1. top tenWeb Hackingtechniques 2010 Jeremiah Grossman Founder & Chief Technology Officer Webcast 03.17.2011 © 2011 WhiteHat Security, Inc.
2. Jeremiah Grossman• WhiteHat Security Founder & CTO• Technology R&D and industry evangelist• InfoWorlds CTO Top 25 for 2007• Co-founder of the Web Application Security Consortium• Co-author: Cross-Site Scripting Attacks• Former Yahoo! information security officer © 2010 WhiteHat Security, Inc. | Page 2
4. 400+ enterprise customers •Start-ups to Fortune 500Flagship offering “WhiteHat Sentinel Service” •1000’s of assessments performed annuallyRecognized leader in website security •Quoted thousands of times by the mainstream press 4
5. About the Top Ten“Every year the Web security community produces a stunningamount of new hacking techniques published in various whitepapers, blog posts, magazine articles, mailing list emails, etc. Withinthe thousands of pages are the latest ways to attack websites, Webbrowsers, Web proxies, and so on. Beyond individual vulnerabilityinstances with CVE numbers or system compromises, were talkingabout brand new and creative methods of Web-based attack.” 5
6.New Techniques 2009 (80) Creating a rogue CA certificate 2008 (70) GIFAR (GIF + JAR) 2007 (83) XSS Vulnerabilities in Common Shockwave Flash Files 2006 (65) Web Browser Intranet Hacking / Port Scanning 6
2010 69 new techniques1) Padding Oracle Crypto Attack2) Evercookie3) Hacking Auto-Complete4) Attacking HTTPS with Cache Injection5) Bypassing CSRF protections with ClickJacking and HTTP Parameter Pollution6) Universal XSS in IE87) HTTP POST DoS8) JavaSnoop9) CSS History Hack In Firefox Without JavaScript for Intranet Portscanning10) Java Applet DNS Rebinding http://jeremiahgrossman.blogspot.com/2011/01/top-ten-web-hacking-techniques-of-2010.html 7
7. Bypassing CSRF with Clickjackingand HTTP Parameter Pollution 5Clickjacking is when an attacker invisibly hovers an object(button, link, etc.) below a users mouse. When the userclicks on something they visually see, theyre insteadreally clicking on something the attacker wanted them to.HTTP Parameter Pollution is where an attacker submitsmultiple input parameters (query string, post data,cookies, etc.) with the same name. Upon receiptapplications may react in unexpected ways and open upavenues of server-side and client-side exploitation. Bycleverly leveraging these two former Top Ten attacks,CSRF attacks can be carried out against a user evenwhen recommended token defenses are in use. Lavakumar Kuppan (@lavakumark) http://blog.andlabs.org/2010/03/bypassing-csrf-protections-with.html 8
8. Clickjacking (Top Ten 2009)Think of any button – image, link, form, etc. – on any website – that can appearbetween the Web browser walls. This includes wire transfer on banks, DSL routerbuttons, Digg buttons, CPC advertising banners, Netflix queue.Next consider that an attacker can invisibly hover these buttons below the usersmouse, so that when a user clicks on something they visually see, theyre actuallyclicking on something the attacker wants them to.What could the bad guy do with that ability? 9
9. Hover Invisible IFRAMEs HTML, CSS, and JavaScript may size, follow the mouse and make transparent third- party IFRAME content.<iframe src="http://victim/page.html" scrolling="no" frameborder="0" style="opacity:.1;filter: alpha(opacity=.1); -moz-opacity 1.0;">!</iframe> 10
10. HTTP Parameter Pollution (HPP) - Top Ten 2009If an attacker submit multiple input parameters (query string, post data, cookies,etc.) of the same name, the application may react in unexpected ways and openup new avenues of server-side and client-side exploitation. GET /foo?par1=val1&par1=val2 HTTP/1.1 User-Agent: Mozilla/5.0 Host: Host Accept: */* POST /foo HTTP/1.1 User-Agent: Mozilla/5.0 Host: Host Accept: */* par1=val1&par1=val2 POST /index.aspx?par1=val1&par1=val2 HTTP/1.1 User-Agent: Mozilla/5.0 Host: Host Cookie: par1=val3; par1=val4 Content-Length: 19 par1=val5&par1=val6 11