Dallascon - Adavanced Web Services Hacking...

Presenting paper at Dallascon in first week of May.

DallasCon Information & Wireless Security conference
May 5-6, 2006
Richardson Hotel
Details

EUSecWest talk...

It was fun to be at EUSecWest. Talks and presentations were good. Justin made good notes on it. You can read it over here.

Day 1
Day 2

Releasing wschess 1.5

Following changes are included.

+ Few bugs are solved
+ wspawn is now querying Xmethods. UBRs are closed for Microsoft, IBM etc.
+ wsknight has analysis engine in place. You can supply regex patterns and wsaudit will detect them. It will change color of text. Sample rule file is included.

Get it

Security Advisory - Microsoft ASP.NET Web Services

Unhandled exception leads to LDAP injection disclosure.
Read Here

Advanced Web Hacking - Attacks & Defense (Upcoming talk)

Abstract:

Attacks to web application layer are on the rise and innovative methodologies, attack vectors and exploits are coming into existence. To combat these threats it is imperative to understand its nature, characteristics and risk to application layer. Some of the new attack vectors are XPATH injection, LDAP poisoning and advanced SQL injection. These vectors are getting popular with XML based web applications. At the same time new methodologies for web application foot printing and discovery are coming to existence with rich search engine information provided by Google & MSN. These methodologies are important to have as a tool to web security professionals. Open source exploit framework like Metasploit can be used effectively for web application exploit development for penetration testers. This presentation will encompass new methodologies, tools and techniques on both the aspects - attacks & defense.

Hacking Web Services: Strategies, Tools, and Methods (Upcoming talk)

Date: Tuesday, 4 April 2006
Time: 3:30pm - 5pm
Track: E-Security



Objectives:
1.)Web services as a new area of attack in the Web application domain
2.)A live demo of a Web services assessment methodology
3.)Understanding the Web protocols UDDI, SOAP and WSDL - the latest means of Web services attacks
4.)Leveraging content filtering and secure coding for Web services
5.)Implementing tools and creating your own tool on the fly while performing your work on Web services, e.g. wsChess

Hacking and Securing .NET (Upcoming talk)

Date: Tuesday, 4 April 2006
Time: 8:30am - 10:45am
Track: Platform Security



Objectives:
1.)Understanding the evolution of Web application from CGI scripts to .Net apps and the security concerns along the way
2.).Net Web application hacking methodology and tools required to perform a thorough assessment.
3.).Net and IIS metabase querying and auditing for overall secure deployment of Web application on the framework
4.)HTTP stack intercept on .Net and leveraging it for application security
5.)Building your own HTTPModule and interface to perform content filtering for Web applications

MSNPawn - New tool is coded up.

MSNPawn has been designed and developed on the .Net framework and must be installed on the system. The following utilities have been bundled with MSNPawn.

MSNHostFP - Supply an IP Address or IP Address range to fetch all possible virtual hosts or application running on each IP addresses.

MSNDomainFP - Supply a domain name to fetch the top 50 child domains, considering the supplied domain name as parent.

MSNCrossDomainFP - Supply an application domain to fetch the top 50 domains pointing to this particular domain on the Internet.

MSNCrawler - Supply a domain or application name to fetch all possible links crawled by the search engine.

MSNFetch - Supply a domain and rules file. The tool will run each rule in the file against the domain specified and fetch the first five results of the resultant query. This can help in assessing an application.

Search.MSN - Provides place to run your search against MSN and gather all URLs.

Whitepaper is included for better understanding for all these tools.

[Download]

[Download paper]

Article on web application footprinting [HITB E-zine]

Any search engine database is a very powerful source of information for web applications. The Search Engine’s spiders are well-powered to run frequently on sites and capture all possible links. As an end user, however, we are more interested in the searching interface and criteria these engines provide. By using their search options, end users can craft intelligent queries against a database and fetch critical information. There are several tools out there that query the Google database and fetch this sort of security-related information about web applications.

This paper describes some of the queries that can be run against SEARCH.MSN in order to fetch important information that would eventually help in web application assessment. SEARCH.MSN provides web services APIs to build applications using their search interface.

More information can be gathered from http://search.msn.com/developer/ To be able to use SEARCH.MSN, you will require an Application ID. This can be obtained using MSN passport. Queries are limited to 10,000 a day and allow a total of 50 results for each query. This provides great flexibility to the application. As a security tool, substantial information can be queried from MSN search, making it a handy tool to have in your toolkit. For the examples outlined in this paper, some of the information is retrieved using this interface, with a sample application called wapawn.

Read Here

Assessing Web App Security with Mozilla (Oreilly)

Web application assessment is a challenging task for security analysts. Several products and tools are available, each claiming to perform automated analysis on entire applications. Their capabilities include obtaining data, corroborating it, and printing aesthetically appealing reports--all without user intervention.

The nature of web applications is very different from that of standard applications. Many times, these tools miss key vulnerabilities in the application. The best way to perform web application assessment is by using the unassailable combination of automated tools and human intellect. This article examines the LiveHTTPHeaders project, which fits seamlessly into Mozilla browser components to facilitate very effective web application assessment.

Read Here

RSA Europe 2005

Title: WEB SERVICES SECURITY CHESS:STRATEGIES FOR COMBAT AND SHIELDS FOR DEFENSE

Abstract:

Attack is the best way to know your defense. Knowledge of attack methodology, tools and defense strategies are most critical before creating shield for your ultimate defense. This presentation encompasses all three dimensions (Methodology, Tools and Strategies) with innovative researched approach and live demonstrations. UDDI, SOAP and WSDL are pawn, knight and queen of this new chess board.

Objectives:

1.Imparting web services assessment methodology and demonstrate approach with live application. 2.Leveraging tools and creating your own tool on the fly while performing your work on web services. 3.Build ultimate defense for your web services by leveraging content filtering and secure coding for web services.

OSCON Europe 2005

Open Source Web Application Security Kung-Fu & Art of Defense

Web application attacks are growing at rapid rate in last five years. Many innovative ways of breaking systems have come into existence. Web applications are even more vulnerable since they cannot be protected by firewalls and become easy prey for attackers. Next generation web application attacks have arrived and are here to stay. These attacks are targeted towards vulnerable and poorly written web applications.

Read Here

Papers appeared on packetstorm...

Paper on browser identification.
Read Here

Paper on domain footprinting.
Read Here

Advisory on ASP.NET
Read Here

Presenting paper at HackInTheBox 05

Title: Web hacking Kung-Fu and Art of Defense
Abstract:
Web attacks are on the rise and new methods of hacking are evolving. This presentation will cover new methodologies for web application footprinting, discovery and information gathering with a new range of tools.

Web applications are getting exploited using various new injection techniques like advanced SQL injection, LDAP query, XPATH goofing etc. All these new exploit methods will be discussed. The HTTP stack is changing in application frameworks like .NET. The stack can be utilized for defense using HTTP interfaces. Defense methodology for web applications are required to combat new threats emerging in the field.

This will be a deep-knowledge presentation that will be full of live demos, examples and new tools!

Presenting paper at Syscan05

Title: .Net web security – Attacks and Defense
Abstract:
Web security is becoming very critical as .Net framework is evolving. New set of vulnerabilities are coming up at web application level. Web Services are also becoming integral part of web application and creating next generation threat for emerging web application layer. There are new set of methodology is required to attack .Net applications and to provide defense new strategies are evolving. This presentation will brief about both attacks and defense with new set of tools.

wschess 1.4 released

Some bugs are rectified in this build. These bugs were in following areas
1. wsKnight - SOAP action tag in header and host
2. wsPawn - Parsing error
3. Domain footprinting is removed from wspawn and planning to build a seperate tool.

Thanks for reporting bugs. Few more stuff to be added in next build.

Browser identification on HNS

Paper on browser identification is featured on HNS.

Read Here

Browser Identification

Paper on browser identification is posted on infosecwriters. Several approaches are defined in this paper.

Read Here

[Oreilly] Protect your applications without recoding them

Article on Onlamp.

Web services are increasingly becoming an integral part of next-generation web applications. They're also vulnerable to attacks. The nature of these attacks is the same as for traditional web applications, but the modus operandi is different. These attacks can lead to information leakage; further, they aid in remote command execution. By using WSDL, an attacker can determine an access point and available interfaces for web services. These interfaces or methods take inputs using SOAP over HTTP/HTTPS. Without good defense at the source code level, your application is in danger of compromise and exploitation. mod_security operates as an Apache web server module, ideal for defending web services against attacks that also include malicious POST data containing SOAP envelopes.

Go to Onlamp

wschess 1.3 released

wsKnight is updated with 4 new audit/attack vectors. This will help in auditing or testing web services.

1. Bruteforcing - One can specify user/pass fields and map it to files. This will launch bruteforcing combinations on the wire.
2. Buffer overflow - Specify parameter and buffer size.
3. LDAP and XPath injection - This is very simple just a different category.

[Download]
Stay tune more to go.

Cheers!