Web Hacking Attacks and Defense

by McClure, Stuart; Shah, Saumil; Shah, Shreeraj

• ISBN13: 9780201761764
• ISBN10: 0201761769
• Edition: 1st
• Format: Paperback
• Copyright: 2002-08-08
• Publisher: Addison-Wesley Professional

Summary

This Web hacking volume extends the Hacking Exposed legacy into the terrain of Web vulnerabilities and attacks. McClure and his team bring even more insight into how hackers infiltrate Web commerce systems, including database servers and payment systems.

Author Biography

Stuart McClure, President/CTO, Foundstone, Inc., brings over 12 years of IT and security experience to Foundstone. Stuart is a successful security author, speaker, and teacher whose writings have been translated into dozens of languages around the world.

Stuart is the lead author of the best-selling security book Hacking Exposed: Network Security Secrets and Solutions, which has been translated into 19 languages, and has received critical acclaim around the world. In addition, it was ranked the #4 computer book sold on Amazon in 2001, positioning it as the best selling security book ever sold.

Prior to co-founding Foundstone, Stuart was a Senior Manager with Ernst & Young's National Security Profiling Team responsible for project management, attack and penetration reviews, and security technology evaluations. Prior to Ernst & Young, Stuart was a Security Analyst for the InfoWorld Test Center where he covered the security industry and evaluated over 100 network and security products specializing in firewalls, security auditing, intrusion detection, and public key infrastructure (PKI). Prior to InfoWorld, Stuart was the IT manager for State and Local Governments, supporting Novell, NT, Solaris, AIX, and AS/400 platforms.

Stuart holds a B.A. degree from the University of Colorado, Boulder and numerous certifications including ISC2's CISSP, Novell's CNE, and Check Point's CCSE.

Saumil continues to lead the efforts in e-commerce security research at Net-Square. His focus is on researching vulnerabilities with various e-commerce and Web-based application systems. Saumil also provides information security consulting services to Net-Square clients, specializing in ethical hacking and security architecture. He holds a designation of Certified Information Systems Security Professional. Saumil has had more than eight years experience with system administration, network architecture, integrating heterogenous platforms and information security, and has perfomed numerous ethical hacking exercises for many significant companies in the IT area. Saumil is a regular speaker at security conferences such as BlackHat, RSA, etc.

Previously, Saumil was the Director of Indian Operations for Foundstone Inc, where he was instrumental in developing their Web application security assessment methodology, the Web assessment component of FoundScan--Foundstone's Managed Security Services software and was instrumental in pioneering Foundstone's Ultimate Web Hacking training class.

Prior to joining Foundstone, Saumil was a senior consultant with Ernst & Young, where he was responsible for the company's ethical hacking and security architecture solutions. Saumil has also worked at the Indian Institute of Management, Ahmedabad, as a research assistant and is currently a visiting faculty member there.

Saumil graduated from Purdue University with a master's degree in computer science and a strong research background in operating systems, networking, information security, and cryptography. At Purdue, he was a research assistant in the COAST (Computer Operations, Audit and Security Technology) laboratory. He got his undergraduate degree in computer engineering from Gujarat University, India. Saumil is also the author of The Anti-Virus Book (Tata McGraw-Hill, 1996).

Shreeraj leads the software development and research arm of Net-Square. His role is to develop new methodologies for Web application security assessment and defense. In the past, he has been involved in several Web application assessment projects, protocol analysis, code reviews, ethical Web hacking, etc. He has also been a speaker at RSA and BlackHat.

Shreeraj has vast experience in the fields of security, application development, and network administration in addition to his strong technical background, client management skills, project management, and research methodologies. He was a member of the core development team for the Web application assessment engine at Foundstone. Shreeraj also worked with Chase Manhattan Bank in their middleware application division. Prior to joining Chase, Shreeraj worked with IBM's Domino Application Server team.

Shreeraj graduated from Marist College with a master's degree in computer science. He received his MBA at the Nirma Institute of Managment, India. He got his bachelor's degree in instrumentation and controls engineering from Gujarat University, India. Shreeraj has also authored quite a few white papers during his academic period both in India and USA.

0201761769AB04252003

Table of Contents

Foreword

Introduction

We're Secure, We Have a Firewall

To Err Is Human

Writing on the Wall

Book Organization

Parts

Chapters

A Final Word

Acknowledgments

Contributor

THE E-COMMERCE PLAYGROUND

Case Study: Acme Art, Inc. Hacked!

Web Languages: The Babylon of the 21st Century. Languages of the Web

HTML

Dynamic HTML (DHTML)

XML

XHTML

Perl

PHP

ColdFusion

Active Server Pages

CGI

Java

Web and Database Servers. Web Servers

Apache

Microsoft's Internet Information Server (IIS)

Database Servers

Microsoft SQL Server

Oracle

Shopping Carts and Payment Gateways. Evolution of the Storefront

Electronic Shopping

Shopping Cart Systems

Scope and Lifetime of an Electronic Shopping Cart

Collecting, Analyzing, and Comparing Selected Components

Keeping Track of the Total Cost

Change of Mind

Processing the Purchase

Implementation of a Shopping Cart Application

Product Catalog

Session Management

Database Interfacing

Integration with the Payment Gateway

Examples of Poorly Implemented Shopping Carts

Carello Shopping Cart

DCShop Shopping Cart

Hassan Consulting's Shopping Cart

Cart32 and Several Other Shopping Carts

Processing Payments

Finalizing the Order

Method of Payment

Verification and Fraud Protection

Order Fulfillment and Receipt Generation

Overview of the Payment Processing System

Innovative Ways to Combat Credit Card Fraud

Order Confirmation Page

Payment Gateway Interface

Transaction Database Interface

Interfacing with a Payment GatewayAn Example

Payment System Implementation Issues

Integration

Temporary Information

SSL

Storing User Profiles

Vulnerabilities Caused by Poor Integration of Shopping Cart and Payment Gateway

PayPalEnabling Individuals to Accept Electronic Payments

HTTP and HTTPS: The Hacking Protocols. Protocols of the Web

HTTP

HTTPS (HTTP over SSL)

URL: The Web Hacker's Sword. URL Structure

Web Hacker Psychology

URLs and Parameter Passing

URL Encoding

Meta-Characters

Specifying Special Characters on the URL String

Meta-Characters and Input Validation

Unicode Encoding

The Acme Art, Inc. Hack

Abusing URL Encoding

Unicode Encoding and Code Red's Shell Code

Unicode Vulnerability

The Double-Decode or Superfluous Decode Vulnerability

HTML Forms

Anatomy of an HTML Form

Input Elements

Parameter Passing Via GET and POST. II. URLS UNRAVELED

Case Study: Reconnaissance Leaks Corporate Assets

Web: Under (the) Cover. The Components of a Web Application

The Front-End Web Server

The Web Application Execution Environment

The Database Server

Wiring the Components

The Native Application Processing Environment

Web Server APIs and Plug-Ins

URL Mapping and

Table of Contents provided by Publisher. All Rights Reserved.

Excerpts

"We're Secure, We Have a Firewall" If only we got a nickel every time we heard a client utter this pithy phrase. On second thought, that would unfortunate as we would probably not be writing this book; we'd be sipping Pina Colada's on some white sand beach by now... For those skeptics among you, all warm and cozy next to your firewall, just remember this: over 65% of reported attacks occur over TCP port 80, the traditional web port ( http://www.incidents.org ). Is the web threat real? It's all too real. To Err is Human After performing hundreds of security reviews over the decades, the authors have known for some time what you are about to know (if you don't already): Nothing can be truly secure. Error is at the heart of every security breach and as the saying goes: to err is human. No level of firewall, intrusion detection system (IDS), or anti-virus software will make you secure. Surprised this type of comment introduces a security book? Don't be. It is the harsh reality that must be accepted before the race to security can be started. So what should we do, just throw up our hands, turn the power off to our computers and revert back 30 years; forgetting this Internet or the modem or the computer really happened? Sure, you can do that but you would be alone in your efforts. The Internet and all it has to offer is undeniable: increased communication, increased information sharing, connecting with people of all races, creeds, colors, sexes, and intelligence without boundaries or limits. And that's just the home user's benefits. Businesses use the Internet 24 hours a day, 7 days a week, making revenue and transmitting funds around the world at the blink of an eye. Anyone who denies the ubiquity and staying power of the Internet is just kidding themselves. Writing on the Wall Over three years ago, one of the authors wrote a foreboding article that was indicative of things to come. The column printed on August 9, 1999 and was titled "Bane of e-commerce: We're secure: We allow only Web traffic through our firewall" ( http://www.infoworld.com/articles/op/xml/99/08/09/990809opsecwatch.xml ). The writing was on the security wall at that time but no one wanted to believe it, much less talk about it. They were too caught up in either hyped technologies such as Firewalls, IDS, and virtual private networks (VPN), or peripheral technologies that never hit mainstream, such as Public Key Infrastructure (PKI), Distributed Computing Environment (DCE), and single signon. So why the tremendous interest in the Web and its security now? Because hacking events are frequent in today's connected world. And people are beginning to understand how a single vulnerability in a web application can expose an entire company's jewels to an attacker (a.k.a. Code Red and Nimda worms). Book Organization This book as been organized into four sections: E-Commerce Playground URLs Unraveled How do they do it? Advanced Web Kung Fu The content in each section gets progressively more advanced in its content and delivery, going from a brief web languages introduction (Chapter 1) to finding and exploiting your own buffer overflows (Chapter 14). But don't let the pace derail your learning. If you missed something, you can probably pick it up as you go along. The first two sections are focused to give the reader a preliminary and then more intermediate introduction into the world of the web. In "E-Commerce Playground" we show you how the web works, its languages, applications, databases, protocols, and syntax. In "URLs Unraveled", we delve into the meaning of the URL, what is important to an attacker, how visible code can be helpful to an attacker, and we show you how mapping web sites can be critical to an attacker's repertoire. In the th