.NET Web Services Hacking – Scan, Attacks and Defense Shreeraj Shah Founder & Director, Blueinfy [email_address] 91+987-90...
Who am I? <ul><li>Founder & Director </li></ul><ul><ul><li>Blueinfy Solutions Pvt. Ltd. (Brief) </li></ul></ul><ul><li>Pas...
Agenda <ul><li>Web Services in an era of Web 2.0 </li></ul><ul><li>.NET Web Services Assessment Methodology </li></ul><ul>...
Web Services on the rise with Web 2.0 <ul><li>80% of companies are investing in Web Services as part of their Web 2.0 init...
Web Services and Web 2.0 HTML / JS / DOM RIA (Flash) Ajax Browser Internet Blog Local Application  Database Authentication...
Widget DOM HTML/CSS JavaScript SOAP XML-RPC JSON XML Open APIs SaaS Services REST Browser Protocols Consuming Web Services...
Methodology Footprinting & Discovery Enumeration & Profiling Vulnerability Detection Code / Config Scanning Web Services F...
Footprinting and Discovery <ul><li>Objective: Discovering Web Services running on application domain. </li></ul><ul><li>Me...
Primary Discovery <ul><li>Crawling the application and mapping file extensions and directory structures, like “.asmx” </li...
Primary Discovery - Demos <ul><li>Page scanning with grep – Look in JavaScripts for URLs, Paths etc. </li></ul><ul><li>Cra...
Secondary Discovery <ul><li>Searching UDDI server for Web Services running on particular domain. </li></ul><ul><ul><li>Thr...
Enumerating and Profiling  <ul><li>Fingerprinting .Net framework and Client side technologies – Dojo or Atlas … </li></ul>...
Risk - In transit  <ul><li>In transit Sniffing or Spoofing </li></ul><ul><li>WS-Routing security concern  </li></ul><ul><l...
Risk - Web services Engine <ul><li>Buffer overflow </li></ul><ul><li>XML parsing attacks </li></ul><ul><li>Spoiling Schema...
Web services Deployment - Risk <ul><li>Fault code leaks </li></ul><ul><li>Permissions & Access issues </li></ul><ul><li>Po...
Web services User code - Risk <ul><li>Parameter tampering </li></ul><ul><li>WSDL probing </li></ul><ul><li>SQL/LDAP/XPATH/...
Scanning strategies <ul><li>Manual invocation and response analysis. </li></ul><ul><li>Dynamic proxy creation and scanning...
A1 - Cross Site Scripting (XSS) <ul><li>XSS is possible through Web Services. </li></ul><ul><li>It would be DOM based XSS ...
A2 - Injection Flaws <ul><li>Web Services methods are consuming parameters coming from end users. </li></ul><ul><li>It is ...
A3 - Malicious File Execution  <ul><li>Malicious command can be injected through the parameter. </li></ul><ul><li>WS suppo...
A4 - Insecure Direct Object Reference <ul><li>Injecting characters to break file system sequences. </li></ul><ul><li>Fault...
A5 - Cross Site Request Forgery (CSRF) <ul><li>CSRF with XML streams </li></ul><ul><li>XML-RPC or SOAP based request can b...
A6 - Information Leakage and Improper Error Handling <ul><li>SOAP based Web Services throws faultcode and faultstrings bac...
A7 - Broken Authentication and Session Management <ul><li>Web Services are having session management binding. </li></ul><u...
A8/A9 - Insecure Cryptographic and Communication  <ul><li>Implementation of WSE security </li></ul><ul><li>Web Services tr...
A10 - Failure to Restrict URL Access <ul><li>In Web Services instead of URL – methods. </li></ul><ul><li>WSDL scanning and...
Code Analysis for Web Services <ul><li>Scanning the code base. </li></ul><ul><li>Identifying linkages. </li></ul><ul><li>M...
<ul><li>Regular firewall will not work </li></ul><ul><li>Content filtering on HTTP will not work either since it is SOAP o...
IIS Web Server HTTP Stack .Net Web Services IIS Web Server web2wall Web Services Client SOAP Envelope Reject Rules for SOA...
.Net Web Services .asmx file IIS web server web2wall Web Services Client SOAP Input Envelope <soap:Body soap:encodingStyle...
HTTP Stack for IIS Request IIS aspnet_isapi.dll HttpApplication HttpHandler HttpModule HttpModule HttpModule Response Web ...
HTTP Stack HttpRuntime HttpApplicationFactory   HttpApplication HttpHandlerFactory HttpContext IHttpModule Handler HttpReq...
HTTP Stack for .Net HttpRuntime HttpApplicationFactory   HttpApplication HttpHandlerFactory IHttpModule Handler Web Applic...
IHTTPModule for Web Services Firewall <ul><li>Code walkthrough – Events and Hooks </li></ul><ul><li>Loading the DLL </li><...
Conclusion <ul><li>Web Services can be vulnerable to various attack vectors. </li></ul><ul><li>Footprinting and Discovery ...
.NET Web Services Hacking – Scan, Attacks and Defense Thanks!
Upcoming SlideShare
Loading in …5
×

AppSec 2007 - .NET Web Services Hacking

9,345 views

Published on

Published in: Technology
0 Comments
1 Like
Statistics
Notes
  • Be the first to comment

No Downloads
Views
Total views
9,345
On SlideShare
0
From Embeds
0
Number of Embeds
4,169
Actions
Shares
0
Downloads
115
Comments
0
Likes
1
Embeds 0
No embeds

No notes for slide

AppSec 2007 - .NET Web Services Hacking

  1. 1. .NET Web Services Hacking – Scan, Attacks and Defense Shreeraj Shah Founder & Director, Blueinfy [email_address] 91+987-902-7018
  2. 2. Who am I? <ul><li>Founder & Director </li></ul><ul><ul><li>Blueinfy Solutions Pvt. Ltd. (Brief) </li></ul></ul><ul><li>Past experience </li></ul><ul><ul><li>Net Square, Chase, IBM & Foundstone </li></ul></ul><ul><li>Interest </li></ul><ul><ul><li>Web security research </li></ul></ul><ul><li>Published research </li></ul><ul><ul><li>Articles / Papers – Securityfocus, O’erilly, DevX, InformIT etc. </li></ul></ul><ul><ul><li>Tools – wsScanner, scanweb2.0, AppMap, AppCodeScan, wsChess etc. </li></ul></ul><ul><ul><li>Advisories - .Net, Java servers etc. </li></ul></ul><ul><li>Books (Author) </li></ul><ul><ul><li>Hacking Web Services (Thomson 2006) </li></ul></ul><ul><ul><li>Web Hacking (AWL 2003) </li></ul></ul><ul><ul><li>Web 2.0 Security (Work in progress) </li></ul></ul>http://shreeraj.blogspot.com [email_address] Tools – http://www.blueinfy.com/tools.html
  3. 3. Agenda <ul><li>Web Services in an era of Web 2.0 </li></ul><ul><li>.NET Web Services Assessment Methodology </li></ul><ul><ul><li>Footprinting and Discovery </li></ul></ul><ul><ul><li>Enumeration, Profiling and Fingerprinting </li></ul></ul><ul><ul><li>Attack Vectors </li></ul></ul><ul><ul><li>Scanning and Fuzzing </li></ul></ul><ul><li>.NET Web Services Defense Methodology </li></ul><ul><ul><li>Code Scanning & Secure Coding </li></ul></ul><ul><ul><li>Web Services Firewall (Content Filtering) </li></ul></ul><ul><li>Conclusion </li></ul>
  4. 4. Web Services on the rise with Web 2.0 <ul><li>80% of companies are investing in Web Services as part of their Web 2.0 initiative (McKinsey2007 Global Survey) </li></ul><ul><li>By the end of 2007, 30 percent of large companies will have some kind of Web 2.0-based business initiative up and running. (Gartner) </li></ul><ul><li>2008. Web Services or Service-Oriented Architecture (SOA) would surge ahead. (Gartner) </li></ul>
  5. 5. Web Services and Web 2.0 HTML / JS / DOM RIA (Flash) Ajax Browser Internet Blog Local Application Database Authentication Internet Weather News Documents Emails Bank/Trade RSS feeds Web Services
  6. 6. Widget DOM HTML/CSS JavaScript SOAP XML-RPC JSON XML Open APIs SaaS Services REST Browser Protocols Consuming Web Services Ajax Flash / RIA JSON-RPC Structures Server-Side HTTP(S)
  7. 7. Methodology Footprinting & Discovery Enumeration & Profiling Vulnerability Detection Code / Config Scanning Web Services Firewall Secure Coding Insecure Web Services Secure Web Services Blackbox Whitebox Defense & Countermeasure
  8. 8. Footprinting and Discovery <ul><li>Objective: Discovering Web Services running on application domain. </li></ul><ul><li>Methods </li></ul><ul><ul><li>Primary discovery </li></ul></ul><ul><ul><ul><li>Crawling and spidering </li></ul></ul></ul><ul><ul><ul><li>Script analysis and page scrubbing </li></ul></ul></ul><ul><ul><ul><li>Traffic analysis </li></ul></ul></ul><ul><ul><li>Secondary discovery </li></ul></ul><ul><ul><ul><li>Search engine queries </li></ul></ul></ul><ul><ul><ul><li>UDDI scanning </li></ul></ul></ul>
  9. 9. Primary Discovery <ul><li>Crawling the application and mapping file extensions and directory structures, like “.asmx” </li></ul><ul><li>Page scrubbing – scanning for paths and resources in the pages, like atlas back end call to Web Services. </li></ul><ul><li>Recording traffic while browsing and spidering, look for XML based traffic – leads to XML-RPC, REST, SOAP, JSON calls. </li></ul>
  10. 10. Primary Discovery - Demos <ul><li>Page scanning with grep – Look in JavaScripts for URLs, Paths etc. </li></ul><ul><li>Crawling – Simple! </li></ul><ul><li>Scanning for Atlas references – Framework creates stubs and proxy. – scanweb2.0/scanatlas </li></ul><ul><li>Urlgrep can be used as well. </li></ul>Demo
  11. 11. Secondary Discovery <ul><li>Searching UDDI server for Web Services running on particular domain. </li></ul><ul><ul><li>Three tactics for it – business, services or tModel. </li></ul></ul><ul><li>Running queries against search engines like Google or MSN with extra directives like “inurl” or “filetype” </li></ul><ul><ul><li>Look for “asmx” </li></ul></ul><ul><li>wsScanner – Discovery! </li></ul>Demo
  12. 12. Enumerating and Profiling <ul><li>Fingerprinting .Net framework and Client side technologies – Dojo or Atlas … </li></ul><ul><li>Scanning WSDL </li></ul><ul><ul><li>Looking for Methods </li></ul></ul><ul><ul><li>Collecting In/Out parameters </li></ul></ul><ul><ul><li>Security implementations </li></ul></ul><ul><ul><li>Binding points </li></ul></ul><ul><ul><li>Method signature mapping </li></ul></ul>Demo
  13. 13. Risk - In transit <ul><li>In transit Sniffing or Spoofing </li></ul><ul><li>WS-Routing security concern </li></ul><ul><li>Replay attacks </li></ul>
  14. 14. Risk - Web services Engine <ul><li>Buffer overflow </li></ul><ul><li>XML parsing attacks </li></ul><ul><li>Spoiling Schema </li></ul><ul><li>Complex or Recursive structure as payload </li></ul><ul><li>Denial of services </li></ul><ul><li>Large payload </li></ul>
  15. 15. Web services Deployment - Risk <ul><li>Fault code leaks </li></ul><ul><li>Permissions & Access issues </li></ul><ul><li>Poor policies </li></ul><ul><li>Customized error leakage </li></ul><ul><li>Authentication and Certification </li></ul>
  16. 16. Web services User code - Risk <ul><li>Parameter tampering </li></ul><ul><li>WSDL probing </li></ul><ul><li>SQL/LDAP/XPATH/OS command injection </li></ul><ul><li>Virus/Spyware/Malware injection </li></ul><ul><li>Bruteforce </li></ul><ul><li>Data type mismatch </li></ul><ul><li>Content spoofing </li></ul><ul><li>Session tampering </li></ul><ul><li>Format string </li></ul><ul><li>Information leakage </li></ul><ul><li>Authorization </li></ul>
  17. 17. Scanning strategies <ul><li>Manual invocation and response analysis. </li></ul><ul><li>Dynamic proxy creation and scanning. </li></ul><ul><li>Auto auditing for various vectors. </li></ul><ul><li>Fuzzing Web Services streams – XML or JSON </li></ul><ul><li>Response analysis is the key </li></ul><ul><ul><li>Look for fault code nodes </li></ul></ul><ul><ul><li>Enumerating fault strings </li></ul></ul><ul><ul><li>Dissecting XML message and finding bits </li></ul></ul><ul><ul><li>Hidden error messages in JSON </li></ul></ul>Demo
  18. 18. A1 - Cross Site Scripting (XSS) <ul><li>XSS is possible through Web Services. </li></ul><ul><li>It would be DOM based XSS via eval(). </li></ul><ul><li>JSON-RPC based stream coming in the browser and get injected into DOM. </li></ul><ul><li>Source of stream can be of third party and Un-trusted. </li></ul><ul><li>XML streams coming in the browser and can cause XSS via document.write call. </li></ul>Demo
  19. 19. A2 - Injection Flaws <ul><li>Web Services methods are consuming parameters coming from end users. </li></ul><ul><li>It is possible to inject malicious characters into the stream. </li></ul><ul><li>It can break Web Services code and send faultsting back to an attacker </li></ul><ul><li>Various injections possible – SQL and XPATH </li></ul>Demo
  20. 20. A3 - Malicious File Execution <ul><li>Malicious command can be injected through the parameter. </li></ul><ul><li>WS supports attachments as well and that can lead to uploading a file. </li></ul><ul><li>This can give remote command execution capability to the attacker. </li></ul>Demo
  21. 21. A4 - Insecure Direct Object Reference <ul><li>Injecting characters to break file system sequences. </li></ul><ul><li>Faultcode spits out internal information if not protected. </li></ul><ul><li>Customized error shows the file refernces. </li></ul><ul><li>Access to internal file and full traversal to directories </li></ul><ul><li>Inspecting methods and parameters in the profile stage can help. </li></ul>Demo
  22. 22. A5 - Cross Site Request Forgery (CSRF) <ul><li>CSRF with XML streams </li></ul><ul><li>XML-RPC or SOAP based request can be generated from browsers. </li></ul><ul><li>Splitting form and XML injection is possible – interesting trick. </li></ul><ul><li>If Content-Type is not validated on the server then it can cause a potential CSRF. </li></ul><ul><li>XForms usage in browser can produce XML requests to attack CSRF. </li></ul>Demo
  23. 23. A6 - Information Leakage and Improper Error Handling <ul><li>SOAP based Web Services throws faultcode and faultstrings back to the client. </li></ul><ul><li>Information can be embedded in it. </li></ul><ul><li>It try/catch is not well implemented then default error from .NET framework. </li></ul><ul><li>Published vulnerabilities with leakage information providing references to file, ldap, etc. </li></ul>Demo
  24. 24. A7 - Broken Authentication and Session Management <ul><li>Web Services are having session management binding. </li></ul><ul><li>It is possible to have methods supporting session in .NET </li></ul><ul><li>Session identifier disclosure can lead to hijacking of Web Services </li></ul><ul><li>SOAP message can be bruteforce as well – poor passwords and multiple trial </li></ul><ul><li>WS-Security can be used around it </li></ul>
  25. 25. A8/A9 - Insecure Cryptographic and Communication <ul><li>Implementation of WSE security </li></ul><ul><li>Web Services traffic not going over SSL </li></ul><ul><li>XML-Security or nodes encryption – if cracked or decrypt </li></ul><ul><li>Sessions are established on the tokens, goes over wire in clear text </li></ul><ul><li>Analysis needs to be done in the case of mashup and API calls. </li></ul><ul><li>Several applications and widgets are making backend API calls in clear text (user/pass) </li></ul>
  26. 26. A10 - Failure to Restrict URL Access <ul><li>In Web Services instead of URL – methods. </li></ul><ul><li>WSDL scanning and disclosures can weaken the Services. </li></ul><ul><li>Some internal methods are out in public. </li></ul><ul><li>Admin APIs can be accessed. </li></ul><ul><li>These internal methods can be used to attack Web Services. </li></ul>
  27. 27. Code Analysis for Web Services <ul><li>Scanning the code base. </li></ul><ul><li>Identifying linkages. </li></ul><ul><li>Method signatures and inputs. </li></ul><ul><li>Looking for various patterns for SQL, LDAP, XPATH, File access etc. </li></ul><ul><li>Checking validation on them. </li></ul><ul><li>Code walking and tracing the base - Key </li></ul>Demo
  28. 28. <ul><li>Regular firewall will not work </li></ul><ul><li>Content filtering on HTTP will not work either since it is SOAP over HTTP/HTTPS </li></ul><ul><li>SOAP level filtering and monitoring would require </li></ul><ul><li>ISAPI level filtering is essential </li></ul><ul><li>SOAP content filtering through IHTTPModule </li></ul>Code filtering with IHTTPModule
  29. 29. IIS Web Server HTTP Stack .Net Web Services IIS Web Server web2wall Web Services Client SOAP Envelope Reject Rules for SOAP Code filtering with IHTTPModule
  30. 30. .Net Web Services .asmx file IIS web server web2wall Web Services Client SOAP Input Envelope <soap:Body soap:encodingStyle=&quot;http://schemas.xmlsoap.org/soap/encoding/&quot;> <q1:getInput xmlns:q1=&quot;http://DefaultNamespace&quot;> <id xsi:type=&quot;xsd:string&quot;>12123</id> </q1:getInput> </soap:Body> DB <id xsi:type=&quot;xsd:string&quot;>12123</id> id=12123 Bal=$2500 <ns1:getInputReturn xsi:type=&quot;xsd:string&quot;> $2500 </ns1:getInputReturn> SOAP Output Envelope Code filtering with IHTTPModule
  31. 31. HTTP Stack for IIS Request IIS aspnet_isapi.dll HttpApplication HttpHandler HttpModule HttpModule HttpModule Response Web Application Resource Web Application Client 146
  32. 32. HTTP Stack HttpRuntime HttpApplicationFactory HttpApplication HttpHandlerFactory HttpContext IHttpModule Handler HttpRequest HttpResponse IHttpHandler 147
  33. 33. HTTP Stack for .Net HttpRuntime HttpApplicationFactory HttpApplication HttpHandlerFactory IHttpModule Handler Web Application Firewall & IDS 148
  34. 34. IHTTPModule for Web Services Firewall <ul><li>Code walkthrough – Events and Hooks </li></ul><ul><li>Loading the DLL </li></ul><ul><li>Setting up the rules </li></ul><ul><li>Up and running! </li></ul><ul><li>Demo. </li></ul>Demo
  35. 35. Conclusion <ul><li>Web Services can be vulnerable to various attack vectors. </li></ul><ul><li>Footprinting and Discovery are start points. </li></ul><ul><li>Scanning and Auditing can help in finding holes. </li></ul><ul><li>Fuzzing is also important aspect. </li></ul><ul><li>Top 10 – OWASP, for Web Services </li></ul><ul><li>Scanning the code is equally important. </li></ul><ul><li>Web Services Firewall – Armoring the app. </li></ul>
  36. 36. .NET Web Services Hacking – Scan, Attacks and Defense Thanks!

×