the-web-application-hackers-handbook

Chapter 18 n Attacking the Application Server 677
OWA_
OWA.
HTP.
HTF.
This filter was designed to block access to powerful default functionality
within the database. However, the list was incomplete and did not block access
to other powerful default procedures owned by DBA accounts such as CTXSYS
and MDSYS. Further problems were associated with the PL/SQL Exclusion List,
as described later in this chapter.
Of course, the purpose of the PL/SQL gateway is to host specific packages
and procedures, and many of the defaults have since been found to contain
vulnerabilities. In 2009, the default packages forming part of the E-Business
Suite proved to contain several vulnerabilities, including the ability to edit
arbitrary pages. The researchers give the example of using icx_define_pages
.DispPageDialog to inject HTML into the administrator’s landing page, executing
a stored cross-site scripting attack:
/pls/dad/icx_define_pages.DispPageDialog?p_mode=RENAME&p_page_id=[page_id]
HACK STEPS
1. Tools such as Nikto are effective at locating much default web content.
The application mapping exercises described in Chapter 4 should have
identified the majority of default content present on the server you are
targeting.
2. Use search engines and other resources to identify default content and
functionality included within the technologies known to be in use. If feasible,
carry out a local installation of these, and review them for any default
functionality that you may be able to leverage in your attack.
Directory Listings
When a web server receives a request for a directory, rather than an actual file,
it may respond in one of three ways:
n It may return a default resource within the directory, such as index.html.
n It may return an error, such as the HTTP status code 403, indicating that
the request is not permitted.
n It may return a listing showing the contents of the directory, as shown
in Figure 18-6.