1. Copyright © 2005 - The OWASP Foundation Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License. The OWASP Foundation OWASP AppSec DC October 2005 http://www.owasp.org/ Advanced WebScarab Rogan Dawes, WebScarab project lead Senior Consultant, Deloitte South Africa rdawes@deloitte.co.za +27 82 784 9498

2. OWASP AppSec DC 2005 2 Who am I?  Day job  Senior Consultant, Deloitte South Africa, ERS  Security Assessments  Security Consulting  Night job  Self-taught Java programmer  Exodus  WebScarab

3. OWASP AppSec DC 2005 3 What is WebScarab?  A tool for anyone involved with HTTP-based applications (e.g. web applications)  Key features  Full visibility into the HTTP protocol  Also supports HTTPS (incl client certs)  Persistent audit trail can easily be reviewed  Primary uses  Security analysis  Application debugging

4. OWASP AppSec DC 2005 4 What does WebScarab do?  Allows user to view HTTP(S) conversations between browser and server  Allows user to review those conversations  Allows user to intercept and modify on the fly  Allows user to replay previous requests  Allows user to script conversations with full access to the the request and response object models  And much more!

5. OWASP AppSec DC 2005 5 Obtaining WebScarab  Hosted on Sourceforge  https://sourceforge.net/projects/owasp https://sourceforge.net/projects/owasp  Various package formats  webscarab-installer-.jar  webscarab-selfcontained-.jar  webscarab-src-.jar  Windows IE Integration library  W32WinInet.dll  JavaHelp support

6. OWASP AppSec DC 2005 6 Setting up the environment  Upstream Proxies  Internet Explorer integration - “Get IE settings”  Exclusion list uses IE format  Certificates  PKCS#12 format files  Store password and key password usually identical  Server cert loaded from the.jar  MS CAPI integration coming (IE cert store)  Settings saved in properties file  ${user.home}/WebScarab.properties

7. OWASP AppSec DC 2005 7 Useful Tools  Shared Cookies  List of cookies seen by various plugins  Maintains history of previous cookies  Can add and delete cookies  Can be used by Manual Request and Spider plugins  Transcoder  URL {en,de}code  BASE64 {en,de}code  Hashing

8. OWASP AppSec DC 2005 8 Conversation viewer  Remembers size and placement  Splitpanes allow resizing Request / Response  Different “editors” for various Content-Type  Hex  Text  Image  HTML  XML  URL Encoded  Multi-part

9. OWASP AppSec DC 2005 9 Configuring Proxy Listeners  Listens on 127.0.0.1:8008 by default  Supports multiple listeners if required  “Uses plugins” optional  Internet Explorer Integration  Primary listener hijacks IE proxy settings on startup  Reverse proxy support  For hard-coded applications  Cannot be primary!  Network simulators  Latency and bandwidth

10. OWASP AppSec DC 2005 10 Manual Request  Creating from scratch  Based on previous request via drop-down  Automatic Content-Length adjustment  Only if the header already exists  Change to the “Raw” tab to get new editors  Checks Content-Type header  “Get Cookies” updates from “Shared Cookies”  “Update CookieJar” adds to “Shared Cookies”

11. OWASP AppSec DC 2005 11 Session ID Analysis  Quickly collect a large sample of cookies  Convert String to a (BIG) number  Default Calculator – per position character set  Various calculation algorithms possible  Changing calculators requires recompilation  Table shows calculations and differences  Graph allows visual identification of patterns

12. OWASP AppSec DC 2005 12 Session ID Analysis  Based on previous request from drop-down  Manual editing if necessary (e.g. HEAD vs GET)  Choose location of Session ID, and Name  Regex describes substring to extract  Default regex is (.*)  “Test” to see what is extracted  Specify number of samples

13. OWASP AppSec DC 2005 13 Demonstration  Collecting and graphing sessionids from WebGoat

14. OWASP AppSec DC 2005 14 Scripting support  Proxy beanshell public Response fetchResponse(HTTPClient nextPlugin, Request request) throws IOException { // your request modifications here response = nextPlugin.fetchResponse(request); // your response modifications here return response; }  Tools -> Script Manager  Plugins export hooks  Framework hook  Proxy hooks

15. OWASP AppSec DC 2005 15 Scripting support continued  Scripted Plugin  Multiple language support via BSF  BeanShell (tested)  Javascript, Jython, Groovy, etc (untested)  Documentation in the source code  ScriptedObjectModel.java  Most useful methods public Request getRequest(int id) public Response fetchResponse(Request request) public ConversationID addConversation(Response response) public void submitAsyncRequest(Request request) public Response getAsyncResponse()

16. OWASP AppSec DC 2005 16 Demonstration  Brute forcing a session ID

17. OWASP AppSec DC 2005 17 New plugins  Fuzzer  Search  Compare  Web Services

18. OWASP AppSec DC 2005 18 Fuzzer  Specify the method, URL and Version  Add any additional headers  Specify the parameters  Location (Path, Fragment, Query, Cookie, Body)  Name  Type (only String)  Value (used if not fuzzing this parameter)  Priority (controls the permutation algorithm)  Fuzz Source (a named list of fuzz strings)  GO!

19. OWASP AppSec DC 2005 19 Creating fuzz sources  Description  File name and location  Internal interface also supports programmatic generation of strings (e.g. length related), but this requires some coding  Fuzzer is extremely stupid  Only stops on errors (400 or exception)  Just hit Start again if it stops

20. OWASP AppSec DC 2005 20 Demonstration  Fuzzing for SQL injection errors

21. OWASP AppSec DC 2005 21 Search plugin  How do we find interesting results then?  Search plugin performs arbitrary matches against conversations  Description  Search expression  E.g: new String(response.getContent()).matches("(?is).*(error|exception).*")  (?is) matches multi-line, case-insensitive

22. OWASP AppSec DC 2005 22 Demonstration  Finding conversations with SQL injection errors

23. OWASP AppSec DC 2005 23 Compare  Compares the body of various responses  Select a baseline to compare against  Conversation list shows the “distance” from baseline (# words)  Can be sorted on any (combination of ) columns  Select a conversation to show both bodies

24. OWASP AppSec DC 2005 24 Web Services  Identifies WSDL in conversations  Can load from a file  Parses WSDL  Parses Schema (complex types!)  Presents Services and Operations  Constructs an Object hierarchy for editing  Converts to SOAP message  Invoke!  Currently RPC/encoded only

25. Copyright © 2005 - The OWASP Foundation Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License. The OWASP Foundation OWASP AppSec DC October 2005 http://www.owasp.org/ Questions? Rogan Dawes, WebScarab project lead Senior Consultant, Deloitte South Africa rdawes@deloitte.co.za +27 82 784 9498