Palestra do CTO Rafael Silva no evento Chesf Security Day.

1. Novos ataques em
www.estuarioti.com.br
Aplicações Web.
@estuarioti
Rafael Silva
rafaelsilva@estuarioti.com.br

2. Agenda
 Whoami
 OWASP top 10
 Ferramentas X SkillSet
 IFrames
 HTML 5 Hacking Features
 Cursor Hijack / Click Hijack
 HTTP Parameter Pollution
 HTTPOnly XSS Bypass
www.estuarioti.com.br @estuarioti

3. $whoami
 OWASP Member
 rfdslabs || TheBug Magazine
 FAB (Força Aérea Brasileira)
 C.E.S.A.R
 Tempest @rfdslabs
 EstuárioTI 
www.estuarioti.com.br @estuarioti

4. Owasp TOP 10
www.estuarioti.com.br @estuarioti

5. Ferramentas X skillSet
 Nessus, Acunetix, Nstalker…
 Attacks and Vulnerabilities
 Automated scanners not detect:
 Session Fixation
 Privilege Escalation [Horizontal and Vertical]
 Logout
 Logic Flaws
 Unauthenticated Direct Access
 “Forgot my password”
 …
www.estuarioti.com.br @estuarioti

6. IFRAMES
 Stealth
 Browser Exploit or JAVA or SWF…
 Insert Malicious Javascript
 Stored XSS + IFRAME = Chaos
 Redirect Defacement
www.estuarioti.com.br @estuarioti

7. IFRAMES
www.estuarioti.com.br @estuarioti

8. IFRAMES
DEMO 1
www.estuarioti.com.br @estuarioti

9. HTML 5 Hacking Features
Cross Origin Resource Sharing
 Cross Domain AJAX
 With Cookies
 Blind
 Not limited to <form> syntax
 Used to Trigger CSRF
www.estuarioti.com.br @estuarioti

10. HTML 5 Hacking Features
Cross Origin Resource Sharing
www.estuarioti.com.br @estuarioti

11. HTML 5 Hacking Features
Cross Origin Resource Sharing
www.estuarioti.com.br @estuarioti

12. HTML 5 Hacking Features
Silent File Upload
 Java Script FileUpload!
Stealth <input type=file> with any file
name and content
 Use CORS
 How? Create raw multipart/form-data
www.estuarioti.com.br @estuarioti

13. HTML 5 Hacking Features
Silent File Upload
www.estuarioti.com.br @estuarioti

14. HTML 5 Hacking Features
Silent File Upload
www.estuarioti.com.br @estuarioti

15. HTML 5 Hacking Features
Silent File Upload
 No User Action
 No Frames
 Cross-domain with cookies 
 Works in most browsers 
 You can add more form fields
-- CSRF flaw needed
-- No access to response
www.estuarioti.com.br @estuarioti

16. Cursor Hijack / Click Hijack
 Facebook Scams
 Actively Exploited
 Javascript in url bar 
 NoScript Plugin to mitigate 
 Use your creativity
www.estuarioti.com.br @estuarioti

17. Cursor Hijack / Click Hijack
www.estuarioti.com.br @estuarioti

18. Cursor Hijack / Click Hijack
www.estuarioti.com.br @estuarioti

19. Cursor Hijack / Click Hijack
www.estuarioti.com.br @estuarioti

20. Cursor Hijack / Click Hijack
DEMO 2
www.estuarioti.com.br @estuarioti

21. Cursor Hijack / Click Hijack
DEMO 3
www.estuarioti.com.br @estuarioti

22. HTTP Parameter Pollution
 Query String Term ?
 Defined in the RFC 3986
 GET and POST:
 Query string meta characters are & ? # ; =
www.estuarioti.com.br @estuarioti

23. HTTP Parameter Pollution
www.estuarioti.com.br @estuarioti

24. HTTP Parameter Pollution
 Bypass ModSecurity
Busted Query:
Accepted Query:
www.estuarioti.com.br @estuarioti

25. HTTP Parameter Pollution
 Bypass IBM Web Application Firewall (FIXED)
Busted Query:
Accepted Query:
Discovered by Wendel Henrique from Trustwave Labs
www.estuarioti.com.br @estuarioti

26. HTTPOnly XSS Bypass
 Implemented in 2002 by Microsoft in IE 6
 Additional FLAG included in a Set-Cookie HTTP responde
header
 Exploiting a XSS with a HTTPOnly in response? No cookies
for you? 
www.estuarioti.com.br @estuarioti

27. HTTPOnly XSS Bypass
How to Bypass?
 Cross-Site Tracking – HTTP TRACE (FIXED)
 XMLHttpRequest also blocked TRACE Method (FIXED)
 CVE-2009-0357 XMLHttpRequest in FireFox (FIXED)
www.estuarioti.com.br @estuarioti

28. HTTPOnly XSS Bypass
Java API Applet HTTP TACE (FIXED)
www.estuarioti.com.br @estuarioti

29. HTTPOnly XSS Bypass
 Java GetHeaderField in java.net.URLConnection package
(UNFIXED) 
 By Aung Khant http://yehg.net
www.estuarioti.com.br @estuarioti

30. HTTPOnly XSS Bypass
www.estuarioti.com.br @estuarioti

31. HTTPOnly XSS Bypass
 and… WORKS! 
www.estuarioti.com.br @estuarioti

32. EstuárioTI
www.estuarioti.com.br @estuarioti

33. References
Tempest Blog
Steffano di Paola
SecKB Blog
OWASP
Marcus Niemietz
www.estuarioti.com.br @estuarioti