CSC 482/582: Computer Security

CSC 482/582: Computer Security
HTTP Security CSC 482/582: Computer Security

Topics How HTTP works HTTP methods, headers, and responses
URIs, URLs, and URNs Statelessness Cookies More HTTP methods and headers Proxying and Caching HTTP Vulnerabilities CSC 482/582: Computer Security

HTTP: HyperText Transfer Protocol
Request for Resource Response Web Client Web Server CSC 482/582: Computer Security

Pages Require Many Requests
CSC 482/582: Computer Security

HTTP GET Request Method URL Protocol Version Headers
GET HTTP/1.1 Host: User-Agent: Mozilla/5.0 (Windows NT 6.2) Gecko/ Firefox/35.0 Accept: text/html, image/png, */* Accept-Language: en-us,en;q=0.5 Cookie: rememberme=true; PREF=ID=21039ab4bbc49153:FF=4 Blank Line No Data for GET method CSC 482/582: Computer Security

HTTP POST Request Method URL Protocol Version Headers
POST HTTP/1.1 Host: User-Agent: Mozilla/5.0 (Windows NT 6.2) Gecko/ Firefox/35.0 Accept: text/html, image/png, */* Accept-Language: en-us,en;q=0.5 Blank Line name=Jane+Doe&sex=female&color=green&over6feet=true&over200pounds=false&athleticability=NA POST data CSC 482/582: Computer Security

HTTP Response Protocol Version HTTP Response Code HTTP/1.1 200 OK
Cache-Control: private Content-Type: text/html Server: GWS/2.1 Date: Fri, 13 Oct :16:30 GMT <HTML> ... (page data) ... </HTML> Headers Blank Line Web Page Data CSC 482/582: Computer Security

Common HTTP Methods Method Description GET
Retrieve resource located at specified URI. HEAD Retrieve metadata about resource located at specified URI. Useful for caches to determine if they need to retrieve an updated resource. PUT Create or replace resource located at specified URI with resource provided by client. DELETE Delete resource located at specified URI. OPTIONS Return list of HTTP methods that can be used with specified URI. POST Create a new resource under the specified URI, e.g. adding a new message in a web forum, adding a comment to a blog post, annotating a photo, etc. In summary, POST is a way for a client to create a new resource without knowing its URI; the client just knows the URI of a “parent” or “factory” resource. CSC 482/582: Computer Security

Idempotence and Safety
An operation is safe if making the request will not change any state on the server. GET, HEAD, and OPTIONS are safe. An operation is idempotent if making one request has the same effect as making a series of identical requests. PUT and DELETE are idempotent. POST is neither safe nor idempotent. It is possible for servers to misuse requests like GET. Example: GET If misused, testing tools, spiders, caches can destroy data. CSC 482/582: Computer Security

Common HTTP Response Codes
Meaning 200 OK Resource is available in the body of the response. No errors. 400 BAD REQUEST Client sent a request with an error. If there is a response body, it contains an error message. 500 INTERNAL SERVER ERROR Server error. If there is a response body, it contains an error message. 301 MOVED PERMANENTLY Client triggered action that caused URI to change or attempted to access old URI. 404 NOT FOUND No resource is available at the specified URI. 410 GONE Resource is no longer available at the specified URI. 409 CONFLICT Client requested action that would put resources in an inconsistent state. CSC 482/582: Computer Security

Common Request Headers
Description Accept: Content-types (Internet media types) acceptable for response. Authorization: Authentication credentials for HTTP authorization. Cookie: Sends state previously set by server back to server. Content-Length: Length of data in body (important for POST requests.) Host: Name of server (and port if not default). Mandatory in HTTP/1.1. If-Modified-Since: Server should only return a response if the data was modified since date specified in this header. Referer: URL of web page from which a link was followed to produce this request. Some URLs contain sensitive information, so some sites use intermediate services to anonymize this header. User-Agent: String that identifies browser, typically containing a product name and version (Firefox/36.0), layout name and version (Gecko/2010), operating system (Linux x86_64), and compatibility (Mozilla/5.0). CSC 482/582: Computer Security

Common Response Headers
Description Content-Length: Specifies length of response body sent to browser except in the case of chunked data, where chunk lengths are sent in body. Content-Type: Internet media type of data being sent to browser. Location: Used in redirection responses. Server: Server identification string, e.g. Apache/ Set-Cookie: Creation or overwriting of an HTTP cookie. Transfer-Encoding: Specifies encoding (compression type or chunked) for page data sent to browser. WWW-Authenticate: Specifies type of HTTP authentication that should be used. CSC 482/582: Computer Security

HTTP Header Parsing Handling of duplicate headers.
~50% of browsers/servers will use first header. ~50% of browsers/servers will use last header. Mixing of protocol versions Difficult to predict effect of mixing of 1.0 and 1.1 headers, especially when headers have the same purpose. Ex: Expires(1.0) and Cache-Control(1.1) headers. Semicolon-delimited header values Quoted string format values not handled well by IE. Content-Disposition: attach; filename=“evil.exe;.txt” CSC 482/582: Computer Security

Internet Media Types Standards Format Handling in HTTP
Original MIME (Multipurpose Internet Mail Extensions) IANA maintains official registry of types at Format Type/Subtype; Optional Parameters Example: text/html; charset=UTF-8 Handling in HTTP Requested in Accept: header. Specified by server in Content-Type: header. Browser may view directly, use plug-in, or start an external program.

HTTP Standards Historical Standards
HTTP 0.9 (1991) 1st documented version. HTTP 1.0 (1996) defined in RFC 1945. HTTP 1.1 (1999) defined in RFC 2616. Current Standard (well specified HTTP/1.1, 2014) RFC 7230: Message Syntax and Routing RFC 7231: Semantics and Content RFC 7232: Conditional Requests RFC 7233: Range Requests RFC 7234: Caching RFC 7235: Authentication CSC 482/582: Computer Security

HTTP/2 Focused on performance; no semantics changes Status
Based on Google’s SPDY protocol. Single TCP connection for each client/server pair. Allows multiple requests and responses to be sent simultaneously over same connection. HPACK header compression. Server can push additional documents (images, stylesheets, scripts, iframes). Status IETF finished, expected to publish RFC in 1Q2015. Firefox 36 and Chrome 40 will support draft HTTP/2. CSC 482/582: Computer Security

Uniform Resource Identifiers (URIs)
A URI is a string of characters that identify a web resource that come in two types. Uniform Resource Names (URNs) Identify a resource by name within a specific namespace. Ex: urn:isbn: Uniform Resource Locators (URLs) Identify a resource via a representation of its primary access mechanism, e.g. a network address. Ex: CSC 482/582: Computer Security

URL Format Proto is the network protocol, e.g. http, ftp, mailto, etc. User and pw are optional authentication credentials. Host is the DNS name or IP address of the server. Port is the TCP port number; defaults to 80 for http. Path is the name of the resource on the server, which may or may not represent a filesystem path. Qstr is a query string typically used by GET requests to send parameters to an application. Frag is a fragment identifier used by the client to identify a location within a web page. It is not sent to the server. Some client apps use fragments for navigation, so their contents may be security sensitive. RFC 1738 for URL definitions CSC 482/582: Computer Security

URL Encoding Query string is set of key=value pairs separated by & ?q=cloud&lang=en Whitespace marks end of URL Special characters must be URL-encoded. %HH represents character with hex values, e.g. %20 = space. Special characters include whitespace ? / # & Any character may be encoded, including proto, path, etc. URL encoding is also used in the body of POST requests. RFC 1738 for URL definitions CSC 482/582: Computer Security

HTTP is a stateless protocol
A stateful protocol allows requests to move the server into a different state, in which a request may produce a different result. Example protocols: FTP, SMTP, TCP FTP command “get rest.txt” will return a different file when cwd is /public rather than /private. A stateless protocol treats each request as an independent transaction that is unrelated to any previous request so that communication consists of independent pairs of requests and responses. Examples: HTTP, IP CSC 482/582: Computer Security

Stateless and Stateful Architectures
CSC 482/582: Computer Security

Handling Statelessness
Store state information directly in the address (URI) To access second page in google search for “http”: q=http&safe=off&start=10 Works best for web services. Store state indirectly in an HTTP header (cookies) Most common type of state storage. Some plug-ins can store state. Flash cookies are the most common type. HTML 5 provides browser storage features. CSC 482/582: Computer Security

Cookies Maintain state via HTTP headers Examples Encoding
State specified is set of name=value pairs. Set-Cookie header sent from server. Cookie header sent from browser. No RFC specification used til RFC 6265 in 2011. Examples Set-Cookie: foo=bar; path=/; expires Fri, 20-Feb :59:00 GMT Cookie: foo=bar Encoding Encode cookies with base64 to avoid metacharacter interpretation (colons, commas, slashes, quotes, etc.) CSC 482/582: Computer Security

CSC 482/582: Computer Security
Cookie Fields Expires: if specified, cookie may be saved to disk and persist across sessions. If not, then cookie persists for duration of browser session. Max-age: similar to Expires, but not supported by IE. Domain: scoping mechanism to allow cookie to be scoped to domain broader than host that sent Set-Cookie header. Path: scopes cookie to a specified path prefix. Secure: prevents cookie from being sent over non-encrypted connections. HttpOnly: removes ability to read cookie via document.cookie API in JavaScript to protect against XSS. RFC 6265 CSC 482/582: Computer Security

Cookie Security Policy
Domain parameter limits which servers are sent cookie in complex ways (see table). Path parameter limits which paths are sent cookies, but JavaScript from any path can read cookies. Table 9-3 from The Tangled Web CSC 482/582: Computer Security

More HTTP Methods Method Description COPY Copies file to path in Destination header. Part of WebDAV specification. MOVE Moves file to path in Destination header. Part of WebDAV specification. SEARCH Searches directory path for resources. PROPFIND Retrieves information about resources, such as author, size, content-type. CONNECT Make non-HTTP connections via HTTP proxies. TRACE Returns exact request received by header in response body. Can be used to bypass HttpOnly cookie protection against XSS attacks.

HTTP TRACE Example $ telnet localhost 80
Trying... Connected to Escape character is '^]'. TRACE / HTTP/1.1 Host: foo x-myheader: spam HTTP/ OK Date: Mon, 04 Mar :34:45 GMT Server: Apache/ (Unix) Connection: close Content-Type: message/http TRACE / HTTP/1.0 Connection closed. CSC 482/582: Computer Security

HTTP Proxies Browser configured to proxy GET request
GET HTTP/1.1 User-Agent: mybrowser/2.0 Host: URL and Host specifications Perform same task. Evolved separately. Proxy must be careful to avoid being tricked into caching page from one as page from another site Host: CSC 482/582: Computer Security

HTTP Caching HTTP/1.1 cache behavior Cache-Control header
GETs with 200, 301, &c responses may be cached. Cache may be returned to any future requests for that URL even if headers differ, including cookies. Cache may revalidate content (with If-Modified-Since header) before reuse but is not required to do so. Cache-Control header Public: document is cacheable publicly. Private: proxies are not permitted to cache. No-cache: cache but don’t reuse; only FF supports. No-store: do not cache this document at all. Pragma: no-cache from HTTP/1.0 still in use. CSC 482/582: Computer Security

HTTP Headers HTTP headers can be vulnerable to
Injection Attacks, including SQL Injection Cross-Site Scripting (XSS) Most commonly vulnerable headers Referer User-Agent String userAgent = request.getHeader(“user-agent”); String sQuery = “DELETE FROM UP_USER_UA_MAP WHERE USER_ID=“ + userId + “ AND USER_AGENT=‘” + userAgent + “’” ... stmt.executeUpdate(sQuery); CSC 482/582: Computer Security

HTTP Header Injection Add new header + body content to HTTP response.
Client sends input containing end-of-line (EOL) HTTP EOL is CR/LF (\r\n, %0d%0a URL-encoded) Example Code: String author = request.getParameter(AUTHOR_PARAM); ... Cookie cookie = new Cookie("author", author); cookie.setMaxAge(cookieExpiration); response.addCookie(cookie); CSC 482/582: Computer Security

HTTP Response Splitting
Malicious input submitted via AUTHOR_PARAM form input: A Hacker\r\nHTTP/ OK\r\nContent-Type: text/html\r\n <html>Hacker Content</html> Resulting HTTP responses HTTP/ OK … Set-Cookie: author=A Hacker Content-Type: text/html <html>Hacker Content</html>

Response Splitting Impact
Attacker controls page contents Page defacement. Can redirect to attacker controlled site. Script executes in context of legitimate site JavaScript sent by attacker as part of second response has access to cookies and other data of legitimate site. CSC 482/582: Computer Security

Cache Poisoning Attack
Select a page to poison in proxy cache. Replace /admin with phishing trojan. Locate header injection vulnerability. Inject second response body with trojan. Connect to proxy and send requests. First request is header injection described above. Second request is for page that’s being poisoned. Proxy talks to app, gets response. Proxy interprets 2nd response body as response to attacker’s 2nd pipelined request. Updates cache with trojan version. CSC 482/582: Computer Security

Key Points Requests Stateless architecture Cookies
Idempotence Safety Stateless architecture Cookies HTTP response splitting Cache poisoning CSC 482/582: Computer Security

References David Gourley et. Al., HTTP: The Definitive Guide, O’Reilly, 2002. Krishnamurthy et. Al., Key Differences Between HTTP/1.0 and HTTP/1.1, Mark Nottingham, RFC 2616 is Dead, Dafydd Stuttart and Marcus Pinto, The Web Application Hacker’s Handbook, 2nd Edition, Wiley, 2011. HTTP/2 Home Page, Sanctum, “HTTP Response Splitting Whitepaper,” tpresponse.pdf, 2004. Michael Zalewski, The Tangled Web: A Guide to Securing Modern Web Applications, No Starch Press, 2011. CSC 482/582: Computer Security

CSC 482/582: Computer Security

Similar presentations

Presentation on theme: "CSC 482/582: Computer Security"— Presentation transcript:

Similar presentations

About project

Feedback

Log in

Auth with social network:

CSC 482/582: Computer Security

Similar presentations

Presentation on theme: "CSC 482/582: Computer Security"— Presentation transcript:

Similar presentations

About project

Feedback