[PDF] - Hands-On Ethical Hacking and Network Defense Second Edition Chapter PDF Document

SLIDE 1

Hands-On Ethical Hacking and Network Defense Second Edition Chapter 10 Hacking Web Servers Objectives

– Describe Web applications – Explain Web application vulnerabilities – Describe the tools used to attack Web servers Understanding Web Applications

– Nearly impossible – Some bugs create security vulnerabilities

– Larger user base than standalone applications – Bugs are a bigger problem Web Application Components

– Created using HTML

– Information varies – Need special components

– Allows customer to submit information to Web server

– Process information from a form using a Web application

– Security testers should recognize when forms are used

<html> <body> <form> Enter your username:

SLIDE 2

Hands-On Ethical Hacking and Network Defense Second Edition Chapter 10 Hacking Web Servers <input type="text" name="username"> <br> Enter your password: <input type="text" name="password"> </form></body></html> Common Gateway Interface

– From Web server to Web browser

– Many created with CGI and scripting languages

– Determines how Web server passes data to Web browser

#!/usr/bin/perl print "Content-type: text/html\n\n"; print "Hello Security Testers!"; Active Server Pages

– HTML documents can be displayed on the fly

– JScript – VBScript

– Largely replaced by ASP.NET

<HTML> <HEAD><TITLE> My First ASP Web Page </TITLE></HEAD> <BODY> <H1>Hello, security professionals</H1> The time is <% = Time %>. </BODY> </HTML>

SLIDE 3

Hands-On Ethical Hacking and Network Defense Second Edition Chapter 10 Hacking Web Servers

– Makes ASP more secure Apache Web Server

– Another Web Server program – Said to run on more than twice as many Web servers as IIS

– Works on just about any *nix and Windows platform – Free Using Scripting Languages

– Developed using several scripting languages

– Most are based on scripting language PHP Hypertext Processor

– Similar to ASP

– Embedded in an HTML Web page

– Users cannot see PHP code on their Web browser

– More widely used now

<html> <head> <title>My First PHP Program </title> </head> <body> <?php echo '<h1>Hello, Security Testers!</h1>'; ?> </body> </html>

SLIDE 4

Hands-On Ethical Hacking and Network Defense Second Edition Chapter 10 Hacking Web Servers ColdFusion

– Used to develop dynamic Web pages – Created by the Allaire Corporation

– Written in ColdFusion Markup Language (CFML)

– Can contain other technologies (e.g., HTML or JavaScript)

<html> <head> <title>Using CFML</title> </head> <body> <CFLOCATION URL="www.isecom.org/cf/index.htm" ADDTOKEN="NO"> </body> </html> VBScript

– Scripting language – Developed by Microsoft – Converts static Web pages into dynamic Web pages

– Powerful programming language features

– Starting point for investigating VBScript vulnerabilities

<html> <body> <script type="text/vbscript"> document.write("<h1>Hello Security Testers!</h1>") document.write("Date Activated: " & date()) </script> </body> </html> JavaScript

SLIDE 5

Hands-On Ethical Hacking and Network Defense Second Edition Chapter 10 Hacking Web Servers

– Branching – Looping – Testing

– Exploited in older Web browsers

<html> <head> <script type="text/javascript"> function chastise_user() { alert("So, you like breaking rules?") document.getElementByld("cmdButton").focus() } </script> </head> <body> <h3>"If you are a Security Tester, please do not click the command button below!"</h3> <form> <input type="button" value="Don't Click!" name="cmdButton"

</form> </body> </html> Connecting to Databases

– Used connect databases with Web applications

SLIDE 6

Hands-On Ethical Hacking and Network Defense Second Edition Chapter 10 Hacking Web Servers – Allows application to access data stored in a database management system

– Standardized representation for data types – Library of ODBC function calls – Standard method of connecting to and logging on Object Linking and Embedding Database

– Enable applications to access data stored in DBMS

– Faster, more efficient, and more stable than ODBC

– Allows application to access data stored on external device

– Depends on data source ActiveX Data Objects

– Defines a set of technologies that allow desktop applications to interact with Web

– Create ADO connection – Open database connection created – Create ADO recordset – Open recordset and select data you need – Close recordset and database connection Understanding Web Application Vulnerabilities

– Application security

– Deface the Web site – Destroy company’s database or sell contents – Gain control of user accounts – Perform secondary attacks – Gain root access to other application servers

SLIDE 7

Hands-On Ethical Hacking and Network Defense Second Edition Chapter 10 Hacking Web Servers Application Vulnerabilities Countermeasures

– Not-for-profit organization – Finds and fights Web application vulnerabilities – Publishes Ten Most Critical Web Application Security Vulnerabilities

– Cross-site scripting (XSS) flaws – Injection flaws and malicious file execution – Unsecured direct object reference – Cross-site request forgery (CSRF) – Information leakage and incorrect error handling – Broken authentication and session management – Unsecured cryptographic storage – Unsecured communication – Failure to restrict URL access

– Helps security testers learn how to conduct vulnerability testing on Web applications Assessing Web Applications

– Does the Web application use dynamic Web pages? – Does the Web application connect to a back-end database server? – Does the Web application require authentication of the user? – On what platform was the Web application developed?

– Do not create a secure environment

– Submitting a specially formatted URL to attacked Web server – IIS does not correctly parse the URL information – Attacker could launch a Unicode exploit http://www.nopatchiss.com/scripts/..%255c..%255cwinnt/system32/cmd.exe?/c+dir+c – Attacker can install a Trojan program

– SQL injection: attacker inserts SQL commands in Web application field

SLIDE 8

Hands-On Ethical Hacking and Network Defense Second Edition Chapter 10 Hacking Web Servers SELECT * FROM customer WHERE tblusername = ' OR "=" AND tblpassword = ' OR "="

Basic testing should look for: – Whether you can enter text with punctuation marks – Whether you can enter a single quotation mark followed by any SQL keywords – Whether you can get any sort of database error when attempting to inject SQL statements Does the Web Application Require Authentication of the User?

users – Examine how information is passed between the two servers

– Verify logon and password information are stored securely

On What Platform Was the Web Application Developed?

– Attacks differ depending on platform and technology

– The more you know about a system, the easier it is to gather information about vulnerabilities Tools of Web Attackers and Security Testers

– Security testers or attackers look for tools to test or attack the system

– No matter which platform is used, there is a security hole and a tool capable of breaking into it

– Written in C in 1999 by Bronc Buster – Tool for searching Web sites for CGI scripts that can be exploited

– Uses a black box approach

SLIDE 9

Hands-On Ethical Hacking and Network Defense Second Edition Chapter 10 Hacking Web Servers – Inspects by searching from outside

– Uses “fuzzing”

– Web Tools (cont’d.)

– Attempts authentication using: