SSD Week 1

SSD Week 1

1. Server Architecture

   • Web Servers
     • Serves static content
       • Safe from active web app attacks
         • Can be used for information gathering
   • Dynamic Servers
     • Serves static & dynamic content
       • Simple and affordable steup
         • Difficult to protect & harden
   • Application Servers
     • Provide applications with features/add-ons
   • Proxy Servers
     • Provide content caching for applications
       • Target for cache poisoning & information disclosure

2. HTTP

   • HTTP Request Types
     • GET
       • Obtain web resource
         • Parameters in URL easily manipulated
     • POST
       • Obtain web resource
         • Method Interchange to GET
     • HEAD
       • Return HTTP header
         • Can use to bypass authentication
     • TRACE
       • Echo request to client
         • Hackers can see proxy server's changes
     • OPTIONS
       • List supported request methods
         • Reveals methods that can be used for attacks
     • PUT
       • Uploads HTTP payload
         • Unauthorized upload, and can cause DoS
     • DELETE
       • Removes specified resource
         • Unauthorized deletion, and can cause DoS
           • Should not be supported
     • CONNECT
       • Creates HTTP tunnel
         • Used to attack resources behind the proxy
   • HTTP Status Codes
     • 100 - 1XX
       • Informational
         • 100: Continue
         • 101: Switch Protocol
     • 200 - 2XX
       • Success
         • 200: OK
     • 300 - 3XX
       • Redirection
         • 302: Redirect
         • 304: Not modified
     • 400 - 4XX
       • Client-side error
         • 401: Unauthorized
         • 404: File not found
     • 500 - 5XX
       • Server-side error
         • 500: Server error
         • 502: Bad Gateway

3. Authentication

   • Basic Authentication
     • Server uses "Realm" to identify itself
     • Credentials encoded in Base64, easily reversed
     • Plaintext authentication, sniffable without HTTPS
     • Authentication easily replayed
     • No account lockout, unlimited login attempts
     • Easy to impersonate, can dupe users
   • Digest Authentication
     • Similar to Basic
       • Uses MD5 to send hashes
         • Still weak
       • Uses nonce as a salt
         • Can be predicted
         • Interceptable by MitM attacks
       • Quality of Protection flag tells client how to generate response hash
   • Forms-based Authentication
     • Very customizable
     • Credentials transported in plaintext, without HTTPS
     • SQL Injection vulnerabilities
     • XSS vulnerabilities
   • OAuth
     • Secret key can be disclosed e.g intercepted if no SSL
     • JavaScript information leakage flaws
     • Can be spoofed to dupe users