WhiteHat Security “Web Application Security” and “Presenting”

1. Windows Security 2002 BlackHat New Orleans WhiteHat Security“Web Application Security”and“Presenting” Jeremiah Grossman jeremiah@whitehatsec.com

2. Topics • Web Application Security Landscape • Why is Web Application Security Important • Common Web Application Security Mistakes • Web Application Attack Methodologies

3. Web Application Security Landscape E-Commerce Shopping Auctions Banking Stock Trading Just Plain Crazy Printers PDA’s Cell Phones System Configuration .NET/Passport Entertainment Message Boards WebMail Guest Books Voting Polls

4. Web Application The Simple Definition A web application or web service is a software application that is accessible using a web browser or HTTP(s) user agent.

5. Web Application The “EASIER” Definition If it runs on port 80 or port 443, then is probably a web application.

9. Why is Web Application Security Important? • Easiest way to compromise hosts, networks and users. • Widely deployed. • No Logs! (POST Request payload) • Incredibly hard to defend against or detect. • Most don’t think of locking down web applications. • Intrusion detection is a joke. • Firewall? What firewall? I don’t see no firewall… • Encrypted transport layer does nothing. • How much easier can it get!? Unicode.

10. Common Web Application Security Mistakes Trusting Client-Side Data Unescaped Special Characters HTML Output Character Filtering SUID ActiveX/JavaScript Authentication Lack of User Authentication before performing critical task.

11. Trusting Client-Side Data DO NOT TRUST CLIENT-SIDE DATA!!! Trusting client-side data is #1 cause of vulnerabilities. Identify all input parameters that trust client-side data.

12. Unescaped Special Characters The Level of Trust : Searches/Queries/Templates Path: http://foo.com/cgi?val=string&file=/html/name.db Or better yet… http://www.foo.com/cgi?string=root&file=../../../../../etc/passwd

13. Unescaped Special Characters ! @ $ % ^ & * ( ) -_ + ` ~ \ | [ ] { } ; : ' " ? / , . > < Check for: Unescaped special characters within input strings

14. HTML Character Filtering Proper handling of special characters > => &gt; < => &lt; " => &quot; & => &amp; Null characters should all be removed. %00

15. More mistakes… SUID (Does a web application really need root?) Authentication mechanisms using technologies such as JavaScript or ActiveX. Lack of re-authenticating the user before issuing new passwords or performing critical tasks. Hosting of uncontrolled data on a protected domain.

16. WhiteHat Arsenal • GUI Web-Based Interface • Session Based • Discovery Utilities • Active Assessment • Encoding/Decoding • Reporting

17. Web Application Penetration Methodologies Information Gathering & Discovery Input/Output Client-Side Data Manipulation

18. Information Gathering & Discovery • Spidering /Site Map • Identifiable Characteristics • Error and Response Codes • File / Application Enumeration

19. Spidering

20. Spidering/Site Crawling • Site Map • Service Map • Documentation • Hidden Services • CGI's and Forms • Email addresses

21. Identifiable Characteristics Comment Lines URL Extensions Meta Tags Cookies Client-Side scripting languages Enormous wealth of information about process flows, debug command, system types and configurations.

22. Error and Response Codes HTTP Response Headers Server: IBM/Apache 1.3.19 Cookie Characteristics Error Messages Exception Messages (Java / SQL) 404 Error Pages Failed Login Locked Account Database or file non-existent

23. File/Application Enumeration Commonly referred to as “forced browsing” or “CGI Scanning”.

24. File/Application Enumeration Sample Files Template Directories Temp or Backup files Hidden Files Vulnerable CGIs

25. Common Directories

26. Common Log Files

27. Common Backup Files

28. Input/Output Client-Side Data Manipulation URL Manipulation CGI Parameter Tampering HTTP Client-Header Injection Filter/Intrusion Detection Evasion Protocol/Method Manipulation Overflows

29. Input Manipulation Parameter Tampering"Twiddling Bits." • Cross-Site Scripting • Filter-Bypass Manipulation • OS Commands • Meta Characters • Path/Directory Traversal • Hidden Form Field Manipulation • HTTP Headers

30. Cross-Site ScriptingBad name given to a dangerous security issue Attack targets the user of the system rather than the system itself. Outside client-side languages executing within the users web environment with the same level of privilege as the hosted site.

31. Client-Side Scripting Languages DHTML (HTML, XHTML, HTML x.0) Opens all the doors. • JavaScript (1.x) Browser/DOM Manipulation • Java (Applets) Malicious Applets • VBScript Browser/DOM Manipulation • Flash Dangerous Third-Party Interactivity • ActiveX Let me count the ways… • XML/XSL Another Door Opener • CSS Browser/DOM Manipulation

32. The Scenarios • Trick a user to re-login to a spoofed page • Compromise authentication credentials • Load dangerous of malicious ActiveX • Re-Direct a user or ALL users • Crash the machine or the browser

33. CSS Danger“The Remote Launch Pad.” • Successfully CSS a user via a protected domain. • Utilizing a Client-Side utility (JavaScript, ActiveX, • VBScript, etc.), exploit a browser hole to download • a trojan/virus. • User is unknowingly infected/compromised within • a single HTTP page load. • ActiveX Netcat Anyone?

34. 2 Types of CSS • Click on a link to activate <A HREF=“http://www.evil_javascript_link”> Click Here </A> • Auto-Execute by viewing HTML <SCRIPT>run evil JavaScript</SCRIPT>

35. Dangerous HTML“HTML Bad” • <APPLET> Malicious Java Applications • <BODY> Altering HTML Page Characteristics • <EMBED> Embedding Third-Party Applications (Flash, etc.) • <FRAME> Directly calling in other uncontrolled HTML • <FRAMESET> Directly calling in other uncontrolled HTML • <HTML> Altering HTML Page Characteristics • <IFRAME> Directly calling in other uncontrolled HTML • <IMG> SCRing Protocol attacks and other abuses • <LAYER> Directly calling in other uncontrolled HTML • <ILAYER> Directly calling in other uncontrolled HTML • <META> META Refreshes. (Client-Redirects) • <OBJECT> ActiveX (Nuff Said) • <SCRIPT> JavaScript/VBScript Loading • <STYLE> Style Sheet and Scripting Alterations

36. Dangerous Attributes“Attributes Bad” • ATTRIBUTE DANGER LIST • (Any HTML Tag that has these attributes) • STYLE • SRC • HREF • TYPE

37. Power of the Dots and Slashespiping input to the command line. • Path Directory Traversal • http://foo.com/app.cgi?directory=/path/to/data • DotDot Slash: • http://foo.com/app.cgi?dir=path/to/data../../../../etc/passwd • Dot Slash: • http://foo.com/app.cgi?dir=path/to/data../../../../etc/././passwd • Double DotDot Slash: • http://foo.com/app.cgi?dir=path/to/data....//….//….//etc/passwd

38. More Filter Bypassing • Method Alteration (HEAD, PUT, POST, GET, ect.) • URL Encode • http://www.foo.com/cgi?value=%46%72%68%86 • Null Characters • http://www.foo.com/cgi?value=file%00.html • More… • Alternate Case, Unicode, String Length, Multi-Slash, etc.

39. More Filter Bypassing • Method Alteration (HEAD, PUT, POST, GET, ect.) • URL Encode • http://www.foo.com/cgi?value=%46%72%68%86 • Null Characters • http://www.foo.com/cgi?value=file%00.html • More… • Alternate Case, Unicode, String Length, Multi-Slash, etc.

40. Authentication & Session Management Brute/Reverse Force Session Hi-Jacking Session Replay Session Forgoing Page Sequencing

41. Reporting XML/HTML Based Manual Hack Attack Log w/ Descriptor Common Directory Force Browsing Common Log File Force Browsing Backup File Force Browsing Spider Log

42. Spider XML Log

43. Attempts XML Log

44. A few quick things to help secure a web application. • Do Not Trust Client-Side Data • Escape and filter all input/output data • Set-up parameter and request method allow lists. Don’t use what your not expecting to receive.

45. Thank You!BlackHat and AttendeesQuestions? Jeremiah Grossman jeremiah@whitehatsec.com WhiteHat Security All presentation updates will be available on www.whitehatsec.com and community.whitehatsec.com