Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
駭客看 Django
Search
Orange
May 26, 2013
Technology
25
12k
駭客看 Django
Taiwan Python Conference 2013
Orange
May 26, 2013
Tweet
Share
More Decks by Orange
See All by Orange
Best Practices - The Upload
p8361
0
27
Security in PHP 那些在滲透測試的小技巧
p8361
0
61
網頁安全 Web Security 入門
p8361
0
70
Bug Bounty 獎金獵人甘苦談 - 那些年我回報過的漏洞
p8361
13
36k
那些 Web Hacking 中的奇技淫巧
p8361
16
14k
關於 HITCON CTF 的那些事 之 Web 狗如何在險惡的 CTF 世界中存活?
p8361
6
12k
PHPConf 2013 - 矛盾大對決
p8361
53
28k
0-Day 輕鬆談 - Happy Fuzzing Internet Explorer
p8361
15
12k
Other Decks in Technology
See All in Technology
目標と時間軸 〜ベイビーステップでケイパビリティを高めよう〜
kakehashi
PRO
8
1k
Amazon Aurora のバージョンアップ手法について
smt7174
2
190
フォーイット_エンジニア向け会社紹介資料_Forit_Company_Profile.pdf
forit_tech
1
1.7k
サバイバルモード下でのエンジニアリングマネジメント
konifar
21
7.1k
AI Agent時代なのでAWSのLLMs.txtが欲しい!
watany
3
370
開発組織を進化させる!AWSで実践するチームトポロジー
iwamot
2
540
Amazon Athenaから利用時のGlueのIcebergテーブルのメンテナンスについて
nayuts
0
110
OPENLOGI Company Profile for engineer
hr01
1
20k
マーケットプレイス版Oracle WebCenter Content For OCI
oracle4engineer
PRO
3
540
LayerXにおけるAI活用事例とその裏側(2025年2月) バクラクの目指す “業務の自動運転” の例 / layerx-ai-deim2025
yuya4
1
540
OCI Success Journey OCIの何が評価されてる?疑問に答える事例セミナー(2025年2月実施)
oracle4engineer
PRO
2
220
ABWG2024採択者が語るエンジニアとしての自分自身の見つけ方〜発信して、つながって、世界を広げていく〜
maimyyym
1
210
Featured
See All Featured
Optimizing for Happiness
mojombo
377
70k
4 Signs Your Business is Dying
shpigford
183
22k
RailsConf & Balkan Ruby 2019: The Past, Present, and Future of Rails at GitHub
eileencodes
134
33k
What's in a price? How to price your products and services
michaelherold
244
12k
The Web Performance Landscape in 2024 [PerfNow 2024]
tammyeverts
4
440
The Pragmatic Product Professional
lauravandoore
32
6.4k
VelocityConf: Rendering Performance Case Studies
addyosmani
328
24k
KATA
mclloyd
29
14k
Into the Great Unknown - MozCon
thekraken
35
1.6k
実際に使うSQLの書き方 徹底解説 / pgcon21j-tutorial
soudai
175
52k
Large-scale JavaScript Application Architecture
addyosmani
511
110k
Code Review Best Practice
trishagee
67
18k
Transcript
駭客看 DJANGO 2013/05/26 @ PyCon <Orange@chroot.org>
本場演講「四不一沒有」
四不一沒有 • 四不 – 我不是駭客 – 我不會寫 django – 不會有 django 新漏洞( 請洽七月台灣駭客年會
) – 這場演講不難,真的很簡單 • 沒有 – 這場演講沒有梗,有笑點的話拜託笑一下
About Me • 蔡政達 aka Orange • 2009 台灣駭客年會競賽 冠軍
• 2011, 2012 全國資安競賽 金盾獎冠軍 • 2011 東京 AVTOKYO 講師 • 2012 香港 VXRLConf 講師 • 台灣 PHPConf, WebConf 講 師 • 專精於 – 駭客攻擊手法 – Web Security – Windows Vulnerability Exploitation
About Me • CHROOT Security Group 成員 • NISRA 資訊安全研究會
成員 • Disclosed – Windows MS12-071(CVE-2012-4775) – Django (CVE-2013-0305) • Blog – http://blog.orange.tw/
2013 年 X 月 O 日 天氣晴,今天是寒假的第一天… 幹, Rails 爆遠端執行代碼漏洞欸
None
Django 會不會有同樣的問題呢? 學生什麼都沒有, 最多的就是時間。 來研究個 Open Source 專案很正常吧!
Vulnerabilities by Year Django
Vulnerabilities by Year Django 同樣情境跟 Rails 比較...
包含至少 8 個 Remote Code Execution
......
其實我今天是來推廣 Rails 開玩笑的啦我沒有要戰語言 T_T
Django 現有的保護機制 Django Security Overview
Security Overview • Built-in XSS protection • Built-in SQL Injection
protection – ORM ( Q Object ) • Built-in CSRF protection – django.middleware.csrf.CsrfViewMiddleware – Check REFERER header – Compare CSRF token
Security Overview • Clickjacking protection – django.middleware.clickjacking.XFrameOptionsMiddleware – Optional in settings.py – X-Frame-Options:
SAMEORIGIN
Security Overview • Password hashing is more and more stronger
– Default is PBKDF2 hasher – django.contrib.auth.hahsers – 10000 iterators makes attackers say fuck … $ time python pbkdf2.py mypassword real 0m0.401s user 0m0.260s sys 0m0.074s
攻擊手法 Some Attacking Vectors
Some Attacking Vectors • VERY VERY BASIC attacking way •
Weak admin password • Debug mode on – Leakage URL pattern – Leakage database password
Some Attacking Vectors • Cross-Site Scripting – HttpResponse( html ) – {{
output|safe }} – {% autoescape off %} • Bad HTML style is always vulnerable – <a href="{{ url }}"> # safe – <a href={{ url }}> # unsafe – <a href=xxx onload=alert(/xss/)>
Some Attacking Vectors • SQL Injection in Django ORM – raw(
sql ) is injectable – extra( select=…, where=… ) is also injectable • String concatenate and format string are vulnerable in any case
Some Attacking Vectors • Third-party module security • Py-bcrypt #
CVE-2013-1895 – Authentication bypass • Python Image Library # CVE-2012-3443 – Denied-of-Service • Python XML.sax # CVE-2013-1664 & 1665 – XXE & XEE Injection
XML eXternal Entity Injection Parsing XML Document Type Definition issue
<?xml encoding='utf-8' ?> <!DOCTYPE account[ <!ENTITY output SYSTEM '/etc/passwd'>]> <account> &output; </account>
XML Entity Expansion Injection <?xml encoding='utf-8' ?> <!DOCTYPE account[ <!ENTITY
a "ooo"> <!ENTITY b "&a; &a; &a; &a; &a;"> <!ENTITY c "&b; &b; &b; &b; &b;"> ... <!ENTITY z "&y; &y; &y; &y; &y;"> ]> <account> &z; </account>
Secret Key Leakage Issue (1/3) • Django SECRET_KEY use in
– get_random_string() using in csrf and hash generating – Django session_data encryption – Django signed cookie encryption – ……
Secret Key Leakage Issue (2/3) • Signed cookie store python
object using Pickle – > HTTP_COOKIE – > decode with secret_key – > pickle.loads( … )
Pickle & cPickle • A module that serializing and De-serializing
python objects • Execute command >>> import pickle >>> pickle.loads( "cos\nsystem\n(S'/bin/sh'\ntR." ) • You can observe by using pickletools >>> import pickletools >>> pickletools.dis( "cos\nsystem\n(S'/bin/sh'\ntR." )
Secret Key Leakage Issue (3/3) • Signed_cookie is encoded by
Pickle – > HTTP_COOKIE # malicious cookie – > decode with secret_key – > pickle.loads( … ) # code execution • Protect your SECRET_KEY ( ex .gitignore )
Conclusion • I think Django is a secure framework •
More and more wrapper make the attack difficult • People is always the most dangerous things
Reference • Django Weblog – https://www.djangoproject.com/weblog/ • Security in Django – https://docs.djangoproject.com/en/dev/topics/security/
• CVE Details – http://www.cvedetails.com/
Any Questions ? Whatever can be asked
Thanks. <Orange@chroot.org>