Hacking Web Apps: Detecting and Preventing Web Application Security Problems

284 Pages·2012·14.68 MB·English

by  Mike Shema

Hacking Web Apps
Hacking Web Apps
Detecting and Preventing Web
Application Security Problems
Mike Shema
Technical Editor
Jorge Blanco Alcover
AMSTERDAM • BOSTON • HEIDELBERG • LONDON
NEW YORK • OXFORD • PARIS • SAN DIEGO
SAN FRANCISCO • SINGAPORE • SYDNEY • TOKYO
Syngress is an Imprint of Elsevier
Acquiring Editor: Chris Katsaropolous
Development Editor: Meagan White
Project Manager: Jessica Vaughan
Designer: Kristen Davis
Syngress is an imprint of Elsevier
225 Wyman Street, Waltham, MA 02451, USA
© 2012 Elsevier, Inc. All rights reserved.
No part of this publication may be reproduced or transmitted in any form or by any means,
electronic or mechanical, including photocopying, recording, or any information storage
and retrieval system, without permission in writing from the publisher. Details on how to
seek permission, further information about the Publisher’s permissions policies and our
arrangements with organizations such as the Copyright Clearance Center and the Copyright
Licensing Agency, can be found at our website: www.elsevier.com/permissions.
This book and the individual contributions contained in it are protected under copyright by the
Publisher (other than as may be noted herein).
Notices
Knowledge and best practice in this field are constantly changing. As new research and
experience broaden our understanding, changes in research methods or professional practices,
may become necessary. Practitioners and researchers must always rely on their own experience
and knowledge in evaluating and using any information or methods described herein. In using
such information or methods they should be mindful of their own safety and the safety of
others, including parties for whom they have a professional responsibility.
To the fullest extent of the law, neither the Publisher nor the authors, contributors, or editors,
assume any liability for any injury and/or damage to persons or property as a matter of products
liability, negligence or otherwise, or from any use or operation of any methods, products,
instructions, or ideas contained in the material herein.
Library of Congress Cataloging-in-Publication Data
Application submitted
British Library Cataloguing-in-Publication Data
A catalogue record for this book is available from the British Library.
ISBN: 978-1-59749-951-4
Printed in the United States of America
12 13 14 15 16 10 9 8 7 6 5 4 3 2 1
For information on all Syngress publications visit our website at www.syngress.com
About the Author
Mike Shema develops web application security solutions at Qualys, Inc.
His current work is focused on an automated web assessment service. Mike
previously worked as a security consultant and trainer for Foundstone where
he conducted information security assessments across a range of industries and
technologies. His security background ranges from network penetration testing,
wireless security, code review, and web security. He is the co-author of Hacking
Exposed: Web Applications, The Anti-Hacker Toolkit and the author of Hack
Notes: Web Application Security. In addition to writing, Mike has presented at
security conferences in the U.S., Europe, and Asia.
v
Acknowledgements
Several people deserve thanks for helping move this book from concept to
completion. The Lorimer crew provided endless entertainment and unexpected
lessons in motivation. The development team at Elsevier helped immensely.
Thanks to Chris Katsaropoulos for urging this book along; and Alex Burack, Dave
Bevans, Jessica Vaughn, Meagan White, and Andre Cuello for shepherding it to
the finish line. Finally, it’s important to thank the readers of the Seven Deadliest
Web Attacks whose interest in web security and feedback helped make the writing
process a rewarding experience.
vii
B978-1-59-749951-4.00013-8
CHAPTER
Introduction
Mike Shema
487 Hill Street, San Francisco, CA 94114, USA
INFORMATION IN THIS CHAPTER:
• Book Overview and Key Learning Points
• Book Audience
• How this Book is Organized
• Where to Go From Here
Pick your favorite cliche or metaphor you’ve heard regarding The Web. The aphorism
might generically describe Web security or evoke a mental image of the threats faced
by and emanating from Web sites. This book attempts to illuminate the vagaries of
Web security by tackling eight groups of security weaknesses and vulnerabilities
most commonly exploited by hackers. Some of the attacks will sound very familiar.
Other attacks may be unexpected, or seem unfamiliar simply because they neither
adorn a top 10 list nor make headlines. Attackers might go for the lowest common
denominator, which is why vulnerabilities like cross-site scripting and SQL injection
garner so much attention—they have an unfortunate combination of pervasiveness
and ease of exploitation. Determined attackers might target ambiguities in the design
of a site’s workflows or assumptions—exploits that result in significant financial gain
that may be specific to one site only, but leave few of the tell-tale signs of compro-
mise that more brutish attacks like SQL injection do.
On the Web information equals money. Credit cards clearly have value to hack-
ers; underground “carder” sites have popped up that deal in stolen cards; complete
with forums, user feedback, and seller ratings. Yet our personal information, pass-
words, email accounts, on-line game accounts, and so forth all have value to the
right buyer, let alone the value we personally place in keeping such things private.
Consider the murky realms of economic espionage and state-sponsored network
attacks that have popular attention and grand claims, but a scarcity of reliable public
information. (Not that it matters to Web security that “cyberwar” exists or not; on
that topic we care more about WarGames and Wintermute for this book.) It’s possible
to map just about any scam, cheat, trick, ruse, and other synonyms from real-world
conflict between people, companies, and countries to an analogous attack executed
on the Web. There’s no lack of motivation for trying to gain illicit access to the wealth
of information on the Web, whether for glory, country, money, or sheer curiosity.
Hacking Web Apps. http://dx.doi.org/10.1016/B978-1-59-749951-4.00013-8 xiii
© 2012 Elsevier, Inc. All rights reserved.
xiv CHAPTER I ntroduction
BOOK OVERVIEW AND KEY LEARNING POINTS
Each of the chapters in this book presents examples of different hacks against Web
applications. The methodology behind the attack is explored as well as showing its
potential impact. An impact may be against a site’s security, or a user’s privacy.
A hack may not even care about compromising a Web server, instead turning its
focus on the browser. Web security impacts applications and browsers alike. After
all, that’s where the information is.
Then the chapter moves on to explain possible countermeasures for different
aspects of the attack. Countermeasures are a tricky beast. It’s important to under-
stand how an attack works before designing a good defense. It’s equally important to
understand the limitations of a countermeasure and how other vulnerabilities might
entirely bypass it. Security is an emergent property of the Web site; it’s not a sum-
mation of individual protections. Some countermeasures will show up several times,
others make only a brief appearance.
BOOK AUDIENCE
Anyone who uses the Web to check email, shop, or work will benefit from knowing
how the personal information on those sites might be compromised or how sites
harbor malicious content. The greatest security burden lies with a site’s developers.
Users have their own part to play, too. Especially in terms of maintaining an up-to-
date browser, being careful with passwords, and being wary of non-technical attacks
like social engineering.
Web application developers and security professionals will benefit from the tech-
nical details and methodology behind the Web attacks covered in this book. The first
steps to improving a site’s security are understanding the threats to an application
and poor programming practices lead to security weaknesses that lead to vulner-
abilities that lead to millions of passwords being pilfered from an unencrypted data
store. Plus, several chapters dive into effective countermeasures independent of the
programming languages or technologies underpinning a specific site.
Executive level management will benefit from understanding the threats to a Web
site and in many cases how a simple hack—requiring no more tools than a browser
and a brain—negatively impacts a site and its users. It should also illustrate that even
though many attacks are simple to execute, good countermeasures require time and
resources to implement properly. These points should provide strong arguments for
allocating funding and resources to a site’s security in order to protect the wealth of
information that Web sites manage.
This book assumes some basic familiarity with the Web. Web security attacks
manipulate HTTP traffic to inject payloads or take advantage of deficiencies in the
protocol. They also require understanding HTML in order to manipulate forms or
inject code that puts the browser at the mercy of the attacker. This isn’t a prerequisite
for understanding the broad strokes of a hack or learning how hackers compromise
Shema 978-1-59-749951-4
Book Audience xv
a site. For example, it’s good to start off with the familiarity that HTTP uses port 80
by default for unencrypted traffic and port 443 for traffic encrypted with the Secure
Sockets Layer/Transport Layer Security (SSL/TLS). Sites use the https:// scheme to
designate TLS connections. Additional details are necessary for developers and secu-
rity professionals who wish to venture deeper into the methodology of attacks and
defense. The book strives to present accurate information. It does not strive for exact-
ing adherence to nuances of terminology. Terms like URL and link are often used
interchangeably, as are Web site and Web application. Hopefully, hacking concepts
and countermeasure descriptions are clear enough that casual references to HTML
tags and HTML elements don’t irk those used to reading standards and specifica-
tions. We’re here to hack and have fun.
Readers already familiar with basic Web concepts can skip the next two sections.
The Modern Browser
There are few references to specific browser versions in this book. The primary
reason is that most attacks work with standard HTML or against server-side tech-
nologies to which the browser is agnostic. Buffer overflows and malware care about
specific browser versions, hacks against Web sites rarely do. Another reason is that
browser developers have largely adopted a self-updating process or at least very fast
release process. This means that browsers stay up to date more often, a positive secu-
rity trend for users. Finally, as we’ll discover in Chapter 1, HTML5 is still an emerg-
ing standard. In this book, a “modern browser” is any browser or rendering engine
(remember, HTML can be accessed by all sorts of devices) that supports some aspect
of HTML5. It’s safe to say that, as you read this, if your browser has been updated
within the last 2 months, then it’s a modern browser. It’s probably true that if the
browser is even a year old it counts as a modern browser. If it’s more than a year old,
set the book down and go install the security updates that have been languishing in
uselessness for you all this time. You’ll be better off for it.
Gone are the days when Web applications had to be developed with one browser
in mind due to market share or reliance on rendering quirks. It’s a commendable feat
of engineering and standards (networking, HTTP, HTML, etc.) that “dead” browsers
like Internet Explorer 6 still render a vast majority of today’s Web sites. However,
these relics of the past have no excuse for being in use today. If Microsoft wants IE6
to disappear, there’s no reason a Web site should be willing to support it—in fact, it
would be a bold step to actively deny access to older browsers for sites whose content
and use requires a high degree of security and privacy protections.
One Origin to Rule them all
Web browsers have gone through many iterations on many platforms: Konqueror,
Mosaic, Mozilla, Internet Explorer, Opera, Safari. Browsers have a rendering
engine at their core. Microsoft calls IE’s engine Trident. Safari and Chrome have
WebKit. Firefox relies on Gecko. Opera has Presto. These engines are responsible
Shema 978-1-59-749951-4