1 / 74

CGI Scripting and Vulnerabilities

CGI Scripting and Vulnerabilities. COEN 351: E-commerce Security. Thomas Schwarz, S.J. 2006. CGI with Perl Fundamentals. Webserver passes information to the CGI script via environmental variables. %ENV hash CGI scripts produce output by printing an HTTP message on STDOUT

farica
Télécharger la présentation

CGI Scripting and Vulnerabilities

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. CGI Scripting and Vulnerabilities COEN 351: E-commerce Security Thomas Schwarz, S.J. 2006

  2. CGI with Perl Fundamentals • Webserver passes information to the CGI script via environmental variables. • %ENV hash • CGI scripts produce output by printing an HTTP message on STDOUT • CGI scripts need to put out an HTTP header, but it does not have to be a full one.

  3. CGI with Perl Fundamentals • Perl has three standard file handles. • STDIN • Webservers passes request (with the header removed) to the cgi script. • If there is post data, it will be available for reading from STDIN. • There is no end-of-file marker, so read the content-length header to decide when you read the end-of-input, otherwise the script will hang. • STDOUT • Perl writes HTTP header and body through STDOUT. • Different webservers have different buffering policies. • STDERR • Perl can send error messages to STDERR. • However, webservers differ in how they treat the output. • Apache puts STDERR output into the log. • iPlanet puts STDERR into the HTTP, but probably out of order, because STDERR traffic is not buffered.

  4. CGI with Perl Fundamentals • You are now ready to create a webpage in your home directory • index.html • Next step is to try a cgi script. #!/perl/bin/perl -wT print "Content-type: text/html\n\n"; print "<h1>Hi</h1>\n"; Path to the perl executable. Different from UNIX!

  5. CGI with Perl Fundamentals • Creating dynamic web-pages with PERL • Web server passes information to CGI scripts via environment variables. • CGI scripts produce output by printing the HTTP message on STDOUT. • CGI scripts do not need to printout full headers.

  6. CGI with Perl Fundamentals

  7. CGI with Perl Fundamentals • This script uses only a simple header. • Notice the double lines in the first print statement. • This generates a basic HTTP message. • HTTP requests:

  8. CGI with Perl Fundamentals • The minimum requirement for a static website are: • The “Content-Type” line. • The document itself. • Need to include the she-bang line. • Use taint mode as a generic precaution. • Use the CGI::Carp Perl module • Perl has a handy short-cut to print out many lines of text.

  9. CGI with Perl Fundamentals • Header Types • Content-type header • Redirection • Status Message

  10. CGI with Perl Fundamentals Shebang with path to Perl #! /perl/bin/perl -wT use CGI::Carp qw(warningsToBrowser fatalsToBrowser); print <<EHTML; Content-type: text/html <html> <head><title>Environmental Variables</title></head> <body> <h1>Hi</h1> <pre> Server $ENV{SERVER_NAME} Listening port $ENV{SERVER_PORT} Server software $ENV{SERVER_SOFTWARE} Server protocol $ENV{SERVER_PROTOCOL} CGI version $ENV{GATEWAY_INTERFACE} </pre> </body> </html> EHTML Sends diagnostic messages to the browser. Remove before posting it. This allows you to just type in code instead of using individual print statements. The closing EHTML (or whatever token you choose) needs to be in the first position in the line and followed by an empty line. Environmental variables

  11. CGI with Perl Fundamentals #! /perl/bin/perl -wT use CGI::Carp qw(warningsToBrowser fatalsToBrowser); print <<EHTML; Content-type: text/html <html> <head><title>Environmental Variables</title></head> <body> <h1>Hi</h1> <pre> Server $ENV{SERVER_NAME} Listening port $ENV{SERVER_PORT} Server software $ENV{SERVER_SOFTWARE} Server protocol $ENV{SERVER_PROTOCOL} CGI version $ENV{GATEWAY_INTERFACE} </pre> </body> </html> EHTML

  12. CGI with Perl Fundamentals • Environmental Variables • AUTH_TYPE • CONTENT_LENGTH • CONTENT_TYPE • DOCUMENT_ROOT • GATEWAY_INTERFACE • PATH_INFO • PATH_TRANSLATED

  13. CGI with Perl Fundamentals • Environmental Variables • QUERY_STRING • REMOTE_ADDR • REMOTE_HOST • REMOTE_IDENT • Ident daemon: UNIX and IRC clients only • REMOTE_USER • REQUEST_METHOD

  14. CGI with Perl Fundamentals • Environmental Variables • SCRIPT_NAME • SERVER_NAME • SERVER_PROTOCOL • SERVER_SOFTWARE

  15. CGI with Perl Fundamentals • Additional CGI Environment Variables: • HTTP_ACCEPT • HTTP_ACCEPT_CHARSET • HTTP_ACCEPT_ENCODING • HTTP_ACCEPT_LANGUAGE • HTTP_COOKIE • HTTP_FROM • HTTP_HOST • HTTP_REFERER • HTTP_USER_AGENT

  16. CGI with Perl Fundamentals • Environmental Variables • Secure server adds many more environmental variables. • X.509 server / browser certificates • HTTPS • Used as a flag to indicate whether the connection is secure. • Values vary by server • “ON”, “on”, “Off”, “off”

  17. CGI with Perl Fundamentals #!/perl/bin/perl -wT use CGI qw(:standard); use CGI::Carp qw(warningsToBrowser fatalsToBrowser); my $email = "tjschwarz\@scu.edu"; my $url = "http://www.cse.scu.edu"; print header; print start_html("Scalars"); print <<EndHTML; <h2>Hello</h2> <p> My e-mail address is $email, and my web url is <a href="$url">$url</a>. </p> EndHTML print end_html;

  18. CGI with Perl Fundamentals

  19. CGI with Perl Fundamentals • CGI can output full or partial headers. • Partial headers: One of • Content-type header • Location header • Specifies URL to redirect the client to. • Status header • E.g. “204 No response” • Delimited by TWO new-lines

  20. CGI with Perl Fundamentals

  21. CGI with Perl Fundamentals • When using a code, remember that the HTTP status message is not displayed. • Therefore, you might want to formulate your own error page.

  22. CGI with Perl Fundamentals • Complete Headers: • Need status line. • Need Content-type line • Need Server header. • The last two are given to you as environmental variables. • Called nph (non-parsed header) scripts

  23. CGI: Forms COEN 351

  24. CGI: Getting Data from Client • HTML provides forms as a means to gather information and send them to the server. • Use either POST or GET method.

  25. CGI: Getting Data from Client • HTML form tags • <FORM ACTION = “register.cgi” METHOD = “POST”> • METHOD: Either GET or POST • ACTION: URL of the script that should receive the HTTP request. • Default is the same URL • ENCTYPE: Specifies the media type used to encode the request. Default is usually adequate. • onSubmit: Javascript handler.

  26. Getting Data from Client

  27. Getting Data from Client

  28. Getting Data from Client • Script register.cgi receives data. • HTTP request looks like this: POST register.cgi HTTP/1.1 Host: bobadilla.engr.scu.edu Content-Length: 11 Content-Type: application/x-www-form-urlencode name=thomas

  29. Getting Data from Client

  30. Getting Data from Client

  31. Getting Data from Client • To read the data: • Read the data from the query string: • $ENV{QUERY_STRING} • Determine the method • $ENV{REQUEST_METHOD} • If the method is POST, determine the size of the request • $ENV{CONTENT_LENGTH} • Read that amount of data from STDIN • Parse the data and process it.

  32. Getting Data from Client Determine the request method Read up to $ENV{CONTENT_LENGTH} from stdin

  33. Getting Data from Client

  34. Getting Data from Client

  35. Getting Data from Client • In principle, you can write a perl parse function that will parse the input and give it to you in nice value-pair form. • In reality, you want to use a perl module that prepares the input for you. • See next week’s cgi lesson.

  36. CGI: CGI.pm COEN 351

  37. CGI.pm • Perl Modules • Pre-written code. • Standard library modules. • Other modules e.g. at Comprehensive Perl Archive Network. • CGI.pm module • Load with “use CGI qw(:standard);” • Has various function names: • header • start_html • end_html

  38. CGI.pm • CGI.pm handles • Input • Replaces environment variables with environment methods • HTML output • Easy handling of http headers • start_html, end_html • Error handling

  39. CGI.pm • Comes with two small vulnerabilities of the DOS type • Can be fixed by setting values in CGI.pm • Allows uploading arbitrarily large files. • Set $DISABLE_UPLOADS = 1. • Allows arbitrarily large post messages • Set $POST_MAX = 102_400; #100KB max

  40. CGI.pm • CGI.pm module • print start_html(“hello”) • Prints out: <html><head><title>hello</title></head><body> • end_html • Prints out: </body></html>

  41. CGI.pm • CGI.pm can be used in an object-oriented and in an imperative style. Imperative version use CGI qw(:standard); print header; print start_html("Hello World"); Object-Oriented Version use CGI; # don't need qw(:standard) $cgi = CGI->new; # ($cgi is now the object) print $cgi->header; # function call: $obj->function print $cgi->start_html("Hello World");

  42. CGI.PM Output http://perldoc.perl.org/CGI.html

  43. CGI.PM Handling Output • Simple method calls to generate html output: • $q->header • q->header( -type => "text.html", -target => "main_frame", -expires => "+30m", -status => "444 What's that");

  44. CGI.PM Handling Output • q->start_html • q->end_html • $q->hr • $q->h1(...) • $q->h2(...) • $q->p(…)

  45. CGI.PM Handling Output • Form Elements such as: • start_form • end_form • textfield • password_field • filefield • button • submit • reset • hidden • ...

  46. CGI.PM Handling Output #!/perl/bin/perl.exe use strict;use CGI; my $q = new CGI; print $q->header("text/html"),$q->start_html( -title => "Env Var", -bgcolor => "#f0f0f0"),$q->h3("HTTP Environmental Variables"); foreach( $q->http) { print $q->p($_.": ",$q->http( $_ ), "<br><br>");}$q->end_html;

  47. CGI.PM Handling Output • The example demonstrates output as well as access to the http environmental variables. • The latter are accessed through the http method.

  48. CGI.PM Handling Output #!/perl/bin/perl.exe use strict;use CGI; my $q = new CGI; print $q->header("text/html"),$q->start_html( -title => "Env Var", -bgcolor => "#f0f0f0"),$q->h3("HTTP Environmental Variables"); foreach( $q->http) { print $q->p($_.": ",$q->http( $_ ), "<br><br>");}$q->end_html;

  49. CGI.pm • Alternatives for output • CGI methods • Compact, but limited expressionability • Lots of print statements • Lots of typing, easy to control • “here document” feature in Perl • Straight html text from perl

  50. CGI.PM Handling Input http://perldoc.perl.org/CGI.html

More Related