cnit 129s: securing web applications · file inclusion vulnerabilities • include files make code...
TRANSCRIPT
![Page 1: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/1.jpg)
CNIT 129S: Securing Web Applications
Ch 10: Attacking Back-End Components
![Page 2: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/2.jpg)
Injecting OS Commands• Web server platforms often have APIs
• To access the filesystem, interface with other processes, and for network communications
• Sometimes they issue operating commands directly to the server
• Leading to command injection vulnerabilities
![Page 3: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/3.jpg)
Example: Injecting via Perl
![Page 4: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/4.jpg)
![Page 5: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/5.jpg)
![Page 6: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/6.jpg)
Real-World Command Injection
![Page 7: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/7.jpg)
Injecting via ASP
• User-controlled dirName used in command
![Page 8: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/8.jpg)
![Page 9: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/9.jpg)
![Page 10: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/10.jpg)
Injecting via PHP
• eval function executes a shell command
• User controls "storedsearch" parameter
![Page 11: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/11.jpg)
Finding Command Injection Flaws
• Any item of user-controlled data may be used to construct commands
• Special characters used for injection
• ; | &
• Batch multiple commands together
• ` (backtick)
• Causes immediate command execution
![Page 12: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/12.jpg)
Blind Command Injection
• You may not be able to see the results of a command, like blind SQL injection
• ping will cause a time delay
• Create a back-channel with TFTP, telnet, netcat, mail, etc.
![Page 13: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/13.jpg)
Exploiting NSLOOKUP• Put server code in domain name
• Puts this error message in the file
• Then browse to the file to execute it
![Page 14: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/14.jpg)
Preventing OS Command Injection
• Avoid calling OS command directly
• If you must, filter input with whitelisting
• Use APIs instead of passing parameters to a command shell which then parses them
![Page 15: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/15.jpg)
Preventing Script Injection Vulnerabilities
• Don't pass user input into dynamic execution or include functions
• If you must, filter it with whitelisting
![Page 16: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/16.jpg)
Manipulating File Paths
• File path traversal
• File inclusion
![Page 17: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/17.jpg)
Path Traversal Vulnerabilities
• This function displays a file in the browser
• Using "..\" moves to the parent directory
![Page 18: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/18.jpg)
Exploiting Path Traversal Vulnerabilities
• May allow read or write to files
• This may reveal sensitive information such as passwords and application logs
• Or overwrite security-critical items such as configuration files and software binaries
![Page 19: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/19.jpg)
Filesystem Monitoring Tools
• FileMon from SysInternals on Windows
• Now replaced by ProcMon (link Ch 10a)
• ltrace, strace, or Tripwire on Linux
• truss on Solaris
![Page 20: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/20.jpg)
Detecting Path Traversal
• Inject an unique string in each submitted parameter, such as traversaltest
• Filter the filesystem monitoring tool for that string
![Page 21: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/21.jpg)
![Page 22: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/22.jpg)
Circumventing Obstacles to Traversal Attacks
• Try both ../ and ..\
• Try URL-encoding
• Dot - %2e
• Forward slash - %2f
• Backslash - %5c
![Page 23: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/23.jpg)
Circumventing Obstacles to Traversal Attacks
![Page 24: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/24.jpg)
Bypassing Obstacles• The overlong Unicode sequences are
technically illegal, but are accepted anyway by many Unicode representations, especially on Windows
• If the app filters character sequences, try placing one sequence within another
![Page 25: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/25.jpg)
Using Null Characters• App requires a filename to end in .jpg
• This filename passes the test but is interpreted as ending in .ini when used
![Page 26: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/26.jpg)
Exploiting Read Access•Password files for OS and apps•Configuration files to discover other vulnerabilities or fine-tune another attack
• Include files with database credentials•Data sources such as MySQL database files or XML files
•Source code for server-side scripts to hunt for bugs
•Log files, may contain usernames, session tokens
![Page 27: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/27.jpg)
Exploiting Write Access
• Create scripts in users' startup folders
• Modify files such as in.ftpd to exectue commands when a user next connects
• Write scripts to a Web directory with execute permissions, and call them from your browser
![Page 28: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/28.jpg)
Preventing Path Traversal Vulnerabilities
• Avoid passing user-controlled data into any filesystem API
• If you must, only allow the user to choose from a list of known good inputs
• If you must allow users to submit filenames, add defenses from the next slide
![Page 29: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/29.jpg)
Defenses• After decoding and decanonicalization:
• Check for forward slashes, backslashes, and null bytes
• If so, stop. Don't attempt to sanitize the malicious filename
• Use a hard-coded list of permissible file types
• Reject any request for a different type
![Page 30: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/30.jpg)
Defenses• After decoding and decanonicalization:
• Use filesystem APIs to verify that the filename is ok and that it exists in the expected directory
• In Java, use getCanonicalPath; make sure filename doesn't change
• In ASP.NET, use System.Io.Path.GetFullPath
![Page 31: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/31.jpg)
Defenses• Run app in a chroot jail
• So it doesn't have access to the whole OS file system
• In Windows, map a drive letter to the allowed folder and use that drive letter to access contents
• Integrate defenses with logging and alerting systems
![Page 32: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/32.jpg)
File Inclusion Vulnerabilities
• Include files make code re-use easy
• Common files are included within other files
• PHP allows include functions to accept remote file paths
![Page 33: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/33.jpg)
PHP Example• Country specified in a parameter
• Attacker can inject evil code
![Page 34: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/34.jpg)
Local File Inclusion (LFI)
• Remote file inclusion may be blocked, but
• There may be server-executable files you can access via LFI, but not directly
• Static resources may also be available via LFI
![Page 35: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/35.jpg)
Finding Remote File Inclusion Vulnerabilities
• Insert these items into each targeted parameter
• A URL on a Web server you control; look at server logs to see requests
• A nonexistent IP address, to see a time delay
• If it's vulnerable, put a malicious script on the server
![Page 36: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/36.jpg)
Finding Local File Inclusion Vulnerabilities
• Insert these items into each targeted parameter
• A known executable on the server
• A known static resource on the server
• Try to access sensitive resources
• Try traversal to another folder
![Page 37: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/37.jpg)
iClickers
![Page 38: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/38.jpg)
Which vulnerability allows you to add malware from a different server to a target Web page?
A. Command injection
B. Path traversal
C. File inclusion
D. Procmon
E. chroot
![Page 39: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/39.jpg)
Which defense places the Web server in a restricted file system?
A. Command injection
B. Path traversal
C. File inclusion
D. Procmon
E. chroot
![Page 40: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/40.jpg)
What defense detects file system modifications?
A. Command injection
B. Path traversal
C. File inclusion
D. Procmon
E. chroot
![Page 41: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/41.jpg)
Injecting XML External Entities
• XML often used to submit data from the client to the server
• Server-side app responds in XML or another format
• Most common in Ajax-based applications with asynchronous requests in the background
![Page 42: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/42.jpg)
Example: Search
• Client sends this request
![Page 43: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/43.jpg)
Example: Search
• Server's response
![Page 44: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/44.jpg)
XML External Entity Injection (XXE)
• XML parsing libraries support entity references
• A method of referencing data inside or outside the XML document
• Declaring a custom entity in DOCTYPE
• Every instance of &testref; will be replaced by testrefvalue
![Page 45: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/45.jpg)
Reference an External Entity• XML parser will fetch the contents of a remote
file and use it in place of SearchTerm
![Page 46: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/46.jpg)
Response Includes File Contents
![Page 47: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/47.jpg)
Connecting to Email Server
![Page 48: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/48.jpg)
Possible Exploits• Attacker can use the application as a proxy to
get sensitive information from Web servers
• Send URL-based exploits to back-end web applications
• Scan ports and harvest banners
• Denial of service:
![Page 49: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/49.jpg)
Injecting into SOAP Services
• Simple Object Access Protocol (SOAP) uses XML
• Banking app: user sends this request
![Page 50: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/50.jpg)
SOAP Message• Sent between two of the application's back-end
components
• ClearedFunds = False; transaction fails
![Page 51: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/51.jpg)
![Page 52: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/52.jpg)
• The comment tag is unmatched
• No -->
• It won't be accepted by normal XML parsers
• This might work on flawed custom implementations
![Page 53: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/53.jpg)
Finding SOAP Injection• Simple injection of XML metacharacters will
break the syntax, leading to unhelpful error messages
• Try injecting </foo> -- if no error results, your injection is being filtered out
• If an error occurs, inject <foo></foo> -- if the error vanishes, it may be vulnerable
![Page 54: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/54.jpg)
Finding SOAP Injection• Sometimes the XML parameters are stored,
read, and sent back to the user
• To detect this, submit these two values in turn:
• test</foo>
• test<foo></foo>
• Reply may contain "test" or injected tags
![Page 55: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/55.jpg)
Finding SOAP Injection• Try injecting this into one parameter:
• <!--
• And this into another parameter:
• -->
• May comment out part of the SOAP message and change application logic or divulge information
![Page 56: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/56.jpg)
Preventing SOAP Injection
• Filter data at each stage
• HTML-encode XML metacharacters
![Page 57: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/57.jpg)
Injecting into Back-end HTTP Requests
• Server-side HTTP redirection
• HTTP parameter injection
![Page 58: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/58.jpg)
Server-Side HTTP Redirection• User-controllable input incorporated into a URL
• Retrieved with a back-end request
• Ex: user controls "loc"
![Page 59: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/59.jpg)
Connecting to a Back-End SSH Service
![Page 60: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/60.jpg)
Use App as a Proxy• Attack third-parties on the Internet
• Connect to hosts on the internal network
• Connect back to other services on the app server itself
• Deliver attacks such as XSS that include attacker-controlled content
![Page 61: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/61.jpg)
HTTP Parameter Injection• This request from the user causes a back-end
request containing parameters the user set
![Page 62: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/62.jpg)
HTTP Parameter Injection• Front-end server can bypass a check by
including this parameter in the request
• clearedfunds=true
• With this request
![Page 63: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/63.jpg)
Result
![Page 64: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/64.jpg)
HTTP Parameter Pollution• HTTP specifications don't say how web servers
should handle repeated parameters with the same name
![Page 65: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/65.jpg)
Example• Original back-end request
• Front-end request with added parameter
![Page 66: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/66.jpg)
Attacks Against URL Translation
• URL rewriting is common
• To map URLs to relevant back-end functions
• REST-style parameters
• Custom navigation wrappers
• Others
![Page 67: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/67.jpg)
Apache mod_rewrite• This rule
• Changes this request
• To this
![Page 68: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/68.jpg)
Attack• This request
• Changes to this
![Page 69: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/69.jpg)
Injecting into Mail Services
• Apps often send mail via SMTP
• To report a problem
• To provide feedback
• User-supplied information is inserted into the SMTP conversation
![Page 70: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/70.jpg)
Email Header Manipulation
![Page 71: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/71.jpg)
Injecting a Bcc
![Page 72: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/72.jpg)
SMTP Command Injection• This feedback request
• Creates this SMTP conversation
![Page 73: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/73.jpg)
Inject into Subject Field
![Page 74: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/74.jpg)
Resulting Spam
![Page 75: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/75.jpg)
Finding SMTP Injection Flaws
• Inject into every parameter submitted to an email function
• Test each kind of attack
• Use both Windows and Linux newline characters
![Page 76: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/76.jpg)
Preventing SMTP Injection• Validate user-supplied data
![Page 77: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/77.jpg)
iClickers
![Page 78: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/78.jpg)
Which attack sets the same value twice?
A. XXE
B. SOAP injection
C. HTTP Parameter Injection
D. HTTP Parameter Pollution
E. HTTP Redirection
![Page 79: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/79.jpg)
Which attack uses declare a custom DOCTYPE?
A. XXE
B. SOAP injection
C. HTTP Parameter Injection
D. HTTP Parameter Pollution
E. HTTP Redirection
![Page 80: CNIT 129S: Securing Web Applications · File Inclusion Vulnerabilities • Include files make code re-use easy • Common files are included within other files • PHP allows include](https://reader034.vdocuments.net/reader034/viewer/2022050608/5faf922301ff447c2401c971/html5/thumbnails/80.jpg)
Which attack uses HTML comments?
A. XXE
B. SOAP injection
C. HTTP Parameter Injection
D. HTTP Parameter Pollution
E. HTTP Redirection