nullcon 2011 - (secure) sitehoster – disable xss & sql injection

NEW CONCEPTS

DEFEATING

WEB ATTACKS

( s e c u r e ) S i t e H o s t e r

http://nullcon.net

http://nullcon.net/

http://null.co.in http://nullcon.net aBionic@twitter,linkedin,FB

Family Named: AbhishekKr

Friends Call: ABK

g33k Handle: aBionic

Independent Security Enthusiast/Researcher

Also a Member of „EvilFingers‟ (other than ‘NULL’)

Application-Developer in ThoughtWorks Inc.

OpenSource Lover

http://null.co.in/

http://nullcon.net/


Other than expanding to (secure)SiteHoster

A Fresh Approach

A Lab RAT

(s)SH

http://sourceforge.net/projects/sitehoster

http://null.co.in/

http://nullcon.net/

http://null.co.in

http://nullcon.net

aBionic@

twitter,linkedin,FB

It‟s The Same Old Problem

http://null.co.in/

http://nullcon.net/

http://null.co.in

http://nullcon.net

aBionic@

twitter,linkedin,FB

With A New Perspective To Solve It

Same Old Problem

http://null.co.in/

http://nullcon.net/

http://null.co.in

http://nullcon.net

aBionic@

twitter,linkedin,FB

ATTACK THE ATTACKER

offensive security to secure

http://null.co.in/

http://nullcon.net/

http://null.co.in

http://nullcon.net

aBionic@

twitter,linkedin,FB

Stats are not same (of 2009) …

But t h r e a t s are

Major Threats for Web Applications

http://null.co.in/

http://nullcon.net/


always aim the strongest opponent first,

makes you win battle easily

XSS Defeating Concept

http://null.co.in/

http://nullcon.net/

aBionic@twitter,linkedin,FB

IT IS JUST A PIECE OF CODE


<TAGS/> R GooD


And if it’s Code…

http://null.co.in

http://nullcon.net

aBionic@

twitter,linkedin,FB

BUG

!dea is to

http://null.co.in/

http://nullcon.net/

http://null.co.in

http://nullcon.net

aBionic@

twitter,linkedin,FB

All Effect From Options of User Input, a Web2.0 Gift

3 Major XSS Attack Patterns

http://null.co.in/

http://nullcon.net/

http://null.co.in

http://nullcon.net

aBionic@

twitter,linkedin,FB

What You See Is (*NOT*) What You Get

Included or injected <script/>

+ Karthik calling Karthik…

+ User (tricked) Input…

http://null.co.in/

http://nullcon.net/

http://null.co.in

http://nullcon.net

aBionic@

twitter,linkedin,FB

What finally happens is unwanted <script/>

Who calls, or who injects

http://null.co.in/

http://nullcon.net/

http://null.co.in

http://nullcon.net

aBionic@

twitter,linkedin,FB

Take away all its POWER!!!!!

Disarm <script/>

http://null.co.in/

http://nullcon.net/

http://null.co.in

http://nullcon.net

aBionic@

twitter,linkedin,FB

To kill all unwanted „Creepy-Living‟ Beings

Dis-Infect Entire Body

http://null.co.in/

http://nullcon.net/


Generated HyperText

<html>

<head><script>function h(){alert(“some dev-script in HEAD

Tag”);}</script></head>

<body>

<script DEFER>heavy_stuff=true;</script>

name: <div id=”fromDB” onMouseOver=”h();”>

<script>alert(„attacker injected it, could do anything‟);</script>

</div>

</body>

</html>


Server Patched View

<html>

<head>

<script> function h(){alert(“this is dev-scripts in HEAD Tag”);}</script>

</head>

<BD>

<BODY >

<script DEFER>heavy_stuff=true;</script>

<script type='text/javascript'>

x=document.getElementsByTagName("BODY");

x[0].innerHTML = "name:<div id=\"fromDB\" onclick=\"h();\">

<script>alert(\'attacker injected it, could do anything\');<\/script><\/div>“;

</script>

</BODY>

</BD>

</html>

http://null.co.in

http://nullcon.net

aBionic@

twitter,linkedin,FB

…other two monkeys got a chance

But… still

http://null.co.in/

http://nullcon.net/

http://null.co.in

http://nullcon.net

aBionic@

twitter,linkedin,FB

„javascript:‟ may effect as

http://null.co.in/

http://nullcon.net/

http://null.co.in

http://nullcon.net

aBionic@

twitter,linkedin,FB

So „javascript:<bugMe/>‟

http://null.co.in/

http://nullcon.net/

http://null.co.in

http://nullcon.net

aBionic@

twitter,linkedin,FB

2 are pwn3d… but 3rd is powerful enough

1 Monkey can wreck havoc

http://null.co.in/

http://nullcon.net/

http://null.co.in

http://nullcon.net

aBionic@

twitter,linkedin,FB

-says „JS-Events‟

„Be Kind‟ on Entropy

http://null.co.in/

http://nullcon.net/


http://null.co.in/

http://nullcon.net/


Ninja Parse User Input


Bug-it-su pwn JS-Events


hardcore ‘js-events’ pwnage

http://null.co.in

http://nullcon.net

aBionic@

twitter,linkedin,FB

<TAGS/> go Green

XSS Attack gets bugged

http://null.co.in/

http://nullcon.net/

http://null.co.in

http://nullcon.net

aBionic@

twitter,linkedin,FB

Normal User Input Matching Attack aint Filtered

Innocence Is Saved

http://null.co.in/

http://nullcon.net/

http://null.co.in

http://nullcon.net

aBionic@

twitter,linkedin,FB

And so are Script-Junkies

All Monkeys Defeated

http://null.co.in/

http://nullcon.net/


CURRENTLY JUST DEV PERSPECTIVE


For Un-Privileged AXNs


Old Wine, Why Not Always Used

DB

Web-App User-

Mapper

Read on Table T1

Read,Write on Table t2

all Read,write.*

boss

http://null.co.in

http://nullcon.net

aBionic@

twitter,linkedin,FB

A n A A p p l e H a s h A A n D a y I n p u t

Ke e p s T h e D o c t o r A t t a c k e r Aw a y

& For Condition Match

http://null.co.in/

http://nullcon.net/


I Tweet Tech: http://www.twitter.com/aBionic

I Blog Tech: http://abhishekkr.wordpress.com/

I OpenSource

GitHub: https://github.com/abhishekkr

SourceForge: http://sourceforge.net/users/abhishekkr

I Socialize: http://www.facebook.com/aBionic

I Techalize: http://in.linkedin.com/in/abionic

I Deviantize: http://abhishekkr.deviantart.com/

http://null.co.in/

http://nullcon.net/

http://www.twitter.com/aBionic

http://www.twitter.com/aBionic

http://abhishekkr.wordpress.com/



https://github.com/abhishekkr




http://sourceforge.net/users/abhishekkr




http://www.facebook.com/aBionic




http://in.linkedin.com/in/abionic





http://abhishekkr.deviantart.com/



nullcon 2011 - (secure) sitehoster – disable xss & sql injection

Technology