ANZTB SIGIST May 2011 Perth OWASP How minor vulnerabilities can do very bad things. OWASP Wednesday 25 th May The OWASP Foundation

Transcription

1 ANZTB SIGIST May 2011 Perth OWASP How minor vulnerabilities can do very bad things Christian Frichot / David Taylor (Some of) Perth OWASP s Chapter Leads OWASP Wednesday 25 th May 2011 Copyright The OWASP Foundation Permission is granted to copy, distribute and/or modify this document under the terms of the OWASP License. The OWASP Foundation

2 Introductions Photo of handshake removed to reduce file size. OWASP

3 Why we think this is important. OWASP

4 Impact Crater 4

5 Photo of bored cat removed to reduce file size. *bored cat 5

6 Photo of scared cat removed to reduce file size. *scared cat is scared 6

7 Overview Overview of the evening From XSS to total session compromise Would you like some BeEF with your XSS? Remote File Include, an attackers best friend. When RFI met Metasploit Useful SQL Injection OWASP 7

8 A Brief History Of OWASP 8

9 Cross Site Scripting (XSS) "XSS flaws occur whenever an application takes untrusted data and sends it to a web browser without proper validation and escaping. XSS allows attackers to execute script in the victim s browser which can hijack user sessions, deface web sites, or redirect the user to malicious sites. What does this mean? Attackers can execute scripts within a users browser. This may lead to defacement, session hijacking, browser redirection or even the installation of malware. OWASP 9

10 Reflective XSS Authenticated User 2. XSS script forces Browser to submit document.cookie to Evil Server Hi Joe, We ve noticed you haven t updated your phone number. Click here to proceed. Thanks document.cookie Vulnerable App 4. Collect cookies Attacker Evil Server OWASP 10

11 Stored XSS Vulnerable App Authenticated User 1. Post comment on blog Including XSS 2. Visits blog Attacker 4. Collect cookies kie 3. document.cooki Evil Server OWASP 11

12 Injection "Injection flaws, such as SQL, OS, and LDAP injection, occur when untrusted data is sent to an interpreter as part of a command or query. The attacker's hostile data can trick the interpreter into executing unintended commands or access unauthorised data. What does this mean? Injection can result in data loss or corruption, lack of accountability, or denial of access. In worst case scenarios it can lead to complete OWASP 12 host takeover.

13 Setting the scene Your developers create a Secure Cloud Open Access Tool Secure portal for exchanging files with customers. Your company, Acme, take their information very seriously, as most of their intellectual property is contained within. OWASP 13

14 This slide left intentionally blank 14

15 Conclusions from Session Compromise According to the OWASP Top 10 of 2010, XSS is the most prevalent web application security flaw. The Web Hacking Incident Database (WHID) lists XSS as the 3 rd top attack method.[1] Detecting XSS is easy. Open Source: w3af, rat, XSSscan.py, XSSFuzz etc Mixed Source: Burp! (If you buy one piece of software, buy this) Bling ($$) Source: IBM AppScan, HP WebInspect, NTOSpider [1] OWASP 15

16 16

17 Photo of person removed to reduce file size. Session Compromise 17

18 OWASP 18

19 Browser Exploitation Framework Photo of meat removed to reduce file size. OWASP 19

20 OWASP

21 (insert demo here) OWASP 21

22 Conclusions from BeEF injection ;) Why do things manually, when you can do them automagically? The web browser IS the operating system. Clearly demonstrates how a fairly trivial vulnerability can explode into something larger OWASP

23 OWASP

24 (insert break here) OWASP 24

25 OWASP

26 Photo of Nano car removed to reduce file size. *Planet's cheapest car, the Nano. OWASP

27 Photo of Bentley Coupe removed to reduce file size. *This is a Bentley Coupe!= planet s cheapest car OWASP

28 OWASP

29 OWASP

30 OWASP

31 But how does an attacker deface a website? RFI or Remote File Inclusion Was in OWASP s Top 10 in 2007 Used to be highly prevalent in PHP until the default configuration was changed Exploits the require or include functions, eg: Include $_GET[ option ] OWASP

32 (insert scariness here) OWASP 32

33 Conclusions The web is a great channel for exploiting PCs Google s research back in 2007 highlighted: One in 10 web pages contained malicious code F-secure 2010: Adobe Reader files were exploited in almost 49% of targeted attacks in 2009 Keep your applications up to date! OWASP

34 OWASP

35 SQL Injection The login page of the application is vulnerable to SQL Injection: SELECT $id FROM dt_users WHERE user= $user AND pass= $pass What happens if we make the username: jdoe AND 1=1 -- The SQL becomes SELECT $id FROM dt_users WHERE user= jdoe AND 1=1 AND pass= $pass OWASP

36 Blind SQL Injection So, we can log into the app without a password - pretty cool. But what if we want to mess with the database some more? The SQL Injection is blind because none of the results from the SELECT are echoed to the browser. OWASP

37 Taking Over The World, 1 Bit At A Time Essentially we can get 1 bit of data from the database at a time: If the trailing condition evaluates to TRUE, the application gets logged in. If the trailing condition evaluates to FALSE you get the password error message. For example: SELECT $id FROM dt_users WHERE user= jdoe AND 1<2 TRUE SELECT $id FROM dt_users WHERE user= jdoe AND 1>2 FALSE OWASP

38 Lets take a short detour Binary Search Photo of detour sign removed to reduce file size. OWASP

39 Detour: Binary Search OWASP

40 Detour: Binary Search Example: Searching for an ASCII character Is character < ASCII code 128? Yes Is character < ASCII code 64? No Is character < ASCII code 96? Yes Is character < ASCII code 80? No Is character < ASCII code 88? No Is character < ASCII code 92? Yes Is character < ASCII code 90? Yes Is character < ASCII code 89? No Character is ASCII 89! ( X ) OWASP

41 Detour: Binary Search Each step in a binary search requires 1 bit of information. We have a SQL Injection bug that reveals 1 bit of information at a time. Binary search, meet Blind SQL Injection. Blind SQL Injection, this is Binary Search. OWASP

42 Blind SQL Injection Setting it up SUBSTRING(CAST((SELECT SELECT version() ASCII(SUBSTRING(CAST((SELECT version()) version()) CHAR(4000)) version()) AS CHAR(4000)),1,1)) OWASP

43 Blind SQL Injection Putting it into action SELECT WHERE user= jdoe AND 64>(SELECT 96>(SELECT 128>(SELECT ASCII(SUBSTRING(CAST((SELECT version()) AS CHAR(4000)),1,1))) And so on And so on And so on And THEN SELECT WHERE user= jdoe AND 128>(SELECT ASCII(SUBSTRING(CAST((SELECT version()) AS CHAR(4000)),2,1))) And so on And so on And so on And so on OWASP

44 Blind SQL Injection Luckily there are tools to do this for us. (insert pwnage here) OWASP

45 Conclusions (BSQLi) Tiny little blind SQL injection bugs can (eventually) leak your entire database BSQLi bugs are pretty hard to find (unless you ve got the source code) Even after you ve found them, they are reasonably difficult (and noisy) to exploit Validate inputs and use parameterised queries OWASP

46 No tools were harmed in the making of this presentation BeEF ( Metasploit Framework ( SQLMap ( SQL Power Injector *not demonstrated ( Burp Suite Professional ( OWASP

47 Photo of many spanners removed to reduce file size. OWASP 47

48 OWASP 48

49 OWASP 49

50 OWASP Enterprise Security API (ESAPI) Don t write your own security controls! Reinventing the wheel when it comes to developing security controls for every web application or web service leads to wasted time and massive security holes OWASP 50

51 ESAPI not just about preventing XSS/SQLi Authentication Access Control Input Validation Output encoding/escaping Cryptography Error handling and logging Communication security HTTP security Security configuration OWASP 51

52 OWASP s Development Guide Allow businesses, developers, designers and solution architects to produce secure web applications OWASP 52

53 OWASP 53

54 OWASP 54

55 Wrapping it up Relatively innocuous bugs can be leveraged to do bad things (to the client or the server) Weaponised exploitation frameworks and tools currently exist Secure coding practices and security assessments to minimise exposure OWASP

56 Photo of large question mark removed to reduce file size.