Slide 1

Slide 1 text

Fuzzing Websockets Rohit Jadav

Slide 2

Slide 2 text

[~]$ whoami ● Security researcher & enthusiast ● In InfoSec since 2014 ● Area of expertise Penetration Testing ● Currently working @ Net Square ● @54ucyv1p3r

Slide 3

Slide 3 text

Agenda ● What are websockets? ● HTTP vs Websockets ● Difficulties during Websocket pentesting ● Fuzzing harness ● Using a harness to pentest websockets ● Demo

Slide 4

Slide 4 text

What are websockets?

Slide 5

Slide 5 text

● WebSocket is a protocol for creating a fast two-way channel between a web browser and a server. ● WebSocket overcomes limitations with HTTP to allow for low latency communications between a user and a web service.

Slide 6

Slide 6 text

HTTP vs Websockets http:// ws://

Slide 7

Slide 7 text

How does HTTP works?? client server Do you have any messages? No! No! Now? Now??? Bob sent a message Hello World!! wait wait wait Continue

Slide 8

Slide 8 text

How does Websockets works?? client server Let me know when you have any messages for me. Bob sent a message Hello World!! Continue working

Slide 9

Slide 9 text

Difficulties during Websocket pentesting oops!

Slide 10

Slide 10 text

There are many great resources about the basics of how Websockets work and how to get started assessing them “manually”. But for a security analyst or a bug bounty hunter, “dynamically” testing the Web Sockets is really hard. Burp Suite Pro, allows users to intercept Websocket messages and manipulate them manually (one at a time), but essential functionality like dynamic scanning is not yet available.

Slide 11

Slide 11 text

Sample Websocket request and response in Burp

Slide 12

Slide 12 text

Test Harness

Slide 13

Slide 13 text

Fuzz Testing ● Fuzzer executes the target application repeatedly, each time modifying the inbound data to cause hangs, leaks, exceptions, or crashes. ● Needs an entry-point executable, or EPE ● 2 ways for fuzzing: ○ Standard Form – Ready to Go - “C:\Windows\System32\notepad.exe c:\someTestFile.txt” ○ Nonstandard Forms - ????

Slide 14

Slide 14 text

Non Standard forms are tested using Test Harness ● For the applications, services, and libraries which do not have a standard EPE, i.e a client-server application. A test harness is used to bridge the gap. ● It is a custom executable / script that reads in file data and pipes or otherwise transmits the data to the target data parser so that the fuzzer can test it.

Slide 15

Slide 15 text

Websocket Test Harness Applying the same idea of Fuzz testing we can create a Websocket harness. Requirements: 1. Testing tool (BurpSuite, SQLmap etc) 2. web server on the loopback interface 3. Websocket endpoint Courtesy: VDA Labs https://www.vdalabs.com/2019/03/05/hacking-web-sockets-all-web-pentest-tools-welcomed/

Slide 16

Slide 16 text

Burp Suite Target WebSocket Application Loopback Server (WS test harness) HTTP GET Request WebSocket Request WebSocket Response HTTP Response Courtesy: VDA Labs https://www.vdalabs.com/2019/03/05/hacking-web-sockets-all-web-pentest-tools-welcomed/

Slide 17

Slide 17 text

Analysis of Test harness

Slide 18

Slide 18 text

#!/usr/bin/python import socket,ssl from BaseHTTPServer import BaseHTTPRequestHandler,HTTPServer from websocket import create_connection, WebSocket from urlparse import parse_qs import argparse import os LOOP_BACK_PORT_NUMBER = 8000 def FuzzWebSocket(fuzz_value): print fuzz_value ws.send(ws_message.replace("[FUZZ]", str(fuzz_value[0]))) result = ws.recv() return result def LoadMessage(file): file_contents = "" try: if os.path.isfile(file): f = open(file,'r') file_contents = f.read() f.close() except: print ("Error reading file: %s" % file) exit() return file_contents class myWebServer(BaseHTTPRequestHandler): #Handler for the GET requests def do_GET(self): qs = parse_qs(self.path[2:]) fuzz_value = qs['fuzz'] result = FuzzWebSocket(fuzz_value) self.send_response(200) self.send_header('Content-type','text/html') self.end_headers() self.wfile.write(result) return parser = argparse.ArgumentParser(description='Web Socket Harness: Use traditional tools to assess web sockets') parser.add_argument('-u','--url', help='The remote WebSocket URL to target.',required=True) parser.add_argument('-m','--message', help='A file that contains the WebSocket message template to send. Please place [FUZZ] where injection is desired.',required=True) args = parser.parse_args() ws_message = LoadMessage(args.message) ws = create_connection(args.url,sslopt={"cert_reqs": ssl.CERT_NONE},header={},http_proxy_host="", http_proxy_port=8080) try: #Create a web server and define the handler to manage the #incoming request server = HTTPServer(('', LOOP_BACK_PORT_NUMBER), myWebServer) print 'Started httpserver on port ' , LOOP_BACK_PORT_NUMBER #Wait forever for incoming http requests server.serve_forever() except KeyboardInterrupt: print '^C received, shutting down the web server'

Slide 19

Slide 19 text

Demo

Slide 20

Slide 20 text

Thank you!