Module 15

Hacking Web
Application
Ansh Bhawnani
Web Application
Concepts

Module 15
1. Introduction

Module 15
Web Application Concepts

▰ Web applications provide an interface between end users and web servers
through a set of web pages that are generated at the server end or contain
script code to be executed dynamically within the client web browser.
▰ Though web application enforce certain security policies, they are vulnerable
to various attacks such as SQL injection, cross-site scripting, session
hijacking, etc.
▰ Web technologies such as Web 2.0 provide more attack surface for web
application exploitation.
▰ Web applications and Web 2.0 technologies are invariably used to support
critical business functions such as CRM, SCM, etc. and improve business
efficiency.
4
Web Application Concepts

5
2. Web Application
Components

Module 15
Web Application Concepts

7
3. Web Application
Architecture

Module 15
Web Application Concepts

9
4. Web 2.0
Applications

Module 15
Web Application Concepts

▰ Web 2.0 refers to a generation of Web applications that provide an infrastructure for
more dynamic user participation, social interaction and collaboration.
▰ It offers various features such as:
▻ Interoperability:
▻ Advanced gaming
▻ Dynamic as opposed to static site content
▻ User-centered Design:
▻ Social networking sites (Flickr, Facebook, [Link])
▻ Wikis and other collaborative applications
▻ Google Base and other free web services (Google Maps) 11
Web Application Concepts

▰ Collaboration on the Web:

▻ Online office software (Google Docs and Microsoft Light)
▻ Interactive encyclopedias and dictionaries
▻ Cloud computing websites such as [Link]
▰ Interactive Data Sharing:
▻ Frameworks (Yahoo! Ul Library, jQuery)
▻ Mobile application (iPhone)
▻ New technologies like AJAX (Gmail, YouTube)
▻ Blogs (Wordpress)
12
5. Vulnerability
Stack

Module 15
Web Application Concepts

14
Web Application
Attack Methodology

Module 15
1. Footprint Web
Infrastructure

Module 15
Web Application Attack Methodology

▰ Web infrastructure footprinting is the first step in web application hacking; it

helps attackers to select victims and identify vulnerable web applications.
▰ Server Discovery: Discover the physical servers that hosts web application.
▰ Service Discovery: Discover the services running on web servers that can be
exploited as attack paths for web app hacking.
▰ Server Identification: Grab server banners to identify the make and version of
the web server software.
▰ Hidden Content Discovery: Extract content and functionality that is not directly
linked or reachable from the main visible content.
17
Web Application Attack Methodology

▰ Server Discovery
▻ Server discovery gives information about the location of servers and ensures that
the target server is alive on Internet.
▻ Whois Lookup: Whois lookup utility gives information about the IP address of web
server and DNS names
▻ DNS Interrogation: DNS interrogation provides information about the location and
type of servers
▻ Port Scanning: Port Scanning attempts to connect to a particular set of TCP or
UDP ports to find out the service that exists on the server.
▻ Scan the target web server to identify common ports that web servers use
for different services.
18
Web Application Attack Methodology

▻ Tools used for service discovery:

▻ Nmap
▻ NetScan Tools Pro
▻ Sandcat Browser
▻ Identified services act as attack paths for web application hacking.

19
Web Application Attack Methodology

20
Web Application Attack Methodology

▰ Server Identification/Banner Grabbing

▻ Analyze the server response header field to identify the make, model and version
of the web server software.
▻ Syntax: C:\telnet Website URL or IP address 80
▻ Run command s_client -host [target website] -port 443
▻ [Link]
▻ Type GET / HTTP/1.0 to get the server information
▻ Banner Grabbing Tools:
▻ Telnet, Netcat, ID Serve, Netcraft
21
Web Application Attack Methodology

▰ Detecting Proxies:
▻ Determine whether your target site is routing your requests through a
proxy servers.
▻ Proxy servers generally add certain headers in the response header field.
▻ Use TRACE method of HTTP/1.1 to identify the changes the proxy server
made to the request.

22
Web Application Attack Methodology

▰ Detecting Web App Firewall:

▻ Web Application Firewall (WAF) prevents web application attack by
analyzing HTTP traffic.
▻ Determine whether your target site is running web app firewall in front of
an web application.
▻ Check the cookies response of your request because most of the WAFs
add their own cookie in the response.
▻ Use WAF detection tools such as WAFW00F to find which WAF is running
in front of application.
23
Web Application Attack Methodology

▰ Hidden Content Discovery

▻ Discover the hidden content and functionality that is not reachable from
the main visible content to exploit user privileges within the application.
▻ It allows an attacker to recover backup copies of live files, configuration
files and log files containing sensitive data, backup archives containing
snapshots of files within the web root, new functionality which is not
linked to the main application, etc.

24
Web Application Attack Methodology

▰ Web Spidering:
▻ Web spiders automatically discover the hidden content and functionality
by parsing HTML form the client-side JavaScript requests and responses.
▻ Web Spidering Tools:
▻ OWASP Zed Attack Proxy
▻ Burp Suite
▻ WebScarab

25
Web Application Attack Methodology

▰ Attacker-Directed Spidering:
▻ Attacker accesses all of the application's functionality and uses an
intercepting proxy to monitor all requests and responses.
▻ The intercepting proxy parses all of the application's responses and
reports the content and functionality it discovers.
▻ Tool: OWASP Zed Attack Proxy, Burpsuite
▰ Brute-Forcing:
▻ Use automation tools such as Burp Suite to make huge numbers of
requests to the web server in order to guess the names or identifiers of
hidden content and functionality.
26
Web Application Attack Methodology

▰ Web Spidering Using Burp Suite

▻ Configure your web browser to use Burp as a local proxy.
▻ Access the entire target application visiting every single link/URL
possible, and submit all the application forms available.
▻ Browse the target application with JavaScript enabled and disabled, and
with cookies enabled and disabled.
▻ Check the site map generated by the Burp proxy, and identify any hidden
application content or functions.
▻ Continue these steps recursively until no further content or functionality
is identified. 27
2. Attacking Web
Servers

Module 15
Web Application Attack Methodology

▰ Scan the server for known vulnerabilities using any web server vulnerability scanner.
▰ Launch web server attack to exploit identified vulnerabilities.
▰ Tools used:
▻ UrlScan
▻ Nikto
▻ Nessus
▻ Acunetix Web Vulnerability
▻ WebInspect
▰ Launch Denial-of-Service (DoS) against web server.
▻ DoSHTTP, Hping, Loci and Xoic, SYN Flooding, Slowloris, DRDos. 29
3. Analyze Web
Application

Module 15
Web Application Attack Methodology

▰ Analyze the active application's functionality and technologies in order to identify the
attack surfaces that it exposes.
▰ Identify Entry Points for User Input: Review the generated HTTP request to identify the
user input entry points.
▰ Identify Server-Side Functionality: Observe the applications revealed to the client to
identify the server-side structure and functionality. [Common Gateway Interface (CGI)]
▰ Identify Server-Side Technologies: Fingerprint the technologies active on the server
using various fingerprint techniques such as HTTP fingerprinting.
▻ ASP, [Link], ColdFusion, JSP, PHP, Python, and Ruby on Rails.
▰ Map the Attack Surface: Identify the various attack surfaces uncovered by the
applications and the vulnerabilities that are associated with each one.
31
Web Application Attack Methodology

▰ Identify Entry Points for User Input

▻ Examine URL, HTTP Header, query string parameters, POST data, and cookies to
determine all user input fields.
▻ Identify HTTP header parameters that can be processed by the application as user
inputs such as User-Agent, Referer, Accept, Accept-Language, and Host headers.
▻ Determine URL encoding techniques and other encryption measures implemented
to secure the web traffic such as SSL.
▻ Tools used:
▻ Burp Suite, HttPrint, WebScarab, OWASP Zed Attack Proxy

32
Web Application Attack Methodology

▰ Identify Server-Side Technologies

▻ Perform a detailed server fingerprinting, analyze HTTP headers and HTML source
code to identify server side technologies.
▻ Examine URLs for file extensions, directories, and other identification information.
▻ Examine the error page messages.
▻ Examine session tokens:
▻ JSESSIONID - Java
▻ ASPSESSIONID - IIS server
▻ ASP.NET_SessionId - [Link]
▻ PHPSESSID - PHP 33
Web Application Attack Methodology

▰ Identify Server-Side Functionality

▻ Examine page source and URLs and make an educated guess to determine the
internal structure and functionality of web applications.
▻ Tools used:
▻ GUN Wget, Teleport Pro, BlackWidow
▻ Examine URL:
▻ [Link]
sActive=O&startDate=20%2F11%2F2010&endDate=20%2F05%2F2011&s
howBy=name
▻ https: SSL
▻ aspx: ASPX | Platform 34
Web Application Attack Methodology

35
4. Attack
Authentication
Mechanism
Module 15
Web Application Attack Methodology

▰ Attackers can exploit design and implementation flaws in web applications,

such as failure to check password strength or insecure transportation of
credentials, to bypass authentication mechanisms.
▰ User Name Enumeration:
▻ Verbose failure messages
▻ Predictable user names
▰ Cookie Exploitation:
▻ Cookie poisoning
▻ Cookie sniffing
▻ Cookie replay 37
Web Application Attack Methodology

▰ Session Attacks:
▻ Session prediction
▻ Session brute-forcing
▻ Session poisoning
▰ Password Attacks:
▻ Password functionality exploits
▻ Password guessing
▻ Brute-force attack
38
Web Application Attack Methodology

▰ User Name Enumeration

▻ If login error states which part of the user name and password is not
correct, guess the users of the application using the trial-and-error
method.
▻ Some applications automatically generate account user names based on
a sequence (such as user101, user102, etc.), and attackers can
determine the sequence and enumerate valid user names.
▻ Note: User name enumeration from verbose error messages will fail if the
application implements account lockout policy i.e., locks account after a
certain number of failed login attempt.
39
Web Application Attack Methodology

▰ Password Functionality Exploits

▻ Password Changing:
▻ Determine password change functionality within the application by
spidering the application or creating a login account.
▻ Try random strings for 'Old Password', 'New Password', and
'Confirm the New Password' fields and analyze errors to identify
vulnerabilities in password change functionality.

40
Web Application Attack Methodology

▰ Password Recovery:
▻ Forgot Password' features generally present a challenge to the user; if the number
of attempts is not limited, attacker can guess the challenge answer successfully
with the help of social engineering.
▻ Applications may also send a unique recovery URL or existing password to an
email address specified by the attacker if the challenge is solved.
▰ "Remember Me" Exploit:
▻ "Remember Me" functions are implemented using a simple persistent cookie, such
as RememberUser=jason or a persistent session identifier such as
RememberUser=ABY112010.
▻ Attackers can use an enumerated user name or predict the session identifier to
bypass authentication mechanisms. 41
Web Application Attack Methodology

▰ Cookie Exploitation: Cookie Poisoning

▻ If the cookie contains passwords or session identifiers, attackers can
steal the cookie using techniques such as script injection and
eavesdropping.
▻ Attackers then replay then cookie with the same or altered passwords or
session identifiers to bypass web application authentication.
▻ Attackers can trap cookies using tools such as OWASP Zed Attack Proxy,
Burp Suite, etc.

42
5. Attack
Authorization
Schemes
Module 15
Web Application Attack Methodology

▰ Authorization Attack
▻ Attackers manipulate the HTTP requests to subvert the application authorization
schemes by modifying input fields that relate to user ID, user name, access group,
cost, filenames, file identifiers, etc.
▻ Attackers first access web application using low privileged account and then
escalate privilege to access protected resources.
▻ Attackers use sources such as the following to perform authorization attacks:
▻ Parameter Tampering, POST Data, Uniform Resource Identifier, HTTP
Headers, Cookies, Hidden Tags

44
Web Application Attack Methodology

▰ HTTP Request Tampering

▻ Query String Tampering:
▻ If the query string is visible in the address bar on the browser, the attacker
can easily change the string parameter to bypass authorization
mechanisms.
▻ [Link]
0com
▻ [Link]
▻ [Link]
▻ Attackers can use web spidering tools such as Burp Suite to scan the web app for
POST parameters. 45
Web Application Attack Methodology

▰ HTTP Headers:
▻ If the application uses the Referer header for making access control decisions,
attackers can modify it to access protected application functionalities.
GET [Link] HTTP/1.1
Host: janaina:8180
...
Referer: [Link]
▻ ItemID=201 is not accessible as Admin parameter is set to false, attacker can
change it to true and access protected items.
46
Web Application Attack Methodology

▰ Cookie Parameter Tampering

▻ In the first step, the attacker collects some cookies set by the web
application and analyzes them to determine the cookie generation
mechanism.
▻ The attacker then traps cookies set by the web application, tampers with
its parameters using tools, such as OWASP Zed Attack Proxy, and replay
to the application.

47
6. Attack Session
Management
Mechanism
Module 15
Web Application Attack Methodology

▰ Session Management Attack

▻ Attackers break an application's session management mechanism to bypass the
authentication controls and impersonate privileged application users.
▻ Session Token Generation:
▻ Session Tokens Prediction
▻ Session Tokens Tampering
▻ Session Tokens Handling:
▻ Man-In-The-Middle Attack
▻ Session Replay
▻ Session Hijacking 49
Web Application Attack Methodology

▰ Session Token Generation Mechanism

▻ Weak Encoding Example:
▻ [Link]
3D%6A%61%73%6F%6E%3B%61%70%70%3D%61%64%6D%69%6E%3B
%64%61%74%65%3D%32%33%2F%31%31%2F%32%30%31%30
▻ When hex-encoding of an ASCII string
user=jason;app=admin;date=23/11/2010, the attacker can predict another
session token by just changing date and use it for another transaction with
server.
50
Web Application Attack Methodology

▰ Session Token Prediction:

▻ Attackers obtain valid session token by sniffing the traffic or legitimately
logging into application and analyzing it for encoding (hex-encoding,
Base64) or any pattern.
▻ If any meaning can be reverse engineered from the sample of session
tokens, attackers attempt to guess the tokens recently issued to other
application users.
▻ Attackers then make a large number of requests with the predicted
tokens to a session-dependent page to determine a valid session token.

51
Web Application Attack Methodology

▰ Session Token Sniffing

▻ Attackers sniff the application traffic using a sniffing tool such as
Wireshark or an intercepting proxy such as Burp. If HTTP cookies are
being used as the transmission mechanism for session tokens and the
secure flag is not set, attackers can replay the cookie to gain
unauthorized access to application.
▻ Attacker can use session cookies to perform session hijacking, session
replay, and Man-in-the-Middle attacks.

52
7. Performing
Various Attacks

Module 15
Web Application Attack Methodology

▰ Injection Attacks/Input Validation Attacks (?)

▻ In injection attacks, attackers supply crafted malicious input that is syntactically
correct according to the interpreted language being used in order to break
application's normal intended functionality.
▻ Web Scripts Injection: If user input is used into dynamically executed code, enter
crafted input that breaks the intended data context and executes commands on
the server.
▻ OS Commands Injection: Exploit operating systems by entering malicious codes in
input fields if applications utilize user input in a system-level command.
▻ SMTP Injection: Injection arbitrary SMTP commands into application and SMTP
server conversation to generate large volumes of spam email.
54
Web Application Attack Methodology

▻ SQL Injection: Enter a series of malicious SQL queries into input fields to directly
manipulate the database.
▻ LDAP Injection: Take advantage of non-validated web application input
vulnerabilities to pass LDAP filters to obtain direct access to databases.
▻ XPath Injection: Enter malicious strings in input fields in order to manipulate the
XPath query so that it interferes with the application's logic.
▻ Buffer Overflow: Injections large amount of bogus data beyond the capacity of the
input field.
▻ Canonicalization: Manipulate variables that reference files with "dot-dot-slash (../)"
to access restricted directories in the application.
55
Web Application Attack Methodology

Attack Data Connectivity (?)

▻ Database connection strings are used to connect applications to database
engines.
▻ Example of a common connection string used to connect to a Microsofl SQL
Server database: "Data Source=Server, Port; Network Library=DBMSSOCN;
Initial Catalog=DataBase; User ID=Username; Password=pwd;"
▻ Database connectivity attacks exploit the way applications connect to the
database instead of abusing database queries.
▻ Data Connectivity Attacks:
▻ Connection String Injection
▻ Connection Pool DoS 56
Web Application Attack Methodology

▰ Connection String Injection

▻ In a delegated authentication environment, the attacker injects
parameters in a connection string by appending them with the semicolon
(;) character.
▻ A connection string injection attack can occur when a dynamic string
concatenation is used to build connection strings based on user input.
▻ Before Injection:
▻ "Data Source=Server, Port; Network Library=DBMSSOCN; Initial
Catalog=DataBase; User ID=Username; Password=pwd;"
57
Web Application Attack Methodology

▰ Connection String Injection

▻ After Injection:
▻ "Data Source=Server, Port; Network Library=DBMSSOCN; Initial
Catalog=DataBase; User ID=Username;
Password=pwd;Encryption=off"
▻ When the connection string is populated, the Encryption value will be
added to the previously configured set of parameters.

58
Web Application Attack Methodology

▰ Connection String Parameter Pollution (CSPP) Attacks

▻ In CSPP attacks, attackers overwrite parameter values in the connection string.
▻ Hash Stealing:
▻ Attacker replaces the value of Data Source parameter with that of a Rogue
Microsoft SQL Server connected to the Internet running a sniffer.
▻ Data source = SQL2005; initial catalog = db1; integrated security=no;
user id =;Data Source=Rogue Server;Password=;Integrated
Security=true;
▻ Attacker will then sniff Windows credentials (password hashes) when the
application tries to connect to Rogue_Server with the Windows credentials
it's running on.
59
Web Application Attack Methodology

▰ Port Scanning:
▻ Attacker tries to connect to different ports by changing the value and seeing the
error messages obtained.
▻ Data source = SQL2005; initial catalog = db1; integrated security=no; user id
=;Data Source=Target Server, Target Port=443;Password=;Integrated
Security=true;
▰ Hijacking Web Credentials:
▻ Attacker tries to connect to the database by using the Web Application System
account instead of a user-provided set of credentials.
▻ Data source = SQL2005; initial catalog = db1; integrated security=no; user id
=;Data Source=Target Server</span>, Target Port;Password=;Integrated
60
Security=true;
Web Application Attack Methodology

▰ Connection Pool DoS

▻ Attacker examines the connection pooling settings of the application, constructs a
large malicious SQL query, and runs multiple queries simultaneously to consume
all connections in the connection pool, causing database queries to fail for
legitimate users.
▻ Example: By default in [Link], the maximum allowed connections in the pool is
100 and timeout is 30 seconds.
▻ Thus, an attacker can run 100 multiple queries with 30+ seconds execution time
within 30 seconds to cause a connection pool DoS such that no one else would be
able to use the database-related parts of the application.

61
8. Attack Web App
Client

Module 15
Web Application Attack Methodology

▰ Attackers interact with the server-side applications in unexpected ways in order to

perform malicious actions against the end users and access unauthorized data.
▰ Cross-Site Scripting: An attacker bypasses the clients ID's security mechanism and
obtains access privileges, and then injects malicious scripts into the web pages of a
website. These malicious scripts can even rewrite the HTML content of the website.
▰ HTTP Header Injection: Attackers splits an HTTP response into multiple responses by
injecting a malicious response in an HTTP header. By doing so, attackers can deface
websites, poison the cache, and trigger cross-site scripting.
▰ Request Forgery Attack: In a request forgery attack, attackers exploit the trust of a
website or web application on a user's browser. The attack works by including a link on
a page, which takes the user to an authenticated website.
63
Web Application Attack Methodology

▰ Privacy Attacks: A privacy attack is tracking performed with the help of a remote site by
employing a leaked persistent browser state.
▰ Redirection Attacks: Attackers develop codes and links that resemble a legitimate site
that a user wants to visit; however, in so doing, the URL redirects the user to a malicious
website on which attackers could potentially obtain the user's credentials and other
sensitive information.
▰ Frame Injection: When scripts do not validate their input, attackers inject codes through
frames. This affects all the browsers and scripts, which do not validate untrusted input.
These vulnerabilities occur in HTML pages with frames. Another reason for this
vulnerability is that web browsers support frame editing.

64
Web Application Attack Methodology

▰ Session Fixation: Session fixation helps attackers hijack valid user sessions.
They authenticate themselves using a known session ID, and then use the
already known session ID to hijack a user-validated session. Thus, attackers
trick the users into accessing a genuine web server using an existing session
ID value.
▰ ActiveX Attacks: Attackers lure victims via email or via a link that attackers
have constructed in such a way that loopholes of remote execute code
become accessible, allowing the attackers to obtain access privileges equal to
that of an authorized user.

65
9. Attack Web
Services

Module 15
Web Application Attack Methodology

▰ Web services work atop the legacy web applications, and any attack on web
service will immediately expose an underlying application's business and logic
vulnerabilities for various attacks.
▰ Various types of attacks used to attack web services are:
▻ SOAP Injection
▻ XML Injection
▻ WSDL Probing Attacks
▻ Information Leakage
▻ Application Logic Attacks
67
▻ Database Attacks
Web Application Attack Methodology

▰ Probing Attacks
▻ The attacker traps the WSDL document from web service traffic and
analyzes it to determine the purpose of the application, functional break
down, entry points, and message types.
▻ Attacker then creates a set of valid requests by selecting a set of
operations, and formulating the request messages according to the rules
of the XML Schema that can be submitted to the web service.
▻ Attacker uses these requests to include malicious contents in SOAP
requests and analyzes errors to gain a deeper understanding of potential
security weaknesses.
68
Web Application Attack Methodology

▰ SOAP Injection
▻ Attacker injects malicious query strings in the user input field to bypass web
services authentication mechanisms and access backend databases.
▻ This attack works similarly to SQL Injection attacks.

69
Web Application Attack Methodology

▰ XML Injection (?)

▻ Attackers inject XML data and tags into user input fields to manipulate XML
schema or populate XML database with bogus entries.
▻ XML injection can be used to bypass authorization, escalate privileges, and
generate web services DoS attacks.

70
Web Application Attack Methodology

▰ Parsing Attacks
▻ Parsing attacks exploit vulnerabilities and weaknesses in the processing
capabilities of the XML parser to create a denial-of-service attack or
generate logical errors in web service request processing.
▻ Recursive Payloads: Attacker queries for web services with a
grammatically correct SOAP document that contains infinite processing
loops resulting in exhaustion of XML parser and CPU resources.
▻ Oversize Payloads: Attackers send a payload that is excessively large to
consume all systems resources rendering web services inaccessible to
other legitimate users.
71
Web Application Attack Methodology

▰ SoapUI and XMLSpy

▻ SoapUI:
▻ SoapUI is a web service testing tool which supports multiple
protocols such as SOAP, REST, HTTP, JMS, AMF, and JDBC.
▻ Attacker can use this tool to carry out web services probing, SOAP
injection, XML injection, and web services parsing attacks.
▻ XMLSpy:
▻ Altova XMLSpy is the XML editor and development environment for
modeling, editing, transforming, and debugging XML-related
technologies. 72
HACKING
Is an art, practised through a creative mind.

73