Basic Web Hacking Tools MSS book csci 5931
Basic Web Hacking & Tools (MSS book) csci 5931 Web Security 1
Topics A. Ch. 4, 15 (Netcat, Achilles, HTTPS) B. Ch. 5 (URLs, HTML Forms) C. Ch. 6 (Web Application Components) csci 5931 Web Security 2
Network Utility Programs q Netcat http: //www. atstake. com/research/tools/network_u tilities/ q Cryptcat http: //sourceforge. net/projects/cryptcat/ csci 5931 Web Security 3
Network Utility Programs 1. Example Use of Netcat To get a web page: 1. nc sce. uhcl. edu 80 GET / HTTP/1. 0 HTTP/1. 1 200 OK Server: Microsoft-IIS/5. 0 Date: Wed, 26 Feb 2003 15: 08: 22 GMT Connection: Keep-Alive Content-Length: 10166 Content-Type: text/html Set-Cookie: ASPSESSIONIDSASQDDAR=MECEBLAAEIKECJGFFELEBJMA; path=/ Cache-control: private <html> <head> <title>SCE Home Page</title> … csci 5931 Web Security 4
Network Utility Programs 1. Example Use of Netcat 1. To get the meta information of a web page: nc sce. uhcl. edu 80 HEAD / HTTP/1. 0 HTTP/1. 1 200 OK Server: Microsoft-IIS/5. 0 Date: Wed, 26 Feb 2003 15: 11: 33 GMT Connection: Keep-Alive Content-Length: 10166 Content-Type: text/html Set-Cookie: ASPSESSIONIDSASQDDAR=PECEBLAAKMPGGDIHEGJOAJ LJ; path=/ Cache-control: private csci 5931 Web Security 5
Network Utility Programs Other Uses of Netcat q q Have Netcat listen at a particular port: (AT the listening side) nc -L -p 53 -e cmd. exe (At the remote side) nc –v host. Address 53 • Allows the administrator to see if a port is available, for example, through a firewall. csci 5931 Web Security 6
Achilles q Acts like a web proxy q Allows a person to intercept and modify information sent from a web server to a web browser q Download: achilles-0 -27. zip q Proxy configuration on the browser csci 5931 Web Security 7
Achilles csci 5931 Web Security 8
![HTTP & History of the WWW q [HTTP 1991] The Original HTTP as defined](http://slidetodoc.com/presentation_image_h2/17b7c8a1ccd0ee7e6c2153408edda80d/image-9.jpg "HTTP & History of the WWW q [HTTP 1991] The Original HTTP as defined")
HTTP & History of the WWW q [HTTP 1991] The Original HTTP as defined in 1991 q [HTTP 1992] Basic HTTP as defined in 1992 q [HTTP 1996] RFC 1945: Hypertext Transfer Protocol -- HTTP/1. 0. Informational. q [HTTP 1999] RFC 2616: Hypertext Transfer Protocol -- HTTP/1. 1. q [irt. org 1998] WWW – How It All Began. q [isoc. org 2000] The Internet Society. A Brief History of the Internet. August 4, 2000. csci 5931 Web Security 9
HTTP q q q An application-level protocol Lightness and speed necessary for distributed, collaborative, hypermedia information systems A stateless protocol can be used for many tasks, such as name servers and distributed object management systems, through extension of its request methods Its data typing feature allows systems to be built independently of the data being transferred. csci 5931 Web Security 10
HTTP q Its data typing feature allows systems to be built independently of the data being transferred. The Content-Type entity-header field indicates the media type of the Entity-Body sent to the recipient or, in the case of the HEAD method, the media type that would have been sent had the request been a GET. Content-Type = "Content-Type" ": " media-type Media types are defined in Section 3. 6 of RFC 1945. An example of the field is Content-Type: text/html csci 5931 Web Security 11
HTTP Request Methods q GET Retrieves the information requested from the file system. q HEAD Almost identical to the GET method, but only return the meta-information. q POST Requests that the server accept the enclosed information and act on it. Commonly used when server-side scripting is involved. q More request methods in HTTP/1. 1: Table 4 -4 (pp. 126 -127) csci 5931 Web Security 12
HTTP Response q Response code See Table 4 -2 (p. 122) q Header fields Additional information about the response Table 4 -3 (p. 124), 4 -5 (p. 128) q Data The body of the response csci 5931 Web Security 13
HTTP Security q HTTP provides a simple challenge-response authentication mechanism which may be used by a server to challenge a client request and by a client to provide authentication information. q The HTTP protocol does not restrict applications to this simple challenge-response mechanism for access authentication. Additional mechanisms may be used, such as encryption at the transport level or via message encapsulation, and with additional header fields specifying authentication information. However, these additional mechanisms are not defined by this specification. csci 5931 Web Security 14
HTTP Security q The "basic" authentication scheme is based on the model that the user agent must authenticate itself with a user-ID and a password for each realm. q The server will authorize the request only if it can validate the user. ID and password for the protection space of the Request-URI. There are no optional authentication parameters. q The "basic" authentication scheme is not a secure method of user authentication, nor does it prevent the Entity-Body from being transmitted in clear text across the physical network used as the carrier. csci 5931 Web Security 15
HTTP Security Considerations q The GET and HEAD methods should never have the significance of taking an action other than retrieval. q These methods should be considered “safe”. True? q It is not possible to ensure that the server does not generate side-effects as a result of performing a GET request. csci 5931 Web Security 16
HTTP Security Considerations q Abuse of Server Log Information: A server is in the position to save personal data about a user's requests which may identify their reading patterns or subjects of interest. This information is clearly confidential in nature and its handling may be constrained by law in certain countries. csci 5931 Web Security 17
HTTP Security Considerations q Transfer of Sensitive Information: HTTP cannot regulate the content of the data that is transferred, nor is there any a priori method of determining the sensitivity of any particular piece of information within the context of any given request. Revealing the specific software version of the server may allow the server machine to become more vulnerable to attacks against software that is known to contain security holes. Implementors should make the Server header field a configurable option. csci 5931 Web Security 18
HTTP Security Considerations q Attacks Based On File and Path Names: Implementations of HTTP origin servers should be careful to restrict the documents returned by HTTP requests to be only those that were intended by the server administrators. For example, Unix, Microsoft Windows, and other operating systems use ". . " to indicate a directory level above the current one. Files intended for reference only internally to the server (such as access control files, configuration files, and script code) must be protected from inappropriate retrieval. csci 5931 Web Security 19
HTTPS q HTTP over SSL encrypts traffic between two hosts, significantly reducing the ability of an attacker to access sensitive traffic and record information such as passwords. But, SSL does not truly provide security, if the SSL certificate is exposed. Tools such as ssldump can be used to decrypt SSL traffic. A network packet analyzer: Snort (Assignment #2? ) (http: //www. snort. org/dl/binaries/1. 8. 7/) csci 5931 Web Security 20
Ch 6: Web Application Components 1. Fig. 6 -1: A typical Web application (p. 166) 2. Fig. 6 -2: Interfacing Web application servers with front-end web servers (p. 170) A. The native application processing environment (e. g. , ASP on MS IIS) B. Web server APIs and plug-ins (e. g. , MS ISAPI extensions, Netscape NSAPI modules, …) csci 5931 Web Security 21
Ch 6: Web Application Components C. URL Mapping and internal proxying The application server listens on a TCP port other than the one used by the web server. The web server is configured to map specific URLs onto the application server. C. Proxying with back-end application server (e. g. , Fig. 64, p. 174) csci 5931 Web Security 22
Next q Midterm q Ch. 7: HTML source sifting, wget, Teleport Pro q Ch 8: Site Linkage Analysis q Core JAVA Security Model (GS: 7) q Team Presentations csci 5931 Web Security 23
- Slides: 23