0wn1ng The Web at www.wdcnz.com

Abstract:

JavaScript is an incredibly powerful tool for good. With great power comes great responsibility. Are we taking our responsibility seriously? JavaScript is also an incredibly powerful tool for evil. As a developer it's time to empower your tech sense and see how easy it is for those hiding in the shadows to own not only you, but your friends, family, clients, customers... Anyone that uses a browser. New advances in technology look shiny... until we stop believing the hype, open our minds and start poking at them. Let me show you what happens when we start poking.

The Play:

The presentation is basically the process I take to carry out a small client penetration testing assignment, but with a focus on why and how web developers should be doing the same within their teams. It goes through:

1. Why we even care about breaking our or a clients code and/or system(s)
2. Reconnaissance (information gathering), tools and tips. What can the public actually get their hands on?
3. Vulnerability scanning, tools and tips
4. Vulnerability searching, tools and tips
5. Exploitation, where to start, how to start, tools (and why) and tips
6. Demo 1: Exploiting an XSS vulnerable web app and what you can get from it using the Browser Exploitation Framework (BeEF). The whole reason being here is to be able to show your employer, boss, client and why they need to do something about it. After seeing how easy it is and what you can do, few will deny that it just needs to be fixed and provide the resources for you to do it.
7. Discuss countermeasures
8. Demo 2: Exploiting people with spear phishing, obtaining their credentials by cloning, spoofing a website they frequently login at with the Social Engineer Toolkit's (SET) Credential Harvester.
9. Discuss countermeasures
10. doppelganger domains (domains that look like the real thing but are fakes)
11. Demo 3: Add ARP and DNS spoofing to the mix. Now when a victim browsers to a website that they like to spend time at, they will be visiting our spoofed website. In this demo, we add the BeEF hook.js to the cloned website. This hook converts the victims browser into a zombie that continually polls the BeEF comms server requesting commands to execute on the victims machine. This is the window of time we use to install a root-kit and pwn the victims machine.
12. Discuss countermeasures
13. Discuss what BeEF can do
14. Demo 4: Again we clone and host a website we know the victim likes to visit with SET. We use a couple of Metasploit attack methods and exploit memory injection. Then select a collection of payloads to deliver via shellcode injection. Encrypt the payloads and configure the reverse shells. launch Metasploit and watch the reverse shells connect. Attempt to escalate privileges to system account. anti-virus (AV) stops us.
15. Demo 5: We use Veil-Evasion to get around AV by creating our payload. We encrypt the payload with Hyperion using a weak 128-bit AES key, which decrypts itself by brute force at the time of execution on the victims machine. We use Metasploit to deliver our psexec exploit that we created with Veil-Evasion and Hyperion. We watch the attackers reverse shell connect straight to the system account.
16. Discuss countermeasures

Speaker Notes:

##############################################################
Why do we Care
##############################################################

As web developers we are hired to create business value and reduce business costs.
Anything you can do to assist in that endeavour will go down well for you.

##############################################################
Reconnaissance
##############################################################

The following set of tools I use often in research and security engagements.

Reconnaissance: The act of information gathering.
The quieter you can do this, the less likely you will be to raise suspicions or raise your clients defenses.

Here we want to gather as much information that will be potentially useful for taking into the following stages.
Where we start to obtain more information about services & other software being used & their versions.
Moving from passive to more active techniques.

We need to learn as much as possible about the people involved within & related to the target org.
This way we’ll be able to create successful pretexts (become them).

##############################################################
Discover
##############################################################

Lee Baird’s discover-scripts
- Shell scripts to aggregate Kali Linux tools & automate various pentesting tasks.
Both passive & active options.
- Allow you to dig up a lot of dirt on your target long before you start trying to penetrate them.
- Domain and Person is very useful.

##############################################################
Discover
##############################################################

For example
Recon -> Domain -> Passive combines:
goofile, goog-mail, goohost, theHarvester, Metasploit, dnsrecon, URLCrazy, Whois, and multiple websites.

Recon -> Domain -> Active combines:
Nmap, dnsrecon, Fierce, lbd, wafw00f, traceroute, Whatweb.

So rather than getting familiar with all the recon tools,
you can just get familiar with Discover Scripts.

Id also recommend Maltego.

##############################################################
Vulnerability Scanning
##############################################################

It’s really important to have done a good job at gathering information in the reconnaissance step.

You’ll know if you didn’t do well, as this step & even more so the exploitation stage will have you wondering what to attack first.
You’ll be hitting machines and people that are less vulnerable than others.
An attacker will focus on the lowest hanging fruit first, so should you.

##############################################################
Vulnerability Scanning: NMAP
##############################################################

We start off using options that are as passive as possible to avoid triggering alarms with IDS’s and savvy sys-admins.

NMap & scripts can tell us a lot, even when it’s configured to scan very quietly.

##############################################################
Vulnerability Scanning: Metasploit
##############################################################

Metasploit provides the ability to scan many services.
Last time I checked there was 449 scanners.

These are just the SSH ones.

##############################################################
Vulnerability Scanning
##############################################################

Use the scanner
Set any options
Check your options
Run

With the results you can feed into multiple vulnerability search tools
and often even get canned exploits.

##############################################################
Vulnerability Scanning: OpenVAS
##############################################################

Open Vulnerability Assessment System (OpenVAS) was forked from Nessus in 2005 before it went proprietary.
it’s accompanied with a daily updated feed of Network Vulnerability Tests, over 35,000 in total (as of April 2014).
Scans pretty much everything against known vulns.
Does make a lot of noise though.

Drive with CLI & web UI.

Covers OWASP Top 10:
- No.5 Security Misconfiguration
- No.7 Missing Function Level Access Control (formerly known as “failure to restrict URL access”)
- No.9 Using Components with Known Vulnerabilities.

##############################################################
Vulnerability Scanning: ZAP
##############################################################

OWASP ZAP is not only a great web intercepting proxy, but also very good for finding web vulnerabilities.

There are many other very good vulnerability scanning tools, with not enough time to cover them all now.