AppSec 2007 - .NET Web Services Hacking

.NET Web Services Hacking – Scan, Attacks and Defense Shreeraj Shah Founder & Director, Blueinfy [email_address] 91+987-902-7018

Who am I? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],http://shreeraj.blogspot.com [email_address] Tools – http://www.blueinfy.com/tools.html

Agenda ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Web Services on the rise with Web 2.0 ,[object Object],[object Object],[object Object]

Web Services and Web 2.0 HTML / JS / DOM RIA (Flash) Ajax Browser Internet Blog Local Application Database Authentication Internet Weather News Documents Emails Bank/Trade RSS feeds Web Services

Widget DOM HTML/CSS JavaScript SOAP XML-RPC JSON XML Open APIs SaaS Services REST Browser Protocols Consuming Web Services Ajax Flash / RIA JSON-RPC Structures Server-Side HTTP(S)

Methodology Footprinting & Discovery Enumeration & Profiling Vulnerability Detection Code / Config Scanning Web Services Firewall Secure Coding Insecure Web Services Secure Web Services Blackbox Whitebox Defense & Countermeasure

Footprinting and Discovery ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Primary Discovery ,[object Object],[object Object],[object Object]

Primary Discovery - Demos ,[object Object],[object Object],[object Object],[object Object],Demo

Secondary Discovery ,[object Object],[object Object],[object Object],[object Object],[object Object],Demo

Enumerating and Profiling ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Demo

Risk - In transit ,[object Object],[object Object],[object Object]

Risk - Web services Engine ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Web services Deployment - Risk ,[object Object],[object Object],[object Object],[object Object],[object Object]

Web services User code - Risk ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Scanning strategies ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Demo

A1 - Cross Site Scripting (XSS) ,[object Object],[object Object],[object Object],[object Object],[object Object],Demo

A2 - Injection Flaws ,[object Object],[object Object],[object Object],[object Object],Demo

A3 - Malicious File Execution ,[object Object],[object Object],[object Object],Demo

A4 - Insecure Direct Object Reference ,[object Object],[object Object],[object Object],[object Object],[object Object],Demo

A5 - Cross Site Request Forgery (CSRF) ,[object Object],[object Object],[object Object],[object Object],[object Object],Demo

A6 - Information Leakage and Improper Error Handling ,[object Object],[object Object],[object Object],[object Object],Demo

A7 - Broken Authentication and Session Management ,[object Object],[object Object],[object Object],[object Object],[object Object]

A8/A9 - Insecure Cryptographic and Communication ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

A10 - Failure to Restrict URL Access ,[object Object],[object Object],[object Object],[object Object],[object Object]

Code Analysis for Web Services ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Demo

[object Object],[object Object],[object Object],[object Object],[object Object],Code filtering with IHTTPModule

IIS Web Server HTTP Stack .Net Web Services IIS Web Server web2wall Web Services Client SOAP Envelope Reject Rules for SOAP Code filtering with IHTTPModule

.Net Web Services .asmx file IIS web server web2wall Web Services Client SOAP Input Envelope <soap:Body soap:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <q1:getInput xmlns:q1="http://DefaultNamespace"> <id xsi:type="xsd:string">12123</id> </q1:getInput> </soap:Body> DB <id xsi:type="xsd:string">12123</id> id=12123 Bal=$2500 <ns1:getInputReturn xsi:type="xsd:string"> $2500 </ns1:getInputReturn> SOAP Output Envelope Code filtering with IHTTPModule

HTTP Stack for IIS Request IIS aspnet_isapi.dll HttpApplication HttpHandler HttpModule HttpModule HttpModule Response Web Application Resource Web Application Client 146

HTTP Stack HttpRuntime HttpApplicationFactory HttpApplication HttpHandlerFactory HttpContext IHttpModule Handler HttpRequest HttpResponse IHttpHandler 147

HTTP Stack for .Net HttpRuntime HttpApplicationFactory HttpApplication HttpHandlerFactory IHttpModule Handler Web Application Firewall & IDS 148

IHTTPModule for Web Services Firewall ,[object Object],[object Object],[object Object],[object Object],[object Object],Demo

Conclusion ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

.NET Web Services Hacking – Scan, Attacks and Defense Thanks!

AppSec 2007 - .NET Web Services Hacking

AppSec 2007 - .NET Web Services Hacking

Recommended

More Related Content

What's hot

What's hot(20)

Similar to AppSec 2007 - .NET Web Services Hacking

Similar to AppSec 2007 - .NET Web Services Hacking(20)

More from Shreeraj Shah

More from Shreeraj Shah(9)

Recently uploaded

Recently uploaded(20)

AppSec 2007 - .NET Web Services Hacking