"Both novice and seasoned readers will come away with an increased understanding of how Web hacking occurs and enhanced skill at developing defenses against such Web attacks. Technologies covered include Web languages and protocols, Web and database servers, payment systems and shopping carts, and critical vulnerabilities associated with URLs. This book is a virtual battle plan that will help you identify and eliminate threats that could take your Web site off line..."
--From the Foreword by William C. Boni, Chief Information Security Officer, Motorola
"Just because you have a firewall and IDS sensor does not mean you aresecure; this book shows you why."Whether it's petty defacing or full-scale cyber robbery, hackers are moving to the Web along with everyone else. Organizations using Web-based business applications are increasingly at risk. Web Hacking: Attacks and Defense is a powerful guide to the latest information on Web attacks and defense. Security experts Stuart McClure (lead author of Hacking Exposed), Saumil Shah, and Shreeraj Shah present a broad range of Web attacks and defense.
--Lance Spitzner, Founder, The Honeynet Project
"How Do They Do It?" sections show how and why different attacks succeed, including:
Appendices include a listing of Web and database ports, cheat sheets for remote command execution, and source code disclosure techniques.
Web Hacking informs from the trenches. Experts show you how to connect the dots--how to put the stages of a Web hack together so you can best defend against them. Written for maximum brain absorption with unparalleled technical content and battle-tested analysis, Web Hacking will help you combat potentially costly security threats and attacks.
Click below for Web Resources related to this title:
Author Web Site
Click below for Sample Chapter(s) related to this title:
Sample Chapter 10
(NOTE: Each chapter begins with an Introduction and concludes with a Summary.)
“We're Secure, We Have a Firewall”.
To Err Is Human.
Writing on the Wall.
A Final Word.
I. THE E-COMMERCE PLAYGROUND.Case Study: Acme Art, Inc. Hacked!
Languages of the Web.
Dynamic HTML (DHTML).
Active Server Pages.
Java.2. Web and Database Servers.
Microsoft's Internet Information Server (IIS).
Microsoft SQL Server.
Oracle.3. Shopping Carts and Payment Gateways.
Evolution of the Storefront.
Shopping Cart Systems.
Scope and Lifetime of an Electronic Shopping Cart.
Collecting, Analyzing, and Comparing Selected Components.
Keeping Track of the Total Cost.
Change of Mind.
Processing the Purchase.
Implementation of a Shopping Cart Application.
Integration with the Payment Gateway.
Examples of Poorly Implemented Shopping Carts.
Carello Shopping Cart.
DCShop Shopping Cart.
Hassan Consulting's Shopping Cart.
Cart32 and Several Other Shopping Carts.
Finalizing the Order.
Method of Payment.
Verification and Fraud Protection.
Order Fulfillment and Receipt Generation.
Overview of the Payment Processing System.
Innovative Ways to Combat Credit Card Fraud.
Order Confirmation Page.
Payment Gateway Interface.
Transaction Database Interface.
Interfacing with a Payment Gateway—An Example.
Payment System Implementation Issues.
Storing User Profiles.
Vulnerabilities Caused by Poor Integration of Shopping Cart and Payment Gateway.
PayPal—Enabling Individuals to Accept Electronic Payments.4. HTTP and HTTPS: The Hacking Protocols.
Protocols of the Web.
HTTPS (HTTP over SSL).5. URL: The Web Hacker's Sword.
Web Hacker Psychology.
URLs and Parameter Passing.
Specifying Special Characters on the URL String.
Meta-Characters and Input Validation.
The Acme Art, Inc. Hack.
Abusing URL Encoding.
Unicode Encoding and Code Red's Shell Code.
The Double-Decode or Superfluous Decode Vulnerability.
Anatomy of an HTML Form.
Parameter Passing Via GET and POST.
II. URLS UNRAVELED.Case Study: Reconnaissance Leaks Corporate Assets.
The Components of a Web Application.
The Front-End Web Server.
The Web Application Execution Environment.
The Database Server.
Wiring the Components.
The Native Application Processing Environment.
Web Server APIs and Plug-Ins.
URL Mapping and Internal Proxying.
Proxying with a Back-End Application Server.
Connecting with the Database.
The Craftiest Hack of Them All.
Using Native Database APIs.
Specialized Web Application Servers.
Identifying Web Application Components from URLs.
The Basics of Technology Identification.
Advanced Techniques for Technology Identification.
Identifying Database Servers.
Rule 1: Minimize Information Leaked from the HTTP Header.
Rule 2: Prevent Error Information from Being Sent to the Browser.7. Reading Between the Lines.
Information Leakage Through HTML.
What the Browsers Don't Show You .
Netscape Navigator—View | Page Source.
Internet Explorer—View | Source.
Clues to Look For.
Developer or Author Details.
Cross-References to Other Areas of the Web Application.
Reminders and Placeholders.
Comments Inserted by Web Application Servers.
Old “Commented-Out” Code.
Internal and External Hyperlinks.
E-mail Addresses and Usernames.
UBE, UCE, Junk Mail, and Spam.
Keywords and Meta Tags.
Automated Source Sifting Techniques.
Sam Spade, Black Widow, and Teleport Pro.8. Site Linkage Analysis.
HTML and Site Linkage Analysis.
Site Linkage Analysis Methodology.
Step 1: Crawling the Web Site .
Crawling a Site Manually.
A Closer Look at the HTTP Response Header.
Some Popular Tools for Site Linkage Analysis.
Crawlers and Redirection.
Step 2: Creating Logical Groups Within the Application Structure.
Step 3: Analyzing Each Web Resource.
1. Extension Analysis.
2. URL Path Analysis.
3. Session Analysis.
4. Form Determination.
5. Applet and Object Identification.
6. Client-Side Script Evaluation.
7. Comment and E-Mail Address Analysis.
Step 4: Inventorying Web Resources.
III. HOW DO THEY DO IT?Case Study: How Boris Met Anna's Need for Art Supplies.
Defacing Acme Travel, Inc.'s Web Site.
Mapping the Target Network.
Throwing Proxy Servers in Reverse.
Brute Forcing HTTP Authentication.
Uploading the Defaced Pages.
What Went Wrong?
HTTP Brute-Forcing Tools.
Countermeasures Against the Acme Travel, Inc. Hack.
Turning Off Reverse Proxying.
Using Stronger HTTP Authentication Passwords.
Turning off Directory Browsing.10. E-Shoplifting.
Building an Electronic Store.
The Store Front-End.
The Shopping Cart.
The Checkout Station.
Putting It All Together.
Evolution of Electronic Storefronts.
Robbing Acme Fashions, Inc.
Setting Up Acme's Electronic Storefront.
Tracking Down the Problem.
Bypassing Client-Side Validation.
Using Search Engines to Look for Hidden Fields.
Facing a New Problem with the Overhauled System.
Postmortem and Further Countermeasures.
Shopping Carts with Remote Command Execution.11. Database Access.
Direct SQL Attacks.
A Used Car Dealership Is Hacked.
Countermeasures.12. Java: Remote Command Execution.
Architecture of Java Application Servers.
Attacking a Java Web Server.
Identifying Loopholes in Java Application Servers.
Example: Online Stock Trading Portal.
Harden the Java Web Server.
Other Conceptual Countermeasures.13. Impersonation.
Session Hijacking: A Stolen Identity and a Broken Date.
March 5, 7:00 A.M.—Alice's Residence.
8:30 A.M.—Alice's Workplace.
10:00 A.M.—Bob's Office.
11:00 A.M.—Bob's Office.
12:30 P.M.—Alice's Office.
9:30 P.M.-Bertolini's Italian Cuisine.
Postmortem of the Session Hijacking Attack.
Application State Diagrams.
HTTP and Session Tracking.
Stateless Versus Stateful Applications.
Cookies and Hidden Fields.
Cookie Control, Using Netscape on a Unix Platform.
Implementing Session and State Tracking.
Session Identifiers Should Be Unique.
Session Identifiers Should Not Be “Guessable”.
Session Identifiers Should Be Independent.
Session Identifiers Should Be Mapped with Client-Side Connections.14. Buffer Overflows: On-the-Fly.
Buffer Overflow: Its Simplest Form.
Buffer Overflow: An Example.
IV. ADVANCED WEB KUNG FU.Case Study.
Security Recommendations.16. Worms.
Code Red Worm.
January 26, 2000.
June 18, 2001: The First Attack.
July 12, 2001.
July 19, 2001.
August 4, 2001.
Combatting Worm Evolution.
React and Respond.17. Beating the IDS.
Getting Past an IDS.
Secure Hacking-Hacking Over SSL.
Tunneling Attacks via SSL.
Intrusion Detection via SSL.
Sniffing SSL Traffic.
Illegal Unicode/Superfluous Encoding.
Adding Fake Paths.
Inserting Slash-Dot-Slash Strings.
Using Nonstandard Path Separators.
Using Multiple Slashes.
Mixing Various Techniques.
Generating False Positives.
IDS Evasion in Vulnerability Checkers.
URL Decoding.Appendix A: Web and Database Port Listing.Appendix B: HTTP/1.1 and HTTP/1.0 Method and Field Definitions.Appendix C: Remote Command Execution Cheat Sheet.Appendix D: Source Code, File, and Directory Disclosure Cheat Sheet.Appendix E: Resources and Links.Appendix F: Web-Related Tools.Index. 0201761769T07312002
"We're Secure, We Have a Firewall"
If only we got a nickel every time we heard a client utter this pithy phrase. On second thought, that would unfortunate as we would probably not be writing this book; we'd be sipping Pina Colada's on some white sand beach by now...
For those skeptics among you, all warm and cozy next to your firewall, just remember this: over 65% of reported attacks occur over TCP port 80, the traditional web port (http://www.incidents.org). Is the web threat real? It's all too real.
After performing hundreds of security reviews over the decades, the authors have known for some time what you are about to know (if you don't already): Nothing can be truly secure. Error is at the heart of every security breach and as the saying goes: to err is human. No level of firewall, intrusion detection system (IDS), or anti-virus software will make you secure. Surprised this type of comment introduces a security book? Don't be. It is the harsh reality that must be accepted before the race to security can be started.
So what should we do, just throw up our hands, turn the power off to our computers and revert back 30 years; forgetting this Internet or the modem or the computer really happened? Sure, you can do that but you would be alone in your efforts. The Internet and all it has to offer is undeniable: increased communication, increased information sharing, connecting with people of all races, creeds, colors, sexes, and intelligence without boundaries or limits. And that's just the home user's benefits. Businesses use the Internet 24 hours a day, 7 days a week, making revenue and transmitting funds around the world at the blink of an eye. Anyone who denies the ubiquity and staying power of the Internet is just kidding themselves.
Over three years ago, one of the authors wrote a foreboding article that was indicative of things to come. The column printed on August 9, 1999 and was titled "Bane of e-commerce: We're secure: We allow only Web traffic through our firewall" (http://www.infoworld.com/articles/op/xml/99/08/09/990809opsecwatch.xml). The writing was on the security wall at that time but no one wanted to believe it, much less talk about it. They were too caught up in either hyped technologies such as Firewalls, IDS, and virtual private networks (VPN), or peripheral technologies that never hit mainstream, such as Public Key Infrastructure (PKI), Distributed Computing Environment (DCE), and single signon.
So why the tremendous interest in the Web and its security now? Because hacking events are frequent in today's connected world. And people are beginning to understand how a single vulnerability in a web application can expose an entire company's jewels to an attacker (a.k.a. Code Red and Nimda worms).
This book as been organized into four sections:
The content in each section gets progressively more advanced in its content and delivery, going from a brief web languages introduction (Chapter 1) to finding and exploiting your own buffer overflows (Chapter 14). But don't let the pace derail your learning. If you missed something, you can probably pick it up as you go along.
The first two sections are focused to give the reader a preliminary and then more intermediate introduction into the world of the web. In "E-Commerce Playground" we show you how the web works, its languages, applications, databases, protocols, and syntax. In "URLs Unraveled", we delve into the meaning of the URL, what is important to an attacker, how visible code can be helpful to an attacker, and we show you how mapping web sites can be critical to an attacker's repertoire.In the third section, "How do they do it?" we demystify the art of web hacking, how it is pulled off, and how simple steps at development time can eliminate a significant portion of the threat. This section is bar far the meatier of the sections in terms of information and often provides the greatest clues as to how hackers do what they do. Each chapter provides both a detailed analysis of the hack as well as a countermeasure section at the end which helps prevent the hack.
In the fourth section, "Advanced Web Kung Fu," we discuss some advanced web hacking concepts, methodologies, and tools that simply cannot be missed.
Finally, at the end of the book you will find Appendices that include a listing of common web ports on the Internet, cheat sheets for remote command execution and source code disclosure techniques, among other additions.
Click below to download the Index file related to this title: