Training at Syscan - Web Hacking – Threats & Countermeasure

Web Hacking – Threats & Countermeasure

Introduction and adaptation of new technologies like Ajax, Rich Internet Applications and Web Services has changed the dimension of Web Hacking and Security. We are witnessing new ways of hacking and exploiting web based applications and it needs better understanding of technologies to perform penetration testing and assessment of web security. The course is designed by the author of “Web Hacking: Attacks and Defense”, “Hacking Web Services” and “Web 2.0 Security – Defending Ajax, RIA and SOA” bringing his experience in application security and research as part of curriculum to address new challenges for pen-testers, consultants, auditors and QA teams. Web Hacking 2.0 is extensively hands-on class with real life challenges and lab exercises. Participants would be methodically exposed to various different attack vectors and exploits. The learning sessions feature real life cases, hands one exercises, new scanning tools and exploits.

Visit syscan training page - here

HTML 5, XHR (L2) and DOM (L3) - Top 10 Attacks

Current stack and technology surface
















Top 10 Attack Vectors

1. XSS abuse with tags and attributes
2. DOM based XSS and Redirects
3. Stealing from the storage
4. Injecting and Exploiting WebSQL
5. Abusing network API and Sockets
6. CSRF across streams – JSON, AMF and XML
7. Sandbox attacks and ClickJacking
8. Abusing new features like drag-and-drop
9. Botnet/Spynet gets persistent life using WebWorkers
10. Threats to widgets and mashups

DOM Hacking - Paper and Tools

DOM Hacking was presented at BlackHat and going to present at next HackInTheBox. Here is the paper and Tools (DOMScan and DOMTracer). It helps during scanning, assessments and pen-testing. Enjoy!

Paper on DOM Hacking

Download
PDF document from here [BlackHat site]
Presentation slides from here [BlackHat site]

DOMScan (Beta)
DOMScan - Scanning and Analyzing DOM

DOMScan is utility to drive IE and capture real time DOM from the browser. It gives access to active DOM context along with JavaScripts. One can observe the DOM in detail using this utility. It has predefined rules to scan DOM. One can run the scan on existing DOM and fetch interesting entry points and calls. It allows tracing through JavaScript variables as well. Using this utility one can identify following vulnerabilities.

• DOM based XSS
• DOM based vulnerable calls
• Source of abuse and external content loading methods
• Possible DOM logic and business layer calls
• Same Origin Bypass calls and usage
• Mashup usage inside DOM
• Widget Architecture review using the tool

Download

DOMTracer (Beta)
DOMTracer - Firefox Plugin (Trace DOM and JavaScript Calls)

The DOM as seen in all the aforementioned cases needs to be analyzed in many aspects. Run-time analysis of the DOM/JavaScript is vital and aids one to look at the calls made during the ‘dynamic DOM manipulation’. The DOMTracer is a Firefox Extension for this same purpose. It has been written using the standard method of writing extensions using the XUL platform and the JavaScript language in majority. This is in beta and we are working on new features.

Download

HITB - Malaysia

Training - TT1 – Web 2.0 Hacking – Advanced Attacks and Defense (Ajax, RIA and SOA)

Hacking a Browser’s DOM – Exploiting Ajax and RIA

Web 2.0 applications are using dynamic DOM manipulations extensively for presenting JSON or XML streams in the browser. These DOM calls mixed with XMLHttpRequest (XHR) object are part of client side logic written in JavaScript or part of any other client side technology be it Flash or Silverlight. DOM driven XSS is a sleeping giant in the application code and it can be exploited by an attacker to gain access to the end user’s browser/desktop. This can become a root cause of following set of interesting vulnerabilities – Cross Widget Sniffing, RSS feed reader exploitation, XHR response stealing, Mashup hacking, Malicious code injection, Spreading Worm etc. This set of vulnerability needs innovative way of scanning the application and corresponding methodology needs to be tweaked. We have seen DOM driven XSS exploited in various different popular portals to spread worm or virus. This is a significant threat on the rise and should be mitigated by validating un-trusted content poisoning Ajax or Flash routines. DOM driven XSS, Cross Domain Bypass and CSRF can cause a deadly cocktail to exploit Web 2.0 applications across Internet. This presentation will be covering following important issues and concepts.

* Web 2.0 Architecture and DOM manipulation points
* JavaScript exploits by leveraging DOM
* Cross Domain Bypass and Hacks
* DOM hacking for controlling Widgets and Mashups
* Exploiting Ajax routines to gain feed readers
* Scanning and detecting DOM driven XSS in Web 2.0
* Tools for scanning the DOM calls
* Mitigation strategies for better security posture

Secure SDLC and Static Code Analytics ...

Secure SDLC for Software

View more presentations from shreeraj.

Defending Against Top Web Attacks of 2010

Web Attacks - Top threats - 2010

View more presentations from shreeraj.

Future Trainings and Talks ...

	InfoSecWorld 10 - Orlando Web 2.0 Hacking: Attacks and Defense HANDS-ON
	InfoSecWorld 10 - Orlando Defending Against the Worst Web-Based Application Vulnerabilities of 2010 Secure SDLC for Software Assurance
	HackInTheBox - Dubai Web Application Security – Threats & Countermeasures

SecurityByte & OWASP event in India

Blueinfy is conducting one day workshop and sharing research at this event.

Cloud Hacking – Distributed Attack & Exploit Platform

We are witnessing applications, networks and infrastructures moving towards cloud computing. These clouds are emerging as a common platform to perform distributed attacks. Web/Enterprise 2.0 technologies are adding a new dimension to compromise cloud security. In this talk following topics will be covered with real life cases, tools and demonstrations.

• Fingerprinting and Footprinting clouds and resources
• Clouds internals and discoveries
• Cloud applications’ internal APIs and session hijacking & fixations
• Privilege and authorization escalations in cloud computing
• Network and Operating Systems hacks inside clouds
• Exploiting client side of cloud users
• Attack methods and exploits
• Impact analysis of cross domain access inside cloud - Twitter, Facebook, LinkedIn, MySpace etc.
• Google’s model and security threats – lessons to learn
• Live hacks and demos
• Tools to take away

Advanced Web Hacking – Securing Ajax, RIA and SOA

Introduction and adaptation of new technologies like Ajax, Rich Internet Applications and Web Services has changed the dimension of Application Hacking. We are witnessing new ways of hacking web-based applications and it needs better understanding of technologies to secure applications. The only constant in this space is change. In this dynamically changing scenario in the era of Web 2.0 it is important to understand new threats that emerge in order to build constructive strategies to protect corporate application assets. Application layers are evolving and lots of client side attack vectors are on the rise like Ajax based XSS, CSRF, Widget injections, RSS exploits, Mashup manipulations and client side logic exploitations. At the same time various new attack vectors are evolving around SOA by attacking SOAP, XML-RPC and REST. It is time to understand these advanced attack vectors and defense strategies.
Research and Talk

Web 2.0 Hacking class at DeepSec from Blueinfy

Introduction and adaptation of new technologies like Ajax, Rich Internet Applications and Web Services has changed the dimension of Application Hacking. We are witnessing new ways of hacking web based applications and it needs better understanding of technologies to secure applications. The only constant in this space is change. In this dynamically changing scenario in the era of Web 2.0 it is important to understand new threats that emerge in order to build constructive strategies to protect corporate application assets. Application layers are evolving and lot of client side attack vectors are on the rise like Ajax based XSS, CSRF, Widget injections, RSS exploits, Mashup manipulations and client side logic exploitations. At the same time various new attack vectors are evolving around SOA by attacking SOAP, XML-RPC and REST. It is time to understand these advanced attack vectors and defense strategies. The course is designed by the author of --Web Hacking: Attacks and Defense--, “Hacking Web Services” and “Web 2.0 Security – Defending Ajax, RIA and SOA” bringing his experience in application security and research as part of curriculum to address new challenges. Application Hacking 2.0 is hands-on class. The class features real life cases, hands one exercises, new scanning tools and defense mechanisms. Participants would be methodically exposed to various different attack vectors and exploits. In the class instructor will explain new tools like wsScanner, scanweb2.0, AppMap, AppCodeScan etc. for better pen-testing and application audits.

Visit here for detail on event

Secure Coding Class in Singapore

We are conducting class in Singapore from 25th-27th November. Detail over here

Description

Enterprise application source code, independent of languages and platforms, is a major source of vulnerabilities. The class is designed and developed to focus on enterprise architecture and application analytics to discover vulnerabilities. One of the CSI surveys on vulnerability distribution suggests that in 64% of cases, a vulnerability crops up due to programming errors and in 36% of cases, due to configuration issues. We will be covering analysis techniques, with tools, for assessment and review of enterprise application source code. Enterprise 2.0 and mashups, along with other different Web 2.0 concepts, reinforced by hands-on experience, will help in understanding next generation application requirements.

It is imperative to know source code review methodologies and strategies for analysis. The emphasis of the class would be to develop a complete understanding of source code analysis, audit methodologies, techniques and tools. Knowledge gained would help in analyzing and securing enterprise applications at all different stages - architecture, design and/or development. The course is designed by the author of "Web Hacking: Attacks and Defenses", "Hacking Web Service" and "Web 2.0 Security - Defending Ajax, RIA and SOA", bringing his experience in application security and research to the curriculum. Special focus is given to compliance and Top-25 errors for enterprise applications.

This class is hands-on and needs laptops to implement its numerous exercises designed to run hand-in-hand with their concepts. The class features real life cases, hands-on exercises, code scanning tools and defense plans. Participants would be methodically taken down to the source code level and exposed to the possible flaws in architecture, design and coding practices. The class would then focus on the proper ways of writing secure code and analyzing the code base.

Visit for full detail

Annual Conference IT Audit & Controls 2009

Conducting workshop and talk ...

W3 Conducting an Enterprise Application Audit DEMO
Date: Monday, 12 October 2009
Time: 9am - 5pm

The focus of this workshop is to analyze applications within an enterprise architecture to discover vulnerabilities. You will learn scanning, auditing and source code review methodologies – all critical tools to enable application analysis. The workshop features real-life cases, demonstrations, scanning tools and defense plans.
This workshop will cover:
• The most common vulnerabilities and proven methodologies for their detection
• Auditing for compliance and standards like PCI-DSS, OWASP Top 10 and CVE/CWE Top 25 errors
• Common programming errors and source-code scanning methodologies
• Conducting an architecture and design audit to ensure security
• Securing SDLC with best practices
• Effective scanning tools and approaches
• Mitigation strategies and frameworks

5 Auditing and Securing Web/Enterprise 2.0 Applications and Architectures
Date: Tuesday, 13 October 2009
Time: 10:30am - 12pm

• Web 2.0 threats, hacks and incidents
• Auditing and assessing the security of Web 2.0 architectures and design
• Web 2.0 vulnerabilities and mitigation
• Discovering JSON-based SQL injections, XML-driven XSS, CSRF 2.0, RSS feed injections, widget exploits, mashup hacks and more
• Auditing Web 2.0 source code and frameworks
• New tools, methodologies and audit strategies for Web 2.0

OWASP - Belgium chapter talk...

It was fun in presenting at OWASP Belgium chapter a week back before kicking the BruCON training on Web 2.0. Presented techniques on Web 2.0 assessments and some demos on scanning RIA and Flex apps.

PDF of presentation - here (http://www.owasp.org/index.php/File:Shreeraj_OWASP_Belgium.pdf)

Talk on - Application Source Code Audit - Why, What and How

Enterprise application source code, independent of languages and platforms, is a major source of vulnerabilities. This talk is designed to focus on enterprise architecture and application analytics to discover vulnerabilities. One of the CSI surveys on vulnerability distribution suggests that in 64% of cases, a vulnerability crops up due to programming errors and in 36% of cases, due to configuration issues. We will be covering analysis and audit techniques, for assessment and review of enterprise application source code. Essentially all three important aspects of the audit will be addresses – Why it is needed, What to do and how to achieve.

Online meet - here (http://www.brighttalk.com/summit/itaudit2)

ScanEx - Scanning for iframe and script Injections and External References (Beta)

This is a simple utility which runs against target site and look for external references and cross domain malicious injections. There are several vulnerable sites which get manipulated with these types of injections and compromised. The site gets registered with stopbadware and other databases as well. This tool helps in doing initial scanning to look from obvious injections. At this point it is looking into iframe and script tags as defined in regex file.

Download

Paper from Blueinfy Labs - Cross Widget DOM Spying

Widgets, Gadgets or Modules are very common and powerful feature of Web 2.0 applications. It converts single loaded page in the browser to multi-threaded application. It allows end user to work on multiple little utilities and windows from one page. Widget framework is supported by various Ajax libraries and lot of code is getting created by developers to allow this feature. Once framework is in place various different users can leverage APIs and libraries to develop their own little widget and deploy on the application domain. Any user of the application can register that widget and start utilizing its feature. This scenario opens up possibility of Cross Widget DOM Spying. This paper is going to describe that scenario and its understanding.

Read here

Web 2.0 Hacking Training at BruCon...

Training Detail ...

Introduction and adaptation of new technologies like Ajax, Rich Internet Applications and Web Services has changed the dimension of Application Hacking. We are witnessing new ways of hacking web based applications and it needs better understanding of technologies to secure applications. The only constant in this space is change. In this dynamically changing scenario in the era of Web 2.0 it is important to understand new threats that emerge in order to build constructive strategies to protect corporate application assets. Application layers are evolving and lot of client side attack vectors are on the rise like Ajax based XSS, CSRF, Widget injections, RSS exploits, Mashup manipulations and client side logic exploitations. At the same time various new attack vectors are evolving around SOA by attacking SOAP, XML-RPC and REST. It is time to understand these advanced attack vectors and defense strategies.

The course is designed by the author of "Web Hacking: Attacks and Defense", “Hacking Web Services” and “Web 2.0 Security – Defending Ajax, RIA and SOA” bringing his experience in application security and research as part of curriculum to address new challenges. Application Hacking 2.0 is hands-on class. The class features real life cases, hands one exercises, new scanning tools and defense mechanisms. Participants would be methodically exposed to various different attack vectors and exploits. In the class instructor will explain new tools like wsScanner, scanweb2.0, AppMap, AppCodeScan etc. for better pen-testing and application audits.

For more details see Web 2.0 Hacking – Attacks and Defense

Binging - Footprinting and Discovery Tool

Binging is a simple tool to query Bing search engine. It will use your Bing API key and fetch multiple results. This particular tool can be used for cross domain footprinting for Web 2.0 applications, site discovery, reverse lookup, host enumeration etc. One can use various different directives like site, ip etc. and run queries against the engine. On top of it tool provides filtering capabilities so you can ask for unique URLs or hosts. It is also possible to filter results by applying power of regular expression. Get your Bing API key and use this tool for your audit, assessment and research.

Download

View more documents from Blueinfy Solutions.

AppPrint - Web, Application Server and Web 2.0 Fingerprinting tool (Beta)

AppPrint scans IP range, IP or host for Web and Application servers. It scans port 80 for a particular target and tries to deduce the banner using httprint methodology. This gives best guessed banner for Web Server. In next step it uses method of forced plug-in invoke and scan for application server type. At this point it tries to fingerprint Tomcat, WebLogic, WebSphere, Orion, ColdFusion and Resin. It also fingerprints Web 2.0 libraries and components. It requires .NET framework installed. In future version we will build several other technology mapping and fingerprinting technologies like Flash, Laszlo etc. Also, planning to add WAF fingerprinting module.

Download

View more presentations from Blueinfy Solutions.

Web2Fuzz - AppSec Labs Tool....

This tool is coded by our research and consulting team to test Web 2.0 applications. It is simple utility to check vulnerabilities while doing pen-testing and assessment. It is effective to use with Web2Proxy.

Here is tool detail..
Web2Fuzz (Beta)
Web 2.0 Application Auto Fuzzing tool

This tool helps in fuzzing next generation application running on Web/enterprise 2.0 platform. It can be used with Web2Proxy by harvesting JSON, XML, JS-Object etc. from already profiled HTTP requests. Adding various fuzz loads and injecting them into particular request. One can encode fuzz load in various forms to pollute/poison Web 2.0 streams. It is possible to analyze responses by using various techniques like response behavior, stream structure or patterns. Tool contains sample payload and pdf/slides can help you in giving better understanding of its behavior.

Download

PDF/Slides for tools

View more documents from Blueinfy Solutions.

Web Hacking Training at Syscan

We are conducting 2 days hands-on training at Syscan 09. This event is going to be in Singapore starting from 30th June.

Training detail over here...