Transcript
Introduction to Web Application Firewalls
From Rich Helton’s October 2010 Web Application Firewall classes
WAF ( A quick fix)
Instead of rewriting code, some potentially quicker methods is to put an application to intercept the HTTP traffic ahead of the HTTP server known as a Web Application Firewall (WAF).
The WAF takes configurations like a normal firewall on what traffic to pass and reject. The difference is that it is responding specifically to an HTTP server like Apache or IIS.
For Apache, the most popular approach is to use its Open Source plugin called mod_security. http://www.modsecurity.org/
For IIS, WebKnight from AQTronix, http://aqtronix.com/?PageID=99 is the most popular Open Source solution.
Not everything can be covered by a WAF, especially session hijacking flaws, but XSS and SQL Injection can be mitigated. http://www.owasp.org/index.php/Category:OWASP_Best_Practices:_Use_of_Web_Application_Firewalls
WAF ( Not just a server fix)
WAFs are filters that sit in front of the Web Application. Depending on their configuration, they will deny, or log,
validated information from the Internet into the Application.
They are a good source in auditing the information that is hitting the Web site and the scans that are constantly taking place.
Pro’s and Con’s
Pro’s: Installing a WAF is quicker, in most cases, than changing
code and re-deploying a Web Application. WAF’s may find issues, by using its rule sets, that the code
may not be prepared to find. This is because WAFs have thousands of rules generated by industry experts.
Con’s:WAFs are limited by the rules that are installed in them. Therefore, if the rule is not there, it cannot protect against it. Validation is a better protection, because form level validation will use white-listing on what input is allowed, versus black-listing on the input that is denied.
ModSecurity/ApacheLabs
Lab1(Applying Tomcat)
Tomcat will need Apache
Starting Apache:
If there is an error, run the “StartApache.bat” in the lab and observe the error. Likely Apache may already be started.
Check Apache by IE http://localhost/ and it returns:
Tomcat will need Apache
To link Tomcat and Apache, the mod_jk module will need to be installed, see http://tomcat.apache.org/connectors-doc/ . Also known as the Tomcat Connector.
Note: Tomcat can also use Microsoft’s IIS, instead of Apache, utilizing the Microsoft ISAPI plugin. The easiest way to install the mod_jk connector is to have
Tomcat generate “conf/auto/mod_jk.conf” from its Container and have Apache reference it from its “conf/httpd.conf” file: LoadModule jk_module modules/mod_jk.so
Include C:/Apache2/apache-tomcat-6.0.28/conf/auto/mod_jk.conf
See http://www.johnturner.com/howto/apache2-tomcat4129-jk-winxp-howto.html
Tomcat will need Apache
Tomcat will need Apache
Start in “C:\Labs\Lab_Mod_JK”. Run the “TestApacheConfig.bat”
The Apache directory is pre-installed in “C:\Apache2”. Tomcat will be pre-installed in “C:\Apache2\apache-
tomcat-6.0.28”
Tomcat will need Apache
You might receive the following screen from the generated mod_jk.conf:
The mod_jk.conf is generated from Tomcat and is running an old version of Tomcat. This file can be edited and copied to a new location and referenced, such as “C:\Apache2\apache-tomcat-6.0.28\conf” .
Installing mod_jk
mod_jk is the module that Tomcat and Apache will use to communicate. The C:\Apache2\apache-tomcat-6.0.28\conf\auto\mod_jk.conf file is generated from Tomcat at startup to tell Apache which files are available.
The Apache httpd.conf is configured to find the mod_jk.so module and configuration files by adding the following lines:
This is both in the Lab1 directory and already modified.
Installing mod_jk
Notice that the mod_jk.log will log the communications from Apache to Tomcat.
A workers.properties also has to be created in the $tomcat/conf to describe the ajp13 (mod_jk protocol) threads across port 8009.
Tomcat’s server.xml also has to be modified to listen with the mod_jk.so file:
Starting Tomcat/Apache
After a successful Start in Apache, and running C:\Apache2\apache-tomcat-6.0.28\bin\startup.bat . You can see it is successful by looking at the logs for an exceptions (look for the keyword exception in the files) and a successful start:
Port 8009
Port 8009 was used in the configuration workers.properties and server.xml to communicate between Apache and Tomcat. Using a product like fport.exe from Foundstone, the port should appear to be open and listening from java starting it, notice port 8009:
Now Try a Struts XSS Sample
Calling http://localhost/mandiant-struts-form-vulnerable/index.jsp
Now Try a Struts XSS Sample
Typing in the XSS “<script>alert(123)</script>”, XSS appears:
Lab2(Adding ModSecurity)
Apache mod_security
The mod_security module information can be found at http://www.modsecurity.org/
Load the mod_security and unique id modules (this example is XP) in conf/httpd.conf: LoadModule security2_module modules/mod_security2.so
LoadModule unique_id_module modules/mod_unique_id.so
Add the base configuration and some of the base rules: Include conf/mod_security.conf
Include conf/base_rules/modsecurity_crs_41_xss_attacks.conf
Include conf/base_rules/modsecurity_crs_23_request_limits.conf
Include conf/base_rules/modsecurity_crs_35_bad_robots.conf
Include conf/base_rules/modsecurity_crs_40_generic_attacks.conf
Include conf/base_rules/modsecurity_crs_41_sql_injection_attacks.conf
Apache mod_unique_id
The modules/mod_unique_id.so has to be installed for mod_security to work.
To check to see which modules are currently being used by Apache, run httpd –t –D DUMP_MODULES from the Apache2/bin directory:
Apache mod_unique_id
Ensuring that the field is set in Apache2/httpd.conf :
Now run httpd –t –D DUMP_MODULES from the Apache2/bin directory:
Apache mod_security2
Copying the libxml2.dll, mod_security2.so, and pcre.dll to Apache2/modules, and adding the following to httpd.conf :
Now run httpd –t –D DUMP_MODULES from the
Apache2/bin directory to see security2_module:
mod_security2 minimal configuration
Changing the modsecurity.conf-minimal to modsecurity.conf, the httpd.conf needs to call it:
Setting the rules to “500 Internal Server Error”, the XSS
now returns an error code of 500:
Testing which rules may apply
http://www.modsecurity.org/demo/phpids has a smoketest to verify which rules may apply
ModSecurity Template for Building Rules
Lab3(Manipulating Rules)
Apache mod_security logs
The mod_security logs show what the mod_security blocked. If the minimal configuration was used with mod_security, it
will send which rule that it blocked on to the “Apache2/logs/mod_audit.log.”
The log will match a rule that will define, usually through a Regex expression, the blocking sequence.
To log, the location of the logs need to be defined, as well as their level of logging.
SecAuditEngine On Enables audit logging for all transactions.
SecAuditEngine RelevantOnly Enables audit logging only for transactions that match a rule, or that have a status code that matches the regular expression configured via SecAuditLo- gRelevantStatus.
SecAuditEngine Off Disables audit logging.
Defining logging (modsecurity.conf)
What do the mod_audit log say?
It blocked the mandiant page for the following reasons:
What do the mod_audit log say?
Looking closer,
It appears that the phids filter identified “<scri” as XSS.
What do the mod_audit log say?
Looking closer,
It appears that the phids filter identified “<scri” as XSS.
A simple test
Let’s see what happens when we remove the 41_phids_filters.conf
I am going to leave Tomcat running, it is not processing the rules, only Apache.
I am going to stop Apache, delete the 41_phids_filters.conf file, test the configuration, and start Apache.
The Apache configuration tested good, always test with changes…
This time it didn’t block,but triggered an audit rule
In the modsecurity_crs_41_xss_attacks.conf, it says pass and audit:
Conclusion
Adding the file 41_phids_filters.conf back in will start the process to block again.
Another alternative is to set the xss_attacks.conf rule to block by changing the rule from changing “pass” to “deny”.
There are many, many rules, and more than likely, they overlap in some manner.
This exercise was to show how to manipulate the rules just in case some of them block normal business activities.
Lab4(Logging Only)
Startup
Ensure that Apache is set to block XSS with phids rules as before.
In this exercise, we will simply log and not block. By default, modsecurity only logs, so we need to simply
commit out the deny statement in the httpd.conf, after stopping Apache, check the config, and restart Apache.
XSS passes through
This time XSS passes through
The XSS alerts are logged
In the audit log we see the phpids alerts for XSS, along with the other rules as well. This is because it was not blocked by the phpids alert and kept going:
Lets test some tools(scanning with Netsparker)
It found XSS(scanning with Netsparker)
ModSecurity audit logs
When Netsparker scanned the site, the audit logs went from 32 KB to 732 KB. This is because it was capturing the NetSparker attacks.
Turning on “deny” again(XSS went away)
Conclusions
The most interesting part of this exercise is that we have the ability to capture an audit log , without blocking anything, and understand what attacks are hitting the web site.
Lab5(FingerPrinting)
Startup
Ensure that Apache is set to block XSS with phids rules as before.
By knowing the Web Server type, and patches, it provides hackers a roadmap of what attacks to perform.
ModSecurity can fake the signature. Changing the httpd.conf:
HttpPrint scans our type (Apache)
Let’s pretend to be an IIS machine
Changing the httpd.conf:
And the mod_security.conf:
Now we are Apache appearing as IIS 5.0
WebKnight/IISLabs
Lab1(Starting IIS/Hacme Bank)
WebKnight
WebKnight is an Open Source Web Application Firewall from AQTronix, http://aqtronix.com/?PageID=99
IIS 5.1 and SQL Server 2008 be installed from (Need ISO/Disk for XP while Installing) Web Platform Installer http://www.microsoft.com/web/downloads/platform.aspx
What also will prove useful is the Web Visual Studio 2010 Express, http://www.microsoft.com/web/downloads/platform.aspx
The version of HacmeBank is an updated version of HacmeBank to work on the modern .NET frameworks, it may work with versions 2.0 – 4.0. It was updated from the older versions found at http://www.owasp.org/index.php/OWASP_O2_Platform/WIKI/Using_O2_on:_HacmeBank
Ensure IIS is started and HacmeBank installed (Control Panel-> Administrative
Tools->Internet Information Services)
Webknight
HacmeBank has 3 main pieces: The Hacme_Bank_V2_WS – Hacme Bank Web Service
that will provide the Login web service to the Database, has .asmx files.
The Hacme_Bank_V2_Website – provides the asp files for the pages and forms.
The FoundStone_Bank Database will have to be installed.
FoundStone_Bank DB(SQL Server Management Studio)
Installing FoundStone_Bank DB
With the newer source code, there is a both a sql script and installer for the Database:
Visual Studio Web Express
Most of the management can be done by Visual Studio:
.NET Version
Be very aware of which .NET version is set for the Web Site, it will change many things.
Test the Hacme Web Service
http://localhost/HacmeBank_v2_WS/WebServices/UserManagement.asmx
Test the Hacme Web Service
Login Service, user “jv”, password “jv789”.
Test the Hacme Web Service
Return of “0001” means that it found it in the database.
Test the Hacme Web Site
http://localhost/HacmeBank_v2_Website/aspx/Login.aspx, UserName “jv”, Password “jv789”.
Test the Hacme Web Site
Joe Vilella will Login OK.
Lab2(SQL Injection Test)
Intro to SQL Injection…
Many web pages communicate directly to a backend database for processing.
For example, a username and password is asked for on the Web page and the web page will pass it to the database to validate the information.
Some applications will not validate the field adequately before passing it to the database, and the database will process whatever it will receive.
Hackers will pass SQL commands directly to the database, and in some cases tables like “passwords” are returned because the SQL commands are not being filtered adequately.
SQL may return errors in the web page that even lists the correct tables to query so that the hacker may make more accurate attempts to get data.
SQL Injection
SQL Injection is the ability to inject malicious SQL commands into the backend code.
For example:
SELECT * FROM users WHERE username = ‘USRTEXT ' AND password = ‘PASSTEXT’
Passing ' OR 1=1-- in the USRTEXT field generates:
SELECT * FROM users WHERE username = ‘’ OR 1=1 -- '
AND password = ‘PASSTEXT’ The OR 1=1 returns true and the rest is commented
out
Common attack strings
‘ or 27(hex) – delineates SQL string values.“ or 22 (hex) – also delineates SQL string values.; or 3B (hex) - terminates statements.# or 23(hex) - also terminates a statement. (Access DB)/* or 2F2A (hex) - comment delimiter.-- or 2D2D (hex) – also comment delimiter.( or 28 (hex) or ) or 29 (hex) – logical sub clauses.{ or 7B (hex) or } or 7D (hex) – terminates a question.exec – used to call MS-SQL stored procedures.
union – a SQL command very common to SQL injection.
SQL Injection
http://localhost/HacmeBank_v2_Website/aspx/Login.aspx, use “' OR 1=1–” as the UserName and “Submit”.
SQL Injection
Joe Vilella will Login OK without a Username and Password.
Common Code fixes to SQL Injection…
Validate the form field to only accept specific input for the fields. For example, for login name use ^[0-9a-zA-Z]*$, which is
Regular expressions for an alpha-numerical field.
For Apache Struts, use the org.apache.struts.validator.ValidatorPlugin, http://www.owasp.org/index.php/Data_Validation_(Code_Review) .
For JSPs/Servlets, validate in the Servlet using the with the “java.utile.regex” framework in a similar manner.
Don’t use SQL Use Prepared Statements, or Hibernate, to call the database.
http://www.owasp.org/index.php/Preventing_SQL_Injection_in_Java
Lab3(XSS)
XSS in a form
http://localhost/HacmeBank_v2_Website/aspx/main.aspx?function=PostMessageForm
, type “<script>alert(document.cookie);</script>”
XSS
The cookie script will execute
Lab4(Install WebKnight)
WebKnight
A copy will be in MyDocuments:
WebKnight
The WebKnight page is http://aqtronix.com/?PageID=99 How to install can be found at
http://aqtronix.com/?PageID=99#Install The WebKnight FAQ can be found at
http://aqtronix.com/?PageID=114 and troubleshooting http://aqtronix.com/?PageID=114#trouble
WebKnight
Starting the Install:
WebKnight
Hit Typical:
WebKnight
Already done:
SQL Injection
http://localhost/HacmeBank_v2_Website/aspx/Login.aspx, use “' OR 1=1–” as the UserName and “Submit”.
SQL Injection
Out of the Box, it blocked SQL Injection.
Lab5(WebKnight)
WebKnight
The Webknight product has a Loaded .xml that shows what is currently loaded, a WebKnight.xml on what needs to be loaded next and a Robots.xml dedicated to Bots.
If you ever get into trouble, you can delete the WebKnight.XML and the default will be created.
WebKnight has preview settings to look at online http://www.aqtronix.com/WebKnight/Manual/WebKnight.xml
Make sure you edit the file WebKnight.xml and NOT Loaded.xml (this last one is for debugging and to see what is loaded in memory).
Once every minute, the Loaded.xml will replace itself with the WebKnight.xml.
WebKnight
The Webknight product has editors for looking at the logs and xml:
That are read from the AQTRONIX directory in Program Files:
WebKnight
You can even edit the WebKnight.XML directly if desired:
WebKnight
We don’t really know what was blocked. Looking at Log Anaylsis, part of the block was a shadow file:
WebKnight Loaded XML
WebKnight has several sections to configure sections of the configuration file.
WebKnight
By default, file uploads, Frontpage Extensions, WebDAV, ASP.NET and many protocols are turned off…..
WebKnight Logging
What to log can be specified
WebKnight Authentication
We can deny blank passwords, Admin passwords, common passwords , etc.
WebKnight Robots
We can deny Bots of various kinds.
WebKnight Robots.xml
Webknight aggressively attacks Bots, http://www.aqtronix.com/?PageID=114
WebKnight Robots.xml
Webknight has a Robots.xml just to configure for this effort:
Lab6(Config WebKnight)
Configuring WebKnight
Configuring WebKnight is mostly a combination of going between testing the site for desired results, looking at WebKnight’s Log Analysis to validate if the desired results match perceived results,a and using the WebKnight Configuration tool to change the results until they meet the desired outcome.
Always stop/start IIS after the changes.
WebKnight has preview settings to look at online http://www.aqtronix.com/WebKnight/Manual/WebKnight.xml
Make sure you edit the file WebKnight.xml and NOT Loaded.xml (this last one is for debugging and to see what is loaded in memory).
WebKnight
Looking back at WebKnight, the shadow.txtbox.gif appears as a shadow file and was blocked.
WebKnight
We set WebKnight to temporarily allow all files as test and Soap calls. Wait a minute for it to load as a Loaded.XML.
WebKnight
Now we can log in.
WebKnight
And SQL Injection is blocked.
WebKnight
Logging Only, instead of blocking, set the Incident Response section to “Response Log Only”.
SQL Injection
Joe Vilella will Login OK without a Username and Password.
SQL Injection
Joe Vilella will Login OK without a Username and Password.
Lab7(NetSparker)
Configuring WebKnight
Ensure that WebKnight is in Logging Only mode from the last exercise.
Ensure that Netsparker is installed, if not install it from the “My Documents” directory. It will require the .NET 3.5 framework.
Start scanning with Netsparker
If you are in Logging Only mode
If in Logging Only Mode, Netsparker will report many issues with the Hacme site.
The WebKnight logs will have many alerts in it from NetSparker attacking IIS.
Turn off the Logging Only mode
Double check by both checking the Loaded.xml and test the site for SQLInjection.
Rescan with the Logging Only mode off
The scan is cleaner
If there is time, we can go through the WebKnight.xml, change some settings, test, and continue to reconfigure WebKnight to get the optimal results.
Final Thoughts
Final Thoughts
Are there any Questions? Feel free to contact me at rich.helton@state.co.us Also, always only try these tools with your own
test site or with permission of the system owner.
top related