A 2 hour seminar in Munich, 20th January 2010

1. 1 Web Insecurity and Browser Exploitation brought to you by Michele “AntiSnatchOr” Orrù and Integrating Web LTD 20th January 2009

3. Bachelor Degree in Internet Sciences

4. Owner of http://antisnatchor.com security advisory blog

5. JEE developerOutline 2 of 59

7. Practical demonstrations of some vulnerable Real World web applications (my totally independent security research)

8. Understand the impact of these threats on the most valuable web-app assets

9. Practical screen-casts that show how attackers exploit common flows

10. Browser exploitation discussionSeminar outline 3 of 59

12. CWE-116: Improper Encoding or Escaping of Output

13. CWE-209: Error Message Information Leak

14. CWE-89: Failure to Preserve SQL Query Structure (SQL injection)

15. CWE-79: Failure to Preserve Web Page Structure (XSS)

16. CWE-352: Cross-Site Request Forgery (XSRF)What we will discuss 4 of 59

18. Improper Input Validation can lead to security vulnerabilities when attackers can modify input in unexpected ways for the application

19. The only way to protect our applications is by understanding that all input can be maliciousCWE-20: Improper Input Validation 5 of 59

22. DNS based website blacklist can be bypassed by providing a forged request with a custom HTTP headerHttp request: GET / HTTP/1.1 X-DecoyHost: www.milw0rm.org Host: www.blocked.org CWE-20: Example 7 of 59

24. Whitelist approachinstead of blacklist (you are certainly going to miss some character encoding variants)

25. WebApp case: use a WebApp Firewall (ModSecurity/F5) or an Input Validation Framework for your language.CWE-20: Mitigation 8 of 59

26. http://www.integratingweb.com http://antisnatchor.com CWE-20: MitigationModSecurity CWE-20: Mitigation with ModSecurity 9 of 59

28. Authentication

29. Access Control

30. Input Validation

31. Output Encoding

32. Cryptography

33. Error handling/loggingCWE-20:MITIGATION OWASP ESAPI 10 of 59

35. Developed by skilled hackers (Mario Heiderich - .mario on sla.ckers.org)

36. Try their demo with your nasty attack vectors here: http://demo.php-ids.org

37. Integrated as a module in Drupal, works with the powerful Zend Framework (http://forum.php-ids.org/comments.php?DiscussionID=113)11 of 59

39. Even if input has been filtered, application output could not be safe: it need to be encoded too

40. Common examples: HTML/JavaScript injection on web based applicationsCWE-116: Improper Encoding of Output 12 of 59

45. Always encode application output, especially if it contains previously user-supplied input

46. WebApp firewall and ESAPI/PHPIDS (you lazy developers :-))CWE-116: Mitigation 15 of 59

48. This information is used in the Penetration Testing phase called “Reconnaissance”

49. Even these little secrets can greatly simplify a more concerted attack that yields much bigger rewardsCWE-209: Error Message Information Leak 16 of 59

51. MySQL error when forging a malicious request altering the anno parameterGET /seminari/archivio.php?anno=2008%27 HTTP/1.1 Host: www.dm.unibo.it [...] Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Keep-Alive: 300 Proxy-Connection: keep-alive Cookie: dm=[...] CWE-209: www.dm.unibo.it 17 of 59

53. We can now run more targeted attacks18 of 59

55. Session Management was (IS actually) broken and can be manipulated

56. If we are the hacker riding the victim’s session, and the victim then logout from Uniwex, his session (and ours, because is the same) is invalidated.

57. If we invalidate a session and then we try to submit the previously “invalid” session token... MAGICALLY ...CWE-209: unibo.unibo.it 19 of 59

58. http://www.integratingweb.com http://antisnatchor.com CWE-209: Examples2. uniwex.unibo.it CWE-209: unibo.unibo.it 20 of 59

60. It shouldn’t be there in production!!!

61. This revealed us that Tomcat is used as Application Server, and we’ve also obtained the specific version of a few frameworks on which the application was built:/home/unimatica/uniwex/uniwexng-4.4.0/WEB-INF/lib/struts-1.1.jar /home/unimatica/uniwex/uniwexng-4.4.0/WEB-INF/lib/myfaces-api-1.1.4.jar CWE-209: unibo.unibo.it 21 of 59

63. The most common storage solution is a Relational Database(Oracle, MySQL, Postgres, MS-SQL, Sybase)

64. If attackers can influence the SQL that you use to communicate with your database, then they can do nasty things for fun and profitCWE-89: SQL Injection 22 of 59

65. http://www.integratingweb.com http://antisnatchor.com CWE-89: SQL Injection Exploiting escape characters: "SELECT * FROM customers WHERE name= '" + customerName+ "';" IfcustomerName=marcus’ UNION SELECT 1,2,3,4 FROM admin_users; Then the final query becomes: SELECT * FROM customers WHERE name='marcus’ UNION SELECT 1,2,3,4 FROM admin_users; Exploiting type handling: "SELECT * FROM product_data WHERE product_id = " + productId + ";" IfproductId=10078;DROP TABLE admin_users Then the final query becomes: SELECT * FROM product_data WHERE product_id =10078;DROP TABLE admin_users; CWE-89: SQL Injection 23 of 59

67. The previous example on www.dm.unibo.it demonstrates that input is not being escaped at all

68. After we discovered the SQL injection we can fire-up our favorite injection tool to retrieve useful informationCWE-89: SQL Injection 24 of 59

70. Confirmed unescaped numeric injection on GET parameter “anno”

71. We were able to obtain details about the application stack: Apache 2.2.3, PHP 5.2.0, MySQL >= 5.0

72. For demonstration we retrieved the exact name of the database name to which the web app is bounded:dipartimentoCWE-89: www.dm.unibo.it 25 of 59

73. http://www.integratingweb.com http://antisnatchor.com Screen-Castwww.dm.unibo.it CWE-89: www.dm.unibo.it 26 of 59

75. Confirmed unescaped numeric injection on GET parameter “ID” (SPNewsDettaglio.asp)

76. We were able to obtain details about the application stack: Microsoft IIS 6, ASP and SQL Server 2000

77. We retrieved the exact name of the database name to which the web app is bounded: ServizioNews(and a few tables too)CWE-89: www.virtus.it 27 of 59

79. Use stored procedures

80. Hibernate on JEE, NHibernate on .NET

81. DB specific: Oracle DBMS_ASSERT directive, MySQLreal_escape_string() function

82. Use a whitelist approach, permitting only “known good input”CWE-89: Mitigation 28 of 59

84. Data loss is probably the most negative consequence for an Enterprise

85. If the web application (most of them, if not all) is storing web page content inside the DB, we can deface the site tooCWE-89: Dangers 29 of 59

87. http://www.amazon.co.uk/Web-Application-Hackers-Handbook-Discovering/dp/0470170778/ref=sr_1_1?ie=UTF8&s=books&qid=1260264977&sr=8-1

88. http://www.amazon.com/Database-Hackers-Handbook-Defending-Servers/dp/0764578014/ref=sr_1_2?ie=UTF8&s=books&qid=1260281547&sr=8-2

89. http://www.amazon.com/Web-Security-Testing-Cookbook-Systematic/dp/0596514832/ref=sr_1_3?ie=UTF8&s=books&qid=1260281547&sr=8-3

90. SQLmap author:

91. http://www.slideshare.net/inquis/sql-injection-not-only-and-11CWE-89: Links 30 of 59

93. The page is then accessed by other users, whose browsers execute that malicious script as if it came from the legitimate user (the victim)

94. It always happen when a server-side script/servlet/whatever process the malicious data to generate a page without properly sanitizing the response (non-DOM-based XSS)CWE-79: The Plague of Cross Site Scripting 31 of 59

95. http://www.integratingweb.com http://antisnatchor.com CWE-79: Examples1. www.cia.gov CWE-79: www.cia.gov 32 of 59

96. http://www.integratingweb.com http://antisnatchor.com CWE-79: Examples2. portal.hotspotsvankpn.com CWE-79: portal.hotspotsvankpn.com 33 of 59

98. After my JIRA issue they started to take really care of security (I’m glad to)

99. See http://fisheye6.atlassian.com/changelog/ofbiz?cs=746409 and http://antisnatchor.com/2008/12/11/apache-ofbiz-multiple-security-vulnerabilitiesCWE-79: Mitigation 34 of 59

103. Do not create your own filters: you’ll probably miss some attack vectors or encodings

104. Use well known Encoding/Validation frameworks such as ESAPI,PHPIDS,Microsoft Anti-XSS (yes, Microsoft, don’t laugh please :-))CWE-79: Mitigation 37 of 59

106. As we said many times before, we don’t recommend to write an anti-XSS filter from scratch

107. At CERN they usually develop application from scratch, like Indico (http://indico.cern.ch). Indico is the main solution used by the EGEE partners around Europe (many thousand of users)

108. We found a way to bypass a basic anti-XSS filter implemented in the application

109. Bracelets (< >) are correctly escaped with < and >, thus preventing almost all the attack vectors……CWE-79: Advanced concepts 38 of 59

111. ….. We said almost because we can create attack vectors even without bracelets:http://indico.cern.ch/search.py?categId=0&p=cloud&f=title%22&collections=&startDate=&endDate=&sortOrder=d The rendered HTML after processing the request is the following: &lt;form id=&quot;NextFormEvents&quot; method=&quot;GET&quot; action=&quot;http://indico.cern.ch/search.py&quot;&gt; &lt;input type=&quot;hidden&quot; name=&quot;startDate&quot; value=&quot;&quot;/&gt; &lt;input type=&quot;hidden&quot; name=&quot;endDate&quot; value=&quot;&quot;/&gt; &lt;input type=&quot;hidden&quot; name=&quot;p&quot; value=&quot;cloud&quot;/&gt; &lt;input type=&quot;hidden&quot; name=&quot;f&quot; value=&quot;title&quot;&quot;/&gt; &lt;!-- &lt;-- here is the problem --&gt; &lt;input type=&quot;hidden&quot; name=&quot;collections&quot; value=&quot;Events&quot;/&gt; &lt;input type=&quot;hidden&quot; name=&quot;categId&quot; value=&quot;0&quot; /&gt; &lt;/form&gt; CWE-79: Advanced concepts 39 of 59

113. The following is working on Microsoft Internet Explorer 6 and 7:

114. "style%3d"width: expression(alert('XSS'));"

115. The malicious code will add to the "input" element a "style" attribute: note that expression is understood only by IE.The rendered HTML after processing the request is the following: &lt;form id=&quot;NextFormEvents&quot; method=&quot;GET&quot; action=&quot;http://indico.cern.ch/search.py&quot;&gt; &lt;input type=&quot;hidden&quot; name=&quot;startDate&quot; value=&quot;&quot;/&gt; &lt;input type=&quot;hidden&quot; name=&quot;endDate&quot; value=&quot;&quot;/&gt; &lt;input type=&quot;hidden&quot; name=&quot;p&quot; value=&quot;cloud&quot;/&gt; &lt;input type=&quot;hidden&quot; name=&quot;f&quot; value=&quot;title” style=“width: expression(alert(&apos;XSS&apos;));”/&gt; &lt;input type=&quot;hidden&quot; name=&quot;collections&quot; value=&quot;Events&quot;/&gt; &lt;input type=&quot;hidden&quot; name=&quot;categId&quot; value=&quot;0&quot; /&gt; &lt;/form&gt; CWE-79: Advanced concepts 40 of 59

120. KonaKart is a free Java based web application to manage e-commerce websites (www.konakart.com)

121. Stored XSS has been found and verified in the backend

122. More info here: http://antisnatchor.com/2008/12/22/konakart-2260-responsible-disclosure/

123. Let see how we can exploit themCWE-79: KonaKart 44 of 59

124. http://www.integratingweb.com http://antisnatchor.com Screen-CastKonaKart CWE-79: KonaKart 45 of 59

126. Internal Penetration Test at INFN (National Institute of Nuclear Physics)

127. Workload Management System (distribute job execution between multiple Computing Elements on a Grid infrastructure) monitor

128. Some serious flows have been identified

129. Unsecure handling of X.509 client certificates

130. Reflected XSS

131. TRACE method enabled

132. Let see how can we take full control of the victim browser CWE-79: WMSmonitor 46 of 59

133. http://www.integratingweb.com http://antisnatchor.com Screen-CastWMSmonitor CWE-79: WMSmonitor 47 of 59

135. BeEF: http://www.bindshell.net/tools/beef/

136. Inter-Protocol Exploitation: http://www.bindshell.net/papers/ipe

137. The Advanced Cross-Site Scripting Virus: http://www.bindshell.net/papers/axssv

138. Rsnake & al. works:

139. XSS cheat sheet: http://ha.ckers.org/xss.html

140. XSS proxies:

141. http://ha.ckers.org/blog/20060718/attacking-applications-via-xss-proxies/

142. http://xss-proxy.sourceforge.net/shmoocon-XSS-Proxy.ppt

143. XSS tunneling: http://www.portcullis-security.com/uplds/whitepapers/XSSTunnelling.pdf

144. XSS worm context: http://ha.ckers.org/blog/20080106/diminutive-xss-worm-contest-drama-and-status-update/

145. AntiSnatcOr works research:

146. Advisories on SecurityFocus: http://antisnatchor.com/2009/10/14/finally-on-bugtraq/CWE-79: Links 48 of 59

148. http://www.amazon.co.uk/Web-Application-Hackers-Handbook-Discovering/dp/0470170778/ref=sr_1_1?ie=UTF8&s=books&qid=1260264977&sr=8-1

149. http://www.amazon.com/XSS-Attacks-Scripting-Exploits-Defense/dp/1597491543/ref=sr_1_4?ie=UTF8&s=books&qid=1260281547&sr=8-4

150. http://www.amazon.com/Web-Security-Testing-Cookbook-Systematic/dp/0596514832/ref=sr_1_3?ie=UTF8&s=books&qid=1260281547&sr=8-3

151. http://www.amazon.com/Hacking-Next-Generation-Animal-Guide/dp/0596154577/ref=sr_1_1?ie=UTF8&s=books&qid=1263982791&sr=8-1 CWE-79: Links 49 of 59

153. Once the request gets to the application, it looks as if it came from the user, not the attacker

154. If the victim has admin privileges on the application: GAME OVERCWE-352: Cross Site Request Forgery 50 of 59

156. Changing DNS settings of home routers (thanks pdp & GNUCITIZEN)

157. Performing a Denial Of Service attack on the application

158. Combining it with XSS to build WORMSCWE-352: XSRF Concrete Consequences 51 of 59

160. 2. Trick the administrator to load the hacker page with a malicious request on it that submits a new email

161. 3. Administrator's e-mail is now changed to the email submitted by hacker

162. 4. The hacker performs a lost-password request and receives a new passwordCWE-352: XSRF Concrete Consequences 52 of 59

164. 3 The victim is now using your chosen DNS, where you probably altered her common used domains with your phishing ones CWE-352: XSRF Concrete Consequences 53 of 59

166. Youtube

167. New York Times

168. Gmail [http://directwebremoting.org/blog/joe/2007/01/01/csrf_attacks_or_how_to_avoid_exposing_your_gmail_contacts.html] CWE-352: XSRF Who has been vulnerable? 54 of 59

170. We can create a malicious form that will add a product (eventually with some JS inside) to the Catalog

171. If the victim is already authenticated she will not even realize what she did CWE-352: Apache OFBiz 55 of 59

172. http://www.integratingweb.com http://antisnatchor.com CWE-352: XSRF1. Apache OFBiz &lt;form method=&quot;POST&quot; id=&quot;xsrf&quot; name=&quot;xsrf&quot; action=&quot;https://127.0.0.1:8443/catalog/control/createProduct&quot;&gt; &lt;input type=hidden name=&quot;isCreate&quot; value=&quot;true&quot;&gt; &lt;input type=hidden name=&quot;productId&quot; value=&quot;hack02&quot;&gt; &lt;input type=hidden name=&quot;productTypeId&quot; value=&quot;DIGITAL_GOOD&quot;&gt; &lt;input type=hidden name=&quot;internalName&quot; value=&quot;hack02&lt;script&gt;alert(document.cookie)&lt;/script&gt;&quot;&gt; &lt;/form&gt; &lt;script&gt;document.xsrf.submit(); &lt;/script&gt; CWE-352: Apache OFBiz 56 of 59

174. Implement AJAX functionalities with secure libraries such as DWR-2.0 (Direct Web Remoting) that automatically prevents XSRFCWE-352: XSRF Mitigation 57 of 59

175. http://www.integratingweb.com http://antisnatchor.com Browser Exploitation discussion1. Google and China, Internet Explorer bugs2. ScreenCast: Browser Exploitationwith BeEF and Metasploit Browser Exploitation 58 of 59

176. http://www.integratingweb.com http://antisnatchor.com Thanks for your attention!Take a look at: http://antisnatchor.com Questions? 59 of 59