RSS Security Threats With Financial Services

Web 2.0 technologies are penetrating deeper into the financial services sector as Enterprise 2.0 solutions, adding value to financial services. Analysts can leverage information sources to go beyond the obvious. Trading and Banking companies like Wells Fargo and E*Trade are developing their next generation technologies using Web 2.0 components; components that will be used in banking software, trading portals and other peripheral services. The true advantage of RSS components is to push information to the end user rather than pull it from the Internet. The financial industry estimates that 95% of information exists in non-RSS formats and could become a key strategic advantage if it can be converted into RSS format. Wells Fargo has already implemented systems on the ground and these have started to yield benefits. RSS comes with its own security issues that assume critical significance with regard to financial services. In this article we will see some of the security concerns around RSS security and attack vectors.

Read here

My Bio with respect to Web Security Contribution...

Anurag is running a reflection series on his blog for web security professionals. He is compiling a list of person along with their resources. He has posted mine this week. You can read it here

Web 2.0 with Banks - Web Risk: A Growing Web's Harder To Secure

Banks are moving towards Web 2.0 frameworks and adding risk to the application layer. This news item talks about it.

Read

Ajax scanning on AjaxWorld

Ajax Scanning technique for XSS is posted at AjaxWorld magazine.
Here

Scanning Ajax for XSS Entry Points

The continuous adoption of Web 2.0 architecture for web applications is instrumental in Ajax, Web services and Flash, emerging as key components. Ajax is a combination of technologies such as JavaScript with the XMLHttpRequest object, DOM and XML streams. Cross site scripting (XSS) can make browsers vulnerable to critical information hijacking if exploited with malicious intent. XSS is already categorized as persistent, non-persistent and DOM-based. Ajax code loaded in browser can have entry points to XSS and it is the job of the security analyst to identify these entry points. It is difficult to decisively conclude that possible entry points to an application can be exploited. One may need to do a trace or debug to measure the risk of these entry points.

This paper introduces you to a quick way to identify XSS entry points in an application.

Read here

Stateful Web Application Firewalls with .NET

A Web Application Firewall (WAF), though still evolving, is crucial for strong application layer defense. Unfortunately, HTTP is a stateless protocol, and session management is addressed at the application layer and not at the protocol layer. It is possible to bridge WAF and session objects on the .NET platform to build a stateful WAF (SWAF).

Read Here

Slides to Share

I found slideshare.net an interesting place to share past talks. I have posted some of my past speaking engagements at RSA, Infosecworld, AusCERT, Bellua and HITB on it. You may like it.

Here

Ajax Fingerprinting for Web 2.0 Applications

Fingerprinting is an age old concept and one that adds great value to assessment methodologies. There are several tools available for fingerprinting operating systems (nmap), Web servers (httprint), devices, etc. Each one of these tools uses a different method – inspecting the TCP stack, ICMP responses, HTTP responses. With this evolution of Web 2.0 applications that use Ajax extensively, it is important to fingerprint Ajax tools, framework or library used by a particular web site or a page. This paper describes the method of doing Ajax fingerprinting with a simple prototype serving as an example.
Read Here

Detect Your Web Application's Vulnerabilities Early with Ruby

Web application fuzzing is a method of detecting a web application's vulnerabilities prior to deploying the application on a production system. Users of this approach send several malicious requests to the application and, based on the responses received, determine the application's security posture. Users also can apply fuzzing to perform tests on several different attack vectors such as SQL, XPATH, and LDAP injection, and error handling.

Read Here

Crawling Ajax-driven Web 2.0 Applications

Crawling web applications is one of the key phases of automated web application scanning. The objective of crawling is to collect all possible resources from the server in order to automate vulnerability detection on each of these resources. A resource that is overlooked during this discovery phase can mean a failure to detect some vulnerabilities. The introduction of Ajax throws up new challenges for the crawling engine. New ways of handling the crawling process are required as a result of these challenges. The objective of this paper is to use a practical approach to address this issue using rbNarcissus, Watir and Ruby.

Full paper

Book review - Microsoft Technet

Technet posted book review on Hacking web services
Here
--
Shreeraj Shah's Hacking Web Services (Charles River Media, 2006) is a valuable resource for those involved in development, deployment, or support of Web services. The book is a well-organized general security reference for Web services and their component technologies. And it does a good job of detailing what is involved in defending them in your infrastructure and through your development practices.

The book begins with a relatively in-depth introduction to Web services A case study titled "The Consequences of Procrastination" teaches you about the power of preemptive security procedures and the penalties of reactive systems. The chapter titled "Web Services Scanning and Enumeration" discusses how to use the wsChess, a .NET-based Web service security toolkit from Net-Square (net-square.com/wschess/index.shtml), to profile and footprint Web services.

The book includes a utility CD, which contains a sample .NET-based application called SOAPWall. This shows you how to block injection characters and buffer overflows in your .NET Web services. In addition, the CD provides demos of different types of Web service attacks.
--

XSRF attack vector with Ajax serialization

Cross-site request forgery (CSRF) is a commonly observed security issue in Web applications, and it can be exploited by an attacker or by a worm. Exploitation of this bug is very easy given there are several HTML tags and embedded JavaScript code snippets that can be leveraged by the browser to initiate a forged request without the consent or knowledge of an end user.

This request hits the vulnerable Web application like a cruise missile charged with the end user's session identity and the attacker's objective is achieved. This objective may be a request for a change of password, performing a financial transaction or sending forged email. A vulnerable Web 2.0 application can be susceptible to such an attack. With Web 2.0, another dimension is being added to this attack vector -- the blissfully unaware end user.

Read

Vulnerability Scanning Web 2.0 Client-Side Components

Web 2.0 applications are a combination of several technologies such as Asynchronous JavaScript and XML (AJAX), Flash, JavaScript Object Notation (JSON), Simple Object Access Protocol (SOAP), Representational State Transfer (REST). All these technologies, along with cross-domain information access, contribute to the complexity of the application. We are seeing a shift towards empowerment of an end-user's browser by loading libraries.

All these changes mean new scanning challenges for tools and professionals. The key learning objectives of this article are to understand the following concepts and techniques:

* Scanning complexity and challenges in new generation Web applications
* Web 2.0 client-side scanning objectives and methodology
* Web 2.0 vulnerability detection (XSS in RSS feeds)
* Cross-domain injection with JSON
* Countermeasures and defense through browser-side filtering

Read

Web 2.0 defense with Ajax fingerprinting & filtering

(IN)SECURE magazine contains my article on Ajax fingerprinting and filtering technique. It can help in defending Web 2.0 applications.

Top 10 Ajax Security Holes and Driving Factors

One of the central ingredients of Web 2.0 applications is Ajax encompassed by JavaScripts. This phase of evolution has transformed the Web into a superplatform. Not surprisingly, this transformation has also given rise to a new breed of worms and viruses such as Yamanner, Samy and Spaceflash. Portals like Google, NetFlix, Yahoo and MySpace have witnessed new vulnerabilities in the last few months. These vulnerabilities can be leveraged by attackers to perform Phishing, Cross-site Scripting (XSS) and Cross-Site Request Forgery (XSRF) exploitation.

Read

[O'reilly Net] Detecting Web Application Security Vulnerabilities

Your web application is only as secure as the data coming in, and how you treat user input determines how secure you are. A little bit of thought and Python programming can help you analyze potential vulnerabilities in your code

Read Here

How safe is Web 2.0?

Technology commentator Bill Thompson says the latest incarnation of the web, dubbed Web 2.0, is prone to the same flaws as its predecessor

[Top 10 Web 2.0 attack vectors are taken as reference]
Read story

Hacking Web 2.0 Applications with Firefox

AJAX and interactive web services form the backbone of “web 2.0” applications. This technological transformation brings about new challenges for security professionals.

This article looks at some of the methods, tools and tricks to dissect web 2.0 applications (including Ajax) and discover security holes using Firefox and its plugins. The key learning objectives of this article are to understand the:

* web 2.0 application architecture and its security concerns.
* hacking challenges such as discovering hidden calls, crawling issues, and Ajax side logic discovery.
* discovery of XHR calls with the Firebug tool.
* simulation of browser event automation with the Chickenfoot plugin.
* debugging of applications from a security standpoint, using the Firebug debugger.
* methodical approach to vulnerability detection.

Read

On slashdot you can read reviews on HNS article - Top 10 Web 2.0 Attack Vectors

Read

Top 10 Web 2.0 attack vectors

Web 2.0 is the novel term coined for new generation Web applications. start.com, Google maps, Writely and MySpace.com are a few examples. The shifting technological landscape is the driving force behind these Web 2.0 applications. On the one hand are Web services that are empowering server-side core technology components and on the other hand are AJAX and Rich Internet Application (RIA) clients that are enhancing client-end interfaces in the browser itself.

XML is making a significant impact at both presentation and transport (HTTP/HTTPS) layers. To some extent XML is replacing HTML at the presentation layer while SOAP is becoming the XML-based transport mechanism of choice.

More

Book - Hacking Web Services

Web Services are an integral part of next generation Web applications. The development and use of these services is growing at an incredible rate, and so too are the security issues surrounding them. Hacking Web Services is a practical guide for understanding Web services security and assessment methodologies. Written for intermediate-to-advanced security professionals and developers, the book provides an in-depth look at new concepts and tools used for Web services security. Beginning with a brief introduction to Web services technologies, the book discusses Web services assessment methodology, WSDL -- an XML format describing Web services as a set of endpoints operating on SOAP messages containing information -- and the need for secure coding. Various development issues and open source technologies used to secure and harden applications offering Web services are also covered. Throughout the book, detailed case studies, real-life demonstrations, and a variety of tips and techniques are used to teach developers how to write tools for Web services. If you are responsible for securing your company's Web services, this is a must read resource!

More information

Security Bugs Undercut Mozilla

New flaws leave experts wondering if Mozilla's such a great alternative to Microsoft Internet Explorer and Exchange

Read the story

Auscert 2006 - Web Services Hacking...

AusCERT Asia Pacific
Information Technology Security Conference
21st - 26th May 2006 - Royal Pines Resort - Gold Coast, Australia
More info

Dallascon - Adavanced Web Services Hacking...

Presenting paper at Dallascon in first week of May.

DallasCon Information & Wireless Security conference
May 5-6, 2006
Richardson Hotel
Details

EUSecWest talk...

It was fun to be at EUSecWest. Talks and presentations were good. Justin made good notes on it. You can read it over here.

Day 1
Day 2

Releasing wschess 1.5

Following changes are included.

+ Few bugs are solved
+ wspawn is now querying Xmethods. UBRs are closed for Microsoft, IBM etc.
+ wsknight has analysis engine in place. You can supply regex patterns and wsaudit will detect them. It will change color of text. Sample rule file is included.

Get it

Security Advisory - Microsoft ASP.NET Web Services

Unhandled exception leads to LDAP injection disclosure.
Read Here

Advanced Web Hacking - Attacks & Defense (Upcoming talk)

Abstract:

Attacks to web application layer are on the rise and innovative methodologies, attack vectors and exploits are coming into existence. To combat these threats it is imperative to understand its nature, characteristics and risk to application layer. Some of the new attack vectors are XPATH injection, LDAP poisoning and advanced SQL injection. These vectors are getting popular with XML based web applications. At the same time new methodologies for web application foot printing and discovery are coming to existence with rich search engine information provided by Google & MSN. These methodologies are important to have as a tool to web security professionals. Open source exploit framework like Metasploit can be used effectively for web application exploit development for penetration testers. This presentation will encompass new methodologies, tools and techniques on both the aspects - attacks & defense.

Hacking Web Services: Strategies, Tools, and Methods (Upcoming talk)

Date: Tuesday, 4 April 2006
Time: 3:30pm - 5pm
Track: E-Security



Objectives:
1.)Web services as a new area of attack in the Web application domain
2.)A live demo of a Web services assessment methodology
3.)Understanding the Web protocols UDDI, SOAP and WSDL - the latest means of Web services attacks
4.)Leveraging content filtering and secure coding for Web services
5.)Implementing tools and creating your own tool on the fly while performing your work on Web services, e.g. wsChess

Hacking and Securing .NET (Upcoming talk)

Date: Tuesday, 4 April 2006
Time: 8:30am - 10:45am
Track: Platform Security



Objectives:
1.)Understanding the evolution of Web application from CGI scripts to .Net apps and the security concerns along the way
2.).Net Web application hacking methodology and tools required to perform a thorough assessment.
3.).Net and IIS metabase querying and auditing for overall secure deployment of Web application on the framework
4.)HTTP stack intercept on .Net and leveraging it for application security
5.)Building your own HTTPModule and interface to perform content filtering for Web applications

MSNPawn - New tool is coded up.

MSNPawn has been designed and developed on the .Net framework and must be installed on the system. The following utilities have been bundled with MSNPawn.

MSNHostFP - Supply an IP Address or IP Address range to fetch all possible virtual hosts or application running on each IP addresses.

MSNDomainFP - Supply a domain name to fetch the top 50 child domains, considering the supplied domain name as parent.

MSNCrossDomainFP - Supply an application domain to fetch the top 50 domains pointing to this particular domain on the Internet.

MSNCrawler - Supply a domain or application name to fetch all possible links crawled by the search engine.

MSNFetch - Supply a domain and rules file. The tool will run each rule in the file against the domain specified and fetch the first five results of the resultant query. This can help in assessing an application.

Search.MSN - Provides place to run your search against MSN and gather all URLs.

Whitepaper is included for better understanding for all these tools.

[Download]

[Download paper]

Article on web application footprinting [HITB E-zine]

Any search engine database is a very powerful source of information for web applications. The Search Engine’s spiders are well-powered to run frequently on sites and capture all possible links. As an end user, however, we are more interested in the searching interface and criteria these engines provide. By using their search options, end users can craft intelligent queries against a database and fetch critical information. There are several tools out there that query the Google database and fetch this sort of security-related information about web applications.

This paper describes some of the queries that can be run against SEARCH.MSN in order to fetch important information that would eventually help in web application assessment. SEARCH.MSN provides web services APIs to build applications using their search interface.

More information can be gathered from http://search.msn.com/developer/ To be able to use SEARCH.MSN, you will require an Application ID. This can be obtained using MSN passport. Queries are limited to 10,000 a day and allow a total of 50 results for each query. This provides great flexibility to the application. As a security tool, substantial information can be queried from MSN search, making it a handy tool to have in your toolkit. For the examples outlined in this paper, some of the information is retrieved using this interface, with a sample application called wapawn.

Read Here

Assessing Web App Security with Mozilla (Oreilly)

Web application assessment is a challenging task for security analysts. Several products and tools are available, each claiming to perform automated analysis on entire applications. Their capabilities include obtaining data, corroborating it, and printing aesthetically appealing reports--all without user intervention.

The nature of web applications is very different from that of standard applications. Many times, these tools miss key vulnerabilities in the application. The best way to perform web application assessment is by using the unassailable combination of automated tools and human intellect. This article examines the LiveHTTPHeaders project, which fits seamlessly into Mozilla browser components to facilitate very effective web application assessment.

Read Here

RSA Europe 2005

Title: WEB SERVICES SECURITY CHESS:STRATEGIES FOR COMBAT AND SHIELDS FOR DEFENSE

Abstract:

Attack is the best way to know your defense. Knowledge of attack methodology, tools and defense strategies are most critical before creating shield for your ultimate defense. This presentation encompasses all three dimensions (Methodology, Tools and Strategies) with innovative researched approach and live demonstrations. UDDI, SOAP and WSDL are pawn, knight and queen of this new chess board.

Objectives:

1.Imparting web services assessment methodology and demonstrate approach with live application. 2.Leveraging tools and creating your own tool on the fly while performing your work on web services. 3.Build ultimate defense for your web services by leveraging content filtering and secure coding for web services.

OSCON Europe 2005

Open Source Web Application Security Kung-Fu & Art of Defense

Web application attacks are growing at rapid rate in last five years. Many innovative ways of breaking systems have come into existence. Web applications are even more vulnerable since they cannot be protected by firewalls and become easy prey for attackers. Next generation web application attacks have arrived and are here to stay. These attacks are targeted towards vulnerable and poorly written web applications.

Read Here

Papers appeared on packetstorm...

Paper on browser identification.
Read Here

Paper on domain footprinting.
Read Here

Advisory on ASP.NET
Read Here

Presenting paper at HackInTheBox 05

Title: Web hacking Kung-Fu and Art of Defense
Abstract:
Web attacks are on the rise and new methods of hacking are evolving. This presentation will cover new methodologies for web application footprinting, discovery and information gathering with a new range of tools.

Web applications are getting exploited using various new injection techniques like advanced SQL injection, LDAP query, XPATH goofing etc. All these new exploit methods will be discussed. The HTTP stack is changing in application frameworks like .NET. The stack can be utilized for defense using HTTP interfaces. Defense methodology for web applications are required to combat new threats emerging in the field.

This will be a deep-knowledge presentation that will be full of live demos, examples and new tools!

Presenting paper at Syscan05

Title: .Net web security – Attacks and Defense
Abstract:
Web security is becoming very critical as .Net framework is evolving. New set of vulnerabilities are coming up at web application level. Web Services are also becoming integral part of web application and creating next generation threat for emerging web application layer. There are new set of methodology is required to attack .Net applications and to provide defense new strategies are evolving. This presentation will brief about both attacks and defense with new set of tools.

wschess 1.4 released

Some bugs are rectified in this build. These bugs were in following areas
1. wsKnight - SOAP action tag in header and host
2. wsPawn - Parsing error
3. Domain footprinting is removed from wspawn and planning to build a seperate tool.

Thanks for reporting bugs. Few more stuff to be added in next build.

Browser identification on HNS

Paper on browser identification is featured on HNS.

Read Here

Browser Identification

Paper on browser identification is posted on infosecwriters. Several approaches are defined in this paper.

Read Here

[Oreilly] Protect your applications without recoding them

Article on Onlamp.

Web services are increasingly becoming an integral part of next-generation web applications. They're also vulnerable to attacks. The nature of these attacks is the same as for traditional web applications, but the modus operandi is different. These attacks can lead to information leakage; further, they aid in remote command execution. By using WSDL, an attacker can determine an access point and available interfaces for web services. These interfaces or methods take inputs using SOAP over HTTP/HTTPS. Without good defense at the source code level, your application is in danger of compromise and exploitation. mod_security operates as an Apache web server module, ideal for defending web services against attacks that also include malicious POST data containing SOAP envelopes.

Go to Onlamp

wschess 1.3 released

wsKnight is updated with 4 new audit/attack vectors. This will help in auditing or testing web services.

1. Bruteforcing - One can specify user/pass fields and map it to files. This will launch bruteforcing combinations on the wire.
2. Buffer overflow - Specify parameter and buffer size.
3. LDAP and XPath injection - This is very simple just a different category.

[Download]
Stay tune more to go.

Cheers!

Advisory on securitytracker

Recent finding on ASP.NET is posted on security tracker.
Read Here

Domain Footprinting Paper

Featured on HNS and also posted on infosecwriters. The methodology discussed in the paper is implemented in wschess toolkit.
Read Here

OR
Read Here


wschess you can down load from here
Download

ASP.NET web services advisory

Microsoft ASP.NET Web Services.
Unhandled exception leads to file system disclosure and SQL injection.
Read Here

wschess beta 1.2 release

Changes are as follows

1. Doamin footprinting is added to wspawn. Methodlogy is discussed in paper [Read]
2. wspawn threading is much more controlled now with option to stop.
3. wspawn's command line is also posted which can run under linux with mono.


Planning to add few more audit/attack modules for xpath,xss,ldap etc in wsknight in next release.

wschess beta 1.1 release

New version of wschess beta 1.1 is posted.
[download] [blog]

Paper appeared on HNS (IHTTPModule for .Net)

Web Application Defense At The Gates – Leveraging IHttpModule
It is featured on HNS.
Read Here

HITB 2005 - Bahrain

HITB at Bahrain. You can find detail on my talk here.
Read Here | See Photos

Bellua Archive

Anthony just posted all presentations of Bellua 2005, Jakarta. I had my talk on Web Application Kung-Fu. You can find all material here.
Go

wsChess 1.0 (beta/prototype) - Web Services Assessment and Defense toolkit

A set of tools written C# for the .Net platform. This is a prototype, released as beta with limited support at this point. It has the following tools:

wsPawn - Web services footprinting, discovery and search tools. If you are looking for registered web services and their access points, this tool will help you in retrieving information from public UDDI.

wsKnight - Web services profiling, proxy and audit tool. This tool helps in profiling web services from its WSDL. It also allows you to invoke methods and intercept them before they go on the wire to the target, so that you can manipulate the SOAP envelope if needed. The autoaudit feature allows you to inject characters and attack strings for assessment work.

wsRook - This is a very simple technology demonstration for developers. This is a regular expression-based defense for web services input content. This is a hook in HTTP pipe using the HttpModule interface.

Whitepapers are included for better understanding for all these tools.

Read & Download

HITB videos

Dhillon has just posted HITB videos on his site for HITB2004.
Go

Web Services: Enumeration and Profiling (Whitepaper)

Web services assessment can begin with a corporate name or some other such bit of information. This simple hint offers a wealth of information that needs to be unearthed. Focus first on locating single or multiple access points for a particular corporate. The methodology, which includes web services footprinting, discovery and search, is described in another paper (http://packetstormsecurity.org/papers/web/Defense_using_mod_security.pdf). Once an access point for a web service is uncovered, the next obvious step is to extract information from it.

Web services are deployed to invoke remote calls over HTTP/HTTPS. To make calls such as these, requires that information about the calls be shared with the end client. In the past, during the days of CORBA, developers used to share IDL (Interface Definition Language) files providing the required information over the network. Now, in the days of web services this has changed to WSDL (Web Services Definition Language). WSDL is a major source for information and can help in the enumeration process. We shall go over the enumeration process in subsequent sections.
Read Here

Web application defense at the gates – Leveraging IHttpModule (Whitepaper)

Web applications are vulnerable to many attacks, mainly due to poor input validation at the source code level. Firewalls can block access to ports but once a web application goes live and TCP ports 80 and 443 are accessible, the web application can be an easy prey for attackers. HTTP traffic is legitimate traffic for web applications; all the more reason to include application-level content-filtering over unencrypted and encrypted communication channels. Application-level content filtering is possible to some extent but may not work over HTTPS (port 443). The only way to provide a strong defense is by applying powerful content-filtering at the application-level for both TCP port 80 and TCP port 443.

The .Net framework with ASP.NET provides the IHttpModule interface access to HTTP pipes - the lowest of programming layers - before an incoming HTTP request hits the web application. This can provide defense at the gates. In this paper, we look at how one can build this sort of defense in all three aspects - coding, deployment and configuration.
Read Here

Web Application Footprints and Discovery

Serious challenges arise when doing web application assessments on web servers that host multiple virtual hosts and all this with zero knowledge about the number of web applications mapped to a single IP address. Using the manual techniques outlined in the paper, the methodology pinpoints specific ways to discover applications and enhance web application assessment with tangible results.
Read Here

Defending Web Services using Mod Security (Apache) Methodology and Filtering Techniques (Whitepaper)

Web services are vulnerable to several attacks. These attacks can lead to information leakage and further aid in remote command execution. By using WSDL an attacker can determine an access point and available interfaces for web services. These interfaces or methods take inputs using SOAP over HTTP/HTTPS. If these inputs are not defended well at the source code level, they can be compromised and exploited. ModSecurity operates as an Apache Web server module, ideal for defending web services against attacks that also include malicious /POST variable/content. This paper describes techniques to defend your web services layer using mod_security.
Infosecwriters(Read Here)

Some interesting resources on same topic.
Read Here

Web Services – Attacks and Defense (Whitepaper)

Web Services is growing at a rapid rate and bringing into focus, new security issues in the web security landscape. How do we start assessing web services deployed at any corporate location? That is the fundamental question and once again it all starts with information gathering. UDDI, WSDL and SOAP are three cornerstones of this technology and they can be powerful tools for information gathering. Universal Business Registry (UBR) can help in footprinting using UDDI. UBR and technology fingerprinting can be used to perform discovery of web services. The scope in this paper is limited to only the first phase, namely the Web Services Information Gathering Phase. The entire methodology for web services information gathering is covered in this paper. The next two phases of the Assessment methodology are enumeration and defining attack vectors, both extensive topics too. These will be taken up in later papers.
Infosecwriters (Read Here)

HITB 2004 - Slides

HITB (Hack In The Box) 2004 Presentation by shreeraj Shah: "Web Services - Attacks and Defense Strategies, Methods and Tools". The web service is the new security Lego Land. The main building blocks are UDDI, SOAP and WSDL. This presentation will briefly touch upon each of these aspects.

Read Here