Web Application Security and Release of "WhiteHat Arsenal"

1,519 views

Published on

Discussion will include the theory surrounding some of the more dangerous web application attacks known, how to test for them quickly and determine possible countermeasures. Insecure and unprotected web applications are the fastest, easiest, and arguably the most utilized route to compromise networks and exploit users. It is for these very reasons that WhiteHat Security Inc., is pleased to introduce its new release, "WhiteHat Arsenal", the next generation of professional web security audit software.

WH Arsenal possesses a powerful suite of GUI-Browser based web security tools. These endowments make WH Arsenal capable of completing painstaking web security pen-test work considerably faster and more effectively than any of the currently available tools. Imagine employing WH Arsenal to quickly customize and execute just about any web security attack possible and having those penetration attempts logged in XML format for later reporting or analysis.

Many experienced web security professionals tend to agree that even the best current web security scanners, which scan only for known vulnerabilities, achieve only very limited success or simply do not work at all. Furthermore, these types of tools often result in an enormous overflow of false positives. WhiteHat understands these frustrating shortcomings and is poised to revolutionize the way in which web applications are penetration tested.

Published in: Technology
0 Comments
0 Likes
Statistics
Notes
  • Be the first to comment

  • Be the first to like this

No Downloads
Views
Total views
1,519
On SlideShare
0
From Embeds
0
Number of Embeds
89
Actions
Shares
0
Downloads
27
Comments
0
Likes
0
Embeds 0
No embeds

No notes for slide

Web Application Security and Release of "WhiteHat Arsenal"

  1. 1. <ul><li>Black Hat New Orleans </li></ul><ul><li>Windows Security 2002 </li></ul><ul><li>“ Web Application Security and Arsenal” </li></ul><ul><li>Presenter: Jeremiah Grossman </li></ul>Copyright 2002 WhiteHat Security All Rights Reserved
  2. 2. Topics <ul><li>Web Application Security Landscape </li></ul><ul><li>Why is Web Application Security Important </li></ul><ul><li>Common Web Application Security Mistakes </li></ul><ul><li>Web Application Attack Methodologies </li></ul>
  3. 3. Web Application Security Landscape Entertainment Message Boards WebMail Guest Books Voting Polls E-Commerce Shopping Auctions Banking Stock Trading Just Plain Crazy Printers PDA’s Cell Phones System Configuration .NET/Passport
  4. 4. Web Application The Simple Definition A web application or web service is a software application that is accessible using a web browser or HTTP(s) user agent.
  5. 5. Web Application The “EASIER” Definition If it runs on port 80 or port 443, then is probably a web application.
  6. 9. Why is Web Application Security Important? <ul><li>Easiest way to compromise hosts, networks and </li></ul><ul><li>users. </li></ul><ul><li>Widely deployed. </li></ul><ul><li>No Logs! (POST Request payload) </li></ul><ul><li>Incredibly hard to defend against or detect. </li></ul><ul><li>Most don’t think of locking down web applications. </li></ul><ul><li>Intrusion detection is a joke. </li></ul><ul><li>Firewall? What firewall? I don’t see no firewall… </li></ul><ul><li>Encrypted transport layer does nothing. </li></ul><ul><li>How much easier can it get!? Unicode. </li></ul>
  7. 10. Common Web Application Security Mistakes Trusting Client-Side Data Unescaped Special Characters HTML Output Character Filtering SUID ActiveX/JavaScript Authentication Lack of User Authentication before performing critical task.
  8. 11. Trusting Client-Side Data DO NOT TRUST CLIENT-SIDE DATA!!! Trusting client-side data is #1 cause of vulnerabilities. Identify all input parameters that trust client-side data.
  9. 12. Unescaped Special Characters The Level of Trust : Searches/Queries/Templates Path: http://foo.com/cgi?val=string&file=/html/name.db Or better yet… http://www.foo.com/cgi?string=root&file=../../../../../etc/passwd
  10. 13. Unescaped Special Characters ! @ $ % ^ & * ( ) -_ + ` ~ | [ ] { } ; : ' &quot; ? / , . > < Check for: Unescaped special characters within input strings
  11. 14. HTML Character Filtering Proper handling of special characters > => &gt; < => &lt; &quot; => &quot; & => &amp; Null characters should all be removed. %00
  12. 15. More mistakes… <ul><ul><li>SUID (Does a web application really need root?) </li></ul></ul><ul><li>Authentication mechanisms using technologies such </li></ul><ul><li>as JavaScript or ActiveX. </li></ul><ul><li>Lack of re-authenticating the user before issuing new </li></ul><ul><li>passwords or performing critical tasks. </li></ul><ul><li>Hosting of uncontrolled data on a protected domain. </li></ul>
  13. 16. WhiteHat Arsenal <ul><li>GUI Web-Based Interface </li></ul><ul><li>Session Based </li></ul><ul><li>Discovery Utilities </li></ul><ul><li>Active Assessment </li></ul><ul><li>Encoding/Decoding </li></ul><ul><li>Reporting </li></ul>
  14. 17. Web Application Penetration Methodologies Information Gathering & Discovery Input/Output Client-Side Data Manipulation
  15. 18. Information Gathering & Discovery <ul><li>Spidering /Site Map </li></ul><ul><li>Identifiable Characteristics </li></ul><ul><li>Error and Response Codes </li></ul><ul><li>File / Application Enumeration </li></ul>
  16. 19. Spidering
  17. 20. Spidering/Site Crawling <ul><li>Site Map </li></ul><ul><li>Service Map </li></ul><ul><li>Documentation </li></ul><ul><li>Hidden Services </li></ul><ul><li>CGI's and Forms </li></ul><ul><li>Email addresses </li></ul>
  18. 21. Identifiable Characteristics Comment Lines URL Extensions Meta Tags Cookies Client-Side scripting languages Enormous wealth of information about process flows, debug command, system types and configurations.
  19. 22. Error and Response Codes HTTP Response Headers Server: IBM/Apache 1.3.19 Cookie Characteristics Error Messages Exception Messages (Java / SQL) 404 Error Pages Failed Login Locked Account Database or file non-existent
  20. 23. File/Application Enumeration Commonly referred to as “forced browsing” or “CGI Scanning”.
  21. 24. File/Application Enumeration Sample Files Template Directories Temp or Backup files Hidden Files Vulnerable CGIs
  22. 25. Common Directories
  23. 26. Common Log Files
  24. 27. Common Backup Files
  25. 28. Input/Output Client-Side Data Manipulation URL Manipulation CGI Parameter Tampering HTTP Client-Header Injection Filter/Intrusion Detection Evasion Protocol/Method Manipulation Overflows
  26. 29. Input Manipulation Parameter Tampering &quot;Twiddling Bits.&quot; <ul><li>Cross-Site Scripting </li></ul><ul><li>Filter-Bypass Manipulation </li></ul><ul><li>OS Commands </li></ul><ul><li>Meta Characters </li></ul><ul><li>Path/Directory Traversal </li></ul><ul><li>Hidden Form Field Manipulation </li></ul><ul><li>HTTP Headers </li></ul>
  27. 30. Cross-Site Scripting Bad name given to a dangerous security issue Attack targets the user of the system rather than the system itself. Outside client-side languages executing within the users web environment with the same level of privilege as the hosted site.
  28. 31. Client-Side Scripting Languages DHTML (HTML, XHTML, HTML x.0) Opens all the doors. JavaScript (1.x) Browser/DOM Manipulation Java (Applets) Malicious Applets VBScript Browser/DOM Manipulation Flash Dangerous Third-Party Interactivity ActiveX Let me count the ways… XML/XSL Another Door Opener CSS Browser/DOM Manipulation
  29. 32. The Scenarios Trick a user to re-login to a spoofed page Compromise authentication credentials Load dangerous of malicious ActiveX Re-Direct a user or ALL users Crash the machine or the browser
  30. 33. CSS Danger “The Remote Launch Pad.” Successfully CSS a user via a protected domain. Utilizing a Client-Side utility (JavaScript, ActiveX, VBScript, etc.), exploit a browser hole to download a trojan/virus. User is unknowingly infected/compromised within a single HTTP page load. ActiveX Netcat Anyone?
  31. 34. 2 Types of CSS <ul><li>Click on a link to activate </li></ul><ul><li><A HREF=“http://www.evil_javascript_link”> </li></ul><ul><li>Click Here </li></ul><ul><li></A> </li></ul><ul><li>Auto-Execute by viewing HTML </li></ul><ul><ul><li><SCRIPT>run evil JavaScript</SCRIPT> </li></ul></ul>
  32. 35. Dangerous HTML “HTML Bad” <APPLET> Malicious Java Applications <BODY> Altering HTML Page Characteristics <EMBED> Embedding Third-Party Applications (Flash, etc.) <FRAME> Directly calling in other uncontrolled HTML <FRAMESET> Directly calling in other uncontrolled HTML <HTML> Altering HTML Page Characteristics <IFRAME> Directly calling in other uncontrolled HTML <IMG> SCRing Protocol attacks and other abuses <LAYER> Directly calling in other uncontrolled HTML <ILAYER> Directly calling in other uncontrolled HTML <META> META Refreshes. (Client-Redirects) <OBJECT> ActiveX (Nuff Said) <SCRIPT> JavaScript/VBScript Loading <STYLE> Style Sheet and Scripting Alterations
  33. 36. Dangerous Attributes “Attributes Bad” ATTRIBUTE DANGER LIST (Any HTML Tag that has these attributes) STYLE SRC HREF TYPE
  34. 37. Power of the Dots and Slashes piping input to the command line. Path Directory Traversal http://foo.com/app.cgi?directory=/path/to/data DotDot Slash: http://foo.com/app.cgi?dir=path/to/data../../../../etc/passwd Dot Slash: http://foo.com/app.cgi?dir=path/to/data../../../../etc/././passwd Double DotDot Slash: http://foo.com/app.cgi?dir=path/to/data....//….//….//etc/passwd
  35. 38. More Filter Bypassing Method Alteration (HEAD, PUT, POST, GET, ect.) URL Encode http://www.foo.com/cgi?value=%46%72%68%86 Null Characters http://www.foo.com/cgi?value=file%00.html More… Alternate Case, Unicode, String Length, Multi-Slash, etc.
  36. 39. Authentication & Session Management Brute/Reverse Force Session Hi-Jacking Session Replay Session Forgoing Page Sequencing
  37. 40. Reporting XML/HTML Based Manual Hack Attack Log w/ Descriptor Common Directory Force Browsing Common Log File Force Browsing Backup File Force Browsing Spider Log
  38. 41. Spider XML Log
  39. 42. Attempts XML Log
  40. 43. A few quick things to help secure a web application. <ul><li>Do Not Trust Client-Side Data </li></ul><ul><li>Escape and filter all input/output data </li></ul><ul><li>Set-up parameter and request method allow lists. Don’t use what your not expecting to receive. </li></ul>
  41. 44. Thank You! Questions? Jeremiah Grossman [email_address] WhiteHat Security All presentation updates will be available on www.whitehatsec.com and community.whitehatsec.com

×