= Ch 11 - Web Hacking = Link to PDF of powerpoint presentation http://dl.dropbox.com/u/68566/WebHacking.pdf === Early Days === * In the early days of web hacking the web server was often the main target. * Now days vulnerabilities in server software are widely publicized and easy to detect and attack and protect. * Fewer and fewer vulnerabilities are showing up because… * Vendors and open-source are learning from past mistakes * Sys. Admins are learning how to better configure * Vendors and open-source are responding faster to patches * Proactive countermeasures are fast becoming standard (Watchfire’s !AppSheild, Microsoft’s URLScan, etc.) === Current Vulnerabilities === * Web server vulnerabilities tend to fall into one of the following categories: * Sample files * Source code disclosure * Canonicalization * Server extensions * Input validation (ex. Buffer overflows) === Sample Files === * With more and more features in web software, developers are adding in more sample code and scripts to show what can be done. * If left in place the sample files can become an easy target for hackers. * Ex. IIS4 had two sample files that let hackers remote access and reveal the contents of just about every other file on the server. === Source Code Disclosure === * Allow a malicious user to view the source code of application files on a vulnerable web server that is intended to remain confidential. * Can combine this with other attacks to gain access to protected areas such as /etc/passwd, etc. * Good practice to assume your web files will be seen, and should never store sensitive data in any source code. === Canonicalization Attacks === * Computer and network resources can often be addressed using more than one way. * Ex. C:\text.txt ; ..\\text.txt ; \\computer\C$\text.txt * Apps that make security decisions based on the resource name can be vulnerable to these attacks, and easily fooled. * Make sure to keep web platforms up to date with all patches. * Compartmentalize your directory structure. * Constrain input using platform-layer solutions (MS’s URLScan) to strip unicode or double-hex-encoded characters before reaching the server. === Server Extensions === * Web servers by themselves are minimal in functionality, extensions add a lot to the web experience * With web extensions also come trouble * MS’s indexing extension, IPP, IIS5, WebDAV, SSL, etc all are extensions and all have had their fair share of security holes * Make sure you patch or disable the vulnerable extension. In general make sure you only run extensions that are needed and nothing more === Buffer Overflows === * Buffer overflow attack symbolizes the coup de grace of hacking * Often result in the ability to execute arbitrary commands on the victim machine, with very high privilege levels * Easiest way to counter buffer overflow vulnerabilities is to apply a software patch === Web Server Vulnerability Scanners === * Tools that automate the process of parsing web servers for a bunch of vulnerabilities that come from the hacking community * Allows you to focus on patching the holes that are found when the automated process is done, make sure to patch them fast because a hacker can find them easily too * Ex. Nikto, and Nessus === Web Application Hacking === * Web app hacking refers to hacking the app itself and not the web server * Requires more patience and sophistication then hacking off the shelf web server software === Finding vulnerable apps with Google === * Search engines are dangerous because users are careless * Makes finding candidate machines almost effortless * Find list of publicly accessible pages * Site:southern.edu; inurl:southern.edu * Find unprotected directories * Index of /admin” /password, /mail, password.txt * Find password hint applications that are poorly setup * Password hint, password hint –email, show password hint –email, filetype:htaccess user === Web Crawling === * A serious attacker takes the time to become familiar with the application * Download entire contents of site, look for low hanging fruit * Local path info, back-end server names, IP address, SQL query strings with passwords, info comments, etc * Tools * wget to get entire websites which can then be used to study later in great detail === Web Application Assessment === * Once target app content has been crawled and analyzed attacker will then turn to more in-depth probing * Ultimate goal of this is to thoroughly understand the architecture and design of the application and identify any weaknesses * Focus on authentication, session management, database interaction, generic input validation, and application logic === Browser Plug-ins === * Browser plug-ins allow you to view the requests as they are made and stop, and modify them on their way * Very valuable in finding hidden form fields, modifying query arguments and request headers, and inspecting the response from the remote server * !TamperData is a plug-in for Firefox coupled with no-script can selectively run and edit !JavaScript === Tool Suites === * Web proxies that are in between the web client and server * Basically a man-in-the-middle during an http session * Fiddler can be used with any WinINET library software, IE, Outlook, Office, etc * Fiddler can adjust files on the way * Ex. bpu .css === Common Web Application Vulnerabilities === * The main categories are * Cross-Site Scripting (XSS) * Injection Flaws * Cross-Site Request Forgery (CSRF) === Cross-Site Scripting (XSS) === * Arise from input/output validation deficiencies in web applications * Attacks other users of the page * Ex. Attacker puts code in guestbook online, people who view guestbook has the attackers code executed, potentially giving attacker control of second users’ system * Counter with filter input parameters for special characters. Ex. < > ( ) # & “ === SQL Injection === * Adjusting the SQL to point it at a file you wish to view * Is a problem because by default a web browser is a “trusted” user. * Counter measures * Perform strict input validation on any input from the client * Replace direct SQL statements with stored procedures, prepared statements * Implement defaut error handling * Lock down ODBC * Lock down database server configuration === Cross-Site Request Forgery === * Known about for nearly a decade, but just now becoming a serious problem * Allows for users to stay logged in without having to authenticate after each page load * Can cause problems for the users, passwords changed, funds transferred, merchandise purchased, and more. * Attacker puts image tag in a real page that a user is already logged in to and when the browser requests the link instead of an image it is a url string that can change the password for example. * * Conutermeasures * Tying the incoming request to the auth. session. Use random values, tied to the specified user’s session. If it doesn’t match have them re authenticate their connection. === Misuse of Hidden Tags === * Allows attackers to adjust hidden fields before being sent to the server for processing * Business should not have price of item set as a hidden form * Would be very easy to adjust the price * Countermeasures * Limit the use of hidden tags, or at least confirm the value before processing == Quiz == 1. List 2 of the 5 common web server vulnerabilities. ||<#32cd32>Sample files, Source code disclosure, Canonicalization, Server extensions, Input validation(ex. Buffer overflow) || 2. Name one of the two browser plugins/toolsets to preform a man-in-the-middle attack. ||<#32cd32>!TamperData or Fiddler || 3. What is a common tool used to gather entire websites? ||<#32cd32>wget || 4. What is the easiest method to find vulnerable web applications? ||<#32cd32>Using search engines ||