Download as PDF, PPTX
Uploaded byClubHack
Hybrid Analyzer for Web Application Security (HAWAS) by Lavakumar Kuppan
Hawas is an open-source tool designed to automate the analysis of HTTP logs for web application security, focusing on identifying vulnerabilities such as encoded values, hashed values, and stored XSS candidates. It facilitates the testing of hidden parameters, CSRF, and access-control checks by comparing modified requests against baseline responses. The tool helps penetration testers uncover complex vulnerabilities often missed by automated scanners.
Hybrid Analyzer for Web Application Security (HAWAS) by Lavakumar Kuppan
- 1. HAWAS – HybridAnalyzer for Web Application Security Lavakumar Kuppan lava@ironwasp.org https://twitter.com/lavakumark https://ironwasp.org
- 2. About Penetration Tester 5+ years of experience Security Researcher Flash 0-day WAF bypass 0-day using HPP Multiple HTML5 based attack techniques 5th best Web Application Hacking Technique of 2010 Attack and Defense Labs – http://andlabs.org HTML5 Security Resources Repository – http://html5security.org
- 3. About Developer IronWASP(C# + Python + Ruby) Ravan (PHP + JavaScript) JS-Recon (JavaScript) Shell of the Future (C# + JavaScript) Imposter (C# + JavaScript) Speaker BlackHat OWASP AppSec Asia NullCon SecurityByte ClubHack
- 4. Automated Tools existfor finding: SQL Injection Cross-site Scripting Command Injection Code Injection etc 4
- 5. But there isa lot more to Pentesting CSRF checks Access-control violations Hidden Parameter Guessing and Identifying and testing for site-specific custom attack vectors 5
- 6. HAWAS helps withthe automation of the second type of issues 6
- 7. What is HAWAS? HAWASis an open source tool that analyzes HTTP logs and: Lists out all Parameter names and values Identifies encoded values and decodes them Identifies hashed values and tries to crack them Identifies potential Stored XSS candidates Helps with automation of Hidden parameter guessing, CSRF testing, Access-control checks and more 7
- 8. Listing Parameter names AllQuery, Body, Cookie, Header, Set-Cookie parameters are listed for analysis. Eg: lang user pwd id … … logged_in is_admin … … Notice anything interesting? This can be probed further manually 8
- 9. Listing Parameter values AllQuery, Body, Cookie, Header, Set-Cookie parameter values are listed for analysis. Eg: en true 23944 … … Fy2010_11_report.pdf Fy2011_12_report.pdf … … http://partner.site/data.php … SELECT id FROM Users 9
- 10. Parameter Values saya lot Fy2010_11_report.pdf – possible LFI vulnerability http://partner.site/data.php - possible RFI / Open Redirect vulnerability SELECT id FROM Users – SQL queries created on the client-side and executed on the server-side !!! Ironically automated scanners might not detect this type of SQL Injection! 10
- 11. Identifying Encoded valuesand decoding them HAWAS identifies base64 and hex encoded values from the list of parameter values and decodes them It tries to decode every single parameter value by base64 and hex decoding. If the result is a proper ascii string then it flags it as an encoded value 11
- 12. Why this isimportant? Do you see anything interesting in the strings below: asdljz2398sdsdsdsdkss z23sds9sd9a;sdk=awe bgf2yto6c2vjcmv0mtiz 646973636f756e743a323125 2238019jadja8498434dfdf Lsjflosow2384fkshfl 12
- 13. How about now? asDljz2398sdYDKus3lns z23sdE9sd9Asdk=awe bGF2YTo6c2VjcmV0MTIz–Base64 Decode- > lava::secret123 646973636f756e743a323125 –Hex Decode-> discount:21% 2238019jadja8498434dfdf lsjflosow2384fkshfl 13
- 14. Identifying Hashes andcracking them All parameter values are checked to see if they look similar to MD5, SHA1, SHA256, SHA384 or SHA512 hashes. If any matches are found then the hashes are cracked using the entire list of parameter values are dictionary Both cracked and uncracked hashed parameter values displayed to user 14
- 15. Stored XSS candidatesidentification Analyzes all responses for reflection of any of the input parameters If user input is reflected back in other responses down the line then it is highlighted Rarity of reflection is given higher priority to reduce noise in the results 15
- 16. Interactive Testing CSRF testing,Hidden parameter guessing and Access- control checks all follow the same 3 step process Step 1: Pick a request and corresponding base-line ‘good response’ Step 2: Add or edit any of the parameters in the request and send the it again Step 3: Compare this response with the base-line response 16
- 17. HAWAS automates this Abilityto select one or more requests from log for check User specifies which parameter must be changed or added to the request The response for the new request is compared with the baseline and results displayed to user Ability to support logout detection, auto login, CSRF token updating etc through Session Plugins 17
- 18. Thank You! 18