Revealing the Secrets: Source Code Disclosure, Techniques, and Impacts

I am…  Anant Kochhar, Senior Information Security Consultant with SecurEyes  Project Manager and Researcher  Malware Detection Techniques and  Real World Cracker Techniques

Unique Insecurities…  Each developer is unique  Each application is unique  Each application is uniquely insecure.  Each developer is uniquely insecure.

Source Code Disclosure Types  Accidental Code Disclosure  Backup and Misc. Files  The Dirty Download Page

Accidental Disclosure  Part of the Source Code is available in the HTML source code.  When Dynamic pages are turned into Static pages: like from ‘.asp’ to ‘.html’  Coder don’t remove the ASP code before publishing the HTML page.  Why? Because IE is very forgiving.

Google- Looking in a domain which claims to have ALL ‘audited’ sites “mdb”“server.createobject” OR “server.mappath” site:???.??

In IE

In Mozilla Firefox

Voila…

How to avoid it…  Don’t be careless. –Go through the HTML source code of every page before it is published online.  Use both IE and Firefox to test a page.

Backup and Misc. Files  Source Codes stored in readable formats.  Coders save backup files in the website’s hosting folders.  Zipped files, ‘.bak’ extensions etc.  Coders often use bad extensions- like ‘.inc’- for ‘included’ configuration files.

How to discover…  Directory Listings.  Disclosure in HTML Source (Rare)  Other non-standard techniques.

Google-The same secured domain “zip”“parent directory”site:???.??

Directory Listing Enabled- All ‘internal pages’ visible

Interesting Folder:Election_asp Interesting File: Database Connection

Backup File of Election_asp: Election_asp.zip

All ASP Files…including Database Connection File

Database username and password in the database connection file

How to avoid it…  Disable Directory Listing  Don’t use the Hosting space as a storage space.  Name all ‘.inc’ files as ‘.inc.php’ or ‘.inc.asp’ files to make them inaccessible.

The Dirty Download Page  Better known as ‘Insecure Direct Object Ref.’  Paper in December 2007: osure_over_HTTP.pdf  Many white hats have contacted me regarding it.  Translated into Spanish- which is flattering and scary  Not the target audience.

The Comment… “look on the internet for such pages…”

How An Engine Works PHP Engine User’s Browser URL:/user_login.php HTML part of User_login.php Application Root Folder User_login.php Server

The site’s root folder

Internal Affairs… PHP Engine User’s Browser URL:/1.doc 1.doc Application Root Folder 1.doc Server

The Other Method… Stream the static content files through a dynamic page: 1) Filename passed as a parameter to the dynamic page- hereby called the ‘download’ page. 2) The download page looks for the file in the hosting folder 3) And upon finding it, streams it to the user’s browser.

oad_file.php?filename=1.doc

Internal Affairs 2 PHP Engine User’s Browser URL:/download_file.php? filename=1.doc 1.doc Application Root Folder Download_file.php1.doc Server

The Exploit… Change the filename parameter’s value to login_user.php:  Will it be processed by the engine before being streamed?  Not! The engine does not double-process a single request! It will simply stream the source code file ‘login_user.php’!

d_file.php?filename=user_login.php

Internal Affairs 3 PHP Engine User’s Browser URL:/download_file.php? filename=user_login.php Application Root Folder Download_file.phpUser_login.php user_login.php source code file Server

Google A URL which contains:  A Dynamic Page extension. ext:php OR ext:jsp OR ext:asp OR ext:aspx  A Static File extension in the URL (somewhere): inurl:doc OR inurl:pdf OR inurl:xls OR inurl:txt OR inurl:ppt OR inurl:htm

Pattern (contd.) Combining : inurl:doc OR inurl:pdf OR inurl:xls OR inurl:txt OR inurl:ppt ext:php OR ext:jsp OR ext:asp OR ext:aspx

Google Result Page Lots of false positives

Patterns (contd.) Search can be restricted to a site or a domain site:vulnerable123.com Finding the Dirty Download Page in Inurl:doc OR inurl:pdf OR inurl:xls OR inurl:txt OR inurl:ppt ext:php OR ext:jsp OR ext:asp OR ext:aspx site:vulnerable123.com

Voila…

Unique Case of Java Sites- Directory Listing through the download page

Recommended Resolutions  Indirectly refer internal objects.  For example, index the downloadable files, and pass index numbers instead of file names.  File Extensions Validations can be bypassed: Null Byte Injection

 Contact me: anant.kochhar[at]secureyes[dot]net