=====================================================
用 Firefox 来 Hacking Web 2.0 程序
=====================================================
:原文地址: `Security Focus <http://www.securityfocus.com/infocus/1879/1>`_
:摘录翻译: `惑者 <CliffPeng>`_
Introduction
==============================
AJAX and interactive web services form the backbone of “web 2.0” applications.
This technological transformation brings about new challenges for security
professionals.
This article looks at some of the methods, tools and tricks to dissect web 2.0
applications (including Ajax) and discover security holes using Firefox and its
plugins. The key learning objectives of this article are to understand the:
* web 2.0 application architecture and its security concerns.
* hacking challenges such as discovering hidden calls, crawling issues, and
Ajax side logic discovery.
* discovery of XHR calls with the Firebug tool.
* simulation of browser event automation with the Chickenfoot plugin.
* debugging of applications from a security standpoint, using the Firebug
debugger.
* methodical approach to vulnerability detection.
Web 2.0 application overview
=================================
The newly coined term “web 2.0” refers to the next generation of web
applications that have logically evolved with the adoption of new technological
vectors. XML-driven web services that are running on SOAP, XML-RPC and REST are
empowering server-side components. New applications offer powerful end-user
interfaces by utilizing Ajax and rich internet application (Flash) components.
This technological shift has an impact on the overall architecture of web
applications and the communication mechanism between client and server. At the
same time, this shift has opened up new security concerns [ref1]_ and challenges.
New worms such as Yamanner, Samy and Spaceflash are exploiting “client-side”
AJAX frameworks, providing new avenues of attack and compromising confidential
information.
.. image:: 1.jpg
**Figure 1. Web 2.0 architecture layout.**
As shown in Figure 1, the browser processes on the left can be divided into the
following layers:
* **Presentation layer** - HTML/CSS provides the overall appearance to the
application in the browser window.
* **Logic & Process** - JavaScript running in the browser empowers
applications to execute business and communication logic. AJAX-driven
components reside in this layer.
* **Transport** - XMLHttpRequest (XHR) [ref2]_ . This object empowers
asynchronous communication capabilities and XML exchange mechanism between
client and server over HTTP(S).
* **The server-side components** on the right of Figure 1 that typically
reside in the corporate infrastructure behind a firewall may include
deployed web services along with traditional web application resources.
An Ajax resource running on the browser can directly talk to XML-based web
services and exchange information without refreshing the page. This entire
communication is hidden from the end-user, in other words the end-user would
not “feel” any redirects. The use of a “Refresh” and “Redirects” were
an integral part of the first generation of web application logic. In the
web 2.0 framework they are reduced substantially by implementing Ajax.
Web 2.0 assessment challenges
=====================================================
In this asynchronous framework, the application does not have many *Refreshes*
and *Redirects*. As a result, many interesting server-side resources that can be
exploited by an attacker are hidden. The following are three important
challenges for security people trying to understand web 2.0 applications:
1. **Discovering hidden calls** - It is imperative that one identify
XHR-driven calls generated by the loaded page in the browser. It uses JavaScript
over HTTP(S) to make these calls to the backend servers.
2. **Crawling challenges** - Traditional crawler applications fail on two
key fronts: one, to replicate browser behavior and two, to identify key
server-side resources in the process. If a resource is accessed by an XHR object
via JavaScript, then it is more than likely that the crawling application may
not pick it up at all.
3. **Logic discovery** - Web applications today are loaded with JavaScript
and it is difficult to isolate the logic for a particular event. Each HTML page
may load three or four JavaScript resources from the server. Each of these files
may have many functions, but the event may be using only a very small part of
all these files for its execution logic.
We need to investigate and identify the methodology and tools to overcome these
hurdles during a web application assessment. For the purpose of this article, we
will use Firefox as our browser and try to leverage some of its plugins to
combat the above challenges.
Discovering hidden calls
===============================================
Web 2.0 applications may load a single page from the server but may make several
XHR object calls when constructing the final page. These calls may pull content
or JavaScript from the server asynchronously. In such a scenario, the challenge
is to determine all XHR calls and resources pulled from the server. This is
information that could help in identifying all possible resources and associated
vulnerabilities. Let's start with a simple example.
Suppose we can get today’s business news by visiting a simple news portal
located at: ``http://example.com/news.aspx``
The page in the browser would resemble the screenshot illustrated below in Figure 2.
.. image:: 2.jpg
Being a web 2.0 application, Ajax calls are made to the server using an XHR
object. We can determine these calls by using a tool known as Firebug [ref3]_ .
Firebug is a plug-in to the Firefox browser and has the ability to identify XHR
object calls.
Prior to browsing a page with the plugin, ensure the option to intercept XHR
calls is selected, as shown in Figure 3.
.. image:: 3.jpg
With the Firebug option to intercept XMLHttpRequest calls enabled, we browse the
same page to discover all XHR object calls made by this particular page to the
server. This exchange is shown in Figure 4.
.. image:: 4.jpg
**Figure 4. Capturing Ajax calls.**
We can see several requests made by the browser using XHR. It has loaded the
dojo AJAX framework from the server while simultaneously making a call to a
resource on the server to fetch news articles.
http://example.com/getnews.aspx?date=09262006
If we closely look at the code, we can see following function in JavaScript::
function getNews()
{
var http;
http = new XMLHttpRequest();
http.open("GET", " getnews.aspx?date=09262006", true);
http.onreadystatechange = function()
{
if (http.readyState == 4) {
var response = http.responseText;
document.getElementById('result').innerHTML = response;
}
}
http.send(null);
}
The preceding code makes an asynchronous call to the backend web server and asks
for the resource getnews.aspx?date=09262006. The content of this page is placed
at the ‘result’ id location in the resulting HTML page. This is clearly an
Ajax call using the XHR object.
By analyzing the application in this format, we can identify vulnerable internal
URLs, querystrings and POST requests as well. For example, again using the above
case, the parameter “date” is vulnerable to an SQL injection attack.
Crawling challenges and browser simulation
===========================================================
An important reconnaissance tool when performing web application assessment is
a web crawler. A web crawler crawls every single page and collects all HREFs
(links). But what if these HREFs point to a JavaScript function that makes Ajax
calls using the XHR object? The web crawler may miss this information altogether.
In many cases it becomes very difficult to simulate this environment. For
example, here is a set of simple links::
<a href="#" onclick="getMe(); return false;">go1</a><br>
<a href="/hi.html">go2</a><br>
<a href="#" onclick="getMe(); return false;">go3</a><br>
The “go1” link when clicked will execute the getMe() function. The code for
getMe() function is as shown below. Note that this function may be implemented
in a completely separate file.
::
function getMe()
{
var http;
http = new XMLHttpRequest();
http.open("GET", "hi.html", true);
http.onreadystatechange = function()
{
if (http.readyState == 4) {
var response = http.responseText;
document.getElementById('result').innerHTML = response;
}
}
http.send(null);
}
The preceding code makes a simple Ajax call to the hi.html resource on the
server.
Is it possible to simulate this click using automation? Yes! Here is one
approach using the Firefox plug-in Chickenfoot [ref4]_ that provides
JavaScript-based APIs and extends the programmable interface to the browser.
By using the Chickenfoot plugin, you can write simple JavaScript to automate
browser behavior. With this methodology, simple tasks such as crawling web pages
can be automated with ease. For example, the following simple script will
“click” all anchors with onClick events. The advantage of this plug-in over
traditional web crawlers is distinct: each of these onClick events makes backend
XHR-based AJAX calls which may be missed by crawlers because crawlers try to
parse JavaScript and collect possible links but cannot replace actual onClick
events.
::
l=find('link')
for(i=0;i<l.count;i++){
a = document.links[i];
test = a.onclick;
if(!(test== null)){
var e = document.createEvent('MouseEvents');
e.initMouseEvent('click',true,true,document.defaultView,1,0,0,0,
0,false,false,false,false,0,null);
a.dispatchEvent(e);
}
}
You can load this script in the Chickenfoot console and run it as shown in
Figure 5.
.. image:: 5.jpg
**Figure 5. Simulating onClick AJAX call with chickenfoot.**
This way, one can create JavaScript and assess AJAX-based applications from
within the Firefox browser. There are several API calls [ref5]_ that can be used
in the chickenfoot plugin. A useful one is the “fetch” command to build a
crawling utility.
Logic discovery & dissecting applications
==================================================
To dissect client-side Ajax-based applications, one needs to go through each of
the events very carefully in order to determine process logic. One way of
determining the entire logic is to walk through each line of code. Often, each
of these event calls process just a few functions from specific files only.
Hence, one needs to use a technique to step through the relevant code that gets
executed in a browser.
There are a few powerful debuggers for JavaScript that can be used to achieve
the above objective. Firebug is one of them. Another one is venkman [ref6]_ . We
shall use Firebug again in our example.
Let’s take a simple example of a login process. The login.html page accepts a
username and password from the end-user, as shown in Figure 6. Use the
“inspect” feature of Firebug to determine the property of the form.
.. image:: 6.jpg
**Figure 6. Form property inspection with Firebug.**
After inspecting the form property, it is clear that a call is made to the
“auth” function. We can now go to the debugger feature of Firebug as
illustrated in Figure 7 and isolate internal logic for a particular event.
.. image:: 7.jpg
**Figure 7. Debugging with Firebug.**
All JavaScript dependencies of this particular page can be viewed. Calls are
made to the ajaxlib.js and validation.js scripts. These two scripts must have
several functions. It can be deduced that the login process utilizes some of
these functions. We can use a “breakpoint” to step through the entire
application. Once a breakpoint is set, we can input credential information,
click the “Submit” button and control the execution process. In our example,
we have set a breakpoint in the “auth” function as shown in Figure 8.
.. image:: 8.jpg
**Figure 8. Setting a breakpoint and controlling execution process.**
We now step through the debugging process by clicking the “step in” button,
which was highlighted in Figure 8. JavaScript execution moves to another
function, userval, residing in the file validation.js as shown in Figure 9.
.. image:: 9.jpg
**Figure 9. Moving to validation.js script page.**
The preceding screenshot shows the regular expression pattern used to validate
the username field. Once validation is done execution moves to another function
*callGetMethod* as shown in Figure 10.
.. image:: 10.jpg
Finally, at the end of the execution sequence, we can observe the call to
backend web services as being made by the XHR object. This is shown in Figure 11.
.. image:: 11.jpg
**Figure 11. Web services call on the Firebug console.**
Here we have identified the resource location for the backend web services ::
http://example.com/2/auth/ws/login.asmx/getSecurityToken?username=amish&password=amish
The preceding resource is clearly some web services running under the .NET
framework. This entire dissection process has thrown up an interesting detail:
we've found a user validation routine that can be bypassed very easily. It is a
potential security threat to the web application.
Taking our assessment further, we can now access the web service and its
endpoints by using a WSDL file and directly bruteforce the service. We can
launch several different injection attacks - SQL or XPATH - with tools such as
wsChess [ref7]_ .
In this particular case, the application is vulnerable to an XPATH injection.
The methodology for web services assessment overall is different and is outside
the scope of this article. However this walkthrough technique helps identify
several client-side attacks such as XSS, DOM manipulation attacks, client-side
security control bypassing, malicious Ajax code execution, and so on.
Conclusion
=======================
Service-oriented architecture (SOA), Ajax, Rich Internet Applications (RIA) and
web services are critical components to next generation web applications. To
keep pace with these technologies and combat next-generation application
security challenges, one needs to design and develop different methodologies
and tools. One of the efficient methodologies of assessing applications is by
effectively using a browser.
In this article we have seen three techniques to assess web 2.0 applications.
By using these methodologies it is possible to identify and isolate several
Ajax-related vulnerabilities. Browser automation scripting can assist us in
web asset profiling and discovery, that in turn can help in identifying
vulnerable server-side resources.
Next generation applications use JavaScript extensively. Smooth debugging tools
are our knights in shining armor. The overall techniques covered in this article
is a good starting point for web 2.0 assessments using Firefox.
About the author
========================
Shreeraj Shah, BE, MSCS, MBA, is the founder of Net Square and leads Net
Square’s consulting, training and R&D activities. He previously worked with
Foundstone, Chase Manhattan Bank and IBM. He is also the author of Hacking Web
Services (Thomson) and co-author of Web Hacking: Attacks and Defense
(Addison-Wesley). In addition, he has published several advisories, tools, and
whitepapers, and has presented at numerous conferences including RSA, AusCERT,
InfosecWorld (Misti), HackInTheBox, Blackhat, OSCON, Bellua, Syscan, etc. You
can read his blog at http://shreeraj.blogspot.com/.
References
========================
.. [ref1] `Ajax security <http://www.securityfocus.com/infocus/1868>`_
.. [ref2] `XHR Object specification <http://www.w3.org/TR/XMLHttpRequest/>`_
.. [ref3] `Firebug download <https://addons.mozilla.org/firefox/1843/>`_ ;
`Firebug usage <http://www.joehewitt.com/software/firebug/docs.php>`_
.. [ref4] `Chickenfoot quick start <http://groups.csail.mit.edu/uid/chickenfoot/quickstart.html>`_
.. [ref5] `Chickenfoot API reference <http://groups.csail.mit.edu/uid/chickenfoot/api.html>`_
.. [ref6] `Venkman walkthrough <http://www.mozilla.org/projects/venkman/venkman-walkthrough.html>`_
.. [ref7] `wsChess <http://net-square.com/wschess>`_
HackingWeb2WithFireFox
Revision 12 as of 2009-12-25 07:10:23
Clear message