SlideShare a Scribd company logo
WebGoat.SDWAN.Net
in Depth
Denis Kolegov / @dnkolegov
Oleg Broslavsky / @yalegko
Power of Community - November 8th 2018
SD-WAN New Hope
● Sergey Gordeychik
● Alex Timorin
● Denis Kolegov
● Oleg Broslavsky
● Max Gorbunov
● Nikita Oleksov
● Nikolay Tkachenko
● Anton Nikolaev
● SD-WAN Repository
● SD-WAN Internet Census
● SD-WAN Harvester
● SD-WAN Infiltrator
● SD-WAN Threats (WIP)
https://github.com/sdnewhop/
Disclaimer (1/2)
● Please note, that this talk is by Oleg and Denis
● We don't speak for our employers
● All the opinions and information here are of our responsibility. So,
mistakes and bad jokes are all OUR responsibilities
● Actually no one has seen the slides before
Disclaimer (2/2)
● Unfortunately, this talk is not about sophisticated hacking techniques
● The one is about the current state of SD-WAN product security and typical
vulnerabilities you can meet as pentesters or security researchers
Intro @Oleg
● Post graduate student at Tomsk State University
● Ex…
○ Security developer at VDOM Research
○ WAF developer, Positive Technologies
○ SiBears CTF team captain
Intro @Denis
● PhD, associate professor at Tomsk State University
● Security researcher at Frozy.io
● Ex…
○ Security researcher, Positive Technologies
○ Security engineer, F5 Networks
Why WebGOAT.SDWAN.Net?
● WebGoat is an insecure web application maintained by OWASP designed
to teach web application security lessons
● It seems that current SD-WAN vendors develop the same thing
Questions
● How many SD-WAN nodes are on the Internet?
● Common security level of SD-WAN products
● Is SD-WAN low-hanging fruit and how low it is?
● How to hack SD-WAN via traditional vulnerabilities?
● Security of SD-WAN specific mechanisms
Agenda
● SD-WAN Essence
● SD-WAN Internet Census
● SD-WAN Vulnerabilities in Practice
SD-WAN Essence
Traditional WAN vs Software-defined WAN
Source: http://www.abusedbits.com/2017/01/modern-network-areas-in-software-defined.html
Are SD-WANs secure?
“SD-WAN is perfectly safe for implementing wide-area
networks affordably, efficiently and securely.”
Perfectly safe?
Not exactly...
SD-WAN Security
● No major design flaws in SDN/NFV/SD-WAN concept, but...
● At the present time, SD-WAN is a dangerous mix of
○ complicated logic
○ web technologies
○ outdated or unsupported open source projects
○ packages with known vulnerabilities
○ new custom cryptography protocols
○ immature network features and security mechanisms
SD-WAN Internet Census
SD-WAN Internet Census
● Best effort approach
● Crafted Shodan and Censys queries
● Found version disclosure patterns
● Developed tools
○ SD-WAN Harvester
○ SD-WAN Infiltrator
SD-WAN Map
Last scan: October, 2018
https://github.com/sdnewhop/sdwan-harvester/tree/master/samples
Version Leakage Patterns
SSH Fingerprinting
● SD-WAN version in /etc/issue message
● It is too complicated even for masscan
○ Implement the rest of SSH protocol
○ Look for another tool
● zgrab does almost everything we need
● Add last steps to the zgrab ssh module
● Use zmap + zgrab for hosts enumeration
(feel free to use masscan + zgrab as well)
● Find open SSH -> Grab banners -> Filter
masscan
our banner
...
zgrab
https://github.com/sdnewhop/zgrab2
Occasional Findings
SD-WAN OpenSSH Vulnerabilities
● CVE-2016-10708: OpenSSH before 7.4 allows
remote attackers to cause a denial of service
● CVE-2017-15906: OpenSSH before 7.6 allows
attackers to create zero-length files
● CVE-2016-10010: OpenSSH before 7.4, when
privilege separation is not used, might allow local
users to gain privileges
● CVE-2016-10011: OpenSSH private key leakage
● CVE-2010-5107: OpenSSH DoS
● CVE-2014-1692: OpenSSh DoS
● CVE-2016-0778: A buffer overflow on OpenSSH
client
● CVE-2016-0777: OpenSSH client memory leak
● CVE-2016-8858: OpenSSH DoS
https://github.com/sdnewhop/sdwan-harvester
TELoIP Orchestrator API Version Disclosure
Request: http://example.com/?debug=requestinfo
Response:
{
"usage": ...,
"host":"_v5.02_Teloip Orchestrator API",
"hostType":"SelfHost (AppHostBase)",
"startedAt":"2018-04-26 07:41:49",
"date":"2018-06-20 16:57:44",
"serviceName":"Teloip Orchestrator API",
...
}
TELoIP Orchestrator API Stack Trace Exposure
TELoIP Orchestrator API XSS
Responsible Disclosure Results
No response, but all reported issues were fixed
SD-WAN Vulnerabilities
in Practice
Viprinet Stored XSS
Viprinet XSS
● CVE-2014-2045: Multiple Instances of XSS in Viprinet Multichannel VPN
Router 300
● Viprinet AdminDesk uses ExtJS 4.2.2.1144
● ExtJS (4 to 6 before 6.6.0) is vulnerable to XSS (the report)
● Why does XSS matter here?
○ A private key is accessible via AdminDesk
○ VPN tunnel certificate fingerprint can be set via AdminDesk
Private Key
Certificate Fingerprint
Viprinet CVE-2014-2045
● http://<host>/exec?module=config&sessionid=<sessionid>&
inspect=%3Cscript%20src=http://localhost:9090%3E%3C/scr
ipt%3E
● “The inclusion of session IDs in all URLs partially mitigates the reflective
cross-site scripting but could itself be considered a vulnerability”
● URL Example:
○ http://e.com/exec?module=ajaxconfig&sessionid=RkZGRkZGRkY4ODc5NDM
4MzkwMDM2Mzc4MQ&action=editors&inspect=ROUTERSERVICES.ADMINDESK
Viprinet Interfaces
● There are 3 management interfaces on the Viprinet system
○ CLI available via 127.0.0.1:5111
○ Old Web Interface
○ New Web Interface
● Access control allows adding a user and assigning privileges to him to
write or read some sections (e.g., ADMINRIGHTS, QOSTEMPLATES)
● Using CLI, the added user with minimal privileges could set Name for
created ITEM to <svg/onload=alert(ViprinetSessionId)>
CLI Commands
Viprinet Stored XSS via CLI
Responsible Disclosure Results
No response ;-(
Full disclosure: https://seclists.org/fulldisclosure/2018/Oct/41
The Good Old Friend CSRF
CSRF Intro
● CSRF is an attack that forces an end user to execute unwanted actions on
a web application in which he was authenticated
● The primary protection method is anti-csrf tokens
● Defense in depth methods
○ Same-site cookies
○ Origin verification
● CSRF prevention misconceptions (NCC Group research)
○ Content-type header
○ Secret cookie
○ Multi-step requests
CSRF in SD-WAN
● SD-WAN webapps don’t implement CSRF protection entirely or do it wrong
● The favorite method is Content-type header check, but…
● There is the SWF-based JSON CSRF exploit that bypasses that check
● Vulnerable systems
○ Citrix NetScaler SD-WAN
○ Viptela REST API
○ SilverPeak EdgeConnect
SilverPeak REST API CSRF
● If and only if Content-Type value equals to “application/json” then a
request is handled by the application
● This attack allows remote attackers to perform critical actions like setting
BGP parameters, changing web configuration, adding users, etc. on behalf
of an administrator
● It's possible to bypass this CSRF protection using Flash
● http://10.1.0.135/test.swf?jsonData={"issue":"111","mot
d":"test"}&php_url=http://10.1.0.135/test.php&endpoint=
https://54.158.216.59/8.1.4.9_65644/rest/json/banners
Another Friend:
Host Header Attack
Host Header Attacks
● Described by James Kettle in «Practical HTTP Host header attacks» in 2013
● Riverbed SteelConnect was vulnerable to the password reset poisoning attack
● Host header value was used to build a link for password resetting
● An attacker can send a POST request with an arbitrary Host header value in case of
knowing an admin's username and email
● If the admin clicks on the link the password token will be sent to the attacker's host
Password Reset Poisoning
Password Reset Poisoning
Responsible Disclosure Results
No response ;-(
Full disclosure:
https://seclists.org/fulldisclosure/2018/Oct/39
Insecure Authentication
Authentication
● During the research, we found several vulnerabilities related to insecure
authentication
● All authentication checks were implemented on a client-side
● Authorization token was formed on a client-side, too
● Probably, developers did not distinguish JavaScript from NodeJS
Client-side Authentication
?
! // TODO: fix in prod ?
ZTD Bootstrapping with Hardcoded Password
Use of Hard-coded
Cryptographic Certificate
Overview
● A use of hard-coded cryptographic key was found in a one SD-WAN
product (the vulnerability is being fixed now)
● All appliances use the same pre-installed PKC key pair and the
corresponding self-signed certificate
● This certificate is used in Controller - Orchestrator communication protocol
within Northbound API
● An attacker in MitM position can use the certificate and its private key to
perform eavesdropping and spoofing attacks against all nodes
Provisioning (1/2)
1. The Vendor copies the
pre-generated
appliance_cert
Orchestrator
Controllers
Edge routers
Provisioning (2/2)
2. The Customer generates the
orchestrator_cert and manually
installs it on the controller nodes
Orchestrator
Controllers
Edge routers
Communication Scheme (1/3)
Orchestrator
Controllers
Edge routers
appliance_cert
orchestrator_cert
appliance_cert
orchestrator_cert
appliance_cert
orchestrator_cert
appliance_cert appliance_cert appliance_cert
Protocol initiation
Communication Scheme (2/3)
Orchestrator
Controllers
Edge routers
appliance_cert
orchestrator_cert
appliance_cert
orchestrator_cert
appliance_cert
orchestrator_cert
TLS channel
(TLS_RSA_WITH_AES_256_CBC_SHA,
mutual auth, whitelisting)
Server on TCP/2156
Client
appliance_cert appliance_cert appliance_cert
Communication Scheme (3/3)
Orchestrator
Controllers
Edge routers
appliance_cert
orchestrator_cert
appliance_cert
orchestrator_cert
appliance_cert
orchestrator_cert
Client can use PSK
on the app layer
Server on TCP/2156
Client
appliance_cert appliance_cert appliance_cert
Design Summary
● The “appliance_cert” certificate
○ It is pre-installed on all appliances (controller, orchestrator, network elements, etc.)
○ It is used for traffic encryption with TLS_RSA_WITH_AES_256_CBC_SHA cipher suite
● The “orchestrator_cert” certificate
○ It is generated on the Orchestrator
○ It must be manually installed on all controllers
● TLS
○ TLS_RSA_WITH_AES_256_CBC_SHA
○ PFS is not enforced
● A custom protocol is used to communicate between Orchestrator and
other nodes over TLS
● It is worth noting, that this protocol also has a password-based
authentication feature (PSK)
appliance_cert.pem
● The same certificate on all nodes
○ Self-signed
○ The same SN - 97:D9:5C:BD:EC:AB:E2:93
○ The same Md5sum - de44831068a3d3a641ae71bc37897421
● How many those nodes are on the Internet?
TCP 2156
● SSL with hardcoded certificate on 2156/tcp
● Need to fingerprint SSL certificates on uncommon port
○ Shodan gives no results
○ Masscan can detect SSL and grab its certificate
● Implements a “vulncheck” function for grabbed SSL cert
● …
● EZ WIN
https://github.com/sdnewhop/masscan
Networks were harmed making the research
No kangaroos were harmed during research
But a network was...
> well you kinda killed the entire Tomtech network..
> literally everything is down.
> so looks like I can’t help you with servers
anymore, sorry.
“
”
Northbound API
Orchestrator
Controllers
Edge routers
appliance_cert
orchestrator_cert
appliance_cert
orchestrator_cert
appliance_cert
orchestrator_cert
Commands
Server on TCP/2156
Client
appliance_cert appliance_cert appliance_cert
Results
What is the API and protocol used for?
● Download configs from virtual WAN appliances
(get_config_file_chunk FILENAME)
● Download a list of configs (get_available_configs)
● Ping (ping)
● Get info (get_appliance_info)
● Get management IP address (get_network_mgt_ip_address)
● Get SSO token (get_sso_token)
● Upload config (initiate_config_upload FILENAME,
put_config_file_chunk FILENAME, finalize_config_upload
FILENAME)
Authentication
● Mutual authentication and defence in depth mechanism
● Orchestrator authenticates to Controller using its "orchestrator_cert"
certificate
● Controller authenticates to Orchestrator using the "appliance_cert" and
white-listing method:
○ Controller can communicate with Orchestrator if its appliance_cert certificates are equal
○ Any arbitrary, but equal certificates
● Pre-shared Secret Key
○ Default user name (vendor name)
○ Password is empty
Client CLI Help
Server does not enable the password check
● The password check designed and implemented but not used
● It is not possible to enable this password check
Get Config Command with Empty Password
Design Flaws
● Those certificates are roots of trust
● At the same time
○ The certificates are self-signed
○ The certificates are the same
○ There is no revocation mechanism
○ There is no automatic update mechanism
○ There is no integrity control
○ There is no integration with a private Customer PKI
● “This hockey we do not need” (Nikolai Ozerov)
Attacker Capabilities
1. The attacker in passive MitM position can decrypt all communications
2. The attacker in active MitM position can perform active eavesdropping
3. The attacker in the target network can spoof an Controller
4. The attacker that is able to upload an SD-WAN certificate on a Controller
node can get control over this SD-WAN network
How easy to upload a malicious certificate?
● "www-data" user can create files in certificate directory by design
● It is possible to upload any certificate into this directory using
vulnerabilities in the Web UI
● We identified multiple vulnerabilities to OS command injection attack,
allowing us to upload an arbitrary Orchestrator certificate
Responsible Disclosure Results
1. September 24, 2018: Reported
2. September 25, 2018: A bug was created
3. October 17, 2018: “We have reproduced the behavior you described and
are now in the process of identifying the changes required to address it”
Talari’s SNMP Route Learning
SNMP Route Learning
● A proprietary mechanism to acquire routing tables from a router
● A developer’s linkedin page says the following:
○ “SNMP: Enhanced existing SNMP Route Polling functionality to improve
efficiency and usability of route processing and route filtering in support of key
Customer account.. ”
● snmpwalk-based implementation
SNMP Routes Configuration
* Screenshot from official user guide
Results
● Insecure SNMPv2 protocol is used
○ Community string and SNMP Request ID are the only security mechanisms defending
against SNMP spoofing
○ No route authentication and integrity
● An attacker in MitM-position can arbitrary change routing information
● Probable RCE and SQLi in the mechanism implementation
SQLi-driven Bandwidth Detection
Automatic Bandwidth Detection
● Citrix NetScaler SD-WAN has a bandwidth-detection mechanism automatically
updating the running configuration and connection policies of data plane
● The bandwidth detection feature can be scheduled to run as frequently as every
hour and maintains an historical table of what the bandwidth test results were
● The current bandwidth values are stored in MariaDB
● The basic idea: If we can change bandwidth data stored in the database, we can
change data plane characteristics
Automatic Bandwidth Detection
Is that System vulnerable to SQLi?
● Log_monitoring_utils.cgi is vulnerable to SQLi
● Events_download.cgi is vulnerable to SQLi
SQL Injection in events_download.cgi
Response will contain a gzip archive with events.csv file.
CBVW_Events database name will be in the file
Does that system have other vulns?
Results
1. Remote Command Injection via Cookie
2. Remote Command Injection via Cookie in PAMAuthenticate.php
3. Multiple Remote Command Injections
4. Command Injection in vwcli.cgi
5. Session ID Leakage
6. Slow HTTP DoS Attacks
7. Multiple SQL Injections
8. Path Traversal in getfile.cgi
9. Path Traversal in viewfile.cgi
10. Reflected XSS in /cgi-bin/viewfile.cgi
11. Reflected XSS in /cgi-bin/pages.cgi
12. Stored XSS in pages.cgi
13. Cross-Site Request Forgery Protection is not Implemented
14. Missing Function Level Access Control
Responsible Disclosure Results
1. June 14, 2018: Reported
2. June 15, 2018: A bug created
3. October 12, 2018: A vendor have addressed reported issues and have a
bulletin drafted for release. CVEs are allocated and reserved
4. October 22, 2018: the vulnerabilities were fixed
5. Citrix NetScaler SD-WAN security testing report (POC2018 special release)
Denial of Service RegEx
ReDoS in IDS Rules
ReDoS Example
Found Vulnerabilities to ReDoS
Are Orchestrators More Secure?
Not so Secure :(
1. Slow HTTP DoS Attacks
2. Stored XSS in Inventory Management
3. Stored XSS in Custom Login Message
4. Stored XSS in Log Viewer
5. Cross-Site Request Forgery on Web UI
6. Cross-Site Request Forgery on REST
7. Missing Function Level Access Control
8. RCE via File Uploading
9. OS Command Injection for Unauthenticated User
10. Path Traversal in LogController
Command Injection
● The vulnerability in
"/app/webroot/storageMigrationCompleted.php" leads to OS
command injection attack
● An attacker without any privileges can perform this attack
● It must have a network connection to the Web Management Interface only
OS Command Injection in storageMigrationCompleted.php
OS Command Injection in storageMigrationCompleted.php
Responsible Disclosure Results
1. June 14, 2018: Reported
2. June 15, 2018: A bug created
3. October 12, 2018: A vendor have addressed reported issues and have a
bulletin drafted for release. CVEs are allocated and reserved
Conclusions
Conclusions
● Many, many, many bugs
● Current SD-WAN products are
immature from a security point
of view
● Huge attack surface
● Join the SD-WAN New Hope
project
Any Questions?
Thanks!
Contact us:
@dnkolegov
@yalegko

More Related Content

What's hot

Tracking vulnerable JARs
Tracking vulnerable JARsTracking vulnerable JARs
Tracking vulnerable JARs
David Jorm
 
Cryptography In The Browser Using JavaScript
Cryptography In The Browser Using JavaScriptCryptography In The Browser Using JavaScript
Cryptography In The Browser Using JavaScript
barysteyn
 
[Wroclaw #4] WebRTC & security: 101
[Wroclaw #4] WebRTC & security: 101[Wroclaw #4] WebRTC & security: 101
[Wroclaw #4] WebRTC & security: 101
OWASP
 
How to 2FA-enable Open Source Applications
How to 2FA-enable Open Source ApplicationsHow to 2FA-enable Open Source Applications
How to 2FA-enable Open Source Applications
All Things Open
 
OWASP Poland Day 2018 - Amir Shladovsky - Crypto-mining
OWASP Poland Day 2018 - Amir Shladovsky - Crypto-miningOWASP Poland Day 2018 - Amir Shladovsky - Crypto-mining
OWASP Poland Day 2018 - Amir Shladovsky - Crypto-mining
OWASP
 
[OWASP Poland Day] A study of Electron security
[OWASP Poland Day] A study of Electron security[OWASP Poland Day] A study of Electron security
[OWASP Poland Day] A study of Electron security
OWASP
 
CSW2017 Enrico branca What if encrypted communications are not as secure as w...
CSW2017 Enrico branca What if encrypted communications are not as secure as w...CSW2017 Enrico branca What if encrypted communications are not as secure as w...
CSW2017 Enrico branca What if encrypted communications are not as secure as w...
CanSecWest
 
Mirai botnet
Mirai botnetMirai botnet
Mirai botnet
OWASP
 
A 2018 practical guide to hacking RFID/NFC
A 2018 practical guide to hacking RFID/NFCA 2018 practical guide to hacking RFID/NFC
A 2018 practical guide to hacking RFID/NFC
Slawomir Jasek
 
Root via sms. 4G security assessment
Root via sms. 4G security assessment Root via sms. 4G security assessment
Root via sms. 4G security assessment
Sergey Gordeychik
 
Case VC+: Como tornar seguro um aplicativo mobile payment sem penalizar a exp...
Case VC+: Como tornar seguro um aplicativo mobile payment sem penalizar a exp...Case VC+: Como tornar seguro um aplicativo mobile payment sem penalizar a exp...
Case VC+: Como tornar seguro um aplicativo mobile payment sem penalizar a exp...
Márcio Rosa
 
BlueHat v17 || “_____ Is Not a Security Boundary." Things I Have Learned and...
BlueHat v17 ||  “_____ Is Not a Security Boundary." Things I Have Learned and...BlueHat v17 ||  “_____ Is Not a Security Boundary." Things I Have Learned and...
BlueHat v17 || “_____ Is Not a Security Boundary." Things I Have Learned and...
BlueHat Security Conference
 
[OPD 2019] Threat modeling at scale
[OPD 2019] Threat modeling at scale[OPD 2019] Threat modeling at scale
[OPD 2019] Threat modeling at scale
OWASP
 
SecPod: A Framework for Virtualization-based Security Systems
SecPod: A Framework for Virtualization-based Security SystemsSecPod: A Framework for Virtualization-based Security Systems
SecPod: A Framework for Virtualization-based Security Systems
Yue Chen
 
Uygulama guvenligi gunu - malicious web sites
Uygulama guvenligi gunu - malicious web sitesUygulama guvenligi gunu - malicious web sites
Uygulama guvenligi gunu - malicious web sites
Siber Güvenlik Derneği
 
CodeOne SF 2018 "Are you deploying and operating with security in mind?"
CodeOne SF 2018 "Are you deploying and operating with security in mind?"CodeOne SF 2018 "Are you deploying and operating with security in mind?"
CodeOne SF 2018 "Are you deploying and operating with security in mind?"
Daniel Bryant
 
Cumulonimbus fortification-secure-your-data-in-the-cloud
Cumulonimbus fortification-secure-your-data-in-the-cloudCumulonimbus fortification-secure-your-data-in-the-cloud
Cumulonimbus fortification-secure-your-data-in-the-cloud
David Busby, CISSP
 
JWTs and JOSE in a flash
JWTs and JOSE in a flashJWTs and JOSE in a flash
JWTs and JOSE in a flash
Evan J Johnson (Not a CISSP)
 
BlueHat v17 || Raising the Bar: New Hardware Primitives for Exploit Mitigations
BlueHat v17 || Raising the Bar: New Hardware Primitives for Exploit Mitigations BlueHat v17 || Raising the Bar: New Hardware Primitives for Exploit Mitigations
BlueHat v17 || Raising the Bar: New Hardware Primitives for Exploit Mitigations
BlueHat Security Conference
 
Continuous Integration - Live Static Analysis with Puma Scan
Continuous Integration - Live Static Analysis with Puma ScanContinuous Integration - Live Static Analysis with Puma Scan
Continuous Integration - Live Static Analysis with Puma Scan
Puma Security, LLC
 

What's hot (20)

Tracking vulnerable JARs
Tracking vulnerable JARsTracking vulnerable JARs
Tracking vulnerable JARs
 
Cryptography In The Browser Using JavaScript
Cryptography In The Browser Using JavaScriptCryptography In The Browser Using JavaScript
Cryptography In The Browser Using JavaScript
 
[Wroclaw #4] WebRTC & security: 101
[Wroclaw #4] WebRTC & security: 101[Wroclaw #4] WebRTC & security: 101
[Wroclaw #4] WebRTC & security: 101
 
How to 2FA-enable Open Source Applications
How to 2FA-enable Open Source ApplicationsHow to 2FA-enable Open Source Applications
How to 2FA-enable Open Source Applications
 
OWASP Poland Day 2018 - Amir Shladovsky - Crypto-mining
OWASP Poland Day 2018 - Amir Shladovsky - Crypto-miningOWASP Poland Day 2018 - Amir Shladovsky - Crypto-mining
OWASP Poland Day 2018 - Amir Shladovsky - Crypto-mining
 
[OWASP Poland Day] A study of Electron security
[OWASP Poland Day] A study of Electron security[OWASP Poland Day] A study of Electron security
[OWASP Poland Day] A study of Electron security
 
CSW2017 Enrico branca What if encrypted communications are not as secure as w...
CSW2017 Enrico branca What if encrypted communications are not as secure as w...CSW2017 Enrico branca What if encrypted communications are not as secure as w...
CSW2017 Enrico branca What if encrypted communications are not as secure as w...
 
Mirai botnet
Mirai botnetMirai botnet
Mirai botnet
 
A 2018 practical guide to hacking RFID/NFC
A 2018 practical guide to hacking RFID/NFCA 2018 practical guide to hacking RFID/NFC
A 2018 practical guide to hacking RFID/NFC
 
Root via sms. 4G security assessment
Root via sms. 4G security assessment Root via sms. 4G security assessment
Root via sms. 4G security assessment
 
Case VC+: Como tornar seguro um aplicativo mobile payment sem penalizar a exp...
Case VC+: Como tornar seguro um aplicativo mobile payment sem penalizar a exp...Case VC+: Como tornar seguro um aplicativo mobile payment sem penalizar a exp...
Case VC+: Como tornar seguro um aplicativo mobile payment sem penalizar a exp...
 
BlueHat v17 || “_____ Is Not a Security Boundary." Things I Have Learned and...
BlueHat v17 ||  “_____ Is Not a Security Boundary." Things I Have Learned and...BlueHat v17 ||  “_____ Is Not a Security Boundary." Things I Have Learned and...
BlueHat v17 || “_____ Is Not a Security Boundary." Things I Have Learned and...
 
[OPD 2019] Threat modeling at scale
[OPD 2019] Threat modeling at scale[OPD 2019] Threat modeling at scale
[OPD 2019] Threat modeling at scale
 
SecPod: A Framework for Virtualization-based Security Systems
SecPod: A Framework for Virtualization-based Security SystemsSecPod: A Framework for Virtualization-based Security Systems
SecPod: A Framework for Virtualization-based Security Systems
 
Uygulama guvenligi gunu - malicious web sites
Uygulama guvenligi gunu - malicious web sitesUygulama guvenligi gunu - malicious web sites
Uygulama guvenligi gunu - malicious web sites
 
CodeOne SF 2018 "Are you deploying and operating with security in mind?"
CodeOne SF 2018 "Are you deploying and operating with security in mind?"CodeOne SF 2018 "Are you deploying and operating with security in mind?"
CodeOne SF 2018 "Are you deploying and operating with security in mind?"
 
Cumulonimbus fortification-secure-your-data-in-the-cloud
Cumulonimbus fortification-secure-your-data-in-the-cloudCumulonimbus fortification-secure-your-data-in-the-cloud
Cumulonimbus fortification-secure-your-data-in-the-cloud
 
JWTs and JOSE in a flash
JWTs and JOSE in a flashJWTs and JOSE in a flash
JWTs and JOSE in a flash
 
BlueHat v17 || Raising the Bar: New Hardware Primitives for Exploit Mitigations
BlueHat v17 || Raising the Bar: New Hardware Primitives for Exploit Mitigations BlueHat v17 || Raising the Bar: New Hardware Primitives for Exploit Mitigations
BlueHat v17 || Raising the Bar: New Hardware Primitives for Exploit Mitigations
 
Continuous Integration - Live Static Analysis with Puma Scan
Continuous Integration - Live Static Analysis with Puma ScanContinuous Integration - Live Static Analysis with Puma Scan
Continuous Integration - Live Static Analysis with Puma Scan
 

Similar to WebGoat.SDWAN.Net in Depth

SDN Security: Two Sides of the Same Coin
SDN Security: Two Sides of the Same CoinSDN Security: Two Sides of the Same Coin
SDN Security: Two Sides of the Same Coin
Zivaro Inc
 
The Future of Security and Productivity in Our Newly Remote World
The Future of Security and Productivity in Our Newly Remote WorldThe Future of Security and Productivity in Our Newly Remote World
The Future of Security and Productivity in Our Newly Remote World
DevOps.com
 
Xfocus xcon 2008_aks_oknock
Xfocus xcon 2008_aks_oknockXfocus xcon 2008_aks_oknock
Xfocus xcon 2008_aks_oknock
ownerkhan
 
Here Be Dragons: Security Maps of the Container New World
Here Be Dragons: Security Maps of the Container New WorldHere Be Dragons: Security Maps of the Container New World
Here Be Dragons: Security Maps of the Container New World
C4Media
 
Q Con New York 2015 Presentation - Conjur
Q Con New York 2015 Presentation - ConjurQ Con New York 2015 Presentation - Conjur
Q Con New York 2015 Presentation - Conjur
conjur_inc
 
The Hacking Games - A Road to Post Exploitation Meetup - 20240222.pptx
The Hacking Games - A Road to Post Exploitation Meetup - 20240222.pptxThe Hacking Games - A Road to Post Exploitation Meetup - 20240222.pptx
The Hacking Games - A Road to Post Exploitation Meetup - 20240222.pptx
lior mazor
 
OWASP ZAP Workshop for QA Testers
OWASP ZAP Workshop for QA TestersOWASP ZAP Workshop for QA Testers
OWASP ZAP Workshop for QA Testers
Javan Rasokat
 
Next Generation Vulnerability Assessment Using Datadog and Snyk
Next Generation Vulnerability Assessment Using Datadog and SnykNext Generation Vulnerability Assessment Using Datadog and Snyk
Next Generation Vulnerability Assessment Using Datadog and Snyk
DevOps.com
 
OWASP Brisbane - SDN Security
OWASP Brisbane - SDN SecurityOWASP Brisbane - SDN Security
OWASP Brisbane - SDN Security
David Jorm
 
Open source iam value, benefits, and risks
Open source iam  value, benefits, and risksOpen source iam  value, benefits, and risks
Open source iam value, benefits, and risks
WSO2
 
DevSecOps: What Why and How : Blackhat 2019
DevSecOps: What Why and How : Blackhat 2019DevSecOps: What Why and How : Blackhat 2019
DevSecOps: What Why and How : Blackhat 2019
NotSoSecure Global Services
 
44CON London 2015 - Software Defined Networking (SDN) Security
44CON London 2015 - Software Defined Networking (SDN) Security44CON London 2015 - Software Defined Networking (SDN) Security
44CON London 2015 - Software Defined Networking (SDN) Security
44CON
 
44CON & Ruxcon: SDN security
44CON & Ruxcon: SDN security44CON & Ruxcon: SDN security
44CON & Ruxcon: SDN security
David Jorm
 
Introduction to Frida
Introduction to FridaIntroduction to Frida
Introduction to Frida
AbhishekJaiswal270
 
Vulnerabilities of machine learning infrastructure
Vulnerabilities of machine learning infrastructureVulnerabilities of machine learning infrastructure
Vulnerabilities of machine learning infrastructure
Sergey Gordeychik
 
Shift Left Security
Shift Left SecurityShift Left Security
Shift Left Security
gjdevos
 
Hacking Vulnerable Websites to Bypass Firewalls
Hacking Vulnerable Websites to Bypass FirewallsHacking Vulnerable Websites to Bypass Firewalls
Hacking Vulnerable Websites to Bypass Firewalls
Netsparker
 
Finding and exploiting novel flaws in Java software (SyScan 2015)
Finding and exploiting novel flaws in Java software (SyScan 2015)Finding and exploiting novel flaws in Java software (SyScan 2015)
Finding and exploiting novel flaws in Java software (SyScan 2015)
David Jorm
 
Codebits 2014 - Secure Coding - Gamification and automation for the win
Codebits 2014 - Secure Coding - Gamification and automation for the winCodebits 2014 - Secure Coding - Gamification and automation for the win
Codebits 2014 - Secure Coding - Gamification and automation for the win
Tiago Henriques
 
Demystify Information Security & Threats for Data-Driven Platforms With Cheta...
Demystify Information Security & Threats for Data-Driven Platforms With Cheta...Demystify Information Security & Threats for Data-Driven Platforms With Cheta...
Demystify Information Security & Threats for Data-Driven Platforms With Cheta...
Chetan Khatri
 

Similar to WebGoat.SDWAN.Net in Depth (20)

SDN Security: Two Sides of the Same Coin
SDN Security: Two Sides of the Same CoinSDN Security: Two Sides of the Same Coin
SDN Security: Two Sides of the Same Coin
 
The Future of Security and Productivity in Our Newly Remote World
The Future of Security and Productivity in Our Newly Remote WorldThe Future of Security and Productivity in Our Newly Remote World
The Future of Security and Productivity in Our Newly Remote World
 
Xfocus xcon 2008_aks_oknock
Xfocus xcon 2008_aks_oknockXfocus xcon 2008_aks_oknock
Xfocus xcon 2008_aks_oknock
 
Here Be Dragons: Security Maps of the Container New World
Here Be Dragons: Security Maps of the Container New WorldHere Be Dragons: Security Maps of the Container New World
Here Be Dragons: Security Maps of the Container New World
 
Q Con New York 2015 Presentation - Conjur
Q Con New York 2015 Presentation - ConjurQ Con New York 2015 Presentation - Conjur
Q Con New York 2015 Presentation - Conjur
 
The Hacking Games - A Road to Post Exploitation Meetup - 20240222.pptx
The Hacking Games - A Road to Post Exploitation Meetup - 20240222.pptxThe Hacking Games - A Road to Post Exploitation Meetup - 20240222.pptx
The Hacking Games - A Road to Post Exploitation Meetup - 20240222.pptx
 
OWASP ZAP Workshop for QA Testers
OWASP ZAP Workshop for QA TestersOWASP ZAP Workshop for QA Testers
OWASP ZAP Workshop for QA Testers
 
Next Generation Vulnerability Assessment Using Datadog and Snyk
Next Generation Vulnerability Assessment Using Datadog and SnykNext Generation Vulnerability Assessment Using Datadog and Snyk
Next Generation Vulnerability Assessment Using Datadog and Snyk
 
OWASP Brisbane - SDN Security
OWASP Brisbane - SDN SecurityOWASP Brisbane - SDN Security
OWASP Brisbane - SDN Security
 
Open source iam value, benefits, and risks
Open source iam  value, benefits, and risksOpen source iam  value, benefits, and risks
Open source iam value, benefits, and risks
 
DevSecOps: What Why and How : Blackhat 2019
DevSecOps: What Why and How : Blackhat 2019DevSecOps: What Why and How : Blackhat 2019
DevSecOps: What Why and How : Blackhat 2019
 
44CON London 2015 - Software Defined Networking (SDN) Security
44CON London 2015 - Software Defined Networking (SDN) Security44CON London 2015 - Software Defined Networking (SDN) Security
44CON London 2015 - Software Defined Networking (SDN) Security
 
44CON & Ruxcon: SDN security
44CON & Ruxcon: SDN security44CON & Ruxcon: SDN security
44CON & Ruxcon: SDN security
 
Introduction to Frida
Introduction to FridaIntroduction to Frida
Introduction to Frida
 
Vulnerabilities of machine learning infrastructure
Vulnerabilities of machine learning infrastructureVulnerabilities of machine learning infrastructure
Vulnerabilities of machine learning infrastructure
 
Shift Left Security
Shift Left SecurityShift Left Security
Shift Left Security
 
Hacking Vulnerable Websites to Bypass Firewalls
Hacking Vulnerable Websites to Bypass FirewallsHacking Vulnerable Websites to Bypass Firewalls
Hacking Vulnerable Websites to Bypass Firewalls
 
Finding and exploiting novel flaws in Java software (SyScan 2015)
Finding and exploiting novel flaws in Java software (SyScan 2015)Finding and exploiting novel flaws in Java software (SyScan 2015)
Finding and exploiting novel flaws in Java software (SyScan 2015)
 
Codebits 2014 - Secure Coding - Gamification and automation for the win
Codebits 2014 - Secure Coding - Gamification and automation for the winCodebits 2014 - Secure Coding - Gamification and automation for the win
Codebits 2014 - Secure Coding - Gamification and automation for the win
 
Demystify Information Security & Threats for Data-Driven Platforms With Cheta...
Demystify Information Security & Threats for Data-Driven Platforms With Cheta...Demystify Information Security & Threats for Data-Driven Platforms With Cheta...
Demystify Information Security & Threats for Data-Driven Platforms With Cheta...
 

More from yalegko

SD-WAN Internet Census
SD-WAN Internet CensusSD-WAN Internet Census
SD-WAN Internet Census
yalegko
 
So Your WAF Needs a Parser
So Your WAF Needs a ParserSo Your WAF Needs a Parser
So Your WAF Needs a Parser
yalegko
 
[ISC] Docker + Swarm
[ISC] Docker + Swarm[ISC] Docker + Swarm
[ISC] Docker + Swarm
yalegko
 
How to Open School For Young Hackers
How to Open School For Young HackersHow to Open School For Young Hackers
How to Open School For Young Hackers
yalegko
 
How to make school CTF
How to make school CTFHow to make school CTF
How to make school CTF
yalegko
 
AOP and Inversion of Conrol
AOP and Inversion of ConrolAOP and Inversion of Conrol
AOP and Inversion of Conrol
yalegko
 
White-Box HMAC. Make your cipher secure to white-box attacks.
White-Box HMAC. Make your cipher secure to white-box attacks.White-Box HMAC. Make your cipher secure to white-box attacks.
White-Box HMAC. Make your cipher secure to white-box attacks.
yalegko
 
White box cryptography
White box cryptographyWhite box cryptography
White box cryptography
yalegko
 
How to admin
How to adminHow to admin
How to admin
yalegko
 
ИИ: Этические аспекты проблемы выбора
ИИ: Этические аспекты проблемы выбораИИ: Этические аспекты проблемы выбора
ИИ: Этические аспекты проблемы выбора
yalegko
 
Covert timing channels using HTTP cache headers
Covert timing channels using HTTP cache headersCovert timing channels using HTTP cache headers
Covert timing channels using HTTP cache headers
yalegko
 
Covert timing channels using HTTP cache headers
Covert timing channels using HTTP cache headersCovert timing channels using HTTP cache headers
Covert timing channels using HTTP cache headers
yalegko
 
Include and extend in Ruby
Include and extend in RubyInclude and extend in Ruby
Include and extend in Ruby
yalegko
 
Not a children in da web
Not a children in da webNot a children in da web
Not a children in da web
yalegko
 

More from yalegko (14)

SD-WAN Internet Census
SD-WAN Internet CensusSD-WAN Internet Census
SD-WAN Internet Census
 
So Your WAF Needs a Parser
So Your WAF Needs a ParserSo Your WAF Needs a Parser
So Your WAF Needs a Parser
 
[ISC] Docker + Swarm
[ISC] Docker + Swarm[ISC] Docker + Swarm
[ISC] Docker + Swarm
 
How to Open School For Young Hackers
How to Open School For Young HackersHow to Open School For Young Hackers
How to Open School For Young Hackers
 
How to make school CTF
How to make school CTFHow to make school CTF
How to make school CTF
 
AOP and Inversion of Conrol
AOP and Inversion of ConrolAOP and Inversion of Conrol
AOP and Inversion of Conrol
 
White-Box HMAC. Make your cipher secure to white-box attacks.
White-Box HMAC. Make your cipher secure to white-box attacks.White-Box HMAC. Make your cipher secure to white-box attacks.
White-Box HMAC. Make your cipher secure to white-box attacks.
 
White box cryptography
White box cryptographyWhite box cryptography
White box cryptography
 
How to admin
How to adminHow to admin
How to admin
 
ИИ: Этические аспекты проблемы выбора
ИИ: Этические аспекты проблемы выбораИИ: Этические аспекты проблемы выбора
ИИ: Этические аспекты проблемы выбора
 
Covert timing channels using HTTP cache headers
Covert timing channels using HTTP cache headersCovert timing channels using HTTP cache headers
Covert timing channels using HTTP cache headers
 
Covert timing channels using HTTP cache headers
Covert timing channels using HTTP cache headersCovert timing channels using HTTP cache headers
Covert timing channels using HTTP cache headers
 
Include and extend in Ruby
Include and extend in RubyInclude and extend in Ruby
Include and extend in Ruby
 
Not a children in da web
Not a children in da webNot a children in da web
Not a children in da web
 

Recently uploaded

System Design Case Study: Building a Scalable E-Commerce Platform - Hiike
System Design Case Study: Building a Scalable E-Commerce Platform - HiikeSystem Design Case Study: Building a Scalable E-Commerce Platform - Hiike
System Design Case Study: Building a Scalable E-Commerce Platform - Hiike
Hiike
 
Nunit vs XUnit vs MSTest Differences Between These Unit Testing Frameworks.pdf
Nunit vs XUnit vs MSTest Differences Between These Unit Testing Frameworks.pdfNunit vs XUnit vs MSTest Differences Between These Unit Testing Frameworks.pdf
Nunit vs XUnit vs MSTest Differences Between These Unit Testing Frameworks.pdf
flufftailshop
 
Overcoming the PLG Trap: Lessons from Canva's Head of Sales & Head of EMEA Da...
Overcoming the PLG Trap: Lessons from Canva's Head of Sales & Head of EMEA Da...Overcoming the PLG Trap: Lessons from Canva's Head of Sales & Head of EMEA Da...
Overcoming the PLG Trap: Lessons from Canva's Head of Sales & Head of EMEA Da...
saastr
 
Main news related to the CCS TSI 2023 (2023/1695)
Main news related to the CCS TSI 2023 (2023/1695)Main news related to the CCS TSI 2023 (2023/1695)
Main news related to the CCS TSI 2023 (2023/1695)
Jakub Marek
 
Digital Marketing Trends in 2024 | Guide for Staying Ahead
Digital Marketing Trends in 2024 | Guide for Staying AheadDigital Marketing Trends in 2024 | Guide for Staying Ahead
Digital Marketing Trends in 2024 | Guide for Staying Ahead
Wask
 
How to Interpret Trends in the Kalyan Rajdhani Mix Chart.pdf
How to Interpret Trends in the Kalyan Rajdhani Mix Chart.pdfHow to Interpret Trends in the Kalyan Rajdhani Mix Chart.pdf
How to Interpret Trends in the Kalyan Rajdhani Mix Chart.pdf
Chart Kalyan
 
Artificial Intelligence for XMLDevelopment
Artificial Intelligence for XMLDevelopmentArtificial Intelligence for XMLDevelopment
Artificial Intelligence for XMLDevelopment
Octavian Nadolu
 
UI5 Controls simplified - UI5con2024 presentation
UI5 Controls simplified - UI5con2024 presentationUI5 Controls simplified - UI5con2024 presentation
UI5 Controls simplified - UI5con2024 presentation
Wouter Lemaire
 
Trusted Execution Environment for Decentralized Process Mining
Trusted Execution Environment for Decentralized Process MiningTrusted Execution Environment for Decentralized Process Mining
Trusted Execution Environment for Decentralized Process Mining
LucaBarbaro3
 
leewayhertz.com-AI in predictive maintenance Use cases technologies benefits ...
leewayhertz.com-AI in predictive maintenance Use cases technologies benefits ...leewayhertz.com-AI in predictive maintenance Use cases technologies benefits ...
leewayhertz.com-AI in predictive maintenance Use cases technologies benefits ...
alexjohnson7307
 
GraphRAG for Life Science to increase LLM accuracy
GraphRAG for Life Science to increase LLM accuracyGraphRAG for Life Science to increase LLM accuracy
GraphRAG for Life Science to increase LLM accuracy
Tomaz Bratanic
 
Generating privacy-protected synthetic data using Secludy and Milvus
Generating privacy-protected synthetic data using Secludy and MilvusGenerating privacy-protected synthetic data using Secludy and Milvus
Generating privacy-protected synthetic data using Secludy and Milvus
Zilliz
 
Let's Integrate MuleSoft RPA, COMPOSER, APM with AWS IDP along with Slack
Let's Integrate MuleSoft RPA, COMPOSER, APM with AWS IDP along with SlackLet's Integrate MuleSoft RPA, COMPOSER, APM with AWS IDP along with Slack
Let's Integrate MuleSoft RPA, COMPOSER, APM with AWS IDP along with Slack
shyamraj55
 
Skybuffer AI: Advanced Conversational and Generative AI Solution on SAP Busin...
Skybuffer AI: Advanced Conversational and Generative AI Solution on SAP Busin...Skybuffer AI: Advanced Conversational and Generative AI Solution on SAP Busin...
Skybuffer AI: Advanced Conversational and Generative AI Solution on SAP Busin...
Tatiana Kojar
 
Operating System Used by Users in day-to-day life.pptx
Operating System Used by Users in day-to-day life.pptxOperating System Used by Users in day-to-day life.pptx
Operating System Used by Users in day-to-day life.pptx
Pravash Chandra Das
 
Skybuffer SAM4U tool for SAP license adoption
Skybuffer SAM4U tool for SAP license adoptionSkybuffer SAM4U tool for SAP license adoption
Skybuffer SAM4U tool for SAP license adoption
Tatiana Kojar
 
Finale of the Year: Apply for Next One!
Finale of the Year: Apply for Next One!Finale of the Year: Apply for Next One!
Finale of the Year: Apply for Next One!
GDSC PJATK
 
A Comprehensive Guide to DeFi Development Services in 2024
A Comprehensive Guide to DeFi Development Services in 2024A Comprehensive Guide to DeFi Development Services in 2024
A Comprehensive Guide to DeFi Development Services in 2024
Intelisync
 
Choosing The Best AWS Service For Your Website + API.pptx
Choosing The Best AWS Service For Your Website + API.pptxChoosing The Best AWS Service For Your Website + API.pptx
Choosing The Best AWS Service For Your Website + API.pptx
Brandon Minnick, MBA
 
June Patch Tuesday
June Patch TuesdayJune Patch Tuesday
June Patch Tuesday
Ivanti
 

Recently uploaded (20)

System Design Case Study: Building a Scalable E-Commerce Platform - Hiike
System Design Case Study: Building a Scalable E-Commerce Platform - HiikeSystem Design Case Study: Building a Scalable E-Commerce Platform - Hiike
System Design Case Study: Building a Scalable E-Commerce Platform - Hiike
 
Nunit vs XUnit vs MSTest Differences Between These Unit Testing Frameworks.pdf
Nunit vs XUnit vs MSTest Differences Between These Unit Testing Frameworks.pdfNunit vs XUnit vs MSTest Differences Between These Unit Testing Frameworks.pdf
Nunit vs XUnit vs MSTest Differences Between These Unit Testing Frameworks.pdf
 
Overcoming the PLG Trap: Lessons from Canva's Head of Sales & Head of EMEA Da...
Overcoming the PLG Trap: Lessons from Canva's Head of Sales & Head of EMEA Da...Overcoming the PLG Trap: Lessons from Canva's Head of Sales & Head of EMEA Da...
Overcoming the PLG Trap: Lessons from Canva's Head of Sales & Head of EMEA Da...
 
Main news related to the CCS TSI 2023 (2023/1695)
Main news related to the CCS TSI 2023 (2023/1695)Main news related to the CCS TSI 2023 (2023/1695)
Main news related to the CCS TSI 2023 (2023/1695)
 
Digital Marketing Trends in 2024 | Guide for Staying Ahead
Digital Marketing Trends in 2024 | Guide for Staying AheadDigital Marketing Trends in 2024 | Guide for Staying Ahead
Digital Marketing Trends in 2024 | Guide for Staying Ahead
 
How to Interpret Trends in the Kalyan Rajdhani Mix Chart.pdf
How to Interpret Trends in the Kalyan Rajdhani Mix Chart.pdfHow to Interpret Trends in the Kalyan Rajdhani Mix Chart.pdf
How to Interpret Trends in the Kalyan Rajdhani Mix Chart.pdf
 
Artificial Intelligence for XMLDevelopment
Artificial Intelligence for XMLDevelopmentArtificial Intelligence for XMLDevelopment
Artificial Intelligence for XMLDevelopment
 
UI5 Controls simplified - UI5con2024 presentation
UI5 Controls simplified - UI5con2024 presentationUI5 Controls simplified - UI5con2024 presentation
UI5 Controls simplified - UI5con2024 presentation
 
Trusted Execution Environment for Decentralized Process Mining
Trusted Execution Environment for Decentralized Process MiningTrusted Execution Environment for Decentralized Process Mining
Trusted Execution Environment for Decentralized Process Mining
 
leewayhertz.com-AI in predictive maintenance Use cases technologies benefits ...
leewayhertz.com-AI in predictive maintenance Use cases technologies benefits ...leewayhertz.com-AI in predictive maintenance Use cases technologies benefits ...
leewayhertz.com-AI in predictive maintenance Use cases technologies benefits ...
 
GraphRAG for Life Science to increase LLM accuracy
GraphRAG for Life Science to increase LLM accuracyGraphRAG for Life Science to increase LLM accuracy
GraphRAG for Life Science to increase LLM accuracy
 
Generating privacy-protected synthetic data using Secludy and Milvus
Generating privacy-protected synthetic data using Secludy and MilvusGenerating privacy-protected synthetic data using Secludy and Milvus
Generating privacy-protected synthetic data using Secludy and Milvus
 
Let's Integrate MuleSoft RPA, COMPOSER, APM with AWS IDP along with Slack
Let's Integrate MuleSoft RPA, COMPOSER, APM with AWS IDP along with SlackLet's Integrate MuleSoft RPA, COMPOSER, APM with AWS IDP along with Slack
Let's Integrate MuleSoft RPA, COMPOSER, APM with AWS IDP along with Slack
 
Skybuffer AI: Advanced Conversational and Generative AI Solution on SAP Busin...
Skybuffer AI: Advanced Conversational and Generative AI Solution on SAP Busin...Skybuffer AI: Advanced Conversational and Generative AI Solution on SAP Busin...
Skybuffer AI: Advanced Conversational and Generative AI Solution on SAP Busin...
 
Operating System Used by Users in day-to-day life.pptx
Operating System Used by Users in day-to-day life.pptxOperating System Used by Users in day-to-day life.pptx
Operating System Used by Users in day-to-day life.pptx
 
Skybuffer SAM4U tool for SAP license adoption
Skybuffer SAM4U tool for SAP license adoptionSkybuffer SAM4U tool for SAP license adoption
Skybuffer SAM4U tool for SAP license adoption
 
Finale of the Year: Apply for Next One!
Finale of the Year: Apply for Next One!Finale of the Year: Apply for Next One!
Finale of the Year: Apply for Next One!
 
A Comprehensive Guide to DeFi Development Services in 2024
A Comprehensive Guide to DeFi Development Services in 2024A Comprehensive Guide to DeFi Development Services in 2024
A Comprehensive Guide to DeFi Development Services in 2024
 
Choosing The Best AWS Service For Your Website + API.pptx
Choosing The Best AWS Service For Your Website + API.pptxChoosing The Best AWS Service For Your Website + API.pptx
Choosing The Best AWS Service For Your Website + API.pptx
 
June Patch Tuesday
June Patch TuesdayJune Patch Tuesday
June Patch Tuesday
 

WebGoat.SDWAN.Net in Depth

  • 1. WebGoat.SDWAN.Net in Depth Denis Kolegov / @dnkolegov Oleg Broslavsky / @yalegko Power of Community - November 8th 2018
  • 2.
  • 3. SD-WAN New Hope ● Sergey Gordeychik ● Alex Timorin ● Denis Kolegov ● Oleg Broslavsky ● Max Gorbunov ● Nikita Oleksov ● Nikolay Tkachenko ● Anton Nikolaev ● SD-WAN Repository ● SD-WAN Internet Census ● SD-WAN Harvester ● SD-WAN Infiltrator ● SD-WAN Threats (WIP) https://github.com/sdnewhop/
  • 4. Disclaimer (1/2) ● Please note, that this talk is by Oleg and Denis ● We don't speak for our employers ● All the opinions and information here are of our responsibility. So, mistakes and bad jokes are all OUR responsibilities ● Actually no one has seen the slides before
  • 5. Disclaimer (2/2) ● Unfortunately, this talk is not about sophisticated hacking techniques ● The one is about the current state of SD-WAN product security and typical vulnerabilities you can meet as pentesters or security researchers
  • 6. Intro @Oleg ● Post graduate student at Tomsk State University ● Ex… ○ Security developer at VDOM Research ○ WAF developer, Positive Technologies ○ SiBears CTF team captain
  • 7. Intro @Denis ● PhD, associate professor at Tomsk State University ● Security researcher at Frozy.io ● Ex… ○ Security researcher, Positive Technologies ○ Security engineer, F5 Networks
  • 8. Why WebGOAT.SDWAN.Net? ● WebGoat is an insecure web application maintained by OWASP designed to teach web application security lessons ● It seems that current SD-WAN vendors develop the same thing
  • 9. Questions ● How many SD-WAN nodes are on the Internet? ● Common security level of SD-WAN products ● Is SD-WAN low-hanging fruit and how low it is? ● How to hack SD-WAN via traditional vulnerabilities? ● Security of SD-WAN specific mechanisms
  • 10. Agenda ● SD-WAN Essence ● SD-WAN Internet Census ● SD-WAN Vulnerabilities in Practice
  • 12.
  • 13.
  • 14. Traditional WAN vs Software-defined WAN Source: http://www.abusedbits.com/2017/01/modern-network-areas-in-software-defined.html
  • 16.
  • 17. “SD-WAN is perfectly safe for implementing wide-area networks affordably, efficiently and securely.”
  • 19.
  • 20. SD-WAN Security ● No major design flaws in SDN/NFV/SD-WAN concept, but... ● At the present time, SD-WAN is a dangerous mix of ○ complicated logic ○ web technologies ○ outdated or unsupported open source projects ○ packages with known vulnerabilities ○ new custom cryptography protocols ○ immature network features and security mechanisms
  • 22. SD-WAN Internet Census ● Best effort approach ● Crafted Shodan and Censys queries ● Found version disclosure patterns ● Developed tools ○ SD-WAN Harvester ○ SD-WAN Infiltrator
  • 23. SD-WAN Map Last scan: October, 2018 https://github.com/sdnewhop/sdwan-harvester/tree/master/samples
  • 25.
  • 26. SSH Fingerprinting ● SD-WAN version in /etc/issue message ● It is too complicated even for masscan ○ Implement the rest of SSH protocol ○ Look for another tool ● zgrab does almost everything we need ● Add last steps to the zgrab ssh module ● Use zmap + zgrab for hosts enumeration (feel free to use masscan + zgrab as well) ● Find open SSH -> Grab banners -> Filter masscan our banner ... zgrab https://github.com/sdnewhop/zgrab2
  • 28. SD-WAN OpenSSH Vulnerabilities ● CVE-2016-10708: OpenSSH before 7.4 allows remote attackers to cause a denial of service ● CVE-2017-15906: OpenSSH before 7.6 allows attackers to create zero-length files ● CVE-2016-10010: OpenSSH before 7.4, when privilege separation is not used, might allow local users to gain privileges ● CVE-2016-10011: OpenSSH private key leakage ● CVE-2010-5107: OpenSSH DoS ● CVE-2014-1692: OpenSSh DoS ● CVE-2016-0778: A buffer overflow on OpenSSH client ● CVE-2016-0777: OpenSSH client memory leak ● CVE-2016-8858: OpenSSH DoS https://github.com/sdnewhop/sdwan-harvester
  • 29. TELoIP Orchestrator API Version Disclosure Request: http://example.com/?debug=requestinfo Response: { "usage": ..., "host":"_v5.02_Teloip Orchestrator API", "hostType":"SelfHost (AppHostBase)", "startedAt":"2018-04-26 07:41:49", "date":"2018-06-20 16:57:44", "serviceName":"Teloip Orchestrator API", ... }
  • 30. TELoIP Orchestrator API Stack Trace Exposure
  • 32. Responsible Disclosure Results No response, but all reported issues were fixed
  • 35. Viprinet XSS ● CVE-2014-2045: Multiple Instances of XSS in Viprinet Multichannel VPN Router 300 ● Viprinet AdminDesk uses ExtJS 4.2.2.1144 ● ExtJS (4 to 6 before 6.6.0) is vulnerable to XSS (the report) ● Why does XSS matter here? ○ A private key is accessible via AdminDesk ○ VPN tunnel certificate fingerprint can be set via AdminDesk
  • 38. Viprinet CVE-2014-2045 ● http://<host>/exec?module=config&sessionid=<sessionid>& inspect=%3Cscript%20src=http://localhost:9090%3E%3C/scr ipt%3E ● “The inclusion of session IDs in all URLs partially mitigates the reflective cross-site scripting but could itself be considered a vulnerability” ● URL Example: ○ http://e.com/exec?module=ajaxconfig&sessionid=RkZGRkZGRkY4ODc5NDM 4MzkwMDM2Mzc4MQ&action=editors&inspect=ROUTERSERVICES.ADMINDESK
  • 39. Viprinet Interfaces ● There are 3 management interfaces on the Viprinet system ○ CLI available via 127.0.0.1:5111 ○ Old Web Interface ○ New Web Interface ● Access control allows adding a user and assigning privileges to him to write or read some sections (e.g., ADMINRIGHTS, QOSTEMPLATES) ● Using CLI, the added user with minimal privileges could set Name for created ITEM to <svg/onload=alert(ViprinetSessionId)>
  • 42. Responsible Disclosure Results No response ;-( Full disclosure: https://seclists.org/fulldisclosure/2018/Oct/41
  • 43. The Good Old Friend CSRF
  • 44. CSRF Intro ● CSRF is an attack that forces an end user to execute unwanted actions on a web application in which he was authenticated ● The primary protection method is anti-csrf tokens ● Defense in depth methods ○ Same-site cookies ○ Origin verification ● CSRF prevention misconceptions (NCC Group research) ○ Content-type header ○ Secret cookie ○ Multi-step requests
  • 45. CSRF in SD-WAN ● SD-WAN webapps don’t implement CSRF protection entirely or do it wrong ● The favorite method is Content-type header check, but… ● There is the SWF-based JSON CSRF exploit that bypasses that check ● Vulnerable systems ○ Citrix NetScaler SD-WAN ○ Viptela REST API ○ SilverPeak EdgeConnect
  • 46. SilverPeak REST API CSRF ● If and only if Content-Type value equals to “application/json” then a request is handled by the application ● This attack allows remote attackers to perform critical actions like setting BGP parameters, changing web configuration, adding users, etc. on behalf of an administrator ● It's possible to bypass this CSRF protection using Flash ● http://10.1.0.135/test.swf?jsonData={"issue":"111","mot d":"test"}&php_url=http://10.1.0.135/test.php&endpoint= https://54.158.216.59/8.1.4.9_65644/rest/json/banners
  • 48. Host Header Attacks ● Described by James Kettle in «Practical HTTP Host header attacks» in 2013 ● Riverbed SteelConnect was vulnerable to the password reset poisoning attack ● Host header value was used to build a link for password resetting ● An attacker can send a POST request with an arbitrary Host header value in case of knowing an admin's username and email ● If the admin clicks on the link the password token will be sent to the attacker's host
  • 51. Responsible Disclosure Results No response ;-( Full disclosure: https://seclists.org/fulldisclosure/2018/Oct/39
  • 53. Authentication ● During the research, we found several vulnerabilities related to insecure authentication ● All authentication checks were implemented on a client-side ● Authorization token was formed on a client-side, too ● Probably, developers did not distinguish JavaScript from NodeJS
  • 54. Client-side Authentication ? ! // TODO: fix in prod ?
  • 55. ZTD Bootstrapping with Hardcoded Password
  • 57. Overview ● A use of hard-coded cryptographic key was found in a one SD-WAN product (the vulnerability is being fixed now) ● All appliances use the same pre-installed PKC key pair and the corresponding self-signed certificate ● This certificate is used in Controller - Orchestrator communication protocol within Northbound API ● An attacker in MitM position can use the certificate and its private key to perform eavesdropping and spoofing attacks against all nodes
  • 58. Provisioning (1/2) 1. The Vendor copies the pre-generated appliance_cert Orchestrator Controllers Edge routers
  • 59. Provisioning (2/2) 2. The Customer generates the orchestrator_cert and manually installs it on the controller nodes Orchestrator Controllers Edge routers
  • 60. Communication Scheme (1/3) Orchestrator Controllers Edge routers appliance_cert orchestrator_cert appliance_cert orchestrator_cert appliance_cert orchestrator_cert appliance_cert appliance_cert appliance_cert Protocol initiation
  • 61. Communication Scheme (2/3) Orchestrator Controllers Edge routers appliance_cert orchestrator_cert appliance_cert orchestrator_cert appliance_cert orchestrator_cert TLS channel (TLS_RSA_WITH_AES_256_CBC_SHA, mutual auth, whitelisting) Server on TCP/2156 Client appliance_cert appliance_cert appliance_cert
  • 62. Communication Scheme (3/3) Orchestrator Controllers Edge routers appliance_cert orchestrator_cert appliance_cert orchestrator_cert appliance_cert orchestrator_cert Client can use PSK on the app layer Server on TCP/2156 Client appliance_cert appliance_cert appliance_cert
  • 63. Design Summary ● The “appliance_cert” certificate ○ It is pre-installed on all appliances (controller, orchestrator, network elements, etc.) ○ It is used for traffic encryption with TLS_RSA_WITH_AES_256_CBC_SHA cipher suite ● The “orchestrator_cert” certificate ○ It is generated on the Orchestrator ○ It must be manually installed on all controllers ● TLS ○ TLS_RSA_WITH_AES_256_CBC_SHA ○ PFS is not enforced ● A custom protocol is used to communicate between Orchestrator and other nodes over TLS ● It is worth noting, that this protocol also has a password-based authentication feature (PSK)
  • 64. appliance_cert.pem ● The same certificate on all nodes ○ Self-signed ○ The same SN - 97:D9:5C:BD:EC:AB:E2:93 ○ The same Md5sum - de44831068a3d3a641ae71bc37897421 ● How many those nodes are on the Internet?
  • 65. TCP 2156 ● SSL with hardcoded certificate on 2156/tcp ● Need to fingerprint SSL certificates on uncommon port ○ Shodan gives no results ○ Masscan can detect SSL and grab its certificate ● Implements a “vulncheck” function for grabbed SSL cert ● … ● EZ WIN https://github.com/sdnewhop/masscan
  • 66. Networks were harmed making the research No kangaroos were harmed during research But a network was... > well you kinda killed the entire Tomtech network.. > literally everything is down. > so looks like I can’t help you with servers anymore, sorry. “ ”
  • 68. What is the API and protocol used for? ● Download configs from virtual WAN appliances (get_config_file_chunk FILENAME) ● Download a list of configs (get_available_configs) ● Ping (ping) ● Get info (get_appliance_info) ● Get management IP address (get_network_mgt_ip_address) ● Get SSO token (get_sso_token) ● Upload config (initiate_config_upload FILENAME, put_config_file_chunk FILENAME, finalize_config_upload FILENAME)
  • 69. Authentication ● Mutual authentication and defence in depth mechanism ● Orchestrator authenticates to Controller using its "orchestrator_cert" certificate ● Controller authenticates to Orchestrator using the "appliance_cert" and white-listing method: ○ Controller can communicate with Orchestrator if its appliance_cert certificates are equal ○ Any arbitrary, but equal certificates ● Pre-shared Secret Key ○ Default user name (vendor name) ○ Password is empty
  • 71. Server does not enable the password check ● The password check designed and implemented but not used ● It is not possible to enable this password check
  • 72. Get Config Command with Empty Password
  • 73. Design Flaws ● Those certificates are roots of trust ● At the same time ○ The certificates are self-signed ○ The certificates are the same ○ There is no revocation mechanism ○ There is no automatic update mechanism ○ There is no integrity control ○ There is no integration with a private Customer PKI ● “This hockey we do not need” (Nikolai Ozerov)
  • 74. Attacker Capabilities 1. The attacker in passive MitM position can decrypt all communications 2. The attacker in active MitM position can perform active eavesdropping 3. The attacker in the target network can spoof an Controller 4. The attacker that is able to upload an SD-WAN certificate on a Controller node can get control over this SD-WAN network
  • 75. How easy to upload a malicious certificate? ● "www-data" user can create files in certificate directory by design ● It is possible to upload any certificate into this directory using vulnerabilities in the Web UI ● We identified multiple vulnerabilities to OS command injection attack, allowing us to upload an arbitrary Orchestrator certificate
  • 76. Responsible Disclosure Results 1. September 24, 2018: Reported 2. September 25, 2018: A bug was created 3. October 17, 2018: “We have reproduced the behavior you described and are now in the process of identifying the changes required to address it”
  • 78.
  • 79. SNMP Route Learning ● A proprietary mechanism to acquire routing tables from a router ● A developer’s linkedin page says the following: ○ “SNMP: Enhanced existing SNMP Route Polling functionality to improve efficiency and usability of route processing and route filtering in support of key Customer account.. ” ● snmpwalk-based implementation
  • 80. SNMP Routes Configuration * Screenshot from official user guide
  • 81. Results ● Insecure SNMPv2 protocol is used ○ Community string and SNMP Request ID are the only security mechanisms defending against SNMP spoofing ○ No route authentication and integrity ● An attacker in MitM-position can arbitrary change routing information ● Probable RCE and SQLi in the mechanism implementation
  • 83. Automatic Bandwidth Detection ● Citrix NetScaler SD-WAN has a bandwidth-detection mechanism automatically updating the running configuration and connection policies of data plane ● The bandwidth detection feature can be scheduled to run as frequently as every hour and maintains an historical table of what the bandwidth test results were ● The current bandwidth values are stored in MariaDB ● The basic idea: If we can change bandwidth data stored in the database, we can change data plane characteristics
  • 85. Is that System vulnerable to SQLi? ● Log_monitoring_utils.cgi is vulnerable to SQLi ● Events_download.cgi is vulnerable to SQLi
  • 86. SQL Injection in events_download.cgi Response will contain a gzip archive with events.csv file. CBVW_Events database name will be in the file
  • 87. Does that system have other vulns?
  • 88. Results 1. Remote Command Injection via Cookie 2. Remote Command Injection via Cookie in PAMAuthenticate.php 3. Multiple Remote Command Injections 4. Command Injection in vwcli.cgi 5. Session ID Leakage 6. Slow HTTP DoS Attacks 7. Multiple SQL Injections 8. Path Traversal in getfile.cgi 9. Path Traversal in viewfile.cgi 10. Reflected XSS in /cgi-bin/viewfile.cgi 11. Reflected XSS in /cgi-bin/pages.cgi 12. Stored XSS in pages.cgi 13. Cross-Site Request Forgery Protection is not Implemented 14. Missing Function Level Access Control
  • 89. Responsible Disclosure Results 1. June 14, 2018: Reported 2. June 15, 2018: A bug created 3. October 12, 2018: A vendor have addressed reported issues and have a bulletin drafted for release. CVEs are allocated and reserved 4. October 22, 2018: the vulnerabilities were fixed 5. Citrix NetScaler SD-WAN security testing report (POC2018 special release)
  • 91. ReDoS in IDS Rules
  • 95. Not so Secure :( 1. Slow HTTP DoS Attacks 2. Stored XSS in Inventory Management 3. Stored XSS in Custom Login Message 4. Stored XSS in Log Viewer 5. Cross-Site Request Forgery on Web UI 6. Cross-Site Request Forgery on REST 7. Missing Function Level Access Control 8. RCE via File Uploading 9. OS Command Injection for Unauthenticated User 10. Path Traversal in LogController
  • 96. Command Injection ● The vulnerability in "/app/webroot/storageMigrationCompleted.php" leads to OS command injection attack ● An attacker without any privileges can perform this attack ● It must have a network connection to the Web Management Interface only
  • 97. OS Command Injection in storageMigrationCompleted.php
  • 98. OS Command Injection in storageMigrationCompleted.php
  • 99. Responsible Disclosure Results 1. June 14, 2018: Reported 2. June 15, 2018: A bug created 3. October 12, 2018: A vendor have addressed reported issues and have a bulletin drafted for release. CVEs are allocated and reserved
  • 101. Conclusions ● Many, many, many bugs ● Current SD-WAN products are immature from a security point of view ● Huge attack surface ● Join the SD-WAN New Hope project