Exploiting common web application vulnerabilities - Steve Kosten

1. Exploiting and Defending:
Common Web Application
Vulnerabilities

2. Senior Security Consultant
SANS Instructor
Denver OWASP Chapter Lead
Certifications
CISSP, GWAPT, GSSP-Java, CISM
Contact Info
Steve.kosten@cypressdefense.com
@skosten
Introduction: Steve Kosten
©2016 – Cypress Data Defense, LLC

3. Introduction
A1: Injection
A3: Cross-Site Scripting (XSS)
A8: Cross-Site Request Forgery (CSRF)
Agenda
©2016 – Cypress Data Defense, LLC

4. Using real attack tools
Illegal to attack targets without written
contractual consent
Obey all state and federal laws
Cypress Data Defense assumes no liability
Disclaimer
©2016 – Cypress Data Defense, LLC

5. A1: Injection
©2016 – Cypress Data Defense, LLC

6. Text-based attacks that exploit the syntax of the
targeted interpreter.
Almost any source of data can be an injection
vector, including internal sources.
Injection flaws occur when an application sends
untrusted data to an interpreter.
A1: Injection
©2016 – Cypress Data Defense, LLC

7. A1: SQL Injection
©2016 – Cypress Data Defense, LLC

8. XKCD
©2016 – Cypress Data Defense, LLC

9. 110 million customer records
Email, Mailing addresses, other
Personally Identifiable Information
(PII)
In The News (Target)
©2016 – Cypress Data Defense, LLC

10. 50 million customer records
Email, DOB, Password Hashes,
Challenge Questions & Answers
In The News (Living Social)
©2016 – Cypress Data Defense, LLC

11. 130 million credit card numbers
$200 million loss
In The News (Heartland)
©2016 – Cypress Data Defense, LLC

12. Command Injection
Inline SQL
A1: Example (1)
rs = statement.executeQuery(
"Select EmployeeId, LastName, FirstName, PhoneNumber "
+
"From Employees " +
"Where EmployeeId = " +
request.getParameter("employeeId"))
Runtime.getRuntime().exec(String.format("myTestProcess.
exe %s", request.getParameter("employeeId")))
©2016 – Cypress Data Defense, LLC

13. sqlmap DEMO
http://sqlmap.org/
Written in Python
Exploitation DEMO
©2016 – Cypress Data Defense, LLC

14. Parameterized Queries
A1: Solution
©2016 – Cypress Data Defense, LLC

15. XSS
Cross-Site Scripting
©2016 – Cypress Data Defense, LLC

16. XSS flaws occur whenever an application takes untrusted data and
sends it to a web browser without proper encoding.
Execute scripts in the victim’s browser
Hijack user sessions
Deface web sites
Redirect the user to malicious sites.
A3: Cross-Site Scripting (XSS)
©2016 – Cypress Data Defense, LLC

17. In The News (Sears)
©2016 – Cypress Data Defense, LLC

18. Site defaced to contain flashing
images designed to cause seizures
Some victims required hospital care
In The News (EF)
©2016 – Cypress Data Defense, LLC

19. Primaries web site had XSS in the
blog pages
Payloads injected to redirect users to
Hillary Clinton’s election web site
In The News (Obama)
©2016 – Cypress Data Defense, LLC

20. HTML Context
URL Context
JavaScript Context
Reflected Example
<td><%= request.getParameter("Name") %></td>
<a href='<%= String.format("details.aspx?id=%s",
request.getParameter("Name")) %>'></a>
<a href='<%= String.format("javascript:redirect
('{%s}')", request.getParameter("Name"))
%>'>View</a>
©2016 – Cypress Data Defense, LLC

21. Browser Exploitation Framework
(BeEF)
http://beefproject.com/
Written in Ruby
Exploitation DEMO
©2016 – Cypress Data Defense, LLC

22. Encoding, encoding, encoding
Validation is not the solution
Contexts to consider
Html, Url, JavaScript
HtmlAttribute, Css, Xml, XmlAttribute
Mitigations
©2016 – Cypress Data Defense, LLC

23. Recommended encoding libraries
OWASP Java Encoder
HTTP Security Headers
SourceClear Headlines
X-XSS-Protection
Content-Security-Policy (CSP)
Mitigations (2)
©2016 – Cypress Data Defense, LLC

24. CSRF
Cross Site Request Forgery
©2016 – Cypress Data Defense, LLC

25. Researcher earns $10,000 bug
bounty
CSRF vulnerability allowing attackers
to:
Add payment methods
Modify email addresses
Change security questions
Add privileged users
In The News
©2016 – Cypress Data Defense, LLC

26. Admin console vulnerable to CSRF
allowing attackers to perform the
following:
Modify automatic renewals
Edit zone files
Name server management
In The News (GoDaddy)
©2016 – Cypress Data Defense, LLC

27. • 2012: Multiple manufacturers
• 4.5 Million Routers Compromised in Brazil
In The News
©2016 – Cypress Data Defense, LLC

28. A CSRF attack forces a logged-on victim’s browser to send a
forged HTTP request, including the victim’s session cookie and
any other automatically included authentication information.
Audit logs will show the user made the transaction
User has no knowledge of the transaction
Cross-Site Request Forgery
©2016 – Cypress Data Defense, LLC

29. Multiple Authenticated Sessions
Cross-Site Request Forgery (CSRF) Example
©2016 – Cypress Data Defense, LLC

30. Payload on attack page
Cross-Site Request Forgery (CSRF) Example (2)
<form id="csrfForm"
action="http://localhost:8080/csrf/content/vulnerable/changepa
ssword" method="POST" >
<input type="hidden" name="newPassword"
value="StorageRoomB" />
<input type="hidden" name="confirmPassword"
value="StorageRoomB" />
</form>
©2016 – Cypress Data Defense, LLC

31. Request triggered from authenticated session
Cross-Site Request Forgery (CSRF) Example (3)
POST /csrf/content/vulnerable/changepassword HTTP/1.1
Host: localhost:8080
Cookie: JSESSIONID=2E7F523BE6E086F5EEB593B2B69842D2
Content-Type: application/x-www-form-urlencoded
Content-Length: 53
newPassword=StorageRoomB&confirmPassword=StorageRoomB
©2016 – Cypress Data Defense, LLC

32. 200 Response from web site
Cross-Site Request Forgery (CSRF) Example (4)
HTTP/1.1 200 OK
<div class="alert alert-dismissable alert-success">
<span>Your password was successfully changed.</span>
</div>
©2016 – Cypress Data Defense, LLC

33. Simple Javascript Post
Exploitation DEMO
©2016 – Cypress Data Defense, LLC

34. CSRF Mitigations
Random nonce for each request
Anti-Forgery Tokens
CSRF Guard (OWASP Project)
Mitigations
©2016 – Cypress Data Defense, LLC

35. Payload with incorrect csrf token
Cross-Site Request Forgery (CSRF) Solution (1)
<form id="csrfForm"
action="http://localhost:8080/csrf/content/vulnerable/changepa
ssword" method="POST" >
<input type="hidden" name="newPassword"
value="StorageRoomB" />
<input type="hidden" name="confirmPassword"
value="StorageRoomB" />
<input type="hidden" name="&#95;csrf"
value="103ae2a3&#45;d4d6&#45;46e9&#45;8ba6&#45;
92188ff998c2" />
</form>
©2016 – Cypress Data Defense, LLC

36. Request with invalid token submitted
Cross-Site Request Forgery (CSRF) Solution (2)
POST /csrf/content/vulnerable/changepassword HTTP/1.1
Host: localhost:8080
Cookie: JSESSIONID=2E7F523BE6E086F5EEB593B2B69842D2
Content-Type: application/x-www-form-urlencoded
Content-Length: 53
newPassword=StorageRoomB&confirmPassword=StorageRoomB&_csrf=10
3ae2a3-d4d6-46e9-8ba6-92188ff998c2
©2016 – Cypress Data Defense, LLC

37. 403 response from web site
Cross-Site Request Forgery (CSRF) Example (3)
HTTP/1.1 403 Forbidden
<div class="alert alert-dismissable alert-danger">
<span>java.lang.NullPointerException</span>
</div>
©2016 – Cypress Data Defense, LLC

38. Questions?
Contact Info
Steve
Twitter: @skosten
Email: steve.kosten@cypressdefense.com
Thanks for attending!
©2016 – Cypress Data Defense, LLC