WEB APPLICATION VULNERABILITIES: DETECT, EXPLOIT, PREVENT
CONTENTS CHAPTER 1 INTRODUCTION TO WEB APPLICATION HACKING INTRODUCTION WEB APPLICATION ARCHITECTURE COMPONENTS THE WEB SERVER THE APPLICATION CONTENT THE DATA STORE COMPLEX WEB APPLICATION SOFTWARE COMPONENTS LOGIN SESSION TRACKING MECHANISM USER PERMISSIONS ENFORCEMENT ROLE LEVEL ENFORCEMENT DATA ACCESS APPLICATION LOGIC LOGOUT PUTTING IT ALL TOGETHER THE WEB APPLICATION HACKING METHODOLOGY DE? NE THE SCOPE OF THE ENGAGEMENT BEFORE BEGINNING THE ACTUAL ASSESSMENT OPEN SOURCE INTELLIGENCE SCANNING DEFAULT MATERIAL SCANNING BASE LINE THE APPLICATION FUZZING EXPLOITING/VALIDATING VULNERABILITIES REPORTING THE HISTORY OF WEB APPLICATION HACKING AND THE EVOLUTION OF TOOLS EXAMPLE 1: MANIPULATING THE URL DIRECTLY (GET METHOD FORM SUBMITTAL) EXAMPLE 2: THE POST METHOD EXAMPLE 3: MAN IN THE MIDDLE SOCKETS THE GRAPHICAL USER INTERFACE MAN IN THE MIDDLE PROXY COMMON (OR KNOWN) VULNERABILITY SCANNERS SPIDERS AND OTHER CRAWLERS AUTOMATED FUZZERS ALL IN ONE AND MULTI FUNCTION TOOLS OWASP’S WEBSCARAB DEMONSTRATION STARTING WEBSCARAB NEXT: CREATE A NEW SESSION NEXT: ENSURE THE PROXY SERVICE IS LISTENING NEXT, CON? GURE YOUR WEB BROWSER NEXT, CON? GURE WEBSCARAB TO INTERCEPT REQUESTS NEXT, BRING UP THE SUMMARY TAB WEB APPLICATION HACKING TOOL LIST SECURITY E-MAIL LISTS SUMMARY CHAPTER 2 INFORMATION GATHERING TECHNIQUES THE PRINCIPLES OF AUTOMATING SEARCHES THE ORIGINAL SEARCH TERM EXPANDING SEARCH TERMS E-MAIL ADDRESSES TELEPHONE NUMBERS PEOPLE GETTING LOTS OF RESULTS MORE COMBINATIONS USING “SPECIAL” OPERATORS GETTING THE DATA FROM THE SOURCE SCRAPING IT YOURSELF – REQUESTING AND RECEIVING RESPONSES SCRAPING IT YOURSELF – THE BUTCHER SHOP DAPPER AURA/EVILAPI USING OTHER SEARCH ENGINES PARSING THE DATA PARSING E-MAIL ADDRESSES DOMAINS AND SUB-DOMAINS POST PROCESSING SORTING RESULTS BY RELEVANCE BEYOND SNIPPETS PRESENTING RESULTS APPLICATIONS OF DATA MINING MILDLY AMUSING MOST INTERESTING TAKING IT ONE STEP FURTHER COLLECTING SEARCH TERMS ON THE WEB CONTENTS SPYING ON YOUR OWN SEARCH TERMS GMAIL HONEY WORDS REFERRALS CHAPTER 3 INTRODUCTION TO SERVER SIDE INPUT VALIDATION ISSUES CROSS SITE SCRIPTING (XSS) PRESENTING FALSE INFORMATION HOW THIS EXAMPLE WORKS PRESENTING A FALSE FORM EXPLOITING BROWSER BASED VULNERABILITIES EXPLOIT CLIENT/SERVER TRUST RELATIONSHIPS CHAPTER 4 CLIENT-SIDE EXPLOIT FRAMEWORKS ATTACKAPI ENUMERATING THE CLIENT ATTACKING NETWORKS HIJACKING THE BROWSER CONTROLLING ZOMBIES BEEF INSTALLING AND CON? GURING BEEF BEEF MODULES STANDARD BROWSER EXPLOITS PORT SCANNING WITH BEEF INTER-PROTOCOL EXPLOITATION AND COMMUNICATION WITH BEEF CAL9000 XSS ATTACKS, CHEAT SHEETS, AND CHECKLISTS ENCODER, DECODERS, AND MISCELLANEOUS TOOLS HTTP REQUESTS/RESPONSES AND AUTOMATIC TESTING OVERVIEW OF XSS-PROXY XSS-PROXY HIJACKING EXPLAINED BROWSER HIJACKING DETAILS INITIALIZATION COMMAND MODE ATTACKER CONTROL INTERFACE CONTENTS CONTENTS USING XSS-PROXY: EXAMPLES SETTING UP XSS-PROXY INJECTION AND INITIALIZATION VECTORS FOR XSS-PROXY HTML INJECTION JAVASCRIPT INJECTION HANDOFF AND CSRF WITH HIJACKS CSRF HANDOFF HIJACK TO OTHER SITES SAGE AND FILE:// HIJACK WITH MALICIOUS RSS FEED SOLUTIONS FAST TRACK FREQUENTLY ASKED QUESTIONS CHAPTER 5 WEB-BASED MALWARE ATTACKS ON THE WEB HACKING INTO WEB SITES DNS POISONING (PHARMING) MALWARE AND THE WEB: WHAT, WHERE, AND HOW TO SCAN WHAT TO SCAN WHERE TO SCAN HOW TO SCAN PARSING AND EMULATING HTML BROWSER VULNERABILITIES TESTING HTTP-SCANNING SOLUTIONS TANGLED LEGAL WEB CHAPTER 6 WEB SERVER AND WEB APPLICATION TESTING WITH BACKTRACK OBJECTIVES WEB SERVER VULNERABILITIES: A SHORT HISTORY WEB APPLICATIONS: THE NEW CHALLENGE CHAPTER SCOPE APPROACH WEB SERVER TESTING CGI AND DEFAULT PAGES TESTING WEB APPLICATION TESTING CORE TECHNOLOGIES WEB SERVER EXPLOIT BASICS WHAT ARE WE TALKING ABOUT? STACK-BASED OVER? OWS HEAP-BASED OVER? OWS CGI AND DEFAULT PAGE EXPLOITATION WEB APPLICATION ASSESSMENT INFORMATION GATHERING ATTACKS FILE SYSTEM AND DIRECTORY TRAVERSAL ATTACKS COMMAND EXECUTION ATTACKS DATABASE QUERY INJECTION ATTACKS CROSS-SITE SCRIPTING ATTACKS IMPERSONATION ATTACKS PARAMETER PASSING ATTACKS OPEN SOURCE TOOLS INTELLIGENCE GATHERING TOOLS SCANNING TOOLS ASSESSMENT TOOLS AUTHENTICATION PROXY EXPLOITATION TOOLS METASPLOIT SQL INJECTION TOOLS DNS CHANNEL TIMING CHANNEL REQUIREMENTS SUPPORTED DATABASES EXAMPLE USAGE CASE STUDIES: THE TOOLS IN ACTION WEB SERVER ASSESSMENTS CHAPTER 7 SECURING WEB BASED SERVICES WEB SECURITY WEB SERVER LOCKDOWN MANAGING ACCESS CONTROL CONTENTS CONTENTS HANDLING DIRECTORY AND DATA STRUCTURES DIRECTORY PROPERTIES ELIMINATING SCRIPTING VULNERABILITIES LOGGING ACTIVITY PERFORMING BACKUPS MAINTAINING INTEGRITY FINDING ROGUE WEB SERVERS STOPPING BROWSER EXPLOITS EXPLOITABLE BROWSER CHARACTERISTICS COOKIES WEB SPOO? NG WEB SERVER EXPLOITS SSL AND HTTP/S SSL AND TLS HTTP/S TLS S-HTTP INSTANT MESSAGING PACKET SNIFFERS AND INSTANT MESSAGING TEXT MESSAGING AND SHORT MESSAGE SERVICE (SMS) WEB-BASED VULNERABILITIES UNDERSTANDING JAVA-, JAVASCRIPT-, AND ACTIVEX-BASED PROBLEMS JAVA ACTIVEX DANGERS ASSOCIATED WITH USING ACTIVEX AVOIDING COMMON ACTIVEX VULNERABILITIES LESSENING THE IMPACT OF ACTIVEX VULNERABILITIES PROTECTION AT THE NETWORK LEVEL PROTECTION AT THE CLIENT LEVEL JAVASCRIPT PREVENTING PROBLEMS WITH JAVA, JAVASCRIPT, AND ACTIVEX PROGRAMMING SECURE SCRIPTS CODE SIGNING: SOLUTION OR MORE PROBLEMS? UNDERSTANDING CODE SIGNING THE BENE? TS OF CODE SIGNING PROBLEMS WITH THE CODE SIGNING PROCESS BUFFER OVER? OWS MAKING BROWSERS AND E-MAIL CLIENTS MORE SECURE RESTRICTING PROGRAMMING LANGUAGES CONTENTS KEEP SECURITY PATCHES CURRENT SECURING WEB BROWSER SOFTWARE SECURING MICROSOFT IE CGI WHAT IS A CGI SCRIPT AND WHAT DOES IT DO? TYPICAL USES OF CGI SCRIPTS BREAK-INS RESULTING FROM WEAK CGI SCRIPTS CGI WRAPPERS NIKTO FTP SECURITY ACTIVE AND PASSIVE FTP S/FTP SECURE COPY BLIND FTP/ANONYMOUS FTP SHARING AND VULNERABILITIES PACKET SNIF? NG FTP TRANSMISSIONS DIRECTORY SERVICES AND LDAP SECURITY LDAP LDAP DIRECTORIES ORGANIZATIONAL UNITS OBJECTS, ATTRIBUTES AND THE SCHEMA SECURING LDAP