Copyright © The OWASP Foundation Permission is granted to copy, distribute and/or modify this document under the terms of the OWASP License. The OWASP Foundation OWASP Abusing Open HTTP Proxies Mike Zusman Intrepidus Group, Inc June 18, 2008

OWASP 2 Hi everybody!  Mike Zusman, CISSP  Past  Web Application Developer  Whale Communications/Microsoft  ADP Application Security Team  Current  Senior Intrepidus Group

OWASP Don’t mind me, I’m just sniffing your ports! 3

OWASP What am I talking about?  Open HTTP Proxies  Remote Access appliances  Plain Old Web Applications 4

OWASP Using SSL? Come on in!  SSL VPN Remote Access Portals 5

OWASP One HTTP listener, many web servers  URL Rewriting 6

OWASP The Good, the bad, and the 0wned  Microsoft Intelligent Application Gateway  347EF878763CCAEF /path/to/app/index.asp  SonicWALL SSL VPN  httprp/ 7

OWASP The Good, the bad, and the 0wned 8

OWASP The Good, the bad, and the 0wned 9

OWASP But wait, there is more...  We just showed a client-side attack  We can also attack the network and other services  How does HTTP work?  And we can attack the application/proxy itself  Think beyond HTTP 10

OWASP Scanning the Network  HTTP is sent over TCP  vul-notes.nsf/id/ vul-notes.nsf/id/  Date Public02/19/2002  Open HTTP proxies will open arbitrary TCP sockets  /fetchurl.asp?url=  Timing 11

OWASP Scanning the Network Trying: Result: 500 Duration: s Trying: Result: timed out Duration: s

OWASP Attacking the Proxy  Web Applications can act as proxies  Microsoft: WinHTTP, ServerXMLHTTP, XMLHTTP  PHP: Include(), fopen(), etc (if your bored)  Perl: request()  These Libraries can do more then fetch remote URLs  What about file:/// ?file:/// 13

OWASP SEO Web Sites (1)  Search Engine Optimize 14

OWASP SEO Web Sites (2) Great Success!  Search Engine Optimize 15

OWASP Blog Engine.NET  intranet-hacking/ intranet-hacking/  Widespread: “probably 100,000 public installs”  Local web site disclosure  /js.axd?path=  Local file disclosure  /js.axd?path=/web.config 16

OWASP HTTP Request Amplification  Attacker sends X number of requests to the proxy  The proxy sends (x)(y) number of requests to the victim  Google RSS Reader: 2 to 1 request amplification on non-existing feeds  Transloading and WebTV users 17

OWASP Open Application Proxy Chaining  Anonymization  A large number of open app proxies (HTTP GET)  Attacker -> Proxy1 -> Proxy2 -> Proxy3 … -> Victim  Auto-Exploitation: Open Proxy Worm  A large number of open app proxies (HTTP GET)  Attacker -> Proxy1 -> Proxy2 -> Proxy3 … -> ProxyN  The Proxies are the Victims 18

OWASP Open Application Proxy Chaining  Embedding URLs  om%2F%3Furl%3Dhttp%253A%252F%252Fhos t3.com%252F%253Furl%253Dhttp%25253A%2 5252F%25252Fhost3.com%25252F%25253Furl %25253Dhttp% A% F% Fhost4.com% F% Dhttp …. 19

OWASP Open Application Proxy Chaining  Embedding URLs 20

OWASP URL Length .NET 260 char?  IIS: 32K chars  How long of a URL can you have?  “In theory, there is no limit. In practice, IE imposes a limit of 2,083 bytes. Because nobody could need more than 640k. - Some Guy on the Internet 21

OWASP What about the HTTP Response?  Sometimes you see the proxied response, sometimes you don’t  What are your goals?  Timing can help (or hurt you)  Order of Execution  Confirmation  Make yourself the last hop  TCP Sequencing 22

OWASP No request propagation without exploitation!  Request Propagation  Attacker makes one request that turns into N requests  How can we exploit this?  Persistent XSS  Blind SQLi  Get code to run on a machine in the chain (or a web browser) 23

OWASP No request propagation without exploitation!  Persistent XSS   Redir--> 2F%3Furl%3D … 24

OWASP Persistent XSS Exploitation 25

OWASP Demo  Hopefully, it will work. 26

OWASP No FUD  Attack Prerequisites  App must have a URL that makes arbitrary request  The same URL must have some other code execution vulnerability: /index.asp?url=[URL]&param=[EXPLOIT]  Order of Execution: Exploit then Propagate  Leg Work  Attacker must find targets ahead of time  Mitigating Factor  URL Length Limitations 27

OWASP This is OWASP…  …so how do we fix this stuff?  Input Validation  Displaying host names in URLs is bad  Manipulation  Information Leakage  Lock down the config  Use a product that supports white lists  Don’t allow.* hosts  Firewall configuration  Does your proxy NEED to… – talk to the Internet? – talk to every host on your LAN? 28

OWASP Thanks  Questions?  Comments?  Concerns?   