Skip to content

Latest commit

 

History

History
254 lines (213 loc) · 14.2 KB

06-web_server_and_web_application_hacking.md

File metadata and controls

254 lines (213 loc) · 14.2 KB

06-Web Server and Web Application Hacking

Table of Contents

Web Server and Web Application Hacking

Web Organizations

  • Web 2.0: dynamic applications; have a larger attack surface due to simultaneous communication
  • Internet Engineering Task Force (IETF): creating engineering documents to help make the Internet work better
  • World Wide Web Consortium (W3C): a standards-developing community
  • Open Web Application Security Project (OWASP): an organization focused on improving the security of software
    • WebGoat: project maintained by OWASP which is an insecure web application meant to be tested

OWASP Web Top 10 Application Security Risks 2017

  • A1 Injection Flaws: SQL, OS and LDAP injection
  • A2 Broken Authentication and Session Management: functions related to authentication and session management that aren't implemented correctly
  • A3 Sensitive Data Exposure: not properly protecting sensitive data (SSN, CC numbers, etc.)
  • A4 XML External Entities (XXE): exploiting XML processors by uploading hostile content in an XML document
  • A5 Broken Access Control: having improper controls on areas that should be protected
  • A6 Security Misconfiguration: across all parts of the server and application
  • A7 Cross-Site Scripting (XSS): taking untrusted data and sending it without input validation
  • A8 Insecure Deserialization: improperly de-serializing data
  • A9 Using Components with Known Vulnerabilities: libraries and frameworks that have known security holes
  • A10 Insufficient Logging and Monitoring: not having enough logging to detect attacks

Web Server Architecture

  • Most Popular Servers: Apache, IIS and Nginx
    • Apache runs configurations as a part of a module within special files (http.conf, etc.)
    • IIS runs all applications in the context of LOCAL_SYSTEM
    • IIS 5 had a ton of bugs - easy to get into
  • N-Tier Architecture: distributing processes across multiple servers; normally as three-tier: Presentation (web), logic (application) and data (database)
  • Error Reporting: should not be showing errors in production; easy to glean information
  • HTML: markup language used to display web pages
  • HTTP Request Methods
    • GET: retrieving whatever information is in the URL; sending data is done in URL
    • HEAD: identical to get except for no body return
    • POST: sending data via body - data not shown in URL or in history
    • PUT: requesting data be stored at the URL
    • DELETE: requesting origin server delete resource
    • TRACE: requesting application layer loopback of message
    • CONNECT: reserved for use with proxy
  • HTTP Error Messages
    • 1xx: Informational: request received, continuing
    • 2xx: Success: action received, understood and accepted
    • 3xx: Redirection: further action must be taken
    • 4xx: Client Error: request contains bad syntax or cannot be fulfilled
    • 5xx: Server Error: server failed to fulfill an apparently valid request

Technology Stacks

Stack Layer Service Technic
7 Custom Web Applications Business Logic
6 Third Party Components Open Source/Commercial
5 Web Server Apache/MS IIS
4 Database Oracle/MySQL/MS SQL
3 Operating System Windows/Linux/OS X
2 Network Router/Switch
1 Security IPS/IDS

Web Server Attack Methodology

  • Information Gathering: Internet searches, whois, reviewing robots.txt
  • Web Server Footprinting: banner grabbing
    • nmap
      • Detect vulnerable TRACE method: nmap --script http-trace -p80 localhost
      • List email addresses: nmap --script http-google-email <target>
      • Discover virtual hosts on same IP address you're footprinting, * is online db such as IP2Hosts: nmap --script hostmap-_* <host>
      • Enumerate common web apps: nmap --script http-enum -p80 <target>
      • Grab robots.txt: nmap -p80 --script http-robots.txt <target>
      • Find out what options are supported by an HTTP server: nmap --script http-methods <target>
    • Other tools
      • Netcraft
      • HTTPRecon
      • ID Serve
      • HTTPrint
  • Website Mirroring
    • Bringing the site to your own machine to examine structure, etc.
    • Tools
      • Wget
      • BlackWidow
      • HTTrack
      • WebCopier
      • SurfOffline
  • Vulnerability Scanning
    • Scanning web server for vulnerabilities
    • Tools
      • Nessus
      • Nikto: specifically suited for web servers; still very noisy like Nessus; scan files and vulnerable CGIs
  • Session Hijacking
  • Web Server Password Cracking

Web Server and Application Attacks

  • Most often hacked before of inherent weaknesses built into the program
  • First step is to identify entry points (POST data, URL parameters, cookies, headers, etc.)
    • Tools
      • WebScarab: provided by OWASP
      • Burp Suite
      • httprint
  • Cookies:
    • Small text-based files stored that contains information like preferences, session details or shopping cart contents
    • Can be manipulated to change functionality (e.g. changing a cooking that says "ADMIN=no" to "yes")
    • Sometimes, but rarely, can also contain passwords
  • DNS Amplification: uses recursive DNS to DoS a target; amplifies DNS answers to target until it can't do anything
  • Directory Transversal (../ or dot-dot-slash)
    • Example: http://www.example.com/../../../../etc/password
    • File requested that should not be accessible from web server
    • Using Unicode to possibly evade IDS: %2e for dot and %sf for slash
  • Parameter Tampering (URL Tampering): manipulating parameters within URL to achieve escalation or other changes
  • Hidden Field Tampering: modifying hidden form fields producing unintended results
  • Web Cache Poisoning: replacing the cache on a box with a malicious version of it
  • Wfetch: Microsoft tool that allows you to craft HTTP requests to see response data
  • Misconfiguration Attack: improper configuration of a web server
  • Password Attack: attempting to crack passwords related to web resources
  • Connection String Parameter Pollution: injection attack that uses semicolons to take advantage of databases that use this separation method
  • Web Defacement: simply modifying a web page to say something else
  • Shellshock
    • Causes Bash to unintentionally executing commands when commands are concatenated on the end of function definitions
    • RCE via Apache CGI Script
  • Tools
    • Brutus: brute force web passwords of HTTP
    • Hydra: network login cracker
    • Metasploit
      • Exploits hold the actual exploit
      • Payload contains the arbitrary code if exploit is successful
      • Auxiliary used for one-off actions (like a scan)
      • NOPS used for buffer-overflow type operations

Injections

File Injection
  • Attacker injects a pointer in a web form to an exploit hosted elsewhere
Command Injection
  • Attacker gains shell access using Java or similar
LDAP Injection
  • Attacker exploits applications that construct LDAP statements
  • Format for LDAP injection including )(&)
SOAP Injection
  • Injecting query strings in order to bypass authentication
  • Using XML to format information
  • Messages are one way in nature
SQL Injection

  • Injecting SQL commands into input fields to produce output

  • Double dash (--) tells the server to ignore the rest of the query: ' OR 1 = 1 --, basically tells the server if 1 = 1 (always true)

  • Basic test to see if SQL injection is possible is just inserting a single quote '

  • In-band SQL injection: using same communication channel to perform attack

    • Error-based SQL Injection: most common used, inserting bad input to get database-level error message

      • System stored procedure
      • Illegal/Logically incorrect query: SELECT * FROM users WHERE name='bob"' AND password =, gets 'Unclosed quotation mark after sting " AND password='xxx"."

    • UNION SQL Injection: most common used, using UNION clause to append a malicious query

    • Tautology: using always true statements to test SQL (e.g. 1=1)

      A End of Line Comment: writing a line of code that ends in comment --

      SELECT * FROM users WHERE name='admin'--' AND password = 'password'

    • Inline Comment: using in-line comment /* */

    • Piggybacked Query: using semicolon ; to add malicious query after original query

  • Out-of-band SQL injection: using different communication channels (e.g. export results to file on web server)

  • Blind/inferential SQL injection: error messages and screen returns don't occur, usually have to guess whether command work or use timing to know

    • Time delay: inserting wait function for delay
    • Boolean exploitation: manipulating valid statements that evaluate to true and false in HTTP request parameter
      • https://example.com/item.aspx?id=67 and 1=2 gets SQL query SELECT * FROM items WHERE ID=67 AND 1=2, if vulnerable to SQL injection, no item will show
      • https://example.com/item.aspx?id=67 and 1=1 gets SQL query SELECT * FROM items WHERE ID=67 AND 1=1, if vulnerable to SQL injection, item 67 will show
    • Heavy query: in case it's impossible to use time delay function in query, generates heavy queries instead

  • MS SQL Server injection: running commands from SQL shell by using xp_cmdshell

  • Countermeasures

    • To counter Database server runs OS commands
      • Running database service account with minimal rights
      • Disabling commands like xp_cmdshell
    • To counter Using privileged account to connect to database
      • Monitoring DB traffic using an IDS, WAP
      • Using low privileged account for DB connection
    • To counter Error message revealing important information
      • Suppressing all error messages
      • Using custom error messages
    • To counter No Data validation at the server
      • Filtering all client Data
      • Sanitizing Data

  • Tools

    • Sqlmap
    • sqlninja

XSS (Cross-site scripting)

  • Inputting JavaScript into a web form alters what the page does
  • Can also be passed via URL http://IPADDRESS/";!--"<XSS>=&{()}
  • Can be malicious by accessing cookies and sending them to a remote host
  • Can be mitigated by setting HttpOnly flag for cookies
  • DOM Based XSS (Type 0): a form of XSS where the entire tainted data flow from source to sink takes place in the browser, and the data flow never leaves the browser. e.g.: the URL of the page or an element of HTML...
  • Stored XSS (Persistent or Type I): stores the XSS in a forum or like on the target server, for multiple people to access
  • Reflected XSS (Non-persistent or Type II): occurs when user input is immediately returned by a web application, without permanently storing the user provided data

CSRF (Cross-Site Request Forgery)

  • Forcing an end user to execute unwanted actions on an app they're already authenticated on
  • Inheriting identity and privileges of victim to perform an undesired function on victim's behalf
  • Capturing the session and sends a request based off the logged in user's credentials
  • Can be mitigated by sending random challenge tokens

Clickjacking

  • Also known as a user interface redress attack
  • Used to trick web users to click something different from what they think they are clinking

Buffer Overflow (Smashing the stack)

  • Attempting to write data into application's buffer area to overwrite adjacent memory, execute code or crash a system
  • Inputting more data than the buffer is allowed
  • Including stack, heap, NOP sleds (hex value 0x09) and more

Other attacks

  • Session Fixation: attacker logs into a legitimate site and pulls a session ID, then sends link with session ID to victim. Once victim logs in, attacker can now log in and run with user's credentials
  • Fuzzing: inputting random data into a target to see what will happen
  • HTTP Response Splitting
    • Adding header response data to an input field so server splits the response
    • It's not an attack by itself, so it must be combined with another attack
    • Can be used to redirect a user to a malicious site
  • CSPP (Connection Stream Parameter Pollution): polluting connection strings between the Web application authenticating a user to the database, for example, by injecting phony parameters into the connection strings using semicolons as separators