Cookie Manipulation

Cookie Manipulation

Because the HTTP protocol is stateless, there's no way a web server can automatically know that two requests are from the same user. For this reason, cookies were invented. When a web site includes a cookie (an arbitrary string) in a HTTP response, the browser automatically sends the cookie back to the browser on the next request. Web sites can use the cookie to save session state. Gruyere uses cookies to remember the identity of the logged in user. Since the cookie is stored on the client side, it's vulnerable to manipulation. Gruyere protects the cookies from manipulation by adding a hash to it. Despite the fact that this hash isn't very good protection, you don't need to break the hash to execute an attack. The first thing I had to do when taking on this exercise is find out where Gruyere issues cookies. After searching through the code I found that one is issued after logging in. After Parsing through the cookie I found how the cookie is set up and began to think of a way to exploit this. I found the exploit after testing the create user functions. This exercise made me look at using one section of the site to set up the exploit before moving to another page to exploit it.  

Elevation of privilege

Client State Manipulation:

When a user interacts with a web application, they do it indirectly through a browser. When the user clicks a button or submits a form, the browser sends a request back to the web server. Because the browser runs on a machine that can be controlled by an attacker, the application must not trust any data sent by the browser.
It might seem that not trusting any user data would make it impossible to write a web application but that's not the case. If the user submits a form that says they wish to purchase an item, it's OK to trust that data. But if the submitted form also includes the price of the item, that's something that cannot be trusted.

                Elevation of privilege

This section of client state manipulation is about changing the state of your user account from standard user to admin. Gruyere points you in the direction of the edit profile page and after a while of searching the page I found that the vulnerability was in the request sent to the server. After hitting the save profile button the page sends a form to the server with a Boolean field for if the current user is an admin, and another field for the username of the admin. After changing those two parts of the request the server will change the current user to an admin giving you rights to change other user’s accounts or delete their posts. This vulnerability stems from the lack of server side validation of client side requests. 

Reflected XXS via AJAX

This exercise starts out having you search the page for a URL that could have some XXS vulnerability via an ajax call.  Even though I had some exposure to how AJAX works in the last exercise I had a lot of trouble finding a place to insert java script within the different urls generated by the site. After checking the first hint it pointed me in the direction of the user snippit page and the url that looks like: http://google-gruyere.appspot.com/455011419358/feed.gtl?uid=value

After playing with the url I found that you can insert script tags at the end to get XXS when the page is refreshed. This is possible because the Jason being sent back and forth is not escaping JavaScript characters with the Javascript escapes \x3c and \x3e. Overall I found the XXS section very interesting but it would have been more helpful if I installed burp before I started on the exercises because I would be able to see what the site is sending back to the server and the servers response. 

XXS Exploits via AJAX

The next exercise for the XXS exploit modal is stored XXS via AJAX. Ajax is a client-side script that communicates to and from a server/database without the need for a postback or a complete page refresh. Ajax allows a web programmer to transfer data without needing to refresh an entire page. Google Maps, YouTube, and Facebook all use Ajax. Gruyere uses ajax to send post information to the view using this code: _feed(( { "private_snippet": "" ,"cheddar": "Gruyere is the cheesiest application on the web." ,"brie": "Brie is the queen of the cheeses!!!" } )). Not having a lot of experience with AJAX or its syntax it was hard for me to formulate different posts to get stored XXS. Even after checking the first and second hints. The final result makes sense, but without knowing the syntax of AJAX it would be difficult to exploit. I will continue to look over the basics of Ajax before starting on the next exercise of reflected XXS using AJAX. 

I am going to focus my attention on Google’s Gruyere for the rest of the semester. I continued with the XXS section and started with stored XXS via a HTML attribute. Stored XSS is any hacker script being run on a later page by it being saved and accessed later. In this exercise it has you try to use stored XSS by exploiting the profile color input box.

After going through the HTML source code in the profile page I found that the color is rendered as style='color:color'. Seeing this I knew I had to break out of the style statement by adding a ‘ in front of my script in the text field.

 I went back to the source code to see how my script was stored after placing the script in the textbox.

My script was altered because the html page runs a python script that removes all javascript tags within user input divs to keep XXS from happening. After several different attempts I finally found a script call that worked after looking into the second hint that google provides.

As I move through these exercises I keep finding different aspects of web programming I already know being used in weird ways to break a web app. 

Access Controls Cont.

This week I continued reading over access controls in the intro to CISSP book. The two categories of access controls are:

·         System access controls: Controls in this category protect the entire system and provide a first line of defense for the data contained on the system.

·         Data access controls: Controls in this category are specifically implemented to protect the data contained on the system.

System access controls

Although system access controls can provide complete authentication, authorization, and accountability, they’re renowned for authentication. You can base authentication on any of three factors: Something you know, something you have, something you are.

Something you know is normally a password or secret PIN that is used to access a system. Usernames and passwords are the simplest and cheapest way to secure a system but is not the most secure.

Something you have can be a smart card or a token. This concept is based on the assumption that only the owner of the account has the necessary key to unlock the account.

Something you are such as fingerprint, voice, retina, or iris characteristics. This is the most secure form of authentication because it goes under the assumption that only you have access to your eyeball or hand. Biometric systems are some of the most expensive and complicated to implement which makes them rare to see in implementation.

Two-factor authentication requires two of these three authentication factors for authentication. Three-factor authentication requires all three factors for authentication. A commonly cited example of an access control system that uses two-factor authentication is an automatic teller machine (ATM) card and a PIN.

Identification and Authentication

The identification component is normally a relatively simple mechanism based on a username. Identification requirements include only that it must uniquely identify the user (or system/process) and shouldn’t identify that user’s role or relative importance in the organization. Common or shared accounts, such as root, admin, or system should not be permitted. These accounts provide no accountability and are prime targets for Hackers. Passwords are easily the most common and weakest authentication mechanism in use today. Although there are more advanced and secure authentication technologies available, including tokens and biometrics, organizations typically use those technologies as supplements to or in combination with rather than as replacements for traditional usernames and passwords.

A passphrase is a variation on a password; it uses a sequence of characters or words, rather than a single password. Generally, attackers have more difficulty breaking passphrases than breaking regular passwords because longer passphrases are generally more difficult to break than complex passwords. Passphrases also have the following advantages:

·         Users frequently use the same passwords to access numerous accounts; their corporate networks, their home PCs, their e-mail accounts. An attacker who targets a specific user may be able to gain access to his or her work account by going after a less secure system, such as his or her home PC, or by compromising an Internet. Internet sites and home PCs typically don’t use passphrases, so you improve the chances that your users have to use different passwords/passphrases to access their work accounts.

·         Users can actually remember and type passphrases more easily than they can remember and type a much shorter, cryptic password that is more difficult to type.

Passphrases also have a downside:

·         Users can find passphrases inconvenient, so you may find passphrases difficult to implement.

·         Many command-line interfaces and tools don’t support the space character that separates words in a passphrase.

·         A passphrase is still just a password and shares some of the same problems associated with passwords.

The first exercise in Gruyere in on cross site scripting or XXS. Cross-site scripting (XSS) is a vulnerability that permits an attacker to inject code (typically HTML or Javascript) into contents of a website not under the attacker's control. When a victim views such a page, the injected code executes in the victim's browser. Thus, the attacker has bypassed the browser's same origin policy and can steal victim's private information associated with the website in question.

In a reflected XSS attack, the attack is in the request itself (frequently the URL) and the vulnerability occurs when the server inserts the attack in the response verbatim or incorrectly escaped or sanitized. The victim triggers the attack by browsing to a malicious URL created by the attacker. In a stored XSS attack, the attacker stores the attack in the application (e.g., in a snippet) and the victim triggers the attack by browsing to a page on the server that renders the attack, by not properly escaping or sanitizing the stored data.  There are many venerable parts of the site, but the first feature that is exploited is the file upload. If a HTML file is uploaded with <script>alert(document.cookie);</script> as the content the script is executed and the users cookie information is displayed.

The next vulnerability that can be exploited is the URL. The site is designed to display an error if an invalid destination is entered. For example if you added ‘hello’ to the end of the url

http://google-gruyere.appspot.com/698806340929/hello

This page would be displayed.

Seeing that what you put into the url is being directly injected into the site is a good sign that there is a XXS vulnerability. So imputing the url

http://google-gruyere.appspot.com/698806340929/<script>alert(1)</script>

will run the malicious javascript.

As I continue through gruyere I will be leveraging the source code to find more vulnerabilities.  

I started my security training by taking a look at Googles venerable web application gruyere. Gruyere is available online and for download to run a local instance. The source code is written in python, and there are vulnerabilities within the source code and in the html. I started by going to code academy to get myself failure with python so I could read the source code with a small amount of understanding of the syntax. I went through most of the course looking for how methods are crated and called, how to make a class, and how variables are declared and their data type set. Going through the course about 1 hour at a time a couple times a week got me all the information I needed in about a week and a half.

 

After getting all the information I needed on python I downloaded the source code and got Gruyere set up on my computer. Once I was done with the setup I started my intro to CISSP book and videos.  

Intro to CISSP:

The first video I watched went over access control and Software development security. Access control cover one of the fundamental aspects of security called Availability. Meaning that if something is so secure that it is not available to the people that need it you are failing, but if everyone one has access to it you are still failing. Finding this happy medium is the basic idea behind access control. The more formal definition of Access Control is the ability to permit or deny the use of an object (a passive entity, such as a system or file) by a subject (an active entity, such as an individual or process).A subject is an active entity (such as an individual or process) that accesses or acts on an object. An object is a passive entity (such as a system or process) that a subject acts upon or accesses.

Access Control systems include:

·         File permissions, such as “create,” “read,” “edit,” or “delete” on a file server.

·         Program permissions, such as the right to execute a program on an application server.

·         Data rights, such as the right to retrieve or update information in a database.

There are several types of controls used to achieve access control:

·         Preventive controls, for reducing risk

·         Detective controls, for identifying violations and incidents

·         Corrective controls, for remedying violations and incidents and improving existing preventive and detective controls

·         Deterrent controls, for discouraging violations

·         Recovery controls, for restoring systems and information

·         Compensating controls, for providing alternative ways of achieving a task

Introduction

  This semester I will study cyber security through the lens of CISSP focusing on penetration and web tests. As I read through the CISSP book I will be working on programs like metaspliot and googles Gruyere. Reading and summarizing the CISSP book will allow me to get a good handle on corporate security from a conceptual perspective. Working hands on with metasploit and Gruyere will give me some technical experience in the domain. At the end of the semester I hope to have a good understanding of how security can impact an organization while Improving on my technical skills.