Webapp Security

Webapp Security

1. Introduction

   • Protocols
     • HTTP
       • Request
         • Common HTTP Request: GET / HTTP/1.1Host: http://www.page.comUser-Agent: Mozilla/5.0 ...Accept: text/html, application/xhtml+xmlAccept-Encoding: gzip, deflateConnection: keep-alive
       • Response
         • Common HTTP Response: HTTP/1.1 200 OK Date: Fri, 13 Mar 2015 11:28:05 GMT Cache-Control: private, max-age=0 Content-Type: text/html; charset=UTF-8 Content-Encoding: gzip Server: gws Content-Length: 278
         • Common Status
           • 200. OK, resource found
           • 301. Moved permanently
           • 302. Moved temporarily
           • 403. Forbidden
           • 404. Not Found
           • 500. Internal server error
     • HTTPS
       • Can't Sniff
       • Can't alter application layer
       • Define Identity of server
   • Encoding
     • Charset
       • UTF-8
       • ISO-8859-1
     • HTML Encoding
     • HTML Entities
     • URL Encoding
     • Base64
   • Web Application Proxies
     • BurpSuite
     • OWASP ZAP
   • Cookies
     • Parameters
       • Domain
       • Expires
       • Path
       • Content
       • HTTP Only Flag
       • Secured Flag
   • Sessions
     • Common names
       • PHPSESSID
       • JSESSIONID
   • Same Origin Policy (SOP)
     • A document can access (through js) the properties of another document only if they have the same origin.
     • Document: - HTML page - Iframe - Ajax Request
     • Three components
       • 1. Protocol 2. Host 3. Port
     • IE Works slightly different
       • - It doesn't consider port - On a trust zone, SOP is not considered
     • Exceptions
       • window.location
         • On different origin, only can write the location nor read it.
       • document.domain
       • Cross windows messages
       • CORS
         • Cross origin resource sharing

2. Cross Site Scripting

3. SQL Injection

4. Advanced Web Attacks

5. Information Gathering

   • Whois
   • DNS
     • TLD
     • Resource Records
       • Domain name
       • TTL
         • Time to live. Measured in seconds
       • Record class
         • Internet Hesiod Chaos
       • SOA
         • Start Of Authority
       • NS
         • Name Servers
       • A
         • Address Also called forward zones From hostname to IP
       • PTR
         • Pointer Also called reverse zone From IP to hostname
       • CNAME
         • Maps an alias hostname to an A record
       • MX
         • Mail Exchange Host accept emails to a given host. It works with a prioritized list
   • NSLOOKUP
   • Infrastructure
     • Tools
       • - netcat - whatweb - wappalizer
     • Subdomain enumeration
       • Tools
         • subbrute dnsrecon theHarvester
       • Techniques
         • - Search engines - Zone transfer - Netcraft - Brute force
     • Virtualhosts
     • Fingerprint webapps
       • COTS
         • Common Off The Shelf Applications that are usually used and we have the source code available
       • Custom Applications
         • Crawl
         • Functional Graph
         • Map the attack surface
           • - Client side validation - Database interaction - File Uploads and downloads - Display of user supplied data - Redirections - Access control and login pages - Error messages
       • Finding hidden files
         • We can use dirbuster to check for backups files or common "backup" extensions like: .bak, .old, "bkup"
       • Enumerate user accounts
       • Relevant information through misconfiguration
         • Directory listing
         • Log and configuration file
         • HTTP Verbs & File upload
           • We look for writable files, also the PUT verb needs to be available and the user used to browse the site needs to have writing permissions. It's a manual and not so straightforward process.
   • Google Hacking
   • Shodan
     • To look for: - System versions - Devices with default username/passwords - View the configuration of a device