Where do you start when hacking a web application?

Many of the web applications out there today explain that they are secure. According to the Web Hacker's Handbook, many sites tout their SSL as their claim to be secure. Of course, SSL is good - it prevents eavesdropping and keeps your content safe between browser and server over the Internet.

The fundamental security problem with most web applications is that the input is not under direct control of the application. Users all over the world can submit any arbitrary inputs to the application. The developers of the target application must therefore assume that each piece of input is malicious. The list of the Top 25 Most Dangerous Programming Errors compiled by the SANS institute and the MITRE organization in January 2009 describe the top 2 errors that revolve around malicious input and improper escaping of outputs.

The simple fact is that any user anywhere in the world can craft a special string to any publically accessible application that can wreak havoc for the organization. Couple that with the fact that the user doesn't have to use a web browser to interact with the application. There are numerous tools out there that are freely downloadable that can interact with web applications, even trapping the request from the client before it gets to the server and provides the attacker the ability to modify certain parameters that can totally bypass any validations.

Next post will get into the beginnings of how to use tools to completely map a target application.

Changing direction....

I decided that I needed to stop the Metasploit experimentation and go back to the basics of web application security. The Raleigh OWASP chapter got together this June to talk about how to use certain software that is useful in performing network penetration testing and I thought that would be a great place to start. I am going to start a blog series on using these tools and techniques to try and break your or someone else's web application defenses.

On our OWASP listserv someone mentioned a book that I looked into and as a newbie I think it is pretty awesome. It is called The Web Application Hacker's Handbook. Here is the information from Amazon:



I didn't buy it from Amazon but I was able to utilize my Safari Books online account to start reading the book. According to the book's introduction, this book is a practical guide to discovering and exploiting security flaws within web applications.

What I like about this book is the way the authors describe the process of hacking into logical steps. They start out by telling you why mapping your target application is important. Then they tell you in detailed steps how to do it. In addition, they list the tools that assist you in performing the tasks. The more experienced members of the OWASP group have told me about these same tools as listed in the book so they seem to be up to date and topical.

In more postings, I will get into how I started using this book and which tools that I have downloaded and installed. Hopefully, Metasploit will make more sense to me once I have a chance to get through this book!

In a related note, I thought it would be a good idea to spend the summer before school starts this semester studying for the CISSP certification exam. It costs around $500 to sit and the next test is for November. I would have to take the associate exam since I don't have the required professional security experience but it would be good for my career to pass it. Stay tuned.

My first published paper!

The good people at InfosecWriters.com have announced that they will publish my research paper on the SANS/CWE Top 25 Most Dangerous Programming Errors. Click here for more information on this list from the SANS Website.

I wrote this paper for my Spring 2009 grad school class at ECU as we do pretty much every semester especially for Dr. Lunsford's class. He always asks us to submit for publishing and this time they latched onto mine.

Here is a link to my entry: http://www.infosecwriters.com/texts.php?op=display&id=646

Metasploit - downloading and installing Metasploit framework for a newbie.

I'm doing a small presentation on the Metasploit framework for my Advanced Network Security course at ECU and I thought I'd put my experiences down here.

Getting started, I went to the Metasploit's framework site on the support side and downloaded the user guide (PDF format). This is a pretty good user's guide, about 30 pages long, and easy to read. It tells me that since I am a Windows user, I need to download the last stable Windows version. I see that the current version is an EXE file that lists it at 3.2. I had read that version 3.2 came out in March and in Macworld, they say that two people worked really hard to move the best of the Windows exploits to the Mac. It seems that the Windows version is a little better (probably since there are so many exploits on that platform!)

First problem! Avast, my anti virus software, flags the downloading file as containing a few Trojans. I immediately stopped downloading and went to Google to see if I could find some information. I saw a bunch of hits for Avast and Metasploit. I selected and read a few and basically it sums up to :there aren't any trojans in metasploit.

I stopped Avast and redownloaded the file trepidly! I finished the download and clicked the installer file to install the framework. By that time, I had re-enabled the Avast software. During installation of Metasploit, Avast agained complained a few times about Trojans and I dismissed them (about 5 or so alerts in total).

Start Metasploit launched a DOS Window that scrolled a lot of files, for what seemed 3 minutes. Finally I got the splash screen and Metasploit Framework GUI v3.2.

More information next as I play around and see how it works. I'll also report if I ever find any Trojans. I will run Spybot and Adaware also.

I tried to list a few books from Amazon on using Metasploit but the links failed this morning when I looked at it. Deleting now....

New OWASP Cheetsheets.

The Open Web Application Security Project has released two cheatsheets aimed at helping development teams thwart XSS and SQL injection attacks.


XSS : http://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet

SQL Injection: http://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet


The cheatsheets explain how proper output encoding goes a long way to mitigating these types of attacks. And SQL injection is up to about 30% of all malicious attacks on web applications so any protection against these attacks will be worth it to your project.

The best defense is information.

While researching the new version of Metasploit I came across a good blog post there that kind of sums up my term paper for school this semester - The best defense is information. Matter of fact, that is one of my best lessons or goals from my paper on the SANS / CWE Top 25 most dangerous programming errors. Keep up , with podcasts, SlashDot, blogs, etc.

This blog posting on Metasploit's site talks about the recent Adobe 0 day exploits last February. The poster says that security providers by and large depend alot on public information to keep users safe.

http://metasploit.com/blog/#blog-0

Securing your email.

Encrypting your email.

Here is a good article on how to encrypt your emails:
http://www.wi-fiplanet.com/tutorials/article.php/3786446. Here is a link to one of my favorite podcast transcripts where they also talk about email security: http://www.grc.com/sn/sn-182.htm.

Make sure if you use Gmail, make sure to use https rather than http. I have found that if you go to www.gmail.com, it will put you in SSL for logon only. Once, you log in, you go back to plain old http.

If you go to https://www.gmail.com after you log in, you stay in https. I don't know why that's not the default. Also, I am looking forward to the day where all email systems, including Outlook, doesn't have PGP built in tranparentlly. If I sign up for an email system, the first things that should be done is to have me sign up for a certificate.

Lastly, if the contents of the email is really sensitive, encrypt the attachments with a tool such as TrueCrypt, send the email and then call your recipient and give them the key to decrypt.