Hands-On Ethical Hacking and Network Defense

Trang 1

HANDS-ON ETHICAL HACKING AND NETWORK DEFENSE

Lesson 10

Hacking Web Servers

Trang 2

 Collection Information

 Describe Web applications

 Explain Web application vulnerabilities

 Describe the tools used to attack Web servers

2

Trang 5

UNDERSTANDING WEB APPLICATIONS

 It is nearly impossible to write a program without bugs

 Some bugs create security vulnerabilities

 Web applications also have bugs

 Web applications have a larger user base than standalone applications

 Bugs are a bigger problem for Web applications

5

Trang 6

WEB APPLICATION COMPONENTS

 Static Web pages

 Dynamic Web pages

 Need special components

 <form> tags

 Common Gateway Interface (CGI)

 Active Server Pages (ASP)

Trang 7

WEB FORMS

 Use the <form> element or tag in an HTML document

 Allows customer to submit information to the Web server

 Web servers process information from a Web form by using a Web application

 Easy way for attackers to intercept data that users

submit to a Web server

7

Trang 8

WEB FORMS (CONTINUED)

 Web form example

<html>

<body>

<form>

Enter your username:

<br>

Enter your password:

</form></body></html>

8

Trang 10

COMMON GATEWAY INTERFACE (CGI)

 Handles moving data from a Web server to a Web

 Relies on Perl or another scripting language to create

dynamic Web pages

 CGI programs can be written in different

programming and scripting languages

10

Trang 11

COMMON GATEWAY INTERFACE (CGI) (CONTINUED)

print "Content-type: text/html\n\n";

print "Hello Security Testers!";

11

Trang 12

ACTIVE SERVER PAGES (ASP)

 With ASP, developers can display HTML documents to users on the fly

 Main difference from pure HTML pages

 When a user requests a Web page, one is created at that time

 ASP uses scripting languages such as JScript or

VBScript

 Not all Web servers support ASP

12

Trang 14

ACTIVE SERVER PAGES (ASP)

<H1>Hello, security professionals</H1>

The time is <% = Time %>.

Trang 15

APACHE WEB SERVER

 Tomcat Apache is another Web Server program

 Tomcat Apache hosts anywhere from 50% to 60% of all Web sites

Trang 18

USING SCRIPTING LANGUAGES

 Dynamic Web pages can be developed using scripting languages

 VBScript

 JavaScript

 PHP

18

Trang 19

PHP: HYPERTEXT PROCESSOR (PHP)

 Enables Web developers to create dynamic Web pages

 Similar to ASP

 Open-source server-side scripting language

<?php and ?>

 Users cannot see PHP code on their Web browser

 Used primarily on UNIX systems

 Also supported on Macintosh and Microsoft platforms

19

Trang 22

CONNECTING TO DATABASES

 Web pages can display information stored on

databases

 There are several technologies used to connect

databases with Web applications

 Technology depends on the OS used

Trang 23

OPEN DATABASE CONNECTIVITY

(ODBC)

 Standard database access method developed by

the SQL Access Group

 ODBC interface allows an application to access

 Data stored in a database management system

 Any system that understands and can issue ODBC

commands

 Interoperability among back-end DBMS is a key

feature of the ODBC interface

23

Trang 24

OPEN DATABASE CONNECTIVITY

(ODBC) (CONTINUED)

 ODBC defines

 Standardized representation of data types

 A library of ODBC functions

 Standard methods of connecting to and logging on to

a DBMS

24

Trang 25

OBJECT LINKING AND EMBEDDING

DATABASE (OLE DB)

 OLE DB is a set of interfaces

 Enables applications to access data stored in a DBMS

 Developed by Microsoft

 Designed to be faster, more efficient, and more stable

than ODBC

 OLE DB relies on connection strings

 Different providers can be used with OLE DB

depending on the DBMS to which you want to

connect

25

Trang 27

ACTIVEX DATA OBJECTS (ADO)

 ActiveX defines a set of technologies that allow

desktop applications to interact with the Web

 ADO is a programming interface that allows Web

applications to access databases

 Steps for accessing a database from a Web page

 Create an ADO connection

 Open the database connection you just created

 Create an ADO recordset

 Open the recordset

 Select the data you need

 Close the recordset and the connection

27

Trang 28

UNDERSTANDING WEB

APPLICATION VULNERABILITIES

 Many platforms and programming languages can

be used to design a Web site

 Application security is as important as network

security

 Attackers controlling a Web server can

 Deface the Web site

 Destroy or steal company’s data

 Gain control of user accounts

 Perform secondary attacks from the Web site

 Gain root access to other applications or servers

28

Trang 29

COUNTERMEASURES

 Open Web Application Security Project (OWASP)

 Open, not-for-profit organization dedicated to finding

and fighting vulnerabilities in Web applications

 Publishes the Ten Most Critical Web Application

Security Vulnerabilities

 Top-10 Web application vulnerabilities

 Unvalidated parameters

 HTTP requests are not validated by the Web server

 Broken access control

 Developers implement access controls but fail to test them

properly

29

Trang 30

COUNTERMEASURES (CONTINUED)

(continued)

 Broken account and session management

 Enables attackers to compromise passwords or session

cookies to gain access to accounts

 Cross-site scripting (XSS) flaws

 Attacker can use a Web application to run a script on the

Web browser of the system he or she is attacking

 Buffer overflows

 It is possible for an attacker to use C or C++ code that

includes a buffer overflow

30

Trang 31

(continued)

 Command injection flaws

 An attacker can embed malicious code and run a program

on the database server

 Error-handling problems

 Error information sent to the user might reveal information

that an attacker can use

 Insecure use of cryptography

 Storing keys, certificates, and passwords on a Web server

can be dangerous

31

Trang 32

(continued)

 Remote administration flaws

 Attacker can gain access to the Web server through the

remote administration interface

 Web and application server misconfiguration

 Any Web server software out of the box is usually

vulnerable to attack

 Default accounts and passwords

 Overly informative error messages

32

Trang 33

 WebGoat project

 Helps security testers learn how to perform

vulnerabilities testing on Web applications

 WebGoat can be used to

 Reveal HTML or Java code and any cookies or

parameters used

 Hack a logon name and password

33

Trang 36

 WebGoat can be used to

 Traverse a file system on a Windows XP computer

running Apache

 WebGoat’s big challenge

 Defeat an authentication mechanism

 Steal credit cards from a database

 Deface a Web site

36

Trang 40

ASSESSING WEB APPLICATIONS

 Security testers should look for answers to some

important questions

 Does the Web application use dynamic Web pages?

 Does the Web application connect to a backend

Trang 41

DOES THE WEB APPLICATION USE

DYNAMIC WEB PAGES?

 Static Web pages do not create a security

environment

 IIS attack example

 Submitting a specially formatted URL to the

attacked Web server

 IIS does not correctly parse the URL

Trang 42

DOES THE WEB APPLICATION

CONNECT TO A BACKEND

DATABASE SERVER?

 Security testers should check for the possibility of

SQL injection being used to attack the system

 SQL injection involves the attacker supplying

SQL commands on a Web application field

 SQL injection examples

SELECT * FROM customer

WHERE tblusername = ' ' OR 1=1 ' AND tblpassword =

' '

or

SELECT * FROM customer

WHERE tblusername = ' OR "=" AND tblpassword = ' OR

Trang 43

CONNECT TO A BACKEND

DATABASE SERVER? (CONTINUED)

 Basic testing should look for

 Whether you can enter text with punctuation marks

 Whether you can enter a single quotation mark followed by any SQL keywords

 Whether you can get any sort of database error when

attempting to inject SQL

43

Trang 44

REQUIRE AUTHENTICATION OF THE

 Verify that logon and password information is

stored on secure places

 Authentication servers introduce a second target

44

Trang 45

ON WHAT PLATFORM WAS THE WEB

APPLICATION DEVELOPED?

 Several different platforms and technologies can

be used to develop Web applications

 Attacks differ depending on the platform and

technology used to develop the application

 Footprinting is used to find out as much information

as possible about a target system

 The more you know about a system the easier it is to

gather information about its vulnerabilities

45

Trang 46

TOOLS OF WEB ATTACKERS AND

SECURITY TESTERS

 Choose the right tools for the job

 Attackers look for tools that enable them to

attack the system

 They choose their tools based on the vulnerabilities

found on a target system or application

46

Trang 47

WEB TOOLS

 Cgiscan.c: CGI scanning tool

 Written in C in 1999 by Bronc Buster

 Tool for searching Web sites for CGI scripts that can

be exploited

 One of the best tools for scanning the Web for

systems with CGI vulnerabilities

47

Trang 49

WEB TOOLS (CONTINUED)

 Phfscan.c

 Written to scan Web sites looking for hosts that could

be exploited by the PHF bug

 The PHF bug enables an attacker to download the

victim’s /etc/passwd file

 It also allows attackers to run programs on the

victim’s Web server by using a particular URL

49

Trang 50

WEB TOOLS (CONTINUED)

 Wfetch: GUI tool

 This tool queries the status of a Web server

 It also attempts authentication using

Tiêu đề	Hacking Web Servers
Thể loại	bài tập

Định dạng
Số trang	51
Dung lượng	1,95 MB