Collection Information Describe Web applications Explain Web application vulnerabilities Describe the tools used to attack Web servers 2... Use the element or tag in an HTML do
Trang 1Lesson 10 Hacking Web Servers
Trang 2 Collection Information
Describe Web applications
Explain Web application vulnerabilities
Describe the tools used to attack Web servers
2
Trang 3Hands-On Ethical Hacking and Network
Trang 4Hands-On Ethical Hacking and Network
Trang 5 It is nearly impossible to write a program without
bugs
Some bugs create security vulnerabilities
Web applications also have bugs
Web applications have a larger user base than standalone applications
Bugs are a bigger problem for Web
applications
5
Trang 6 Static Web pages
Created using HTML
Dynamic Web pages
Need special components
<form> tags
Common Gateway Interface (CGI)
Active Server Pages (ASP)
Trang 7 Use the <form> element or tag in an HTML
document
Allows customer to submit information to the Web server
Web servers process information from a Web form
by using a Web application
Easy way for attackers to intercept data that users
submit to a Web server
7
Trang 8 Web form example
<html>
<body>
<form>
Enter your username:
<input type="text" name="username">
<br>
Enter your password:
<input type="text" name="password">
</form></body></html>
8
Trang 10 Handles moving data from a Web server to a Web
CGI programs can be written in different
programming and scripting languages
10
Trang 11 CGI example
Written in Perl
Hello.pl
Should be placed in the cgi-bin directory on
the Web server
#!/usr/bin/perl
print "Content-type: text/html\n\n";
print "Hello Security Testers!";
11
Trang 12 With ASP, developers can display HTML
documents to users on the fly
Main difference from pure HTML pages
When a user requests a Web page, one is
created at that time
ASP uses scripting languages such as JScript or
VBScript
Not all Web servers support ASP
12
Trang 14 ASP example
<HTML>
<HEAD><TITLE> My First ASP Web Page </TITLE></HEAD>
<BODY>
<H1>Hello, security professionals</H1>
The time is <% = Time %>.
Trang 15 Tomcat Apache is another Web Server program
Tomcat Apache hosts anywhere from 50% to 60% of all Web sites
Trang 18 Dynamic Web pages can be developed using
Trang 19 Enables Web developers to create dynamic Web pages
Similar to ASP
Open-source server-side scripting language
Can be embedded in an HTML Web page using PHP tags <?php and ?>
Users cannot see PHP code on their Web browser
Used primarily on UNIX systems
Also supported on Macintosh and Microsoft
platforms
19
Trang 22 Web pages can display information stored on
databases
There are several technologies used to connect
databases with Web applications
Technology depends on the OS used
Trang 23 Standard database access method developed by the SQL Access Group
ODBC interface allows an application to access
Data stored in a database management
system
Any system that understands and can issue
ODBC commands
Interoperability among back-end DBMS is a key
feature of the ODBC interface
23
Trang 24 ODBC defines
Standardized representation of data types
A library of ODBC functions
Standard methods of connecting to and
logging on to a DBMS
24
Trang 25 OLE DB is a set of interfaces
Enables applications to access data stored in a DBMS
Developed by Microsoft
Designed to be faster, more efficient, and
more stable than ODBC
OLE DB relies on connection strings
Different providers can be used with OLE DB
depending on the DBMS to which you want to
connect
25
Trang 27 ActiveX defines a set of technologies that allow
desktop applications to interact with the Web
ADO is a programming interface that allows Web
applications to access databases
Steps for accessing a database from a Web page
Create an ADO connection
Open the database connection you just created
Create an ADO recordset
Open the recordset
Select the data you need
Close the recordset and the connection
27
Trang 28 Many platforms and programming languages can be used to design a Web site
Application security is as important as network
security
Attackers controlling a Web server can
Deface the Web site
Destroy or steal company’s data
Gain control of user accounts
Perform secondary attacks from the Web site
Gain root access to other applications or
servers
28
Trang 29 Open Web Application Security Project (OWASP)
Open, not-for-profit organization dedicated to
finding and fighting vulnerabilities in Web
HTTP requests are not validated by the Web server
Developers implement access controls but fail to
test them properly
29
Trang 30 Top-10 Web application vulnerabilities (continued)
Broken account and session management
Enables attackers to compromise passwords or session cookies to gain access to accounts
Cross-site scripting (XSS) flaws
Attacker can use a Web application to run a
script on the Web browser of the system he or she is attacking
Buffer overflows
It is possible for an attacker to use C or C++
code that includes a buffer overflow
30
Trang 31 Top-10 Web application vulnerabilities (continued)
Command injection flaws
An attacker can embed malicious code and run a program on the database server
Error-handling problems
Error information sent to the user might reveal information that an attacker can use
Insecure use of cryptography
Storing keys, certificates, and passwords on a
Web server can be dangerous
31
Trang 32 Top-10 Web application vulnerabilities (continued)
Remote administration flaws
Attacker can gain access to the Web server
through the remote administration interface
Web and application server misconfiguration
Any Web server software out of the box is
usually vulnerable to attack
Default accounts and passwords
Overly informative error messages
32
Trang 33 WebGoat project
Helps security testers learn how to perform
vulnerabilities testing on Web applications
Developed by OWASP
WebGoat can be used to
Reveal HTML or Java code and any cookies or parameters used
Hack a logon name and password
33
Trang 36 WebGoat can be used to
Traverse a file system on a Windows XP
computer running Apache
WebGoat’s big challenge
Defeat an authentication mechanism
Steal credit cards from a database
Deface a Web site
36
Trang 40 Security testers should look for answers to some
important questions
Does the Web application use dynamic Web
pages?
Does the Web application connect to a
backend database server?
Does the Web application require
authentication of the user?
On what platform was the Web application
developed?
40
Trang 41 Static Web pages do not create a security
environment
IIS attack example
Submitting a specially formatted URL to the
attacked Web server
IIS does not correctly parse the URL information
Attackers could launch a Unicode exploit
http://www.nopatchiss.com/scripts/ %255c
%255cwinnt/system32/cmd.exe?/c+dir+c
Attacker can even install a Trojan program
41
Trang 42 Security testers should check for the possibility of SQL injection being used to attack the system
SQL injection involves the attacker supplying SQL commands on a Web application field
SQL injection examples
SELECT * FROM customer
WHERE tblusername = ' ' OR 1=1 ' AND tblpassword = ' '
or
SELECT * FROM customer
WHERE tblusername = ' OR "=" AND tblpassword = ' OR "="
42
Trang 43 Basic testing should look for
Whether you can enter text with punctuation marks
Whether you can enter a single quotation
mark followed by any SQL keywords
Whether you can get any sort of database
error when attempting to inject SQL
43
Trang 44 Many Web applications require another server
authenticate users
Examine how information is passed between the
two servers
Encrypted channels
Verify that logon and password information is
stored on secure places
Authentication servers introduce a second target
44
Trang 45 Several different platforms and technologies can be used to develop Web applications
Attacks differ depending on the platform and
technology used to develop the application
Footprinting is used to find out as much
information as possible about a target system
The more you know about a system the easier
it is to gather information about its
vulnerabilities
45
Trang 46 Choose the right tools for the job
Attackers look for tools that enable them to attack the system
They choose their tools based on the
vulnerabilities found on a target system or
application
46
Trang 47 Cgiscan.c: CGI scanning tool
Written in C in 1999 by Bronc Buster
Tool for searching Web sites for CGI scripts
that can be exploited
One of the best tools for scanning the Web for systems with CGI vulnerabilities
47
Trang 49 Phfscan.c
Written to scan Web sites looking for hosts
that could be exploited by the PHF bug
The PHF bug enables an attacker to download the victim’s /etc/passwd file
It also allows attackers to run programs on the victim’s Web server by using a particular URL
49
Trang 50 Wfetch: GUI tool
This tool queries the status of a Web server
It also attempts authentication using