Web 2.0 Security Chess: Combat Strategies and Defense Tacticsg

Shreeraj ShahShreeraj ShahBlueinfy Solutions Pvt. Ltd.04/09/08 | Session Code: SOA-002

W b 2 0 S it Ch E O i CWeb 2.0 Security Chess – Eye Opening Case

• Web 2 0 Portal – Buy / SellWeb 2.0 Portal Buy / Sell • Technologies & Components – Dojo, Ajax, XML

Services, Blog, Widgetsg g• Scan with tools/products failedfailed• Security issues and hacks

– SQL injection over XML– Ajax driven XSS– Several XSS with Blog componentSeveral XSS with Blog component– Several information leaks through JSON fuzzing– CSRF on both XML and JS-Array

HACKED»HACKED»DEFENSE

A dAgenda

• Web 2.0 – Know the • Vulnerabilities and ScanWeb 2.0 Know the battle field– Where are we moving?

Architecture

Vulnerabilities and Scan– Scan for XSS– One/Two Way CSRF

– Architecture– Strategic Changes– Enemies

– RSS, Widget, Mashup, Blog hacks

– Web Services Attacks • Moves from Black

– MethodologiesFi i ti

and Combats• Moves from White

Code scanning defense– Fingerprinting– Discovery– Enumeration and

– Code scanning defense– Firewall Web 2.0 attacks

and streams

3Crawling

AgendaWeb 2.0 Battle Field (Resource)

Footprinting & DiscoveryConfig Scanning

( )

Enumeration & Crawling

Attacks and Scanning

Config Scanning

Code Scanning

Attacks and Scanning

Secure Coding

Black Moves White Moves

Web 2.0 Firewall

Secure Coding

DefenseS i

Secure Web 2.0Strategies

Web 2.0 – Know the battle fieldWhere are we moving?– Where are we moving?

– Architecture– Strategic Changes– Enemies

Wh i ?Where are we moving?

Wh i ?Where are we moving?• 80% of companies are

investing in Web Services asinvesting in Web Services as part of their Web 2.0 initiative (McKinsey 2007 Global Survey)

• By the end of 2007, 30 percent of large companies have some kind of Web 2.0-based business initiative up andbusiness initiative up and running (Gartner)

• 2008. Web Services or Service-Oriented ArchitectureService Oriented Architecture (SOA) would surge ahead. (Gartner) 20%

WaitingWaiting

ArchitectureArchitecture

Architecture - LayersArchitecture Layers

Services

Browser Protocols

Ajax Flash / RIAJSON-RPC

Structures Server-Side

Widget DOMHTML/CSS JavaScript

SOAPXML-RPCJSON

XML

Open APIsSaaS

ServicesREST

Ajax Flash / RIA

HTTP(S)

St t i ChStrategic Changes• Application Infrastructure

Vector Web 1.0 Web 2.0Protocols HTTP & HTTPS SOAP, XML-RPC, REST etc. overProtocols , ,

HTTP & HTTPS

Information structures HTML transfer XML, JSON, JS Objects etc.

Communication methods Synchronous Asynchronous & Cross-domainsCommunication methods SynchronousPostbackRefresh and Redirect

Asynchronous & Cross domains(proxy)

Information sharing Single place information (Nourge for integration)

Multiple sources (Urge for integratedinformation platform)g g ) p )

St t i ChStrategic Changes

• Security ThreatsSecurity Threats

Vector Web 1.0 Web 2.0

Entry points Structured Scattered and multiple

Dependencies Limited • Multiple technologies• Information sources• Protocols• Protocols

Vulnerabilities Server side [Typical injections] • Web services [Payloads]• Client side [XSS & XSRF]

Exploitation Server side exploitation Both server and client side exploitation

St t i ChStrategic Changes• Methodology

Vector Web 1.0 Web 2.0

Footprinting Typical with "Host" and DNS Empowered with search

Discovery Simple Difficult with hidden calls

Enumeration Structured Several streams

S i St t d d i l Diffi lt ith t i AjScanning Structured and simple Difficult with extensive Ajax

Automated attacks Easy after discovery Difficult with Ajax and web services

Reverse engineering On the server-side [Difficult] Client-side with Ajax & Flash

Code reviews Focus on server-side only Client-side analysis needed

St t i ChStrategic Changes

• Countermeasure

Vector Web 1.0 Web 2.0

Owner of information Single place Multiple places [Mashups & RSS]

Browser security Simple DOM usage Complex DOM usage

Validations Server side Client side [incoming content]

Logic shift Only on server Client side shiftLogic shift Only on server Client side shift

Secure coding Structured and single place Multiple places and scattered

E i Att k & CEnemies, Attacks & Cause

• Complex architecture and confusion with• Complex architecture and confusion with technologies

• Web 2 0 worms and viruses – SammyWeb 2.0 worms and viruses Sammy, Yammaner & Spaceflash

• Ajax and JavaScripts – Client side attacks areAjax and JavaScripts Client side attacks are on the rise (XSS/CSRF)

• Web Services attacks and exploitationp• Flash clients are running with risks

R l Lif CReal Life Cases

Source: The Web Hacking Incidents Database Sou ce e eb ac g c de ts atabase[http://webappsec.org/projects/whid/]

Moves from Black– Methodologies– Methodologies– Fingerprinting– Discovery– Enumeration and Crawling

M th d l iMethodologies

• Fingerprinting Application and Framework• Fingerprinting – Application and Framework• Discovery – Discovering structures like JSON or

XMLXML• Crawling 2.0 – Application crawling with DOM

contextcontext• Scanning strategies – Fuzz and Scan• Defense – Secure Coding and FirewallDefense Secure Coding and Firewall

Fi i ti DFingerprinting

• Application fingerprinting identifying web and

Demo

• Application fingerprinting – identifying web and application servers

• Ajax and RIA framework fingerprintsAjax and RIA framework fingerprints• Getting hold on to technologies – WebLogic or

Tomcat, Atlas or DojoTomcat, Atlas or Dojo• Helps in assessment and mapping publicly

known vulnerabilities

Aj /RIA llAjax/RIA call

• Asynchronous JavaScript and XML• Asynchronous JavaScript and XML

HTML / CSS / Flash

JS / DOM

Database / Resource

XML / Middleware / Text

XMLHttpRequest (XHR) Web Server

Asynchronous over HTTP(S)

Di DDiscovery

• Ajax running with various different structures

Demo

Ajax running with various different structures• Developers are adding various different calls

and methods for it– JSON, Array, JS-Object etc.

• JavaScript can talk with back-end sources• Mashups application talking with various

sources• It has significant security impact• It has significant security impact• Identifying and Discovery of structures

C li & E ti f W b 2 0 DemoCrawling & Enumeration for Web 2.0

• Dynamic page creation through JavaScript using

Demo

• Dynamic page creation through JavaScript using Ajax

• DOM events are managing the application layerDOM events are managing the application layer• DOM is having clear context• Protocol driven crawling is not possible without• Protocol driven crawling is not possible without

loading page in the browser

Vulnerabilities and ScanScan for XSS– Scan for XSS

– One/Two Way CSRF– RSS, Widget, Mashup, Blog hacksg p g– Web Services Attacks and Combats

C Sit S i ti (XSS) 2 0 St lCross Site Scripting (XSS) – 2.0 Style

• What is different?• What is different?– Ajax calls get the stream

Inject into current DOM using eval() or any– Inject into current DOM using eval() or any other meansMay rewrite content using document write or– May rewrite content using document.write or innerHTML calls

– Source of stream can be un-trustedSource of stream can be un trusted– Cross Domain calls are very common

Add i C D i C ll DemoAddressing Cross Domain Calls

• Cross Domain calls are very important for Web

Demo

Cross Domain calls are very important for Web 2.0 applications.– Proxy to talk with cross domainy– Callback implementation to fetch them– Flash via crossdomain.xml

• These are types of bypass and can have it i li tisecurity implications

• Source of the information – key!

S iScenario

JSON V l bl t iBlog

Posting to the site

JSONfeed

Vulnerable stream coming through proxy

DBattacker Web app

proxy

8008

g[Malicious code]

WebWeb app8008

ServerHijack

WebClient

JSON

eval()eval()

XSS

XSS ith RIAXSS with RIA

• Applications running with Flash components• Applications running with Flash components• getURL – injection is possible• SWFIntruder• SWFIntruder• Flasm/Flare(http://www nowrap de/)(http://www.nowrap.de/)

S i f XSS DemoScanning for XSS

Scanning Aja components

Demo

• Scanning Ajax components• Retrieving all JS include files

Part of <SCRIPT SRC= >– Part of <SCRIPT SRC=….>

• Identifying XHR calls• Grabbing function• Grabbing function• Mapping function to DOM event

S i d f XSS l k f l() d• Scanning code for XSS – look for eval() and document.write()

Aj i li ti iAjax serialization issues• Ajax processing various information coming from

d thi d t XSSserver and third party sources. – XSS opportunities

message = {JS – Object

from : "john@example.com",to : "jerry@victim.com",subject : "I am fine",body : "Long message here",showsubject :

function(){document.write(this.subject)}};

JSON issues

{"bookmarks":[{"Link":"www.example.com","Desc":"Interesting link"}]}

new Array(“Laptop”, “Thinkpad”, “T60”, “ d” “900$” “ i d h“Used”, “900$”, “It is great and I have used it for 2 years”)

JS – Array manipulation

C tCountermeasures

• Client side code audit is required• Client side code audit is required• XHR calls and DOM utilization needs to be

analyzedanalyzed• Content from un-trusted information sources

should be filtered out at proxy layershould be filtered out at proxy layer• Cross Domain Callback – careful• Browser side content validation beforeBrowser side content validation before

consuming into DOM

C Sit R t F (CSRF)Cross Site Request Forgery (CSRF)

• Generic CSRF is with GET / POSTGeneric CSRF is with GET / POST• Forcefully sending request to the target

application with cookie replaypp p y• Leveraging tags like

– IMG– SCRIPT– IFRAME

• Not abide by SOP or Cross Domain is possible

C Sit R t F (CSRF) DemoCross Site Request Forgery (CSRF)

• What is different with Web 2 0

Demo

• What is different with Web 2.0– Is it possible to do CSRF to XML stream

How?– How?– It will be POST hitting the XML processing

resources like Web Servicesresources like Web Services– JSON CSRF is also possible

Interesting check to make against application– Interesting check to make against application and Web 2.0 resources

O W CSRF S iOne Way CSRF Scenario

O W CSRF S iOne Way CSRF Scenario

O W CSRF S iOne Way CSRF Scenario

O W CSRF S i DOne Way CSRF Scenario Demo

O W CSRFOne-Way CSRF<html><body><FORM NAME="buy" ENCTYPE="text/plain"

action="http://trade.example.com/xmlrpc/trade.rem" METHOD="POST"><input type="hidden" name='<?xml version'p yp

value='"1.0"?><methodCall><methodName>stocks.buy</methodName><params><param><value><string>MSFT</string></value></param><param><value><double>26</double></value></param></params></methodCall>'>

</FORM><script>document.buy.submit();</script></body></html>

• Splitting XML stream in the form• Possible through XForms as well

Similar techniques is applicable to JSON as well• Similar techniques is applicable to JSON as well

T W CSRFTwo-Way CSRF

• One Way Just making forceful request• One-Way – Just making forceful request.• Two-Way

– Reading the data coming from the targetReading the data coming from the target– May be getting hold onto important information – profile,

statements, numbers etc.– Is it possible with JSON/XML

T W CSRF DTwo-Way CSRF Demo

T W CSRFTwo-Way CSRF

• Application is serving various streams like• Application is serving various streams like –JSON, JS-Object, Array etc.

• Attacker page can make cross domain request p g qusing SCRIPT (firefox)

• Following code can overload the array stream.g yfunction Array() { var obj = this; var index = 0; for(j=0;j<4;j++){ obj[index++] setter = spoof; } } function spoof(x){ send(x.toString()); }

C tCountermeasure

• Server Side Checks• Server Side Checks– Check for client’s content-type

XHR calls xml/application– XHR calls – xml/application– Native calls – text/html

Filt i i ibl it– Filtering is possible on it• Client Side Checks

St b t t d d t i t d b /*– Stream can be started and terminated by /* or any predefined charactersCli t th b f i j ti t– Client can remove them before injecting to DOM

W b 2 0 C tWeb 2.0 Components

• There are various other components for Web 2 0• There are various other components for Web 2.0 Applications– RSS feedsRSS feeds– Mashups

Widgets– Widgets– Blogs

Flash based components– Flash based components

RSS f d DRSS feeds

• RSS feeds coming into application from various

Demo

RSS feeds coming into application from various un-trusted sources

• Feed readers are part of 2.0 Applications.p pp• Vulnerable to XSS• Malicious code can be executed on the browser.• Several vulnerabilities reported

M hMashups

• API exposure for Mashup supplier applicationAPI exposure for Mashup supplier application• Cross Domain access by callback may cause a

security breachy• Confidential information sharing with Mashup

application handling needs to be checked –t i d d di it (SSL)storing password and sending it across (SSL)

• Mashup application can be man in the middle so can’t trust or must be trusted onecan t trust or must be trusted one

Wid t /G d tWidgets/Gadgets

• DOM sharing model can cause many security g y yissues

• One widget can change information on another id iblwidget – possible

• CSRF injection through widget codeE t hij ki i ibl C DOM• Event hijacking is possible – Common DOM

• IFrame – for widget is a MUST

BlBlogs

• Blogs are common to Web 2 0 applicationsBlogs are common to Web 2.0 applications• Many applications are plugging third party blogs• One needs to check these blogs – XSS isOne needs to check these blogs XSS is

common with blogging applications• Exceptions and Search are common XSS points

SOA St kSOA Stack

Presentation StackXML,JSON,JS-* HTML / JS / DOM

RIA (Flash)

Ajax

Discovery Stack

Security StackWS-Security

Access StackWSDL,SOAP,XML-RPC,REST

yUDDI, DISCO

Transport StackHTTP, HTTPS

, , ,

P i Di DPrimary Discovery

• Crawling the application and mapping file

Demo

• Crawling the application and mapping file extensions and directory structures, like “.asmx”

• Page scrubbing – scanning for paths andPage scrubbing scanning for paths and resources in the pages, like atlas back end call to Web Services

• Recording traffic while browsing and spidering, look for XML based traffic – leads to XML-RPC, REST, SOAP, JSON calls

S d Di DSecondary Discovery

• Searching UDDI server for Web Services

Demo

• Searching UDDI server for Web Services running on particular domain– Three tactics for it – business services orThree tactics for it business, services or

tModel• Running queries against search engines likeRunning queries against search engines like

Google or MSN with extra directives like “inurl” or “filetype”– Look for “asmx”

• wsScanner – Discovery!

E ti d P fili DEnumerating and Profiling • Fingerprinting .Net framework and Client side

Demo

technologies – Dojo or Atlas …• Scanning WSDL

– Looking for Methods– Collecting In/Out parameters– Security implementations– Binding pointsg p– Method signature mapping

Scanning strategies DScanning strategies• Manual invocation and response analysis• Dynamic proxy creation and scanning

Demo

• Dynamic proxy creation and scanning• Auto auditing for various vectors

F i W b S i t XML JSON• Fuzzing Web Services streams – XML or JSON• Response analysis is the key

L k f f l d d– Look for fault code nodes– Enumerating fault strings– Dissecting XML message and finding bits– Hidden error messages in JSON

Di i V l biliti DDiscovering Vulnerabilities

• Web Services methods are consuming

Demo

• Web Services methods are consuming parameters coming from end users

• It is possible to inject malicious characters intoIt is possible to inject malicious characters into the stream

• It can break Web Services code and sendIt can break Web Services code and send faultsting back to an attacker

• Various injections possible – SQL and XPATHj p Q• File system access• Remote command injectionRemote command injection• Information leakage

• Moves from WhiteCode scanning defense– Code scanning defense

– Firewall Web 2.0 attacks and streams

C d A l i f W b 2 0 DCode Analysis for Web 2.0

• Scanning the code base

Demo

• Scanning the code base• Identifying linkages• Method signatures and inputs• Method signatures and inputs• Looking for various patterns for SQL, LDAP,

XPATH File access etcXPATH, File access etc.• Checking validation on them• Code walking and tracing the base Key• Code walking and tracing the base - Key

C t t filt i ith 2 0

• Regular firewall will not work

Content filtering with 2.0

• Regular firewall will not work• Content filtering on HTTP will not work either

since it is SOAP/JSON over HTTP/HTTPSsince it is SOAP/JSON over HTTP/HTTPS• SOAP/JOSN level filtering and monitoring would

requirerequire• ISAPI level filtering is essential• SOAP/JSON content filtering throughSOAP/JSON content filtering through

IHTTPModule

HTTP Stack for Net (IIS6/7) DHTTP Stack for .Net (IIS6/7)HttpRuntime

Demo

HttpApplicationFactory Web Application Firewall

HttpApplicationFirewall & IDS

IHttpModule

HttpHandlerFactory

Handler

148

C l iConclusion

• Web 2 0 bringing new challengesWeb 2.0 bringing new challenges• Needs to adopt new methodologies for scanning• Attacks and entry points are scattered andAttacks and entry points are scattered and

multiple• Ajax and SOA are key components• WAF and Code review are important aspects for

Web 2.0 defense

Questions?

Shreeraj ShahShreeraj ShahBlueinfy Solutions Pvt. Ltd.shreeraj@blueinfy.com91+987902701891+9879027018

Tools : http://www.blueinfy.com/tools.html