[PPT] - jk: Using Dynamic Analysis to Crawl and Test Modern Web Applications PowerPoint Presentation

SLIDE 1

jÄk: Using Dynamic Analysis to Crawl and Test Modern Web Applications

Giancarlo Pellegrino(1), Constantin Tschürtz(2), Eric Bodden(2), and Christian Rossow(1)

18th International Symposium on Research in Attacks, Intrusions and Defenses November 3rd, Kyoto, Japan

(1) CISPA, Saarland University, Germany

(2) Fraunhofer SIT / TU Darmstadt, Germany

SLIDE 2

Nov. 3, 2016

Web Application Scanners

 (Semi-)automated security testing tools  Follow a dynamic and black-box testing approach

SLIDE 3

Nov. 3, 2016

Web Application Scanners

 (Semi-)automated security testing tools  Follow a dynamic and black-box testing approach

SLIDE 4

Nov. 3, 2016

Architecture

Crawler Module Attacker Module Analysis Module

SLIDE 5

Nov. 3, 2016

Crawler

Seed URL http://shop.foo http://shop.foo

SLIDE 6

Nov. 3, 2016

Crawler

<html> <head> <title>Online shopping</title> </head> <body> <a href=”/contacts”>Contacts</a> <form action=”/search”> <input type=”text” name=”q”/> <input type=”submit”/> </form> </body> </html> http://shop.foo

SLIDE 7

Nov. 3, 2016

Crawler

<html> <head> <title>Online shopping</title> </head> <body> <a href=”/contacts”>Contacts</a> <form action=”/search”> <input type=”text” name=”q”/> <input type=”submit”/> </form> </body> </html> http://shop.foo New URL

SLIDE 8

Nov. 3, 2016

Crawler

<html> <head> <title>Online shopping</title> </head> <body> <a href=”/contacts”>Contacts</a> <form action=”/search”> <input type=”text” name=”q”/> <input type=”submit”/> </form> </body> </html> http://shop.foo New search HTML form

SLIDE 9

Nov. 3, 2016

Crawler

http://shop.foo/contacts Next?

SLIDE 10

Nov. 3, 2016

Crawler

<html> <head> <title>Contact Page</title> </head> <body> <form action=”/comments”> <input type=”text” name=”msg”/> <input type=”submit”/> </form> </body> </html> http://shop.foo/contacts New HTML form

SLIDE 11

Nov. 3, 2016

Security Testing

<form action=”/search”> <input type=”text” name=”q”/> <input type=”submit”/> </form> Tests == Attacks Responses

?

shop.foo

XSS payload XSS payload SQL payload SQL payload

SLIDE 12

Nov. 3, 2016

Crawler Critical for Coverage

 Crawler explores the Web application attack surface

Missing parts → missing possible vulnerabilities

 Existing crawlers based on:

HTML parsing and pattern matching to extract URLs
“clickable” areas to further explore the surface

SLIDE 13

Nov. 3, 2016

Crawler and Modern Web Applications

 Complexity of client side has dramatically increased (i.e., stateful JS programs)

SLIDE 14

Nov. 3, 2016

Crawler and Modern Web Applications

 Complexity of client side has dramatically increased (i.e., stateful JS programs)  Links and forms can be built and inserted in the webpage at run-time

➔HTML parsing and pattern matching no longer sufficient

var url = scheme() + '://' + domain() + '/' + endpoint(); document.getElementByID('myLink').href = url;

SLIDE 15

Nov. 3, 2016

Crawler and Modern Web Applications

 Complexity of client side has dramatically increased (i.e., stateful JS programs)  Links and forms can be built and inserted in the webpage at run-time

➔HTML parsing and pattern matching no longer sufficient

 JS is an event-driven language

Functions executed upon events

➔Lack of support of event-based execution model

var url = scheme() + '://' + domain() + '/' + endpoint(); document.getElementByID('myLink').href = url;

click mouse movement timeout Ajax response received generate URLs/HTML form register new events Ajax requests

SLIDE 16

Nov. 3, 2016

Crawler and Modern Web Applications

 Complexity of client side has dramatically increased (i.e., stateful JS programs)  Links and forms can be built and inserted in the webpage at run-time

➔HTML parsing and pattern matching no longer sufficient

 JS is an event-driven language

Functions executed upon events

➔Lack of support of event-based execution model

var url = scheme() + '://' + domain() + '/' + endpoint(); document.getElementByID('myLink').href = url;

click mouse movement timeout Ajax response received generate URLs/HTML form register new events Ajax requests

Large part of web applications remain unexplored! Large part of web applications remain unexplored!

SLIDE 17

Nov. 3, 2016

Crawler and Modern Web Applications

 Complexity of client side has dramatically increased (i.e., stateful JS programs)  Links and forms can be built and inserted in the webpage at run-time

➔HTML parsing and pattern matching no longer sufficient

 JS is an event-driven language

Functions executed upon events

➔Lack of support of event-based execution model

var url = scheme() + '://' + domain() + '/' + endpoint(); document.getElementByID('myLink').href = url;

click mouse movement timeout Ajax response received generate URLs/HTML form register new events Ajax requests

Large part of web applications remain unexplored! Large part of web applications remain unexplored!

 We addressed the coverage problem with

JavaScript client side dynamic analysis
Model-based Crawler

 Build a tool: jÄk

SLIDE 18

Nov. 3, 2016

Our Approach

 Combine dynamic analysis with model-based crawler

Dynamic analysis monitors client side program execution
Crawler builds, maintains, uses a model of the visited attack surface

Seed URL

Model-based Crawler

Model Inference/Update Action Navigator

Dynamic Analysis

Trace Analysis APIs I/O Trace Handler reg. JS Engine Probe

SLIDE 19

Nov. 3, 2016

Dynamic Analysis

 Different approaches:

Seed URL Model Inference/Update Action Navigator Trace Analysis I/O Trace Handler reg. JS Engine Environment Probe APIs

SLIDE 20

Nov. 3, 2016

Dynamic Analysis

 Different approaches:

1) JS engine instrumentation → laborious task, engine-dependent

Seed URL Model Inference/Update Action Navigator Trace Analysis I/O Trace Handler reg. JS Engine Environment Probe APIs

SLIDE 21

Nov. 3, 2016

Dynamic Analysis

 Different approaches:

1) JS engine instrumentation → laborious task, engine-dependent 2) JS program instrumentation → JS code is not entirely available

Seed URL Model Inference/Update Action Navigator Trace Analysis I/O Trace Handler reg. JS Engine Environment Probe APIs

SLIDE 22

Nov. 3, 2016

Dynamic Analysis

 Different approaches:

1) JS engine instrumentation → laborious task, engine-dependent 2) JS program instrumentation → JS code is not entirely available 3) Modification of execution environment

Seed URL Model Inference/Update Action Navigator Trace Analysis I/O Trace Handler reg. JS Engine Environment Probe APIs

SLIDE 23

Nov. 3, 2016

Dynamic Analysis

 Modify execution environment via function hooking:

Intercept API calls (e.g., network I/O and event handler registration)
Object manipulations (i.e., object properties)
Schedule DOM inspections

 Hooks installed by injecting own JS code:

Function redefinition
Set functions

Seed URL Model Inference/Update Action Navigator I/O Handler reg. JS Engine Environment Probe APIs

SLIDE 24

Nov. 3, 2016

Function Redefinition

function handler() { alert("hello world"); } el = document.getElementByID('img') el.addEventListener("click", handler);

Application JS code

SLIDE 25

Nov. 3, 2016

Function Redefinition

function handler() { alert("hello world"); } el = document.getElementByID('img') el.addEventListener("click", handler);

SLIDE 26

Nov. 3, 2016

Function Redefinition

function handler() { alert("hello world"); } el = document.getElementByID('img') el.addEventListener("click", handler);

SLIDE 27

Nov. 3, 2016

Function Redefinition

function handler() { alert("hello world"); } el = document.getElementByID('img') el.addEventListener("click", handler);

API API

Element.prototype.addEventListener = function(e, h) { […] listeners[e].append(h); } Element.prototype.addEventListener = function(e, h) { […] listeners[e].append(h); }

SLIDE 28

Nov. 3, 2016

Function Redefinition

function handler() { alert("hello world"); } el = document.getElementByID('img') el.addEventListener("click", handler);

API API

Element.prototype.addEventListener = function(e, h) { […] listeners[e].append(h); } Element.prototype.addEventListener = function(e, h) { […] listeners[e].append(h); }

Intercept! Intercept!

SLIDE 29

Nov. 3, 2016

Function Redefinition

function handler() { alert("hello world"); } el = document.getElementByID('img') el.addEventListener("click", handler);

preamble

Application JS code

PREAMBLE PREAMBLE

var orig_f = Element.prototype.addEventListener; Element.prototype.addEventListener = function(){ console.log("new handler registration"); return orig_f.apply(this, argument); }; var orig_f = Element.prototype.addEventListener; Element.prototype.addEventListener = function(){ console.log("new handler registration"); return orig_f.apply(this, argument); };

SLIDE 30

Nov. 3, 2016

Function Redefinition

function handler() { alert("hello world"); } el = document.getElementByID('img') el.addEventListener("click", handler);

preamble

Application JS code

PREAMBLE PREAMBLE

var orig_f = Element.prototype.addEventListener; Element.prototype.addEventListener = function(){ console.log("new handler registration"); return orig_f.apply(this, argument); }; var orig_f = Element.prototype.addEventListener; Element.prototype.addEventListener = function(){ console.log("new handler registration"); return orig_f.apply(this, argument); };

API API

Element.prototype.addEventListener = function(e, h) { […] listeners[e].append(h); } Element.prototype.addEventListener = function(e, h) { […] listeners[e].append(h); }

SLIDE 31

Nov. 3, 2016

Function Redefinition

function handler() { alert("hello world"); } el = document.getElementByID('img') el.addEventListener("click", handler);

preamble

Application JS code

PREAMBLE PREAMBLE

var orig_f = Element.prototype.addEventListener; Element.prototype.addEventListener = function(){ console.log("new handler registration"); return orig_f.apply(this, argument); }; var orig_f = Element.prototype.addEventListener; Element.prototype.addEventListener = function(){ console.log("new handler registration"); return orig_f.apply(this, argument); };

API API

Element.prototype.addEventListener = function(e, h) { […] listeners[e].append(h); } Element.prototype.addEventListener = function(e, h) { […] listeners[e].append(h); }

SLIDE 32

Nov. 3, 2016

Function Redefinition

function handler() { alert("hello world"); } el = document.getElementByID('img') el.addEventListener("click", handler);

preamble

Application JS code

PREAMBLE PREAMBLE

var orig_f = Element.prototype.addEventListener; Element.prototype.addEventListener = function(){ console.log("new handler registration"); return orig_f.apply(this, argument); }; var orig_f = Element.prototype.addEventListener; Element.prototype.addEventListener = function(){ console.log("new handler registration"); return orig_f.apply(this, argument); };

API API

Element.prototype.addEventListener = function(e, h) { […] listeners[e].append(h); } Element.prototype.addEventListener = function(e, h) { […] listeners[e].append(h); }

SLIDE 33

Nov. 3, 2016

Function Redefinition

function handler() { alert("hello world"); } el = document.getElementByID('img') el.addEventListener("click", handler);

preamble

Application JS code

PREAMBLE PREAMBLE

var orig_f = Element.prototype.addEventListener; Element.prototype.addEventListener = function(){ console.log("new handler registration"); return orig_f.apply(this, argument); }; var orig_f = Element.prototype.addEventListener; Element.prototype.addEventListener = function(){ console.log("new handler registration"); return orig_f.apply(this, argument); };

API API

Element.prototype.addEventListener = function(e, h) { […] listeners[e].append(h); } Element.prototype.addEventListener = function(e, h) { […] listeners[e].append(h); }

SLIDE 34

Nov. 3, 2016

Function Redefinition

function handler() { alert("hello world"); } el = document.getElementByID('img') el.addEventListener("click", handler);

preamble

Application JS code

PREAMBLE PREAMBLE

var orig_f = Element.prototype.addEventListener; Element.prototype.addEventListener = function(){ console.log("new handler registration"); return orig_f.apply(this, argument); }; var orig_f = Element.prototype.addEventListener; Element.prototype.addEventListener = function(){ console.log("new handler registration"); return orig_f.apply(this, argument); };

API API

Element.prototype.addEventListener = function(e, h) { […] listeners[e].append(h); } Element.prototype.addEventListener = function(e, h) { […] listeners[e].append(h); }

SLIDE 35

Nov. 3, 2016

Model-based Crawler

 Creates and maintain a web application model

Oriented graph: nodes are page clusters and edges are URLs, HTML forms, or events

 Model used to decide on the next action

Priority: Events → high, URLs/forms → low

Seed URL

Dynamic Analysis

Trace Analysis APIs I/O Trace Handler reg. Hooking functions JS Engine Environment Probe

Model-based Crawler

Model Inference/Update Navigator Action

SLIDE 36

Nov. 3, 2016

Model-based Crawler

 Creates and maintain a web application model

Oriented graph: nodes are page clusters and edges are URLs, HTML forms, or events

 Model used to decide on the next action

Priority: Events → high, URLs/forms → low

Seed URL

Dynamic Analysis

Trace Analysis APIs I/O Trace Handler reg. Hooking functions JS Engine Environment Probe

Model-based Crawler

Model Inference/Update Navigator Action

SLIDE 37

Nov. 3, 2016

Assessment

SLIDE 38

Nov. 3, 2016

Our Tool

Dynamic Analysis

Trace Analysis APIs I/O Trace Handler reg. Hooking functions JS Engine Environment Probe

Model-based Crawler

Model Inference/Update Navigator Action

 New tool: jÄk [pron. Jack]  Source code on GitHub

https://github.com/ConstantinT/jAEk

 Free to run, copy, distribute, study, change and improve it

Free Software (GPL3) … and also free as free beer!

SLIDE 39

Nov. 3, 2016

Experiments

 Comparative analysis

Skipfish, W3af, Wget, and Crawljax

 Case studies:

WIVET (Web Input Vector Extractor Teaser)
assess strength and limitations of existing crawlers
13 web applications
studied coverage and vulnerability detection power

SLIDE 40

Nov. 3, 2016

Coverage

 Explored surface by jÄk (# of unique URL structs.)

x16 (Crawljax) to x2 (Skipfish) bigger

Crawler jÄk

~x6 bigger

SLIDE 41

Nov. 3, 2016

Coverage

 Explored surface by jÄk (# of unique URL structs.)

x16 (Crawljax) to x2 (Skipfish) bigger

 Relative size of new surface:

From +70% (Wget) to +98% (Crawljax) of URLs are new

jÄk

New surface Known surface ~86% more

SLIDE 42

Nov. 3, 2016

Coverage

 Explored surface by jÄk (# of unique URL structs.)

x16 (Crawljax) to x2 (Skipfish) bigger

 Relative size of new surface:

From +70% (Wget) to +98% (Crawljax) of URLs are new

 Global surface missed by jÄk:

From 22% (Skipfish) to 0.5% (Crawljax) are missed

Crawler jÄk

~15% missed URLs Unknown to jÄk

SLIDE 43

Nov. 3, 2016

Coverage

 Explored surface by jÄk (# of unique URL structs.)

x16 (Crawljax) to x2 (Skipfish) bigger

 Relative size of new surface:

From +70% (Wget) to +98% (Crawljax) of URLs are new

 Global surface missed by jÄk:

From 22% (Skipfish) to 0.5% (Crawljax) are missed
Further analysis:
75% of missed are due to URL forgery
25% to static resources, unsupported action, and others

Crawler jÄk

~15% missed URLs Unknown to jÄk

SLIDE 44

Nov. 3, 2016

Conclusion

SLIDE 45

Nov. 3, 2016

Conclusion/Takeaway

 Novel technique based on

dynamic analysis of JS program + model-based crawling

 Built jÄk, a tool implementing our approach  Assessed against 13 web applications  Our result show that jÄk explores a surface ~6x larger with +86% new URLs