HTTP Security. CSC 482/582: Computer Security Slide #1

Size: px

Start display at page:

Download "HTTP Security. CSC 482/582: Computer Security Slide #1"

Magnus Robinson
5 years ago
Views:

1 HTTP Security CSC 482/582: Computer Security Slide #1

2 Topics 1. How HTTP works 2. HTTP methods, headers, and responses 3. URIs, URLs, and URNs 4. Statelessness 5. Cookies 6. More HTTP methods and headers 7. Proxying and Caching 8. HTTP Vulnerabilities CSC 482/582: Computer Security Slide #2

3 HTTP: HyperText Transfer Protocol Request for Resource Response Web Client Web Server CSC 482/582: Computer Security Slide #3

4 Pages Require Many Requests CSC 482/582: Computer Security Slide #4

5 HTTP GET Request Method URL Protocol Version GET HTTP/1.1 Headers Host: User-Agent: Mozilla/5.0 (Windows NT 6.2) Gecko/ Firefox/35.0 Accept: text/html, image/png, */* Accept-Language: en-us,en;q=0.5 Cookie: rememberme=true; PREF=ID=21039ab4bbc49153:FF=4 Blank Line No Data for GET method CSC 482/582: Computer Security Slide #5

6 HTTP POST Request Method URL Protocol Version POST HTTP/1.1 Headers Host: User-Agent: Mozilla/5.0 (Windows NT 6.2) Gecko/ Firefox/35.0 Accept: text/html, image/png, */* Accept-Language: en-us,en;q=0.5 Blank Line name=jane+doe&sex=female&color=green&ove r6feet=true&over200pounds=false&athletic ability=na POST data CSC 482/582: Computer Security Slide #6

7 HTTP Response Protocol Version HTTP Response Code Blank Line HTTP/ OK Headers Cache-Control: private Content-Type: text/html Server: GWS/2.1 Date: Fri, 13 Oct :16:30 GMT <HTML>... (page data)... </HTML> Web Page Data CSC 482/582: Computer Security Slide #7

8 Common HTTP Methods Method GET HEAD PUT DELETE OPTIONS POST Description Retrieve resource located at specified URI. Retrieve metadata about resource located at specified URI. Useful for caches to determine if they need to retrieve an updated resource. Create or replace resource located at specified URI with resource provided by client. Delete resource located at specified URI. Return list of HTTP methods that can be used with specified URI. Create a new resource under the specified URI, e.g. adding a new message in a web forum, adding a comment to a blog post, annotating a photo, etc. In summary, POST is a way for a client to create a new resource without knowing its URI; the client just knows the URI of a parent or factory resource. CSC 482/582: Computer Security Slide #8

9 Idempotence and Safety An operation is safe if making the request will not change any state on the server. GET, HEAD, and OPTIONS are safe. An operation is idempotent if making one request has the same effect as making a series of identical requests. PUT and DELETE are idempotent. POST is neither safe nor idempotent. It is possible for servers to misuse requests like GET. Example: GET If misused, testing tools, spiders, caches can destroy data. CSC 482/582: Computer Security Slide #9

10 Common HTTP Response Codes Response Code Meaning 200 OK Resource is available in the body of the response. No errors. 400 BAD REQUEST 500 INTERNAL SERVER ERROR 301 MOVED PERMANENTLY Client sent a request with an error. If there is a response body, it contains an error message. Server error. If there is a response body, it contains an error message. Client triggered action that caused URI to change or attempted to access old URI. 404 NOT FOUND No resource is available at the specified URI. 410 GONE Resource is no longer available at the specified URI. 409 CONFLICT Client requested action that would put resources in an inconsistent state. CSC 482/582: Computer Security Slide #10

11 Common Request Headers Header Accept: Authorization : Cookie: Content- Length: Host: If-Modified- Since: Referer: User-Agent: Description Content-types (Internet media types) acceptable for response. Authentication credentials for HTTP authorization. Sends state previously set by server back to server. Length of data in body (important for POST requests.) Name of server (and port if not default). Mandatory in HTTP/1.1. Server should only return a response if the data was modified since date specified in this header. URL of web page from which a link was followed to produce this request. Some URLs contain sensitive information, so some sites use intermediate services to anonymize this header. String that identifies browser, typically containing a product name and version (Firefox/36.0), layout name and version (Gecko/2010), operating system (Linux x86_64), and compatibility (Mozilla/5.0). CSC 482/582: Computer Security Slide #11

12 Common Response Headers Header Content- Length: Content- Type: Location: Server: Set-Cookie: Transfer- Encoding: WWW- Authenticate : Description Specifies length of response body sent to browser except in the case of chunked data, where chunk lengths are sent in body. Internet media type of data being sent to browser. Used in redirection responses. Server identification string, e.g. Apache/ Creation or overwriting of an HTTP cookie. Specifies encoding (compression type or chunked) for page data sent to browser. Specifies type of HTTP authentication that should be used. CSC 482/582: Computer Security Slide #12

13 HTTP Header Parsing Handling of duplicate headers. ~50% of browsers/servers will use first header. ~50% of browsers/servers will use last header. Mixing of protocol versions Difficult to predict effect of mixing of 1.0 and 1.1 headers, especially when headers have the same purpose. Ex: Expires(1.0) and Cache-Control(1.1) headers. Semicolon-delimited header values Quoted string format values not handled well by IE. Content-Disposition: attach; filename= evil.exe;.txt CSC 482/582: Computer Security Slide #13

14 Internet Media Types Standards Original MIME (Multipurpose Internet Mail Extensions) IANA maintains official registry of types at Format Type/Subtype; Optional Parameters Example: text/html; charset=utf-8 Handling in HTTP Requested in Accept: header. Specified by server in Content-Type: header. Browser may view directly, use plug-in, or start an external program. Slide #14

15 HTTP Standards Historical Standards HTTP 0.9 (1991) 1 st documented version. HTTP 1.0 (1996) defined in RFC HTTP 1.1 (1999) defined in RFC Current Standard (well specified HTTP/1.1, 2014) RFC 7230: Message Syntax and Routing RFC 7231: Semantics and Content RFC 7232: Conditional Requests RFC 7233: Range Requests RFC 7234: Caching RFC 7235: Authentication CSC 482/582: Computer Security Slide #15

16 HTTP/2 Focused on performance; no semantics changes Based on Google s SPDY protocol. Single TCP connection for each client/server pair. Allows multiple requests and responses to be sent simultaneously over same connection. HPACK header compression. Server can push additional documents (images, stylesheets, scripts, iframes). Status IETF finished, expected to publish RFC in 1Q2015. Firefox 36 and Chrome 40 will support draft HTTP/2. CSC 482/582: Computer Security Slide #16

17 Uniform Resource Identifiers (URIs) A URI is a string of characters that identify a web resource that come in two types. Uniform Resource Names (URNs) Identify a resource by name within a specific namespace. Ex: urn:isbn: Uniform Resource Locators (URLs) Identify a resource via a representation of its primary access mechanism, e.g. a network address. Ex: CSC 482/582: Computer Security Slide #17

18 URL Format Proto is the network protocol, e.g. http, ftp, mailto, etc. User and pw are optional authentication credentials. Host is the DNS name or IP address of the server. Port is the TCP port number; defaults to 80 for http. Path is the name of the resource on the server, which may or may not represent a filesystem path. Qstr is a query string typically used by GET requests to send parameters to an application. Frag is a fragment identifier used by the client to identify a location within a web page. It is not sent to the server. Some client apps use fragments for navigation, so their contents may be security sensitive. CSC 482/582: Computer Security Slide #18

19 URL Encoding Query string is set of key=value pairs separated by &?q=cloud&lang=en Whitespace marks end of URL Special characters must be URL-encoded. %HH represents character with hex values, e.g. %20 = space. Special characters include whitespace / # & Any character may be encoded, including proto, path, etc. URL encoding is also used in the body of POST requests. CSC 482/582: Computer Security Slide #19

20 HTTP is a stateless protocol A stateful protocol allows requests to move the server into a different state, in which a request may produce a different result. Example protocols: FTP, SMTP, TCP FTP command get rest.txt will return a different file when cwd is /public rather than /private. A stateless protocol treats each request as an independent transaction that is unrelated to any previous request so that communication consists of independent pairs of requests and responses. Examples: HTTP, IP CSC 482/582: Computer Security Slide #20

21 Stateless and Stateful Architectures CSC 482/582: Computer Security Slide #21

22 Handling Statelessness Store state information directly in the address (URI) To access second page in google search for http : q=http&safe=off&start=10 Works best for web services. Store state indirectly in an HTTP header (cookies) Most common type of state storage. Some plug-ins can store state. Flash cookies are the most common type. HTML 5 provides browser storage features. CSC 482/582: Computer Security Slide #22

23 Cookies Maintain state via HTTP headers State specified is set of name=value pairs. Set-Cookie header sent from server. Cookie header sent from browser. No RFC specification used til RFC 6265 in Examples Set-Cookie: foo=bar; path=/; expires Fri, 20-Feb :59:00 GMT Cookie: foo=bar Encoding Encode cookies with base64 to avoid metacharacter interpretation (colons, commas, slashes, quotes, etc.) CSC 482/582: Computer Security Slide #23

24 Cookie Fields Expires: if specified, cookie may be saved to disk and persist across sessions. If not, then cookie persists for duration of browser session. Max-age: similar to Expires, but not supported by IE. Domain: scoping mechanism to allow cookie to be scoped to domain broader than host that sent Set-Cookie header. Path: scopes cookie to a specified path prefix. Secure: prevents cookie from being sent over non-encrypted connections. HttpOnly: removes ability to read cookie via document.cookie API in JavaScript to protect against XSS. CSC 482/582: Computer Security Slide #24

25 Cookie Security Policy Domain parameter limits which servers are sent cookie in complex ways (see table). Path parameter limits which paths are sent cookies, but JavaScript from any path can read cookies. CSC 482/582: Computer Security Slide #25

26 More HTTP Methods Method COPY MOVE SEARCH PROPFIND CONNECT TRACE Description Copies file to path in Destination header. Part of WebDAV specification. Moves file to path in Destination header. Part of WebDAV specification. Searches directory path for resources. Retrieves information about resources, such as author, size, content-type. Make non-http connections via HTTP proxies. Returns exact request received by header in response body. Can be used to bypass HttpOnly cookie protection against XSS attacks.

27 HTTP TRACE Example $ telnet localhost 80 Trying... Connected to Escape character is '^]'. TRACE / HTTP/1.1 Host: foo x-myheader: spam HTTP/ OK Date: Mon, 04 Mar :34:45 GMT Server: Apache/ (Unix) Connection: close Content-Type: message/http TRACE / HTTP/1.0 x-myheader: spam Host: foo Connection closed. CSC 482/582: Computer Security Slide #27

28 HTTP Proxies Browser configured to proxy GET request GET HTTP/1.1 User-Agent: mybrowser/2.0 Host: URL and Host specifications Perform same task. Evolved separately. Proxy must be careful to avoid being tricked into caching page from one as page from another site GET HTTP/1.1 Host: CSC 482/582: Computer Security Slide #28

29 HTTP Caching HTTP/1.1 cache behavior GETs with 200, 301, &c responses may be cached. Cache may be returned to any future requests for that URL even if headers differ, including cookies. Cache may revalidate content (with If-Modified-Since header) before reuse but is not required to do so. Cache-Control header Public: document is cacheable publicly. Private: proxies are not permitted to cache. No-cache: cache but don t reuse; only FF supports. No-store: do not cache this document at all. Pragma: no-cache from HTTP/1.0 still in use. CSC 482/582: Computer Security Slide #29

30 HTTP Headers HTTP headers can be vulnerable to Injection Attacks, including SQL Injection Cross-Site Scripting (XSS) Most commonly vulnerable headers Referer User-Agent String useragent = request.getheader( user-agent ); String squery = DELETE FROM UP_USER_UA_MAP WHERE USER_ID= + userid + AND USER_AGENT= + useragent +... stmt.executeupdate(squery); CSC 482/582: Computer Security Slide #30

31 HTTP Header Injection Add new header + body content to HTTP response. Client sends input containing end-of-line (EOL) HTTP EOL is CR/LF (\r\n, %0d%0a URL-encoded) Example Code: String author = request.getparameter(author_param);... Cookie cookie = new Cookie("author", author); cookie.setmaxage(cookieexpiration); response.addcookie(cookie); CSC 482/582: Computer Security Slide #31

32 HTTP Response Splitting Malicious input submitted via AUTHOR_PARAM form input: A Hacker\r\nHTTP/ OK\r\nContent-Type: text/html\r\n <html>hacker Content</html> Resulting HTTP responses HTTP/ OK Set-Cookie: author=a Hacker HTTP/ OK Content-Type: text/html <html>hacker Content</html>

33 Response Splitting Impact Attacker controls page contents Page defacement. Can redirect to attacker controlled site. Script executes in context of legitimate site JavaScript sent by attacker as part of second response has access to cookies and other data of legitimate site. CSC 482/582: Computer Security Slide #33

34 Cache Poisoning Attack 1. Select a page to poison in proxy cache. Replace /admin with phishing trojan. 2. Locate header injection vulnerability. Inject second response body with trojan. 3. Connect to proxy and send requests. 1. First request is header injection described above. 2. Second request is for page that s being poisoned. 4. Proxy talks to app, gets response. 5. Proxy interprets 2 nd response body as response to attacker s 2 nd pipelined request. Updates cache with trojan version. CSC 482/582: Computer Security Slide #34

35 Key Points 1. Requests 1. Idempotence 2. Safety 2. Stateless architecture 3. Cookies 4. HTTP response splitting 5. Cache poisoning CSC 482/582: Computer Security Slide #35

36 References 1. David Gourley et. Al., HTTP: The Definitive Guide, O Reilly, Krishnamurthy et. Al., Key Differences Between HTTP/1.0 and HTTP/1.1, 3. Mark Nottingham, RFC 2616 is Dead, Dafydd Stuttart and Marcus Pinto, The Web Application Hacker s Handbook, 2 nd Edition, Wiley, HTTP/2 Home Page, 6. Sanctum, HTTP Response Splitting Whitepaper, tpresponse.pdf, Michael Zalewski, The Tangled Web: A Guide to Securing Modern Web Applications, No Starch Press, CSC 482/582: Computer Security Slide #36

How to work with HTTP requests and responses

How a web server processes static web pages Chapter 18 How to work with HTTP requests and responses How a web server processes dynamic web pages Slide 1 Slide 2 The components of a servlet/jsp application