Basic Web Hacking & Tools (MSS book)TopicsNetwork Utility ProgramsSlide 4Slide 5Slide 6AchillesSlide 8HTTP & History of the WWWHTTPSlide 11HTTP Request MethodsHTTP ResponseHTTP SecuritySlide 15HTTP Security ConsiderationsSlide 17Slide 18Slide 19HTTPSCh 6: Web Application ComponentsSlide 22Nextcsci5931 Web Security 1Basic Web Hacking & Tools(MSS book)csci5931 Web Security 2TopicsA. Ch. 4, 15 (Netcat, Achilles, HTTP, HTTPS)B. Ch. 5 (URLs, HTML Forms)C. Ch. 6 (Web Application Components)csci5931 Web Security 3Network Utility ProgramsNetcathttp://www.atstake.com/research/tools/network_utilities/ Cryptcathttp://sourceforge.net/projects/cryptcat/csci5931 Web Security 4Network Utility ProgramsExample Use of NetcatTo get a web page:nc sce.uhcl.edu 80GET / HTTP/1.0HTTP/1.1 200 OKServer: Microsoft-IIS/5.0Date: Wed, 26 Feb 2003 15:08:22 GMTConnection: Keep-AliveContent-Length: 10166Content-Type: text/htmlSet-Cookie: ASPSESSIONIDSASQDDAR=MECEBLAAEIKECJGFFELEBJMA; path=/Cache-control: private<html><head><title>SCE Home Page</title> …csci5931 Web Security 5Network Utility ProgramsExample Use of NetcatTo get the meta information of a web page:nc sce.uhcl.edu 80HEAD / HTTP/1.0HTTP/1.1 200 OKServer: Microsoft-IIS/5.0Date: Wed, 26 Feb 2003 15:11:33 GMTConnection: Keep-AliveContent-Length: 10166Content-Type: text/htmlSet-Cookie: ASPSESSIONIDSASQDDAR=PECEBLAAKMPGGDIHEGJOAJLJ; path=/Cache-control: privatecsci5931 Web Security 6Network Utility ProgramsOther Uses of NetcatHave Netcat listen at a particular port:(AT the listening side) nc -L -p 53 -e cmd.exe(At the remote side) nc –v hostAddress 53•Allows the administrator to see if a port is available, for example, through a firewall.csci5931 Web Security 7AchillesActs like a web proxyAllows a person to intercept and modify information sent from a web server to a web browserDownload: achilles-0-27.zipProxy configuration on the browsercsci5931 Web Security 8Achillescsci5931 Web Security 9HTTP & History of the WWW[HTTP 1991] The Original HTTP as defined in 1991 [HTTP 1992] Basic HTTP as defined in 1992[HTTP 1996] RFC1945: Hypertext Transfer Protocol -- HTTP/1.0. Informational. [HTTP 1999] RFC2616: Hypertext Transfer Protocol -- HTTP/1.1. [irt.org 1998] WWW – How It All Began. [isoc.org 2000] The Internet Society. A Brief History of the Internet. August 4, 2000.csci5931 Web Security 10HTTPAn application-level protocolLightness and speed necessary for distributed, collaborative, hypermedia information systemsA stateless protocolcan be used for many tasks, such as name servers and distributed object management systems, through extension of its request methodsIts data typing feature allows systems to be built independently of the data being transferred.csci5931 Web Security 11HTTPIts data typing feature allows systems to be built independently of the data being transferred. The Content-Type entity-header field indicates the media type of the Entity-Body sent to the recipient or, in the case of the HEAD method, the media type that would have been sent had the request been a GET. Content-Type = "Content-Type" ":" media-type Media types are defined in Section 3.6 of RFC1945.An example of the field is Content-Type: text/htmlcsci5931 Web Security 12HTTP Request MethodsGETRetrieves the information requested from the file system.HEADAlmost identical to the GET method, but only return the meta-information.POSTRequests that the server accept the enclosed information and act on it.Commonly used when server-side scripting is involved.More request methods in HTTP/1.1: Table 4-4 (pp.126-127)csci5931 Web Security 13HTTP ResponseResponse codeSee Table 4-2 (p.122)Header fieldsAdditional information about the responseTable 4-3 (p.124), 4-5 (p.128)DataThe body of the responsecsci5931 Web Security 14HTTP SecurityHTTP provides a simple challenge-response authentication mechanism which may be used by a server to challenge a client request and by a client to provide authentication information.The HTTP protocol does not restrict applications to this simple challenge-response mechanism for access authentication. Additional mechanisms may be used, such as encryption at the transport level or via message encapsulation, and with additional header fields specifying authentication information. However, these additional mechanisms are not defined by this specification.csci5931 Web Security 15HTTP SecurityThe "basic" authentication scheme is based on the model that the user agent must authenticate itself with a user-ID and a password for each realm. The server will authorize the request only if it can validate the user-ID and password for the protection space of the Request-URI. There are no optional authentication parameters. The "basic" authentication scheme is not a secure method of user authentication, nor does it prevent the Entity-Body from being transmitted in clear text across the physical network used as the carrier.csci5931 Web Security 16HTTP Security ConsiderationsThe GET and HEAD methods should never have the significance of taking an action other than retrieval. These methods should be considered “safe”. True?It is not possible to ensure that the server does not generate side-effects as a result of performing a GET request.csci5931 Web Security 17HTTP Security ConsiderationsAbuse of Server Log Information:A server is in the position to save personal data about a user's requests which may identify their reading patterns or subjects of interest. This information is clearly confidential in nature and its handling may be constrained by law in certain countries.csci5931 Web Security 18HTTP Security ConsiderationsTransfer of Sensitive Information:HTTP cannot regulate the content of the data that is transferred, nor is there any a priori method of determining the sensitivity of any particular piece of information within the context of any given request. Revealing the specific software version of the server may allow the server machine to become more vulnerable to attacks against software that is known to contain security holes. Implementors should make the Server header field a configurable option.csci5931 Web Security 19HTTP Security ConsiderationsAttacks Based On File and Path Names:Implementations of HTTP origin servers should be careful to restrict the documents returned by HTTP requests to be only those that were intended by the
View Full Document
Unlocking...