Spoofing Attack in Script

Heard of SQL-injection (SQLi)? Do you know we can do script injection, similar to SQLi? Here is how to protect the shell script from injection attack.

First, check out what is SheBang if you haven't heard of it.

Second, sometime you will notice some SheBang will end with - or --.

#!/bin/bash -

#!/bin/bash --

The purpose of the single-dash is to protect it from script injection. IT simply mens the end of the options and disable any further option processing. Any argument after the --   is treated as filenames and arguments

This can protect the script from setuid based root spoofing and avoid interpreter spoofing, and eventually improve script security.

 

* Many OS ignore the setuid attribute when it detects shebang in an executable shell scripts.

Links:

• https://www.cyberciti.biz/faq/binbash-interpreter-spoofing/
  
• https://www.in-ulm.de/~mascheck/various/shebang/
• http://www.faqs.org/faqs/unix-faq/faq/part4/section-7.html
• https://unix.stackexchange.com/questions/364/allow-setuid-on-shell-scripts
  

Hacking Resistance (Time-to-Hack)

After I read from the article, "ModSecurity SQLi Challenge: Lesson Learned", I learned a lot more about SQLi.

I can see a lot of creative ways to bypass security rules in order to inject SQL statements. The rule of thumb is blacklist filtering is not adequate to fully prevent SQLi.

In the last section of the article is what that catch my eyes, the "Hacking Resistance (Time-to-Hack)".  In the article,

The real goal of using a web application firewall should be to gain visibility and to make your web applications more difficult to hack meaning that it should take attackers significantly more time to hack a vulnerable web site with a WAF in front in blocking mode vs. if the WAF was not present at all.  

The idea is to substantially increase the "Time-to-Hack" metric associated with compromising a site in order allow for operational security to identify the threat and take appropriate actions. 

Think of a WAF as a tool to identify and block the initial probes and to alert incident response personnel.  It is up to the IR teams to match wits with an attacker and protect the application as necessary.

The article also include the analysis of how long it took for each Level II winner to develop a working evasion for the CRS v2.2.0.  Here's the result:

• Avg. # of Requests to find an evasion: 433
• Avg. Duration (Time to find an evasion): 72 hrs
• Shortest # of Requests to find an evasion: 118
• Shortest Duration (Time to find an evasion): 10 hrs

The conclusion is: the data shows that having active monitoring and response capabilities of ongoing web attacks is paramount as it may only a matter of hours before a determined attacker finds a way through your defenses.

SonyPictures.com is Hacked via sqli

Sony Pictures web site is hacked, via SQL injection. All the user ID, emails, and password are shown in plaintext (and available for download).

RSA (March), PSN (April~May), Sony Pictures (June), what's next?

A good write up on Sony PSN attack at Deciphering the Sony PSN Attack.

HTTP Parameter Pollution

>>>> New type of attack on web applications: Parameter Pollution

At the recent OWASP conference, the Italian security experts Luca Carettoni and Stefano Di Paola demonstrated a new way of manipulating web applications and tricking security systems: HTTP Parameter Pollution (HPP).

This form of attack essentially involves submitting the parameters in GET and POST requests in unusual form or order, or with unusual delimiters. A request like:

GET /foo?par1=val1&par2=val2 HTTP/1.1

will be processed in the normal way, while

GET /foo?par1=val1&par1=val2 HTTP/1.1

with two occurrences of par1 can result in various different server-side variable interpretations, depending on the web server's or application's parsing routine. According to Carettoni and Di Paola, this can cause the application to behave in an unwanted and highly unpredictable way and result in security issues.

Web application firewalls (WAFs) and server security extensions are also vulnerable to HPP attacks. While Apache's ModSecurity module recognises an SQL-injection attack like:

/index.aspx?page=select 1,2,3 from table where id=1

it fails to detect

/index.aspx?page=select 1&page=2,3 from table where id=1

say the security experts. HPP can reportedly also be exploited for launching Cross-Site-Scripting attacks (XSS) on web browsers. The XSS filter of Internet Explorer 8 is apparently among the components vulnerable to this kind of attack.

Carettoni and Di Paola recommend stricter filtering and URL encoding to counteract HPP. They also recommend using strict regular expressions in URL rewriting.

SQLmap - Automatic SQL Injection Tool

sqlmap is an automatic SQL injection tool developed in Python. Its goal is to detect and take advantage of SQL injection vulnerabilities on web applications.

Once it detects one or more SQL injections on the target host, the user can choose among a variety of options to perform an extensive back-end database management system fingerprint, retrieve DBMS session user and database, enumerate users, password hashes, privileges, databases, dump entire or user’s specific DBMS tables/columns, run his own SQL SELECT statement, read specific files on the file system and much more.