Advisory on securitytracker

Recent finding on ASP.NET is posted on security tracker.
Read Here

Domain Footprinting Paper

Featured on HNS and also posted on infosecwriters. The methodology discussed in the paper is implemented in wschess toolkit.
Read Here

OR
Read Here


wschess you can down load from here
Download

ASP.NET web services advisory

Microsoft ASP.NET Web Services.
Unhandled exception leads to file system disclosure and SQL injection.
Read Here

wschess beta 1.2 release

Changes are as follows

1. Doamin footprinting is added to wspawn. Methodlogy is discussed in paper [Read]
2. wspawn threading is much more controlled now with option to stop.
3. wspawn's command line is also posted which can run under linux with mono.


Planning to add few more audit/attack modules for xpath,xss,ldap etc in wsknight in next release.

wschess beta 1.1 release

New version of wschess beta 1.1 is posted.
[download] [blog]

Paper appeared on HNS (IHTTPModule for .Net)

Web Application Defense At The Gates – Leveraging IHttpModule
It is featured on HNS.
Read Here

HITB 2005 - Bahrain

HITB at Bahrain. You can find detail on my talk here.
Read Here | See Photos

Bellua Archive

Anthony just posted all presentations of Bellua 2005, Jakarta. I had my talk on Web Application Kung-Fu. You can find all material here.
Go

wsChess 1.0 (beta/prototype) - Web Services Assessment and Defense toolkit

A set of tools written C# for the .Net platform. This is a prototype, released as beta with limited support at this point. It has the following tools:

wsPawn - Web services footprinting, discovery and search tools. If you are looking for registered web services and their access points, this tool will help you in retrieving information from public UDDI.

wsKnight - Web services profiling, proxy and audit tool. This tool helps in profiling web services from its WSDL. It also allows you to invoke methods and intercept them before they go on the wire to the target, so that you can manipulate the SOAP envelope if needed. The autoaudit feature allows you to inject characters and attack strings for assessment work.

wsRook - This is a very simple technology demonstration for developers. This is a regular expression-based defense for web services input content. This is a hook in HTTP pipe using the HttpModule interface.

Whitepapers are included for better understanding for all these tools.

Read & Download

HITB videos

Dhillon has just posted HITB videos on his site for HITB2004.
Go

Web Services: Enumeration and Profiling (Whitepaper)

Web services assessment can begin with a corporate name or some other such bit of information. This simple hint offers a wealth of information that needs to be unearthed. Focus first on locating single or multiple access points for a particular corporate. The methodology, which includes web services footprinting, discovery and search, is described in another paper (http://packetstormsecurity.org/papers/web/Defense_using_mod_security.pdf). Once an access point for a web service is uncovered, the next obvious step is to extract information from it.

Web services are deployed to invoke remote calls over HTTP/HTTPS. To make calls such as these, requires that information about the calls be shared with the end client. In the past, during the days of CORBA, developers used to share IDL (Interface Definition Language) files providing the required information over the network. Now, in the days of web services this has changed to WSDL (Web Services Definition Language). WSDL is a major source for information and can help in the enumeration process. We shall go over the enumeration process in subsequent sections.
Read Here

Web application defense at the gates – Leveraging IHttpModule (Whitepaper)

Web applications are vulnerable to many attacks, mainly due to poor input validation at the source code level. Firewalls can block access to ports but once a web application goes live and TCP ports 80 and 443 are accessible, the web application can be an easy prey for attackers. HTTP traffic is legitimate traffic for web applications; all the more reason to include application-level content-filtering over unencrypted and encrypted communication channels. Application-level content filtering is possible to some extent but may not work over HTTPS (port 443). The only way to provide a strong defense is by applying powerful content-filtering at the application-level for both TCP port 80 and TCP port 443.

The .Net framework with ASP.NET provides the IHttpModule interface access to HTTP pipes - the lowest of programming layers - before an incoming HTTP request hits the web application. This can provide defense at the gates. In this paper, we look at how one can build this sort of defense in all three aspects - coding, deployment and configuration.
Read Here

Web Application Footprints and Discovery

Serious challenges arise when doing web application assessments on web servers that host multiple virtual hosts and all this with zero knowledge about the number of web applications mapped to a single IP address. Using the manual techniques outlined in the paper, the methodology pinpoints specific ways to discover applications and enhance web application assessment with tangible results.
Read Here

Defending Web Services using Mod Security (Apache) Methodology and Filtering Techniques (Whitepaper)

Web services are vulnerable to several attacks. These attacks can lead to information leakage and further aid in remote command execution. By using WSDL an attacker can determine an access point and available interfaces for web services. These interfaces or methods take inputs using SOAP over HTTP/HTTPS. If these inputs are not defended well at the source code level, they can be compromised and exploited. ModSecurity operates as an Apache Web server module, ideal for defending web services against attacks that also include malicious /POST variable/content. This paper describes techniques to defend your web services layer using mod_security.
Infosecwriters(Read Here)

Some interesting resources on same topic.
Read Here

Web Services – Attacks and Defense (Whitepaper)

Web Services is growing at a rapid rate and bringing into focus, new security issues in the web security landscape. How do we start assessing web services deployed at any corporate location? That is the fundamental question and once again it all starts with information gathering. UDDI, WSDL and SOAP are three cornerstones of this technology and they can be powerful tools for information gathering. Universal Business Registry (UBR) can help in footprinting using UDDI. UBR and technology fingerprinting can be used to perform discovery of web services. The scope in this paper is limited to only the first phase, namely the Web Services Information Gathering Phase. The entire methodology for web services information gathering is covered in this paper. The next two phases of the Assessment methodology are enumeration and defining attack vectors, both extensive topics too. These will be taken up in later papers.
Infosecwriters (Read Here)

HITB 2004 - Slides

HITB (Hack In The Box) 2004 Presentation by shreeraj Shah: "Web Services - Attacks and Defense Strategies, Methods and Tools". The web service is the new security Lego Land. The main building blocks are UDDI, SOAP and WSDL. This presentation will briefly touch upon each of these aspects.

Read Here

Interview with star-techcentral Malaysia

[Interview during HITB 2003 KL]
Bad coding can lead to attacks
By RAVIND RAMESH

BAD web application coding is one of the main culprits behind network intrusion incidences said Shreeraj Shah, director of Net Square.

“Although it’s difficult to say if it’s the back-end services or the front-end application at fault, the chances that a system compromise was due to flawed web application code is much higher,” he said.

“This is especially so since there are more services level defences available these days,” he added.

Read Here

HITB 2003 - Slides & Presentations

Talk on web application security at KL during HITB2003
Read Here

Spot the Star by Nasscom

Presented Net Square at Nasscom forum in "Spot the Star" event. It was fun!
Read Here

CII seminar at Ahmedabad

CIT was organized by CII at Ahmedabad. My talk there.
Read Here