java.sun.com/javaone/sf | 2004 JavaOne SM Conference | Session How to Attack Java™ 2 Platform, Enterprise Edition (J2EE) Applications Jeff Williams CEO, Aspect SecurityChair, OWASP Foundation

| 2004 JavaOne SM Conference | Session Goal of Your Talk Learn how hackers attempt to trick your code into doing bad things for them. Bulletproof Code

| 2004 JavaOne SM Conference | Session Warning Using these techniques without permission is illegal. Knowledge is Power By viewing this Birds of a Feather session (hereinafter “The Session”), I agree to refrain from the use of the techniques presented herein without first obtaining documented permission. I further agree to hold the presenter (hereinafter “Jeff”) harmless for any and all damage that may or may not result from the use of the knowledge in The Session. Any further use of the material presented in The Session is subject to all local laws and customs, and may be…

| 2004 JavaOne SM Conference | Session Agenda Network Security Is Irrelevant A Tool for Attacking Testing J2EE Apps Cross Site Scripting SQL Injection Session Hijacking Denial of Service Attacks Breaking Access Control Error Handling and Logging Weak Cryptography Malicious Code

| 2004 JavaOne SM Conference | Session Hackers Trick Your Code Network protection means nothing to application attackers Firewall Hardened OS Web Server App Server Firewall Databases Legacy Systems Web Services Directories Human Resrcs Billing Custom Developed Application Code APPLICATION ATTACK Network Layer Application Layer

| 2004 JavaOne SM Conference | Session Inside an HTTP Request Attackers Can Manipulate Anything! POST HTTP/1.0 Referer: Accept-Language: en-us Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 6.0) Host: id.boa.com Content-Length: 135 Cache-Control: no-cache Cookie: BOA_Cookie=6EC CAFE337:*****1234; SERVERID= _12582_1; state=MD reason=&Access_ID=jeff&Current_Passcode=java&acct=& pswd=&from=homepage&Customer_Type=MODEL&id=*******& rembme=Y&pc=*******&state=VA All HTML form elements become strings in the clear!

| 2004 JavaOne SM Conference | Session WebScarab from OWASP (

| 2004 JavaOne SM Conference | Session Cross Site Scripting Hacker tricks user into sending request containing script in search parameter. alert(document.cookie) Site reflects the script back to user where it executes and sends the session cookie to the hacker.

| 2004 JavaOne SM Conference | Session Example: Hello Trouble! public class HelloTrouble extends HttpServlet { public void doGet( … ) { response.setContentType("text/html"); PrintWriter out = response.getWriter(); out.println(" "); out.println(" Hello Trouble! "); out.println(" "); out.println("Hello, " + request.getParameter("name")); out.println(" "); } Every example program out there… XSS can be used to hijack sessions or modify how web pages appear

| 2004 JavaOne SM Conference | Session SQL Injection Hacker sends SQL commands into a form field. Site executes modified SQL query and returns results to hacker. 101’ or ‘1’=‘1

| 2004 JavaOne SM Conference | Session Example: Query Disaster Class.forName("org.gjt.mm.mysql.Driver"); connection = DriverManager.getConnection( "jdbc:mysql:// /test? user=dba&password=java"); … String = req.getParameter( " " ); String company = req.getParameter( "Company" ); Statement statement = connection.createStatement(); statement.execute( "INSERT INTO guestbook ( , company ) values ( '" + + "', '" + company + ");" ); statement.close(); … Please use PreparedStatement… Queries can be changed to disclose, modify, corrupt, or delete data Class.forName("org.gjt.mm.mysql.Driver"); String user = p.getEncryptedProperty(“dbuser”); String pass = p.getEncryptedProperty(“dbpass”); connection = DriverManager.getConnection( "jdbc:mysql:// /test? user=“+dbuser+”&password=“+ dbpass); … String = req.getParameter( " " ); String company = req.getParameter( "Company" ); Statement stmt = connection.prepareStatement( "INSERT INTO guestbook ( , company ) values ( ?, ? );" ); stmt.setString( 1, ); stmt.setString( 2, company ); stmt.executeQuery(); stmt.close();

| 2004 JavaOne SM Conference | Session Example: Command Injection public void doGet(…) { Runtime runtime = Runtime.getRuntime(); Process process = null; String user = request.getParameter("user"); try { process = runtime.exec( "finger " + user ); out.println( "Hello, " + user ); // print output from process to out } catch (Exception e) { out.println("Problem with finger: " + ServletUtils.getStackTraceAsString(e)); } Are You Running Your Web App as Root?

| 2004 JavaOne SM Conference | Session Never Trust an HttpServletRequest Trace the “taint” from all calls used to get input ─HttpServletRequest.getParameter() ─HttpServletRequest.getCookies() ─HttpServletRequest.getHeader() ─Etc… Bad patterns ─Input -> Output == Cross-Site Scripting (XSS) ─Input -> Query == SQL Injection ─Input -> System == Command Injection The HttpServletRequest API does not do ANY validation! Client-side validation is irrelevant

| 2004 JavaOne SM Conference | Session Example: Faulty Struts! public class DamagedStrutsForm extends ActionForm { public void doForm( HttpServletRequest request) { UserBean u = session.getUserBean(); u.setName(request.getParameter("name")); u.setFavoriteColor(request.getParameter("color")); } public boolean validate( HttpServletRequest request) { try { String param = request.getParameter("Name"); if ( param.indexOf("<script") != -1 ) { logger.log("Script detected" ); return false; } } catch( Exception e ) {} return true; } Validation ain’t so simple

| 2004 JavaOne SM Conference | Session It’s All Jon Postel’s Fault “TCP implementations will follow a general principle of robustness: be conservative in what you do, be liberal in what you accept from others.” -- Jon Postel, RFC 793, Sept. 1981

| 2004 JavaOne SM Conference | Session “Boundary Validation” Validate at reasonable system boundaries ─Between client and business logic ─Between business logic and database ─Between application and major libraries ─Between major subsystems within an application Do not rely on “Sender Validates” ─Modified Postel’s Law… ─“…be liberal in what you accept from others, then validate the hell out of it.”

| 2004 JavaOne SM Conference | Session Nikto ( > nikto.pl -h localhost -p 80 -c -verbose - Scan is dependent on "Server" string which can be faked, use -g to override + Server: Apache Coyote/ server checks loaded for GET: /servlet/org.apache.catalina.ContainerServlet/ alert(‘!') for GET: /test/jsp/declaration/IntegerOverflow.jsp for GET: /%22%3cscript%3ealert(%22xss%22)%3c/script%3e for GET: /..%255c..%255c..%255c..%255c..%255c../winnt/repair/sam + /admin/ Redirects to ' for GET: /../../../../../../../../../../etc/passwd for GET: /jsp/jspsamp/jspexamples/viewsource.jsp?source=../../../../../etc/passwd for GET: /servlet/allaire.jrun.ssi.SSIFilter for GET: /servlet/com.unify.servletexec.UploadServlet for GET: /servlet/ContentServer?pagename= alert('Vulnerable') + Got Cookie on file '/‘ value 'JSESSIONID=8CA5A9BF9E09B7EDF907944C C; Path=/admin'

| 2004 JavaOne SM Conference | Session Session Hijacking Protect like other credentials ─Don’t send in the clear (use SSL) ─Prevent cross site scripting Use your environment’s JSESSIONID ─Don’t craft your own ─Don’t use multiple cookies Regenerate session identifier upon login Don’t put in session identifier in URL ─They end up in bookmarks and referers A session is just as good as a username/password

| 2004 JavaOne SM Conference | Session Denial of Service Attacks Flooding attacks ─Easy for attackers ─Don’t commit resources until necessary ─Implement quotas and delays where possible Lockout attacks ─Be careful with “5 tries” policies How much can your application take?

| 2004 JavaOne SM Conference | Session Breaking Access Control Testing approach ─Walk the site as admin, then logout ─Force browse to admin links as ordinary user ─Also attempt to access other user resources ─Don’t assume hackers can’t figure it out Identifiers ─Many sites use a global identifier (…?cart=10234) ─Attackers will brute force if they have to ─Use indirection with a user-specific identifier Restricting users to authorized stuff only… The lack of a link is is not a security mechanism.

| 2004 JavaOne SM Conference | Session Error Handling and Logging Attackers rely on error messages ─Never printStackTrace() to the user ─Don’t provide too much information ─Catch all Exceptions and handle them appropriately ─Be sure your mechanisms “fail closed” Log message and error message are different ─Don’t send unvalidated input back to user ─Don’t send unvalidated input to the log

| 2004 JavaOne SM Conference | Session Weak Cryptography Keep sensitive information to a minimum ─1. Just don’t store it, users can re-enter ─2. Hash if you need to VERIFY sensitive information ─3. Encrypt if you must STORE sensitive information Use the JCE carefully ─Don’t write your own crypto ─Protect your secrets ─Plan for changing keys ─Keep it simple ─Never store plaintext passwords

| 2004 JavaOne SM Conference | Session Malicious Code Trojan Horse runs for admin if ( System.getCurrentUser().getName().equals( “admin” ) ) Runtime.exec( “sendmail < /etc/passwd” ); Secret trigger removes all files on root partition if( req.getParameter( “codeword” ).equals( “eagle” ) ) Runtime.exec( “rm –rf /” ); Randomly corrupt data one time in 100 if ( Math.random() <.01 ) bean.setValue( “corrupt” ); Load and execute code from remote server ((A)(ClassLoader.getSystemClassLoader().defineClass (null, readBytesFromNetwork(),0,422).newInstance())).attack(); Make backdoor look like inadvertent mistake if ( input < 0 ) throw new RuntimeException( “Input error” ); Are you running with a SecurityManager enabled? Who Wrote Those Libraries?

| 2004 JavaOne SM Conference | Session WebGoat from OWASP (

| 2004 JavaOne SM Conference | Session Summary Never assume your code can’t be attacked To stop a hacker, think like a hacker Never trust an HttpServletRequest Don’t trust libraries (run a SecurityManager) Precompile JSPs Check your code!

| 2004 JavaOne SM Conference | Session For More Information The Open Web Application Security Project (OWASP) tools and guidelines ─ The OWASP Top Ten Most Critical Web Application Security Vulnerabilities ─ Sverre Huseby, “Innocent Code” ─A security wake-up call for web programmers

| 2004 JavaOne SM Conference | Session Q&A Any questions about web application security, Java or J2EE security, or OWASP? 27

java.sun.com/javaone/sf | 2004 JavaOne SM Conference | Session Jeff Williams CEO, Aspect SecurityChair, OWASP Foundation How to Attack Java™ 2 Platform, Enterprise Edition (J2EE) Applications