HACKING EXPOSED WEB APPLICATIONS
CONTENTS PART I RECONNAISSANCE M INTRODUCTION TO WEB APPLICATIONS AND SECURITY THE WEB APPLICATION ARCHITECTURE A BRIEF WORD ABOUT HTML TRANSPORT: HTTP THE WEB CLIENT THE WEB SERVER THE WEB APPLICATION THE DATABASE COMPLICATIONS AND INTERMEDIARIES THE NEW MODEL: WEB SERVICES POTENTIAL WEAK SPOTS THE METHODOLOGY OF WEB HACKING PROFILE THE INFRASTRUCTURE ATTACK WEB SERVERS SURVEY THE APPLICATION ATTACK THE AUTHENTICATION MECHANISM ATTACK THE AUTHORIZATION SCHEMES PERFORM A FUNCTIONAL ANALYSIS EXPLOIT THE DATA CONNECTIVITY ATTACK THE MANAGEMENT INTERFACES ATTACK THE CLIENT LAUNCH A DENIAL-OF-SERVICE ATTACK SUMMARY REFERENCES AND FURTHER READING PROFILING SERVER DISCOVERY INTUITION INTERNET FOOTPRINTING DNS INTERROGATION PING DISCOVERY USING PORT SCANNING DEALING WITH VIRTUAL SERVERS SERVICE DISCOVERY SERVER IDENTIFICATION DEALING WITH SSL HACKING WEB SERVERS COMMON VULNERABILITIES BY PLATFORM APACHE MICROSOFT INTERNET INFORMATION SERVER (IIS) ATTACKS AGAINST IIS COMPONENTS ATTACKS AGAINST IIS ESCALATING PRIVILEGES ON IIS NETSCAPE ENTERPRISE SERVER OTHER WEB SERVER VULNERABILITIES MISCELLANEOUS WEB SERVER HACKING TECHNIQUES AUTOMATED VULNERABILITY SCANNING SOFTWARE WHISKER NIKTO TWWWSCAN/ARIRANG STEALTH HTTP SCANNER TYPHON WEBINSPECT APPSCAN FOUNDSCAN WEB MODULE DENIAL OF SERVICE AGAINST WEB SERVERS SURVEYING THE APPLICATION DOCUMENTING APPLICATION STRUCTURE MANUALLY INSPECTING THE APPLICATION STATICALLY AND DYNAMICALLY GENERATED PAGES DIRECTORY STRUCTURE HELPER FILES JAVA CLASSES AND APPLETS HTML COMMENTS AND CONTENT FORMS QUERY STRINGS BACK-END CONNECTIVITY TOOLS TO AUTOMATE THE SURVEY LYNX WGET TELEPORT PRO BLACK WIDOW WEBSLEUTH COMMON COUNTERMEASURES A CAUTIONARY NOTE PROTECTING DIRECTORIES PROTECTING INCLUDE FILES MISCELLANEOUS TIPS PART II THE ATTACK M AUTHENTICATION AUTHENTICATION MECHANISMS HTTP AUTHENTICATION: BASIC AND DIGEST FORMS-BASED AUTHENTICATION MICROSOFT PASSPORT ATTACKING WEB AUTHENTICATION PASSWORD GUESSING SESSION ID PREDICTION AND BRUTE FORCING SUBVERTING COOKIES BYPASSING SQL-BACKED LOGIN FORMS BYPASSING AUTHENTICATION AUTHORIZATION THE ATTACKS ROLE MATRIX THE METHODOLOGY QUERY STRING POST DATA HIDDEN TAGS URI HTTP HEADERS COOKIES FINAL NOTES CASE STUDY: USING CURL TO MAP PERMISSIONS APACHE AUTHORIZATION IIS AUTHORIZATION ATTACKING SESSION STATE MANAGEMENT CLIENT-SIDE TECHNIQUES HIDDEN FIELDS THE URL HTTP HEADERS AND COOKIES SERVER-SIDE TECHNIQUES SERVER-GENERATED SESSION IDS SESSION DATABASE SESSIONID ANALYSIS CONTENT ANALYSIS TIME WINDOWS INPUT VALIDATION ATTACKS EXPECTING THE UNEXPECTED INPUT VALIDATION ENDGAME WHERE TO FIND POTENTIAL TARGETS BYPASSING CLIENT-SIDE VALIDATION ROUTINES COMMON INPUT VALIDATION ATTACKS BUFFER OVERFLOW CANONICALIZATION (DOT-DOT-SLASH) SCRIPT ATTACKS BOUNDARY CHECKING MANIPULATING THE APPLICATION SQL INJECTION AND DATASTORE ATTACKS COMMAND EXECUTION COMMON SIDE EFFECTS ATTACKING WEB DATASTORES A SQL PRIMER SQL INJECTION M 10 ATTACKING WEB SERVICES WHAT IS A WEB SERVICE? TRANSPORT: SOAP OVER HTTP(S) WSDL DIRECTORY SERVICES: UDDI AND DISCO SAMPLE WEB SERVICES HACKS BASICS OF WEB SERVICE SECURITY SIMILARITIES TO WEB APPLICATION SECURITY WEB SERVICES SECURITY MEASURES M 11 HACKING WEB APPLICATION MANAGEMENT WEB SERVER ADMINISTRATION TELNET SSH PROPRIETARY MANAGEMENT PORTS OTHER ADMINISTRATION SERVICES WEB CONTENT MANAGEMENT FTP SSH/SCP FRONTPAGE WEBDAV WEB-BASED NETWORK AND SYSTEM MANAGEMENT OTHER WEB-BASED MANAGEMENT PRODUCTS M 12 WEB CLIENT HACKING THE PROBLEM OF CLIENT-SIDE SECURITY ATTACK METHODOLOGIES ACTIVE CONTENT ATTACKS JAVA AND JAVASCRIPT ACTIVEX CROSS-SITE SCRIPTING COOKIE HIJACKING M 13 CASE STUDIES CASE STUDY #1: FROM THE URL TO THE COMMAND LINE AND BACK CASE STUDY #2: XOR DOES NOT EQUAL SECURITY CASE STUDY #3: THE CROSS-SITE SCRIPTING CALENDAR