SlideShare a Scribd company logo

Isys20261 lecture 09

•Download as PPT, PDF•
•
Wiliam Ferraciolli
Wiliam Ferraciolli

This document discusses various web application attacks including session hijacking, code injection, cross-site scripting (XSS), pharming, and URL spoofing. It provides details on how each attack works, examples, and potential defenses. Session hijacking involves stealing valid session IDs to take over user sessions. Code injection involves introducing malicious code via data inputs. XSS involves injecting client-side scripts to bypass access controls. Pharming and URL spoofing involve redirecting users to fake websites to steal login credentials.

1 of 17
Computer Security Management (ISYS20261) Lecture 9 - Web application attacks Module Leader: Dr Xiaoqi Ma School of Science and Technology
Today ... … we will discuss: • Session Hijacking • Code injection • Cross-site scripting (XSS) • Pharming • URL spoofing Computer Security Management Page 2
HTTP cookie (1) • An HTTP cookie is usually a small piece of data sent from a website and stored in a user's web browser while a user is browsing a website. – When the user browses the same website in the future, the data stored in the cookie can be retrieved by the website to notify the website of the user's previous activity. • Introduces state into HTTP transactions, used by Web servers to differentiate users and to maintain data related to the user • Data in cookie might be random or meaningful • Server has to maintain a database of cookies • Specification: – four kilobytes of data each – Browser stores at least 300 cookies – at least 20 cookies per server or domain Computer Security Management Page 3
HTTP cookies (2) • Example Server Client1 Client2 Page Request() page data + cookie1() page request + cookie1() page data() page request + cookie2() page data() Computer Security Management Page 4
Session hijacking • Session IDs: – typically granted to a visitor on his first visit to a site – may become invalid after a certain goal has been met – often used to identify a user that has logged into a website – often long randomly-generated string • Session hijacking: – attacker using captured, brute forced or reverse-engineered session IDs to seize control of a legitimate user's session while that session is still in progress – often servers perform additional verification of the client, e.g. locking a session ID to the client's IP address – simple and effective measure as long as the attacker cannot connect to the server from the same address Computer Security Management Page 5
Session sidejacking • Attacker uses packet sniffing to read network traffic between two parties to steal the session cookie • Often web sites use SSL encryption for login pages but do not use encryption for the rest of the site once authenticated • Attackers then can read the network traffic to intercept all the data that is submitted to the server or web pages viewed by the client • Since this data includes the session cookie, it allows him to impersonate the victim, even if the password itself is not compromised • Unsecured WiFi hotspots are particularly vulnerable, as anyone sharing the network will generally be able to read most of the web traffic between other nodes and the access point Computer Security Management Page 6
Code injection • Breaking into applications by processing invalid data • Used by an attacker to introduce code into a computer program to change the course of execution • Examples – SQL injection – PHP injection – Etc. Computer Security Management Page 7
SQL injection example • Takes advantage of the syntax of SQL to inject commands that can compromise the meaning of the original query • Statement – SELECT * FROM users WHERE name = '" + name + "'; • If user enters a' or 't'='t for name statement changes to – SELECT * FROM users WHERE name = 'a' OR 't'='t'; • Forces the selection of all valid usernames because the evaluation of 't'='t' is always true! • Defence: – Input validation – Escaping dangerous characters – Etc. Computer Security Management Page 8
Cross site scripting (XSS) (1) • Possible in web applications which allow code injection by malicious web users into the web pages viewed by other users • Examples: – HTML code – client-side scripts – etc • Can be used by attackers to bypass access controls • 2007: cross-site scripting carried out on websites were roughly 80% of all documented security vulnerabilities • Usually the end-user does not notice that he/she is subject to unauthorized access, theft of sensitive data, and financial loss Computer Security Management Page 9
Cross site scripting (XSS) (2) • Different Types: – Type 0: Document Object Model (DOM)-based – Type 1: Non-Persistent (reflective) – Type 2: Persistent • Type 1 most common, type 2 most dangerous Computer Security Management Page 10
Type 0 1. Ivan sends a URL to Alice (via email or another mechanism) of a maliciously constructed web page 2. Alice clicks on the link 3. The malicious web page's JavaScript opens a vulnerable HTML page installed locally on Alice's computer 4. The vulnerable HTML page contains JavaScript which executes in Alice's computer's local zone 5. Ivan’s malicious script now may run commands with the privileges Alice holds on her own computer Computer Security Management Page 11
Type 1 (1) 1. Alice often visits a particular website, which is hosted by Bob. Bob's website allows Alice to log in with a username/password pair and store sensitive information, e.g. billing information 2. Ivan observes that Bob's website contains a reflected (type 1) XSS vulnerability 3. Ivan crafts a URL to exploit the vulnerability, and sends Alice an email, making it look as if it came from Bob (spoofing) 4. Alice visits the URL provided by Ivan while logged into Bob's website 5. The malicious script embedded in the URL executes in Alice's browser, as if it came directly from Bob's server. The script steals sensitive information and sends this to Ivan’s web server without Alice's knowledge Computer Security Management Page 12
Type 1 (2) • Website that offers search functionality: http://website.com/?search=name • Website echoes (reflects) input without checking: <p>You were looking for: name</p> • If <script type="text/javascript">alert("XSS")</script> is used for name: • Server echoes script that is then executed locally: <p>You were looking for: <script type="text/javascript">alert("XSS") </script></p> Computer Security Management Page 13
Type 2 (1) 1. Bob hosts a web site which allows users to post messages and other content to the site for later viewing by other members 2. Ivan notices that Bob's website is vulnerable to a type 2 XSS attack 3. Ivan posts a message that contains a (hidden) script 4. By viewing the posted message, site users' session cookies or other credentials could be taken and sent to Ivan's web server without their knowledge 5. Later, Ivan logs in as other site users and posts messages on their behalf.... Computer Security Management Page 14
Type 2 (2) • If a web site offers a guest book facility: • Attacker enters for example: Nice web site!<script type="text/javascript">alert("XSS")</script> • Ever user who reads the guest book executes the attacker’s script! Computer Security Management Page 15
Pharming • Attempt to subvert DNS systems to redirect network traffic to a malicious system • Can be achieved by – attacking DNS servers, planting bogus data in their cache so that when a site's IP address is requested that of the attacker’s site is supplied instead – changing the hosts file on the local system so that certain sites will be redirected • Victim's attempts to access certain sites will be redirected silently and invisibly • Can be hard to detect locally Computer Security Management Page 16
URL spoofing • Common way to redirect a user to a web site that looks authentic • This web site might be a spoof with templates that look identical to the actual web site • User enter their login information to these fake web site: providing the attacker with data that can be used to enter the real web site • Example: www.google.com@members.aol.com looks like a URL to the google search engine but in reality it is a URL to the members.aol.com server! Computer Security Management Page 17

More Related Content

Isys20261 lecture 09

  • 1. Computer Security Management (ISYS20261) Lecture 9 - Web application attacks Module Leader: Dr Xiaoqi Ma School of Science and Technology
  • 2. Today ... … we will discuss: • Session Hijacking • Code injection • Cross-site scripting (XSS) • Pharming • URL spoofing Computer Security Management Page 2
  • 3. HTTP cookie (1) • An HTTP cookie is usually a small piece of data sent from a website and stored in a user's web browser while a user is browsing a website. – When the user browses the same website in the future, the data stored in the cookie can be retrieved by the website to notify the website of the user's previous activity. • Introduces state into HTTP transactions, used by Web servers to differentiate users and to maintain data related to the user • Data in cookie might be random or meaningful • Server has to maintain a database of cookies • Specification: – four kilobytes of data each – Browser stores at least 300 cookies – at least 20 cookies per server or domain Computer Security Management Page 3
  • 4. HTTP cookies (2) • Example Server Client1 Client2 Page Request() page data + cookie1() page request + cookie1() page data() page request + cookie2() page data() Computer Security Management Page 4
  • 5. Session hijacking • Session IDs: – typically granted to a visitor on his first visit to a site – may become invalid after a certain goal has been met – often used to identify a user that has logged into a website – often long randomly-generated string • Session hijacking: – attacker using captured, brute forced or reverse-engineered session IDs to seize control of a legitimate user's session while that session is still in progress – often servers perform additional verification of the client, e.g. locking a session ID to the client's IP address – simple and effective measure as long as the attacker cannot connect to the server from the same address Computer Security Management Page 5
  • 6. Session sidejacking • Attacker uses packet sniffing to read network traffic between two parties to steal the session cookie • Often web sites use SSL encryption for login pages but do not use encryption for the rest of the site once authenticated • Attackers then can read the network traffic to intercept all the data that is submitted to the server or web pages viewed by the client • Since this data includes the session cookie, it allows him to impersonate the victim, even if the password itself is not compromised • Unsecured WiFi hotspots are particularly vulnerable, as anyone sharing the network will generally be able to read most of the web traffic between other nodes and the access point Computer Security Management Page 6
  • 7. Code injection • Breaking into applications by processing invalid data • Used by an attacker to introduce code into a computer program to change the course of execution • Examples – SQL injection – PHP injection – Etc. Computer Security Management Page 7
  • 8. SQL injection example • Takes advantage of the syntax of SQL to inject commands that can compromise the meaning of the original query • Statement – SELECT * FROM users WHERE name = '" + name + "'; • If user enters a' or 't'='t for name statement changes to – SELECT * FROM users WHERE name = 'a' OR 't'='t'; • Forces the selection of all valid usernames because the evaluation of 't'='t' is always true! • Defence: – Input validation – Escaping dangerous characters – Etc. Computer Security Management Page 8
  • 9. Cross site scripting (XSS) (1) • Possible in web applications which allow code injection by malicious web users into the web pages viewed by other users • Examples: – HTML code – client-side scripts – etc • Can be used by attackers to bypass access controls • 2007: cross-site scripting carried out on websites were roughly 80% of all documented security vulnerabilities • Usually the end-user does not notice that he/she is subject to unauthorized access, theft of sensitive data, and financial loss Computer Security Management Page 9
  • 10. Cross site scripting (XSS) (2) • Different Types: – Type 0: Document Object Model (DOM)-based – Type 1: Non-Persistent (reflective) – Type 2: Persistent • Type 1 most common, type 2 most dangerous Computer Security Management Page 10
  • 11. Type 0 1. Ivan sends a URL to Alice (via email or another mechanism) of a maliciously constructed web page 2. Alice clicks on the link 3. The malicious web page's JavaScript opens a vulnerable HTML page installed locally on Alice's computer 4. The vulnerable HTML page contains JavaScript which executes in Alice's computer's local zone 5. Ivan’s malicious script now may run commands with the privileges Alice holds on her own computer Computer Security Management Page 11
  • 12. Type 1 (1) 1. Alice often visits a particular website, which is hosted by Bob. Bob's website allows Alice to log in with a username/password pair and store sensitive information, e.g. billing information 2. Ivan observes that Bob's website contains a reflected (type 1) XSS vulnerability 3. Ivan crafts a URL to exploit the vulnerability, and sends Alice an email, making it look as if it came from Bob (spoofing) 4. Alice visits the URL provided by Ivan while logged into Bob's website 5. The malicious script embedded in the URL executes in Alice's browser, as if it came directly from Bob's server. The script steals sensitive information and sends this to Ivan’s web server without Alice's knowledge Computer Security Management Page 12
  • 13. Type 1 (2) • Website that offers search functionality: http://website.com/?search=name • Website echoes (reflects) input without checking: <p>You were looking for: name</p> • If <script type="text/javascript">alert("XSS")</script> is used for name: • Server echoes script that is then executed locally: <p>You were looking for: <script type="text/javascript">alert("XSS") </script></p> Computer Security Management Page 13
  • 14. Type 2 (1) 1. Bob hosts a web site which allows users to post messages and other content to the site for later viewing by other members 2. Ivan notices that Bob's website is vulnerable to a type 2 XSS attack 3. Ivan posts a message that contains a (hidden) script 4. By viewing the posted message, site users' session cookies or other credentials could be taken and sent to Ivan's web server without their knowledge 5. Later, Ivan logs in as other site users and posts messages on their behalf.... Computer Security Management Page 14
  • 15. Type 2 (2) • If a web site offers a guest book facility: • Attacker enters for example: Nice web site!<script type="text/javascript">alert("XSS")</script> • Ever user who reads the guest book executes the attacker’s script! Computer Security Management Page 15
  • 16. Pharming • Attempt to subvert DNS systems to redirect network traffic to a malicious system • Can be achieved by – attacking DNS servers, planting bogus data in their cache so that when a site's IP address is requested that of the attacker’s site is supplied instead – changing the hosts file on the local system so that certain sites will be redirected • Victim's attempts to access certain sites will be redirected silently and invisibly • Can be hard to detect locally Computer Security Management Page 16
  • 17. URL spoofing • Common way to redirect a user to a web site that looks authentic • This web site might be a spoof with templates that look identical to the actual web site • User enter their login information to these fake web site: providing the attacker with data that can be used to enter the real web site • Example: www.google.com@members.aol.com looks like a URL to the google search engine but in reality it is a URL to the members.aol.com server! Computer Security Management Page 17