1. Computer Security Management
(ISYS20261)
Lecture 9 - Web application attacks
Module Leader: Dr Xiaoqi Ma
School of Science and Technology

2. Today ...
… we will discuss:
• Session Hijacking
• Code injection
• Cross-site scripting (XSS)
• Pharming
• URL spoofing
Computer Security Management
Page 2

3. HTTP cookie (1)
• An HTTP cookie is usually a small piece of data sent from a website
and stored in a user's web browser while a user is browsing a
website.
– When the user browses the same website in the future, the data stored in the
cookie can be retrieved by the website to notify the website of the user's
previous activity.
• Introduces state into HTTP transactions, used by Web servers to
differentiate users and to maintain data related to the user
• Data in cookie might be random or meaningful
• Server has to maintain a database of cookies
• Specification:
– four kilobytes of data each
– Browser stores at least 300 cookies
– at least 20 cookies per server or domain
Computer Security Management
Page 3

4. HTTP cookies (2)
• Example
Server Client1 Client2
Page Request()
page data + cookie1()
page request + cookie1()
page data()
page request + cookie2()
page data()
Computer Security Management
Page 4

5. Session hijacking
• Session IDs:
– typically granted to a visitor on his first visit to a site
– may become invalid after a certain goal has been met
– often used to identify a user that has logged into a website
– often long randomly-generated string
• Session hijacking:
– attacker using captured, brute forced or reverse-engineered session IDs to seize
control of a legitimate user's session while that session is still in progress
– often servers perform additional verification of the client, e.g. locking a session
ID to the client's IP address
– simple and effective measure as long as the attacker cannot connect to the
server from the same address
Computer Security Management
Page 5

6. Session sidejacking
• Attacker uses packet sniffing to read network traffic between two
parties to steal the session cookie
• Often web sites use SSL encryption for login pages but do not use
encryption for the rest of the site once authenticated
• Attackers then can read the network traffic to intercept all the data
that is submitted to the server or web pages viewed by the client
• Since this data includes the session cookie, it allows him to
impersonate the victim, even if the password itself is not
compromised
• Unsecured WiFi hotspots are particularly vulnerable, as anyone
sharing the network will generally be able to read most of the web
traffic between other nodes and the access point
Computer Security Management
Page 6

7. Code injection
• Breaking into applications by processing invalid data
• Used by an attacker to introduce code into a computer program to
change the course of execution
• Examples
– SQL injection
– PHP injection
– Etc.
Computer Security Management
Page 7

8. SQL injection example
• Takes advantage of the syntax of SQL to inject commands that can
compromise the meaning of the original query
• Statement
– SELECT * FROM users WHERE name = '" + name + "';
• If user enters a' or 't'='t for name statement changes to
– SELECT * FROM users WHERE name = 'a' OR 't'='t';
• Forces the selection of all valid usernames because the evaluation of
't'='t' is always true!
• Defence:
– Input validation
– Escaping dangerous characters
– Etc.
Computer Security Management
Page 8

9. Cross site scripting (XSS) (1)
• Possible in web applications which allow code injection by malicious
web users into the web pages viewed by other users
• Examples:
– HTML code
– client-side scripts
– etc
• Can be used by attackers to bypass access controls
• 2007: cross-site scripting carried out on websites were roughly 80%
of all documented security vulnerabilities
• Usually the end-user does not notice that he/she is subject to
unauthorized access, theft of sensitive data, and financial loss
Computer Security Management
Page 9

10. Cross site scripting (XSS) (2)
• Different Types:
– Type 0: Document Object Model (DOM)-based
– Type 1: Non-Persistent (reflective)
– Type 2: Persistent
• Type 1 most common, type 2 most dangerous
Computer Security Management
Page 10

11. Type 0
1. Ivan sends a URL to Alice (via email or another mechanism) of a
maliciously constructed web page
2. Alice clicks on the link
3. The malicious web page's JavaScript opens a vulnerable HTML
page installed locally on Alice's computer
4. The vulnerable HTML page contains JavaScript which executes in
Alice's computer's local zone
5. Ivan’s malicious script now may run commands with the privileges
Alice holds on her own computer
Computer Security Management
Page 11

12. Type 1 (1)
1. Alice often visits a particular website, which is hosted by Bob.
Bob's website allows Alice to log in with a username/password pair
and store sensitive information, e.g. billing information
2. Ivan observes that Bob's website contains a reflected (type 1) XSS
vulnerability
3. Ivan crafts a URL to exploit the vulnerability, and sends Alice an
email, making it look as if it came from Bob (spoofing)
4. Alice visits the URL provided by Ivan while logged into Bob's
website
5. The malicious script embedded in the URL executes in Alice's
browser, as if it came directly from Bob's server. The script steals
sensitive information and sends this to Ivan’s web server without
Alice's knowledge
Computer Security Management
Page 12

13. Type 1 (2)
• Website that offers search functionality:
http://website.com/?search=name
• Website echoes (reflects) input without checking:
<p>You were looking for: name</p>
• If <script type="text/javascript">alert("XSS")</script> is used for name:
• Server echoes script that is then executed locally:
<p>You were looking for: <script type="text/javascript">alert("XSS")
</script></p>
Computer Security Management
Page 13

14. Type 2 (1)
1. Bob hosts a web site which allows users to post messages and
other content to the site for later viewing by other members
2. Ivan notices that Bob's website is vulnerable to a type 2 XSS
attack
3. Ivan posts a message that contains a (hidden) script
4. By viewing the posted message, site users' session cookies or
other credentials could be taken and sent to Ivan's web server
without their knowledge
5. Later, Ivan logs in as other site users and posts messages on their
behalf....
Computer Security Management
Page 14

15. Type 2 (2)
• If a web site offers a guest book facility:
• Attacker enters for example:
Nice web site!<script type="text/javascript">alert("XSS")</script>
• Ever user who reads the guest book executes the attacker’s script!
Computer Security Management
Page 15

16. Pharming
• Attempt to subvert DNS systems to redirect network traffic to a
malicious system
• Can be achieved by
– attacking DNS servers, planting bogus data in their cache so that when a site's
IP address is requested that of the attacker’s site is supplied instead
– changing the hosts file on the local system so that certain sites will be redirected
• Victim's attempts to access certain sites will be redirected silently
and invisibly
• Can be hard to detect locally
Computer Security Management
Page 16

17. URL spoofing
• Common way to redirect a user to a web site that looks authentic
• This web site might be a spoof with templates that look identical to
the actual web site
• User enter their login information to these fake web site: providing
the attacker with data that can be used to enter the real web site
• Example: www.google.com@members.aol.com looks like a URL to
the google search engine but in reality it is a URL to the
members.aol.com server!
Computer Security Management
Page 17