Web Application Attacks ECE 4112 Fall 2007 Group
Web Application Attacks ECE 4112 Fall 2007 Group 9 Zafeer Khan & Simmon Yau
Motivation n SANS (Sys. Admin, Audit, Network, Security) Top-20 2007 Security Risks (2007 Annual Update) q q No. 1 Client side vulnerability is web browsers No. 1 Server side vulnerability is web applications n Common forms: q q PHP Remote File Include (Remote Code Execution) SQL Injection Cross-site Scripting (XSS) Cross-Site Request Forgeries (CSRF)
Outline n URL Interpretation Attacks q q n n n HTTP Response Splitting – Cross Site Scripting SQL Injection Impersonation Attacks Buffer Overflow Remote Code Execution
URL Interpretation Attacks n An attacker can take advantage of the multiple ways of encoding an URL and abuse the interpretation of the URL. An URL may contain special character that need special syntax handling in order to be interpreted. Special characters are represented using a percentage character followed by two digits representing the octet code of the original character (%HEX-CODE).
URL Interpretation Attacks n HTTP Response Splitting q q q http: //website/redirect. php? page=http: //website/welcome. ht ml http: //website/redirect. php? page =0 d%0 a. Content. Type: %20 text/html%0 d%0 a. HTTP/1. 1%20200%20 OK%0 d %0 a. Content. Type: %20 text/html%0 d%0 a%3 chtml%3 e. Hello, world!%3 c/html%3 e Result: n Content-Type: text/html n HTTP/1. 1 200 OK n Content-Type: text/html n <html>Hello, world!</html>
URL Interpretation Attacks n Cross Site Scripting q q http: //website/redirect. php? page=http: //website/ha cked. html Runs a Java. Script popup asking for Credit Card Number
URL Interpretation Attacks n SQL Injection q q q “login. asp”: SQLQuery = “SELECT preferences FROM logintable WHERE userid=’” & Request. Query. String(“userid”) & “’ AND password=’” & Request. Query. String(“password”) & “’; ” http: //target/login. asp? userid=bob%27%3 b%20 update%20 l ogintable%20 set%20 passwd %3 d%270 wn 3 d%27%3 b--%00 Result: n SELECT preferences FROM logintable WHERE userid=’bob’; update logintable set password=’ 0 wn 3 d’;
Defenses Against URL Interpretation Attacks n n n There are tools to scan HTTP requests to the server for valid URL such as URLScan from Microsoft (http: //www. microsoft. com/technet/security/tools/urlscan. mspx). Assume all input is malicious. Create a white list that defines all valid input to the software system based on the requirements specifications. Input that does not match against the white list should not be permitted to enter into the system. Test your decoding process against malicious input. When client input is required from web-based forms, avoid using the “GET” method to submit data, as the method causes the form data to be appended to the URL and is easily manipulated. Instead, use the “POST method whenever possible.
Impersonation Attacks n. An attack where someone pretends to be someone they are not n. Ability to gain access to private account information n. Large sums of money involved n. Hackers and organized crime alike would be interested
PHP Session n n Http is a stateless protocol Sessions are needed to store information Sessions are different than cookies Example of a PHP session students will see in the lab http: //www. simmonyau. com/session. php
Session. php <? php session_start(); if ($PHPSESSID) { echo $PHPSESSID; } else { print('This is your first time visiting this site. A session has been created to track your information. '); session_register('PHPSESSID'); $PHPSESSID=rand(); } ? >
Poorly Coded PHP Session Management n n Poorly coded PHP sessions can lead up to impersonation attacks. Although these kinds of attacks are unlikely to happen unless the web developer was an idiot, let’s look at an example. http: //www. simmonyau. com/badsession. php
Badsession. php
Badsession. php (cont’d)
Session Hijacking n n It’s also possible for a hacker to pretend to be a legit organization to trick you into giving them your account information. A malicious user could for example get a false certificate and place it on their website impersonating an organization or pretending to be a real organization.
Session Hijacking Prevention n n As a web developer, be sure to use the safest ways in coding. Sometimes the default settings may be the most secure. For this lab, the following changes were made from the default settings just to hijack the session of the website: 1. 2. register_globals was enabled (usually disabled for security purposes) session_register() was used instead of $_SESSION['name']
Session Hijacking Prevention (cont’d) 3. php. ini changes ; Whether to use cookies. session. use_cookies = 1 session. cookie_secure =0 ; This option enables administrators to make their users invulnerable to ; attacks which involve passing session ids in URLs; defaults to 1. session. use_only_cookies = 0 ; Name of the session (used as cookie name). session. name = PHPSESSID register_globals=on
Session Hijacking Prevention (cont’d) 4. Protect the integrity of your session tokens/ids. 5. Do not ever use $_GET variables. 6. Do not register or input your information under shady websites. 7. If you are logging into a “secure” website, check to see if http changes to https.
Buffer Overflow n n n A buffer overflow attack can occur when a user inputs more data in a buffer than it can handle. As a result, this code flows over into other buffers and can corrupt or overwrite data in them. Although buffer overflows are harder for hackers to find, it is easily exploitable by anyone once it is found.
Buffer Overflow Prevention n n Keep up to date with patches on programs. Invalidate stack execution so extra code that executes in the stack instead of the code can not run. Use good compliers because they usually catch unsafe structures like gets(), strcpy(), etc. Use the tool libsafe to provide secure calls to function. (it follows frame pointers to the correct stack frame when buffers are passed to unsafe functions.
Remote Code Execution n n An exploit where a user could run some arbitrary code on a server. Example: When register_globals are turned on for php, if a webpage contained require($somepage. “. php”); Someone could then type in http: //www. yoursite. com/index. php? somepag e=http: //
Remote Code Execution Preventions n There’s not much you can do besides be careful when coding your web applications.
Resources n n n n n http: //searchsoftwarequality. techtarget. com/search. App. Security/dow nloads/Hacking_Exposed_ch 06. pdf, Hacking Exposed http: //capec. mitre. org, CAPEC (Common Attack Pattern Enumeration and Classification) http: //www. sans. org/, SANS (Sys. Admin, Audit, Network, Security) Institute http: //www. securityfocus. com/infocus/1774 http: //www. pcmag. com/article 2/0, 1759, 34074, 00. asp http: //www. weberdev. com/View. Article/Exploring-Session-Security-In -PHP-Web-Applications http: //www. tizag. com/mysql. Tutorial/mysqltables. php http: //phpsec. org/projects/guide/4. html http: //www. ic. unicamp. br/~stolfi/urna/buffer-oflow/
Questions? ECE 4112 – Don’t Learn To Hack, Hack To Learn
- Slides: 24
