1BO4r2U

219 220
LDAP Injection
For details on LDAP Injection: Testing for LDAP Injection
|
!
(
)
%28
%29
&
%26
%21
%7C
*|
%2A%7C
*(|(mail=*))
%2A%28%7C%28mail%3D%2A%29%29
*(|(objectclass=*))
%2A%28%7C%28objectclass%3D%2A%29%29
*()|%26’
admin*
admin*)((|userPassword=*)
*)(uid=*))(|(uid=*
XPATH Injection
For details on XPATH Injection: Testing for XPath Injection
‘+or+’1’=’1
‘+or+’’=’
x’+or+1=1+or+’x’=’y
/
/
/ *
*/*
@*
count(/child::node())
x’+or+name()=’username’+or+’x’=’y
XML Injection
Details on XML Injection here: Testing for XML Injection
var n=0;while(true){n++;}]]>
SCRIPT]]>alert(‘gotcha’);/
SCRIPT]]>
]>&xee;
]>&xee;
]>&xee;
]>&xee;
OWASP Testing Guide Appendix D:
Encoded Injection
Background
Character encoding is the process of mapping characters, numbers
and other symbols to a standard format. Typically, this is done to create
a message ready for transmission between sender and receiver.
It is, in simple terms, the conversion of characters (belonging to
different languages like English, Chinese, Greek or any other known
language) into bytes. An example of a widely used character encoding
scheme is the American Standard Code for Information Interchange
(ASCII) that initially used 7-bit codes. More recent examples of encoding
schemes would be the Unicode UTF-8 and UTF-16 computing
industry standards.
In the space of application security and due to the plethora of encoding
schemes available, character encoding has a popular misuse.
It is being used for encoding malicious injection strings in a way that
obfuscates them. This can lead to the bypass of input validation filters,
or take advantage of particular ways in which browsers render
encoded text.
Input Encoding – Filter Evasion
Web applications usually employ different types of input filtering
mechanisms to limit the input that can be submitted by the user. If
these input filters are not implemented sufficiently well, it is possible
to slip a character or two through these filters. For instance, a
/ can be represented as 2F (hex) in ASCII, while the same character
(/) is encoded as C0 AF in Unicode (2 byte sequence). Therefore, it is
important for the input filtering control to be aware of the encoding
scheme used. If the filter is found to be detecting only UTF-8 encoded
injections, a different encoding scheme may be employed to bypass
this filter.
Output Encoding – Server & Browser Consensus
Web browsers need to be aware of the encoding scheme used to coherently
display a web page. Ideally, this information should be provided
to the browser in the HTTP header (“Content-Type”) field, as
Content-Type: text/html; charset=UTF-8
shown below:
or through HTML META tag (“META HTTP-EQUIV”), as shown below:
It is through these character encoding declarations that the browser
understands which set of characters to use when converting bytes to
characters. Note that the content type mentioned in the HTTP header
has precedence over the META tag declaration.
CERT describes it here as follows:
Many web pages leave the character encoding (“charset” parameter
in HTTP) undefined. In earlier versions of HTML and HTTP, the character
encoding was supposed to default to ISO-8859-1 if it wasn’t
defined. In fact, many browsers had a different default, so it was not
possible to rely on the default being ISO-8859-1. HTML version 4 legitimizes
this - if the character encoding isn’t specified, any character
encoding can be used.
If the web server doesn’t specify which character encoding is in
use, it can’t tell which characters are special. Web pages with unspecified
character encoding work most of the time because most
character sets assign the same characters to byte values below
128. But which of the values above 128 are special? Some 16-bit
character-encoding schemes have additional multi-byte representations
for special characters such as “’ works as a closing bracket
for a HTML tag. In order to actually display this character on the
web page HTML character entities should be inserted in the page
source. The injections mentioned above are one way of encoding.
There are numerous other ways in which a string can be encoded
(obfuscated) in order to bypass the above filter.
Hex Encoding
Hex, short for Hexadecimal, is a base 16 numbering system i.e it
has 16 different values from 0 to 9 and A to F to represent various
characters. Hex encoding is another form of obfuscation that is
sometimes used to bypass input validation filters. For instance, hex
encoded version of the string is
A variation of the above string is given below. Can be used in case
‘%’ is being filtered:
There are other encoding schemes, such as Base64 and Octal,
that may be used for obfuscation.
Although, every encoding scheme may not work every time, a bit
of trial and error coupled with intelligent manipulations would
definitely reveal the loophole in a weakly built input validation filter.
UTF-7 Encoding
UTF-7 encoding of alert(‘XSS’); is as below
+ADw-SCRIPT+AD4-alert(‘XSS’);+ADw-/SCRIPT+AD4-
For the above script to work, the browser has to interpret the web
page as encoded in UTF-7.
Multi-byte Encoding
Variable-width encoding is another type of character encoding
scheme that uses codes of varying lengths to encode characters.
Multi-Byte Encoding is a type of variable-width encoding that
uses varying number of bytes to represent a character. Multi-byte
encoding is primarily used to encode characters that belong to a
large character set e.g. Chinese, Japanese and Korean.
Multibyte encoding has been used in the past to bypass standard
input validation functions and carry out cross site scripting and
SQL injection attacks.
References
• http: /en.wikipedia.org/wiki/Encode_(semiotics)
• http: /ha.ckers.org/xss.html
• http: /www.cert.org/tech_tips/malicious_code_mitigation.html
• http: /www.w3schools.com/HTML/html_entities.asp
• http: /www.iss.net/security_center/advice/Intrusions/2000639/default.htm
• http: /searchsecurity.techtarget.com/expert/Knowledgebase-
Answer/0,289625,sid14_gci1212217_tax299989,00.html
• http: /www.joelonsoftware.com/articles/Unicode.html