rewardsCWE-209: Error Message Information Leak 16 of 59
- 51. MySQL error when forging a malicious request altering the anno parameterGET /seminari/archivio.php?anno=2008%27 HTTP/1.1 Host: www.dm.unibo.it [...] Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Keep-Alive: 300 Proxy-Connection: keep-alive Cookie: dm=[...] CWE-209: www.dm.unibo.it 17 of 59
- 53. We can now run more targeted attacks18 of 59
- 55. Session Management was (IS actually) broken and can be manipulated
- 56. If we are the hacker riding the victim’s session, and the victim then logout from Uniwex, his session (and ours, because is the same) is invalidated.
- 57. If we invalidate a session and then we try to submit the previously “invalid” session token... MAGICALLY ...CWE-209: unibo.unibo.it 19 of 59
- 58. http://www.integratingweb.com http://antisnatchor.com CWE-209: Examples2. uniwex.unibo.it CWE-209: unibo.unibo.it 20 of 59
- 60. It shouldn’t be there in production!!!
- 61. This revealed us that Tomcat is used as Application Server, and we’ve also obtained the specific version of a few frameworks on which the application was built:/home/unimatica/uniwex/uniwexng-4.4.0/WEB-INF/lib/struts-1.1.jar /home/unimatica/uniwex/uniwexng-4.4.0/WEB-INF/lib/myfaces-api-1.1.4.jar CWE-209: unibo.unibo.it 21 of 59
- 63. The most common storage solution is a Relational Database(Oracle, MySQL, Postgres, MS-SQL, Sybase)
- 64. If attackers can influence the SQL that you use to communicate with your database, then they can do nasty things for fun and profitCWE-89: SQL Injection 22 of 59
- 65. http://www.integratingweb.com http://antisnatchor.com CWE-89: SQL Injection Exploiting escape characters: "SELECT * FROM customers WHERE name= '" + customerName+ "';" IfcustomerName=marcus’ UNION SELECT 1,2,3,4 FROM admin_users; Then the final query becomes: SELECT * FROM customers WHERE name='marcus’ UNION SELECT 1,2,3,4 FROM admin_users; Exploiting type handling: "SELECT * FROM product_data WHERE product_id = " + productId + ";" IfproductId=10078;DROP TABLE admin_users Then the final query becomes: SELECT * FROM product_data WHERE product_id =10078;DROP TABLE admin_users; CWE-89: SQL Injection 23 of 59
- 67. The previous example on www.dm.unibo.it demonstrates that input is not being escaped at all
- 68. After we discovered the SQL injection we can fire-up our favorite injection tool to retrieve useful informationCWE-89: SQL Injection 24 of 59
- 70. Confirmed unescaped numeric injection on GET parameter “anno”
- 71. We were able to obtain details about the application stack: Apache 2.2.3, PHP 5.2.0, MySQL >= 5.0
- 72. For demonstration we retrieved the exact name of the database name to which the web app is bounded:dipartimentoCWE-89: www.dm.unibo.it 25 of 59
- 73. http://www.integratingweb.com http://antisnatchor.com Screen-Castwww.dm.unibo.it CWE-89: www.dm.unibo.it 26 of 59
- 75. Confirmed unescaped numeric injection on GET parameter “ID” (SPNewsDettaglio.asp)
- 76. We were able to obtain details about the application stack: Microsoft IIS 6, ASP and SQL Server 2000
- 77. We retrieved the exact name of the database name to which the web app is bounded: ServizioNews(and a few tables too)CWE-89: www.virtus.it 27 of 59
- 80. Hibernate on JEE, NHibernate on .NET
- 81. DB specific: Oracle DBMS_ASSERT directive, MySQLreal_escape_string() function
- 82. Use a whitelist approach, permitting only “known good input”CWE-89: Mitigation 28 of 59
- 84. Data loss is probably the most negative consequence for an Enterprise
- 85. If the web application (most of them, if not all) is storing web page content inside the DB, we can deface the site tooCWE-89: Dangers 29 of 59
- 90. SQLmap author:
- 93. The page is then accessed by other users, whose browsers execute that malicious script as if it came from the legitimate user (the victim)
- 94. It always happen when a server-side script/servlet/whatever process the malicious data to generate a page without properly sanitizing the response (non-DOM-based XSS)CWE-79: The Plague of Cross Site Scripting 31 of 59
- 95. http://www.integratingweb.com http://antisnatchor.com CWE-79: Examples1. www.cia.gov CWE-79: www.cia.gov 32 of 59
- 96. http://www.integratingweb.com http://antisnatchor.com CWE-79: Examples2. portal.hotspotsvankpn.com CWE-79: portal.hotspotsvankpn.com 33 of 59
- 98. After my JIRA issue they started to take really care of security (I’m glad to)
- 99. See http://fisheye6.atlassian.com/changelog/ofbiz?cs=746409 and http://antisnatchor.com/2008/12/11/apache-ofbiz-multiple-security-vulnerabilitiesCWE-79: Mitigation 34 of 59
- 103. Do not create your own filters: you’ll probably miss some attack vectors or encodings
- 104. Use well known Encoding/Validation frameworks such as ESAPI,PHPIDS,Microsoft Anti-XSS (yes, Microsoft, don’t laugh please :-))CWE-79: Mitigation 37 of 59
- 106. As we said many times before, we don’t recommend to write an anti-XSS filter from scratch
- 107. At CERN they usually develop application from scratch, like Indico (http://indico.cern.ch). Indico is the main solution used by the EGEE partners around Europe (many thousand of users)
- 108. We found a way to bypass a basic anti-XSS filter implemented in the application
- 109. Bracelets (< >) are correctly escaped with < and >, thus preventing almost all the attack vectors……CWE-79: Advanced concepts 38 of 59
- 111. ….. We said almost because we can create attack vectors even without bracelets:http://indico.cern.ch/search.py?categId=0&p=cloud&f=title%22&collections=&startDate=&endDate=&sortOrder=d The rendered HTML after processing the request is the following: <form id="NextFormEvents" method="GET" action="http://indico.cern.ch/search.py"> <input type="hidden" name="startDate" value=""/> <input type="hidden" name="endDate" value=""/> <input type="hidden" name="p" value="cloud"/> <input type="hidden" name="f" value="title""/> <!-- <-- here is the problem --> <input type="hidden" name="collections" value="Events"/> <input type="hidden" name="categId" value="0" /> </form> CWE-79: Advanced concepts 39 of 59
- 113. The following is working on Microsoft Internet Explorer 6 and 7:
- 115. The malicious code will add to the "input" element a "style" attribute: note that expression is understood only by IE.The rendered HTML after processing the request is the following: <form id="NextFormEvents" method="GET" action="http://indico.cern.ch/search.py"> <input type="hidden" name="startDate" value=""/> <input type="hidden" name="endDate" value=""/> <input type="hidden" name="p" value="cloud"/> <input type="hidden" name="f" value="title” style=“width: expression(alert('XSS'));”/> <input type="hidden" name="collections" value="Events"/> <input type="hidden" name="categId" value="0" /> </form> CWE-79: Advanced concepts 40 of 59
- 120. KonaKart is a free Java based web application to manage e-commerce websites (www.konakart.com)
- 121. Stored XSS has been found and verified in the backend
- 122. More info here: http://antisnatchor.com/2008/12/22/konakart-2260-responsible-disclosure/
- 123. Let see how we can exploit themCWE-79: KonaKart 44 of 59
- 124. http://www.integratingweb.com http://antisnatchor.com Screen-CastKonaKart CWE-79: KonaKart 45 of 59
- 126. Internal Penetration Test at INFN (National Institute of Nuclear Physics)
- 127. Workload Management System (distribute job execution between multiple Computing Elements on a Grid infrastructure) monitor
- 128. Some serious flows have been identified
- 129. Unsecure handling of X.509 client certificates
- 130. Reflected XSS
- 131. TRACE method enabled
- 132. Let see how can we take full control of the victim browser CWE-79: WMSmonitor 46 of 59
- 133. http://www.integratingweb.com http://antisnatchor.com Screen-CastWMSmonitor CWE-79: WMSmonitor 47 of 59
- 137. The Advanced Cross-Site Scripting Virus: http://www.bindshell.net/papers/axssv
- 138. Rsnake & al. works:
- 139. XSS cheat sheet: http://ha.ckers.org/xss.html
- 140. XSS proxies:
- 144. XSS worm context: http://ha.ckers.org/blog/20080106/diminutive-xss-worm-contest-drama-and-status-update/
- 146. Advisories on SecurityFocus: http://antisnatchor.com/2009/10/14/finally-on-bugtraq/CWE-79: Links 48 of 59
- 151. http://www.amazon.com/Hacking-Next-Generation-Animal-Guide/dp/0596154577/ref=sr_1_1?ie=UTF8&s=books&qid=1263982791&sr=8-1 CWE-79: Links 49 of 59
- 153. Once the request gets to the application, it looks as if it came from the user, not the attacker
- 154. If the victim has admin privileges on the application: GAME OVERCWE-352: Cross Site Request Forgery 50 of 59
- 156. Changing DNS settings of home routers (thanks pdp & GNUCITIZEN)
- 157. Performing a Denial Of Service attack on the application
- 158. Combining it with XSS to build WORMSCWE-352: XSRF Concrete Consequences 51 of 59
- 160. 2. Trick the administrator to load the hacker page with a malicious request on it that submits a new email
- 161. 3. Administrator's e-mail is now changed to the email submitted by hacker
- 162. 4. The hacker performs a lost-password request and receives a new passwordCWE-352: XSRF Concrete Consequences 52 of 59
- 164. 3 The victim is now using your chosen DNS, where you probably altered her common used domains with your phishing ones CWE-352: XSRF Concrete Consequences 53 of 59
- 166. Youtube
- 167. New York Times
- 168. Gmail [http://directwebremoting.org/blog/joe/2007/01/01/csrf_attacks_or_how_to_avoid_exposing_your_gmail_contacts.html] CWE-352: XSRF Who has been vulnerable? 54 of 59
- 170. We can create a malicious form that will add a product (eventually with some JS inside) to the Catalog
- 171. If the victim is already authenticated she will not even realize what she did CWE-352: Apache OFBiz 55 of 59
- 172. http://www.integratingweb.com http://antisnatchor.com CWE-352: XSRF1. Apache OFBiz <form method="POST" id="xsrf" name="xsrf" action="https://127.0.0.1:8443/catalog/control/createProduct"> <input type=hidden name="isCreate" value="true"> <input type=hidden name="productId" value="hack02"> <input type=hidden name="productTypeId" value="DIGITAL_GOOD"> <input type=hidden name="internalName" value="hack02<script>alert(document.cookie)</script>"> </form> <script>document.xsrf.submit(); </script> CWE-352: Apache OFBiz 56 of 59
- 174. Implement AJAX functionalities with secure libraries such as DWR-2.0 (Direct Web Remoting) that automatically prevents XSRFCWE-352: XSRF Mitigation 57 of 59
- 175. http://www.integratingweb.com http://antisnatchor.com Browser Exploitation discussion1. Google and China, Internet Explorer bugs2. ScreenCast: Browser Exploitationwith BeEF and Metasploit Browser Exploitation 58 of 59
- 176. http://www.integratingweb.com http://antisnatchor.com Thanks for your attention!Take a look at: http://antisnatchor.com Questions? 59 of 59