Copyright Security-Assessment.com 2004 Security-Assessment.com Advances in Web Application Hacking by Nick von Dadelszen

Copyright Security-Assessment.com 2004 Security-Assessment.com Existing Web App Issues Cross-site Scripting SQL Injection Parameter Manipulation Session Management

Copyright Security-Assessment.com 2004 Security-Assessment.com New Ways To Exploit Existing Issues Most issues are still occurring due to incorrect INPUT VALIDATION! Even the vendors are not immune

Copyright Security-Assessment.com 2004 Security-Assessment.com Null Byte Upload 1 ASP has trouble handling Null bytes when using FileScripting Object Take the following HTML code: Your Picture:

Copyright Security-Assessment.com 2004 Security-Assessment.com Null Byte Upload 2 Form posts to the following ASP code: Public Sub Save(Path) Set objFSO = Server.CreateObject("Scripting.FileSystemObject") Set objFSOFile = objFSO.CreateTextFile(objFSO.BuildPath(Path, tFile + ".bmp")) ‘ Write the file contents objFSOFile.Close End Sub

Copyright Security-Assessment.com 2004 Security-Assessment.com Null Byte Upload 3 If the POSTED filename contains a NULL byte, the FileSystem object only uses the information up to the NULL byte to create the file nc.exe test.bmp creates nc.exe in file system Must use Proxy to change filename WebProxy Handles Hex natively

Copyright Security-Assessment.com 2004 Security-Assessment.com

Copyright Security-Assessment.com 2004 Security-Assessment.com.Net XSS Filtering Bypass 1 ASP.Net 1.1 contains request Validation Built-in validators allow out-of-the-box protection for XSS and SQL injection Unfortunately has an implementation flaw allowing bypass of the filters Validator bans all strings in the form of <letter Close tags are allowed

Copyright Security-Assessment.com 2004 Security-Assessment.com.Net XSS Filtering Bypass 2 Bypass performed by adding a NULL byte between the < and the letter foo.bar/test.asp?term= alert('Vulnerable') Validator no longer sees this as an invalid tag and allows it through Browsers disregard NULL bytes when parsing so HTML code is still run

Copyright Security-Assessment.com 2004 Security-Assessment.com.Net Authentication Bypass 1 ASP.Net provides built-in Forms-based authentication Web.config tells server which files and folders to require authentication The following in web.config protects the /secure directory

Copyright Security-Assessment.com 2004 Security-Assessment.com.Net Authentication Bypass 2 Request to the following page redirects to a login page – Using Mozilla the following request will provide the page unauthenticated – Using IE the following request will also provide the page unauthenticated –