x-force atlanta feb 2012 top web hacks

7/31/2019 X-Force Atlanta Feb 2012 Top Web Hacks

1/28

2011 IBM Corporation1

Top 5 Web Hacks

Adrian Owens

Certified Client Technical Professional, Southeast


2/28


IBM Security Solutions

The Bad Guys Want In

Black Hat Hacker: Wants to stealyour important data, especially

financial information, which theycan sell for a gain.

Hactivist: Take your website

down. Could be motivated bypolitics, religion, may wish toexpose wrongdoing, or exactrevenge.

Script Kiddie: May deface yourwebsite to make a name for themselves.


3/28



How: Right Through You The Front Door

3

Resource Access - Address BarXSS- Search Field

SQL Injection - Web Form


4/28


IBM Security Solutions4

OWASP and the OWASP Top 10 list

Open Web Application Security Project

an open organization dedicated to fight insecure software

The OWASP Top Ten

document represents a broad consensus about what themost critical web application security flaws are

www.owasp.org


5/28



5

OWASP Top 10 Vulnerabilities


6/28



Discovering the Value of Web Application Security Testing with IBM Rational AppScan 2008 IBM Corporation

TechWorks

What is it?

User-supplied data is sent to an interpreter as part of a command, query or data.

What are the implications? SQL Injection - Access/modify data in DB

SSI Injection - Execute commands on server and access sensitive data

LDAP Injection Bypass authentication

1. Injection Flaws (SQL Injection)


7/28




TechWorks

SQL Injection

User input inserted into SQL Command:

Get product details by id:Select * from products where id=$REQUEST[id];

Hack: send param id with value or 1=1

Resulting executed SQL:Select * from products where id= or 1=1

All products returned


8/28




TechWorks

SQL Injection Example I

Select user from tvalidateuser where

username=


9/28




TechWorks

SQL Injection Example II


10/28




TechWorks

SQL Injection Example - Exploit

or 1=1--

Select user from tvalidateuser where

username=or 1=1--


11/28




TechWorks

SQL Injection Example - Outcome


12/28




TechWorks

2. Cross-Site Scripting (XSS)

What is it?

Malicious script echoed back into HTML returned from a trusted site, and runsunder trusted context

What are the implications?

Session Tokens stolen

Complete page content compromised

Future pages in browser compromised


13/28




TechWorks

XSS Example I

aSdF


14/28




TechWorks

XSS Example II

HTML code:


15/28



Cross Site Scripting The Exploit Process

Evil.org

User bank.com

1) Link to bank.comsent to user via

E-mail or HTTP

2) User sends script embedded as data

3) Script/data returned, executed by browser

4) Script sends userscookie and sessioninformation without the usersconsent or knowledge

5) Evil.org uses stolensession information to

impersonate user


16/28



3. Broken Authentication & Session Management

What is it?

Session tokens arent guarded and invalidated properly


Session tokens can be planted by hackers in XSS/XSFR attack, hence leaked

Session tokens more easily available (valid longer, less protection) to be stolen

in different ways


17/28



Broken Authentication and Session Management - Examples

Unprotected Session Tokens

Session ID kept in Persistent Cookie

Not using http-only value for cookies

Sessions valid for too long

Session not invalidated after logout

Session timeout too long

Session fixation possible

Session ID not replaced after login


18/28




TechWorks

4. Insecure Direct Object ReferenceWhat is it?

Part or all of a resource (file, table, etc.) name controlled by user input.


Access to sensitive resources

Information Leakage, aids future hacks


19/28




TechWorks

Insecure Direct Object Reference - Example

Attacker may attempt to manipulate parameter Content Change to Boot.ini system file


20/28




TechWorks

Insecure Direct Object Reference Example Cont.

Poison Null Byte

Use NULL Character rather than .htm


21/28




TechWorks

Insecure Direct Object Reference Example Cont.

Bingo Sensitive File Information at our finger tips!


22/28


23/28



XSRF Exploit Illustration

1) User browses pagewith malicious content

2) Script (or link) isdownloaded andexecuted in browser

Evil.org

3) Money

Transferred

Bank.comWebMail

WirelessRouter

3) All mailsforwarded tohacker

3) Router opened foroutside access

4) MoneyWithdrawn

4) Private mails accessed, possibly containingpasswords

4) Firewalls surpassed, internal computers hacked

Victim


24/28



24

Security Testing Technologies... Combination of the Two Delivers

Comprehensive Solution

Static Code Analysis = Whitebox

Scanning source code for security issues

Dynamic Analysis = Blackbox

Security analysis of a compiled application

Total PotentialTotal PotentialSecurity IssuesSecurity Issues

DynamicDynamic

AnalysisAnalysisStaticStatic

AnalysisAnalysisCompleteCoverage


25/28


IBM Security SolutionsIBM Software Group | Watchfire SolutionsIBM Software Group | Rational softwareIBM Software Group | Rational softwareIBM Software Group | Watchfire SolutionsIBM Software Group | Rational softwareIBM Software Group | Rational software

Automated Security TestingAutomated Security TestingAppScan Standard EditionAppScan Standard Edition BlackBlack--box, dynamicbox, dynamic

Desktop VersionDesktop Version connects to Enterpriseconnects to Enterprise ReportingReporting

AppScan Enterprise EditionAppScan Enterprise Edition BlackBlack--box, dynamicbox, dynamic WebWeb--based Versionbased Version connects to Enterprise Reportingconnects to Enterprise Reporting

AppScan Source EditionAppScan Source Edition WhiteWhite--Box, StaticBox, Static

IDE, Desktop, Web BasedIDE, Desktop, Web Based connects to Enterprise Reportingconnects to Enterprise Reporting

AppScan Source For AutomationAppScan Source For Automation Build ComponentBuild Component

Part of Build EnginePart of Build Engine Build Forge EnabledBuild Forge Enabled

AppScan Policy TesterAppScan Policy Tester Quality, Privacy, AccessibilityQuality, Privacy, Accessibility WebWeb--based Versionbased Version connects to Enterprise Reportingconnects to Enterprise Reporting

25


26/28



26

Security specialists Conduct security assessments

Publish findings for remediation/trending

AppScan Standard Edition Desktop (BB)

AppScan Enterprise Web Based Views (WB & BB)

Source Edition Desktop (WB) for Assessments

AppScan

Compliance Officers Review compliance reports ASE Web Based Views (BB & WB)

Developers View assessment results

Remediate issues

Assign issue status

Languages:PHPPerlColdFusionClient-Side JavaScriptC/C++Java/JSP.NET (C#, ASP.NET, VB.NET)Classic ASP (VB6)VBScriptServer-Side JavaScript

ASE Quick Scans (BB)

Visual Studio .Net (WB)

Eclipse Java (WB)

Rational AppScanEnterprise portal AppScan Enterprise Policy Tester Enterprise Source Edition for Core

Management Review most common security issues

View trends

Assess risk

AppScan Enterprise (ASE) Web Based Views (BB & WB)

Source Edition Core

Build automation Source code analysis (WB)

Part of build verification Publish findings for remediation/trending

Headless Source Edition App integration with

Build Forge

Ant

Maven

Make

QA & Accessibility Conduct Quality / Privacy / Accessibility Tests

Publish findings for remediation/trending

AppScan Enterprise Web Based Views (BB)

Policy Tester Module in ASE (BB)

AppScan Tester Edition for RQM (BB)

QC, CQ Publish Security Defects

AppScan Enterprise Integration

ASE Scan Agents(BB)


27/28



Security testing within the application life cycle

%o

fIss

ueFoundbyS

tageofSDLC

Desired ProfileDesired Profile


28/28



Questions

&Thank You!

x-force atlanta feb 2012 top web hacks

Documents