Web 2.0 Security Chess: Combat Strategies and Defense Tacticsg
Shreeraj ShahShreeraj ShahBlueinfy Solutions Pvt. Ltd.04/09/08 | Session Code: SOA-002
W b 2 0 S it Ch E O i CWeb 2.0 Security Chess – Eye Opening Case
• Web 2 0 Portal – Buy / SellWeb 2.0 Portal Buy / Sell • Technologies & Components – Dojo, Ajax, XML
Services, Blog, Widgetsg g• Scan with tools/products failedfailed• Security issues and hacks
– SQL injection over XML– Ajax driven XSS– Several XSS with Blog componentSeveral XSS with Blog component– Several information leaks through JSON fuzzing– CSRF on both XML and JS-Array
HACKED»HACKED»DEFENSE
A dAgenda
• Web 2.0 – Know the • Vulnerabilities and ScanWeb 2.0 Know the battle field– Where are we moving?
Architecture
Vulnerabilities and Scan– Scan for XSS– One/Two Way CSRF
– Architecture– Strategic Changes– Enemies
– RSS, Widget, Mashup, Blog hacks
– Web Services Attacks • Moves from Black
– MethodologiesFi i ti
and Combats• Moves from White
Code scanning defense– Fingerprinting– Discovery– Enumeration and
– Code scanning defense– Firewall Web 2.0 attacks
and streams
3Crawling
AgendaWeb 2.0 Battle Field (Resource)
Footprinting & DiscoveryConfig Scanning
( )
Enumeration & Crawling
Attacks and Scanning
Config Scanning
Code Scanning
Attacks and Scanning
Secure Coding
Black Moves White Moves
Web 2.0 Firewall
Secure Coding
DefenseS i
Secure Web 2.0Strategies
Web 2.0 – Know the battle fieldWhere are we moving?– Where are we moving?
– Architecture– Strategic Changes– Enemies
Wh i ?Where are we moving?
Wh i ?Where are we moving?• 80% of companies are
investing in Web Services asinvesting in Web Services as part of their Web 2.0 initiative (McKinsey 2007 Global Survey)
• By the end of 2007, 30 percent of large companies have some kind of Web 2.0-based business initiative up andbusiness initiative up and running (Gartner)
• 2008. Web Services or Service-Oriented ArchitectureService Oriented Architecture (SOA) would surge ahead. (Gartner) 20%
WaitingWaiting
ArchitectureArchitecture
Architecture - LayersArchitecture Layers
Services
Browser Protocols
Ajax Flash / RIAJSON-RPC
Structures Server-Side
Widget DOMHTML/CSS JavaScript
SOAPXML-RPCJSON
XML
Open APIsSaaS
ServicesREST
Ajax Flash / RIA
HTTP(S)
St t i ChStrategic Changes• Application Infrastructure
Vector Web 1.0 Web 2.0Protocols HTTP & HTTPS SOAP, XML-RPC, REST etc. overProtocols , ,
HTTP & HTTPS
Information structures HTML transfer XML, JSON, JS Objects etc.
Communication methods Synchronous Asynchronous & Cross-domainsCommunication methods SynchronousPostbackRefresh and Redirect
Asynchronous & Cross domains(proxy)
Information sharing Single place information (Nourge for integration)
Multiple sources (Urge for integratedinformation platform)g g ) p )
St t i ChStrategic Changes
• Security ThreatsSecurity Threats
Vector Web 1.0 Web 2.0
Entry points Structured Scattered and multiple
Dependencies Limited • Multiple technologies• Information sources• Protocols• Protocols
Vulnerabilities Server side [Typical injections] • Web services [Payloads]• Client side [XSS & XSRF]
Exploitation Server side exploitation Both server and client side exploitation
St t i ChStrategic Changes• Methodology
Vector Web 1.0 Web 2.0
Footprinting Typical with "Host" and DNS Empowered with search
Discovery Simple Difficult with hidden calls
Enumeration Structured Several streams
S i St t d d i l Diffi lt ith t i AjScanning Structured and simple Difficult with extensive Ajax
Automated attacks Easy after discovery Difficult with Ajax and web services
Reverse engineering On the server-side [Difficult] Client-side with Ajax & Flash
Code reviews Focus on server-side only Client-side analysis needed
St t i ChStrategic Changes
• Countermeasure
Vector Web 1.0 Web 2.0
Owner of information Single place Multiple places [Mashups & RSS]
Browser security Simple DOM usage Complex DOM usage
Validations Server side Client side [incoming content]
Logic shift Only on server Client side shiftLogic shift Only on server Client side shift
Secure coding Structured and single place Multiple places and scattered
E i Att k & CEnemies, Attacks & Cause
• Complex architecture and confusion with• Complex architecture and confusion with technologies
• Web 2 0 worms and viruses – SammyWeb 2.0 worms and viruses Sammy, Yammaner & Spaceflash
• Ajax and JavaScripts – Client side attacks areAjax and JavaScripts Client side attacks are on the rise (XSS/CSRF)
• Web Services attacks and exploitationp• Flash clients are running with risks
R l Lif CReal Life Cases
Source: The Web Hacking Incidents Database Sou ce e eb ac g c de ts atabase[http://webappsec.org/projects/whid/]
Moves from Black– Methodologies– Methodologies– Fingerprinting– Discovery– Enumeration and Crawling
M th d l iMethodologies
• Fingerprinting Application and Framework• Fingerprinting – Application and Framework• Discovery – Discovering structures like JSON or
XMLXML• Crawling 2.0 – Application crawling with DOM
contextcontext• Scanning strategies – Fuzz and Scan• Defense – Secure Coding and FirewallDefense Secure Coding and Firewall
Fi i ti DFingerprinting
• Application fingerprinting identifying web and
Demo
• Application fingerprinting – identifying web and application servers
• Ajax and RIA framework fingerprintsAjax and RIA framework fingerprints• Getting hold on to technologies – WebLogic or
Tomcat, Atlas or DojoTomcat, Atlas or Dojo• Helps in assessment and mapping publicly
known vulnerabilities
Aj /RIA llAjax/RIA call
• Asynchronous JavaScript and XML• Asynchronous JavaScript and XML
HTML / CSS / Flash
JS / DOM
Database / Resource
XML / Middleware / Text
XMLHttpRequest (XHR) Web Server
Asynchronous over HTTP(S)
Di DDiscovery
• Ajax running with various different structures
Demo
Ajax running with various different structures• Developers are adding various different calls
and methods for it– JSON, Array, JS-Object etc.
• JavaScript can talk with back-end sources• Mashups application talking with various
sources• It has significant security impact• It has significant security impact• Identifying and Discovery of structures
C li & E ti f W b 2 0 DemoCrawling & Enumeration for Web 2.0
• Dynamic page creation through JavaScript using
Demo
• Dynamic page creation through JavaScript using Ajax
• DOM events are managing the application layerDOM events are managing the application layer• DOM is having clear context• Protocol driven crawling is not possible without• Protocol driven crawling is not possible without
loading page in the browser
Vulnerabilities and ScanScan for XSS– Scan for XSS
– One/Two Way CSRF– RSS, Widget, Mashup, Blog hacksg p g– Web Services Attacks and Combats
C Sit S i ti (XSS) 2 0 St lCross Site Scripting (XSS) – 2.0 Style
• What is different?• What is different?– Ajax calls get the stream
Inject into current DOM using eval() or any– Inject into current DOM using eval() or any other meansMay rewrite content using document write or– May rewrite content using document.write or innerHTML calls
– Source of stream can be un-trustedSource of stream can be un trusted– Cross Domain calls are very common
Add i C D i C ll DemoAddressing Cross Domain Calls
• Cross Domain calls are very important for Web
Demo
Cross Domain calls are very important for Web 2.0 applications.– Proxy to talk with cross domainy– Callback implementation to fetch them– Flash via crossdomain.xml
• These are types of bypass and can have it i li tisecurity implications
• Source of the information – key!
S iScenario
JSON V l bl t iBlog
Posting to the site
JSONfeed
Vulnerable stream coming through proxy
DBattacker Web app
proxy
8008
g[Malicious code]
WebWeb app8008
ServerHijack
WebClient
JSON
eval()eval()
XSS
XSS ith RIAXSS with RIA
• Applications running with Flash components• Applications running with Flash components• getURL – injection is possible• SWFIntruder• SWFIntruder• Flasm/Flare(http://www nowrap de/)(http://www.nowrap.de/)
S i f XSS DemoScanning for XSS
Scanning Aja components
Demo
• Scanning Ajax components• Retrieving all JS include files
Part of <SCRIPT SRC= >– Part of <SCRIPT SRC=….>
• Identifying XHR calls• Grabbing function• Grabbing function• Mapping function to DOM event
S i d f XSS l k f l() d• Scanning code for XSS – look for eval() and document.write()
Aj i li ti iAjax serialization issues• Ajax processing various information coming from
d thi d t XSSserver and third party sources. – XSS opportunities
message = {JS – Object
from : "[email protected]",to : "[email protected]",subject : "I am fine",body : "Long message here",showsubject :
function(){document.write(this.subject)}};
JSON issues
{"bookmarks":[{"Link":"www.example.com","Desc":"Interesting link"}]}
new Array(“Laptop”, “Thinkpad”, “T60”, “ d” “900$” “ i d h“Used”, “900$”, “It is great and I have used it for 2 years”)
JS – Array manipulation
C tCountermeasures
• Client side code audit is required• Client side code audit is required• XHR calls and DOM utilization needs to be
analyzedanalyzed• Content from un-trusted information sources
should be filtered out at proxy layershould be filtered out at proxy layer• Cross Domain Callback – careful• Browser side content validation beforeBrowser side content validation before
consuming into DOM
C Sit R t F (CSRF)Cross Site Request Forgery (CSRF)
• Generic CSRF is with GET / POSTGeneric CSRF is with GET / POST• Forcefully sending request to the target
application with cookie replaypp p y• Leveraging tags like
– IMG– SCRIPT– IFRAME
• Not abide by SOP or Cross Domain is possible
C Sit R t F (CSRF) DemoCross Site Request Forgery (CSRF)
• What is different with Web 2 0
Demo
• What is different with Web 2.0– Is it possible to do CSRF to XML stream
How?– How?– It will be POST hitting the XML processing
resources like Web Servicesresources like Web Services– JSON CSRF is also possible
Interesting check to make against application– Interesting check to make against application and Web 2.0 resources
O W CSRF S iOne Way CSRF Scenario
O W CSRF S iOne Way CSRF Scenario
O W CSRF S iOne Way CSRF Scenario
O W CSRF S i DOne Way CSRF Scenario Demo
O W CSRFOne-Way CSRF<html><body><FORM NAME="buy" ENCTYPE="text/plain"
action="http://trade.example.com/xmlrpc/trade.rem" METHOD="POST"><input type="hidden" name='<?xml version'p yp
value='"1.0"?><methodCall><methodName>stocks.buy</methodName><params><param><value><string>MSFT</string></value></param><param><value><double>26</double></value></param></params></methodCall>'>
</FORM><script>document.buy.submit();</script></body></html>
• Splitting XML stream in the form• Possible through XForms as well
Similar techniques is applicable to JSON as well• Similar techniques is applicable to JSON as well
T W CSRFTwo-Way CSRF
• One Way Just making forceful request• One-Way – Just making forceful request.• Two-Way
– Reading the data coming from the targetReading the data coming from the target– May be getting hold onto important information – profile,
statements, numbers etc.– Is it possible with JSON/XML
T W CSRF DTwo-Way CSRF Demo
T W CSRFTwo-Way CSRF
• Application is serving various streams like• Application is serving various streams like –JSON, JS-Object, Array etc.
• Attacker page can make cross domain request p g qusing SCRIPT (firefox)
• Following code can overload the array stream.g yfunction Array() { var obj = this; var index = 0; for(j=0;j<4;j++){ obj[index++] setter = spoof; } } function spoof(x){ send(x.toString()); }
C tCountermeasure
• Server Side Checks• Server Side Checks– Check for client’s content-type
XHR calls xml/application– XHR calls – xml/application– Native calls – text/html
Filt i i ibl it– Filtering is possible on it• Client Side Checks
St b t t d d t i t d b /*– Stream can be started and terminated by /* or any predefined charactersCli t th b f i j ti t– Client can remove them before injecting to DOM
W b 2 0 C tWeb 2.0 Components
• There are various other components for Web 2 0• There are various other components for Web 2.0 Applications– RSS feedsRSS feeds– Mashups
Widgets– Widgets– Blogs
Flash based components– Flash based components
RSS f d DRSS feeds
• RSS feeds coming into application from various
Demo
RSS feeds coming into application from various un-trusted sources
• Feed readers are part of 2.0 Applications.p pp• Vulnerable to XSS• Malicious code can be executed on the browser.• Several vulnerabilities reported
M hMashups
• API exposure for Mashup supplier applicationAPI exposure for Mashup supplier application• Cross Domain access by callback may cause a
security breachy• Confidential information sharing with Mashup
application handling needs to be checked –t i d d di it (SSL)storing password and sending it across (SSL)
• Mashup application can be man in the middle so can’t trust or must be trusted onecan t trust or must be trusted one
Wid t /G d tWidgets/Gadgets
• DOM sharing model can cause many security g y yissues
• One widget can change information on another id iblwidget – possible
• CSRF injection through widget codeE t hij ki i ibl C DOM• Event hijacking is possible – Common DOM
• IFrame – for widget is a MUST
BlBlogs
• Blogs are common to Web 2 0 applicationsBlogs are common to Web 2.0 applications• Many applications are plugging third party blogs• One needs to check these blogs – XSS isOne needs to check these blogs XSS is
common with blogging applications• Exceptions and Search are common XSS points
SOA St kSOA Stack
Presentation StackXML,JSON,JS-* HTML / JS / DOM
RIA (Flash)
Ajax
Discovery Stack
Security StackWS-Security
Access StackWSDL,SOAP,XML-RPC,REST
yUDDI, DISCO
Transport StackHTTP, HTTPS
, , ,
P i Di DPrimary Discovery
• Crawling the application and mapping file
Demo
• Crawling the application and mapping file extensions and directory structures, like “.asmx”
• Page scrubbing – scanning for paths andPage scrubbing scanning for paths and resources in the pages, like atlas back end call to Web Services
• Recording traffic while browsing and spidering, look for XML based traffic – leads to XML-RPC, REST, SOAP, JSON calls
S d Di DSecondary Discovery
• Searching UDDI server for Web Services
Demo
• Searching UDDI server for Web Services running on particular domain– Three tactics for it – business services orThree tactics for it business, services or
tModel• Running queries against search engines likeRunning queries against search engines like
Google or MSN with extra directives like “inurl” or “filetype”– Look for “asmx”
• wsScanner – Discovery!
E ti d P fili DEnumerating and Profiling • Fingerprinting .Net framework and Client side
Demo
technologies – Dojo or Atlas …• Scanning WSDL
– Looking for Methods– Collecting In/Out parameters– Security implementations– Binding pointsg p– Method signature mapping
Scanning strategies DScanning strategies• Manual invocation and response analysis• Dynamic proxy creation and scanning
Demo
• Dynamic proxy creation and scanning• Auto auditing for various vectors
F i W b S i t XML JSON• Fuzzing Web Services streams – XML or JSON• Response analysis is the key
L k f f l d d– Look for fault code nodes– Enumerating fault strings– Dissecting XML message and finding bits– Hidden error messages in JSON
Di i V l biliti DDiscovering Vulnerabilities
• Web Services methods are consuming
Demo
• Web Services methods are consuming parameters coming from end users
• It is possible to inject malicious characters intoIt is possible to inject malicious characters into the stream
• It can break Web Services code and sendIt can break Web Services code and send faultsting back to an attacker
• Various injections possible – SQL and XPATHj p Q• File system access• Remote command injectionRemote command injection• Information leakage
• Moves from WhiteCode scanning defense– Code scanning defense
– Firewall Web 2.0 attacks and streams
C d A l i f W b 2 0 DCode Analysis for Web 2.0
• Scanning the code base
Demo
• Scanning the code base• Identifying linkages• Method signatures and inputs• Method signatures and inputs• Looking for various patterns for SQL, LDAP,
XPATH File access etcXPATH, File access etc.• Checking validation on them• Code walking and tracing the base Key• Code walking and tracing the base - Key
C t t filt i ith 2 0
• Regular firewall will not work
Content filtering with 2.0
• Regular firewall will not work• Content filtering on HTTP will not work either
since it is SOAP/JSON over HTTP/HTTPSsince it is SOAP/JSON over HTTP/HTTPS• SOAP/JOSN level filtering and monitoring would
requirerequire• ISAPI level filtering is essential• SOAP/JSON content filtering throughSOAP/JSON content filtering through
IHTTPModule
HTTP Stack for Net (IIS6/7) DHTTP Stack for .Net (IIS6/7)HttpRuntime
Demo
HttpApplicationFactory Web Application Firewall
HttpApplicationFirewall & IDS
IHttpModule
HttpHandlerFactory
Handler
148
C l iConclusion
• Web 2 0 bringing new challengesWeb 2.0 bringing new challenges• Needs to adopt new methodologies for scanning• Attacks and entry points are scattered andAttacks and entry points are scattered and
multiple• Ajax and SOA are key components• WAF and Code review are important aspects for
Web 2.0 defense
Questions?
Shreeraj ShahShreeraj ShahBlueinfy Solutions Pvt. [email protected]+987902701891+9879027018
Tools : http://www.blueinfy.com/tools.html