이 블로그 검색

2023년 8월 29일 화요일

What is LDAP Injection

Definition

LDAP (Lightweight Directory Access Protocol) injection is a security vulnerability that occurs when user-input data is used in LDAP queries without proper validation or sanitization. This can lead to unauthorized access or manipulation of data within an LDAP directory.

List of Vulnerable Points

  • Anywhere user input is used for authentication
  • Login identifiers, passwords

Vulnerability Verification Method

  • Verify if manipulated LDAP queries are inserted and executed in user input values.
USERNAME>(&)

LDAP Injection Cheatsheet

LDAP (Lightweight Directory Access Protocol)

LDAP is a protocol used to implement network directory services, used to store and retrieve directory information such as users, groups, and devices.

What is LDAP(Lightweight Directory Access Protocol)

Network Directory Services

Network directory services are systems designed to centrally manage information such as users, resources, and services in a computer network. The primary purpose is to efficiently perform user identification, authentication, authorization management, resource retrieval, and access.

LDAP, LDAP Server, WAS, DB Structure

Attack Method

Attack Scenario

  1. The attacker manipulates malicious LDAP queries and passes them to a vulnerable application.
  2. The application uses user input for LDAP queries without proper validation.
  3. The manipulated LDAP query is executed, resulting in unauthorized access or data manipulation within the LDAP directory.

Attack Process

Detailed Process Explanation

  1. The attacker provides malicious input, passing it to the application.
  2. The application executes the vulnerable LDAP query without proper user input validation.
  3. The vulnerable LDAP query is sent to and executed by the LDAP server.
  4. The LDAP server processes the query and returns the result to the application.
  5. The application displays the result to the user or utilizes it for other purposes.

Mitigation Strategies

  • Use prepared statements.
  • Implement whitelist-based filtering to allow only alphanumeric characters (a-z, A-Z, 0-9).
  • Minimize access permissions to the LDAP server, restricting application accounts to the least necessary privileges.
  • Apply rulesets to web firewalls to filter LDAP-related special characters.
  • Target filtering:


LDAP Injection Cheatsheet

Basic LDAP Search Query

LDAP (Lightweight Directory Access Protocol) is commonly used to retrieve specific information from directory services (e.g., Active Directory). The following is an example of an LDAP query for basic searches:

(&(attribute1=value1)(attribute2=value2))

Let's break down the components of the query:

  • The & symbol is the logical "AND" operator that combines multiple conditions.
  • attribute1 and attribute2 are the names of the attributes you want to search within the directory (e.g., "cn" for common name, "mail" for email).
  • value1 and value2 are the values you're looking for within those attributes.

You can customize attributes and values to match specific requirements. For example, to search for a user with the common name "John Doe" and the email address "john.doe@example.com," the query would be:

(&(cn=John Doe)(mail=john.doe@example.com))

Thus, for logging in, you can use the following query:

(&(cn=USERNAME)(userPassword=PASSWORD))

Basic LDAP Injection Query

(&) in an LDAP filter doesn't only mean the "AND" operator; it's also a syntactic element that represents an empty filter. You can use this to inject USERNAME>(&) into the identifier field. This will lead to the execution of the query as follows:

(&(cn=USERNAME>(&))(userPassword=PASSWORD))

Depending on the (&), the latter filter becomes unconstrained, and all entries are returned. This naturally results in a successful login.

What is LDAP(Lightweight Directory Access Protocol)

Definition

LDAP (Lightweight Directory Access Protocol) is a protocol that provides directory services as part of the internet protocol stack.

LDAP Structure

LDAP inherently follows a tree structure and stores data with specific conditions. Each node is referred to as an entry, and classified information is stored in each entry.


Entry Name Table

Web Application Structure Using LDAP

Purpose

LDAP provides a way to store and retrieve information about users, groups, devices, and more using a hierarchical data structure.

Advantages

  • Efficient data retrieval is possible due to the hierarchical structure of directory services.
  • Offers features for authentication and access control, enhancing security.
  • Widely known standard protocol with support for various platforms and languages.

Disadvantages

  • LDAP can require complex setup and management.
  • It might not be suitable for handling large amounts of data.
  • It's more specialized for retrieval and storage rather than insertion or modification.

Example

import ldap

# Connect to LDAP server
conn = ldap.initialize('ldap://ldap.example.com')

# Binding (Authentication)
conn.simple_bind_s('username', 'password')

# Search
base_dn = 'ou=users,dc=example,dc=com'
filter = '(& (cn=john))'
attributes = ['cn', 'email']
result = conn.search_s(base_dn, ldap.SCOPE_SUBTREE, filter, attributes)

# Print results
for dn, entry in result:
    cn = entry['cn'][0].decode('utf-8')
    email = entry['email'][0].decode('utf-8')
    print(f'CN: {cn}, Email: {email}')

# Unbind (Disconnect)
conn.unbind()

In the Python code, the ldap module is used to connect to the LDAP server, perform binding (authentication), search, handle results, and disconnect. The ldap.initialize function establishes a connection to the LDAP server, conn.simple_bind_s performs authentication, and conn.search_s is used for searching. The results are then processed and printed.

Operating System Commands by Http Request

Definition

Operating system command execution vulnerabilities are weaknesses that allow malicious users to execute malicious code or induce abnormal behavior within a system using the commands of the operating system.

List of Vulnerability Trigger Points

  • All pages
  • When receiving an HTTP request and the operating system executes a command based on the parameter value

Vulnerability Verification Methods

  • Insert publicly known operating system command execution code into parameter values passed to the web application and verify if the command is executed.

  • Apache Struts 2 RCE (Remote Code Execution) vulnerability (publicly known operating system command execution code) reference site: https://cwiki.apache.org/confluence/display/WW/Security+Bulletins

  • The code below utilizes a vulnerability in the Struts 2 framework. If the web page is vulnerable, the result of 3*4, which is 12, will be displayed on the page.

    <http://host/struts2-blank/example/X.action?action:%25{3\\\\*4}>
    

Attack Methods

Attack Scenario

  1. The attacker generates malicious input to be sent to the system.
  2. In vulnerable sections, the input is interpreted as an operating system command or directly passed to a command execution function.
  3. This results in the execution of malicious code or abnormal system behavior.

Process of Occurrence



Detailed Process Explanation

  1. The attacker generates malicious input.
  2. In vulnerable sections, insufficient input validation or incorrect interpretation of external input occurs as an operating system command.
  3. This leads to the execution of malicious code within the system or abnormal system behavior.

Mitigation Measures

  • Header information restriction: Configure HTTP responses to avoid revealing version information in a few response pages.
  • HTTP entity: Safely handle command execution by passing user input as arguments to operating system commands.
  • Input validation and filtering: Transform or restrict user input into a trusted format to prevent malicious code injection.
  • Permission restriction: Minimize the impact of attacks by limiting the scope of executable commands or restricting the permissions required for command execution.
  • Use of appropriate command execution functions: Utilize secure operating system command execution functions or libraries that perform security checks.

2023년 8월 22일 화요일

What are Authentication and Authorization

Definitions

Authentication

The process of verifying a user's identity, confirming that the person is who they claim to be.

Authentication is the process of confirming the identity of a user or system. This involves the user providing evidence of their claimed identity or the system verifying the identity of the entity attempting to access a resource. Authentication is achieved when a user provides valid credentials (such as a username and password) to confirm their identity, often used during the login process. It is the first step required for a user to gain access to a system.

Authorization

The act of granting permissions to authorized individuals.

Authorization is the process of verifying whether an authenticated entity has the necessary permissions to access specific resources or perform certain actions. It occurs after authentication and involves determining what actions an authenticated entity is allowed to perform. For instance, in a web application, authorization might involve checking a user's permissions before allowing access to a specific page.

Vulnerable Points List

  • All pages requiring authentication or authorization

Vulnerability Testing Methods

  • Checking if access is possible to posts that are not accessible by simply changing page numbers (changing the HTTP address)
  • Verifying if client-side redirection occurs (this might allow response manipulation)
  • Reviewing comment sections for potential vulnerabilities
  • Checking if JavaScript files (.js) are used to implement redirection
  • Testing parameter manipulation

Attack Methods

Authentication Bypass Process

Details of Authentication Bypass Process

  1. Page 1 is accessible to anyone.
  2. Page 2 requires login. An unsuccessful login attempt is made by the attacker.
  3. If the login is successful on Page 2, the user is redirected to Page 3, granting access to the forum.
  4. However, Page 3 does not check for successful authentication.
  5. The attacker accesses Page 3 without going through Page 2.
  6. The server provides Page 3 content to the attacker.

Authorization Bypass Process

Details of Authorization Bypass Process

  1. The attacker requests "user profile" from the web server.
  2. The web server provides the "user profile" to the attacker.
  3. The attacker then requests "admin profile" from the web server.
  4. The web server denies the request, indicating incorrect cookie parameters.
  5. The attacker speculates that the server checks the cookie parameters.
  6. The attacker sends a tampered request for "user profile" to the web server.
  7. The web server provides the "admin profile" to the attacker.

Mitigation Strategies

  • Ultimate defense: Server-side verification through sessions
    • Server-side verification through sessions is essential
    • Client-side code should focus on user convenience features only
  • Additional measures:
    • Implement strong password policies: Enforce length, complexity, and change intervals
    • Introduce Two-Factor Authentication (2FA): Add additional authentication factors beyond passwords
  • Apply the principle of least privilege: Grant users only the minimum permissions required

Feel free to use this translated content for your blog! If you have any further questions or need additional assistance, feel free to ask.


What are Dynamic Analysis and Static Analysis

Definition

Methods of Analyzing Programs

Dynamic Analysis

Verifying through multiple executions

Dynamic analysis is a method of analyzing the behavior of software during its execution.

When software is running, dynamic analysis tools are used to monitor and analyze the program's behavior, state, data flow, and more.

Pros

By analyzing the actual behavior of running software, it's possible to identify issues that occur in real environments.

Cons

Analyzing the behavior of running software can impact performance.

It's limited to the execution environment.

It can require more time and resources compared to static analysis.

Static Analysis

Continuously reading the code visually

Static analysis is a method of analyzing source code in a state where the software isn't being executed.

Using static analysis tools, the structure of the code, compliance with rules, potential bugs, security vulnerabilities, and more are identified and analyzed.

Pros

Since it analyzes the source code, it's not limited to the execution environment. It can identify code defects and security vulnerabilities beforehand.

Cons

It's heavily influenced by the skills of the analyzer.

LeetCode 75. Sort Colors Java Solution

Problem

Sort Colors - LeetCode

Solution Approach

  • This problem asks whether you can implement a sorting algorithm without using built-in sorting functions or methods.
  • Since the input consists of only 0, 1, and 2, it is possible to solve it using a logic-based algorithm.
  • Algorithm:
    • Iterate through all elements and count the occurrences of 0s, 1s, and 2s.
    • Fill the array with 0s, then 1s, and finally 2s based on their counts.
  • The "Follow up" asks about the one-pass algorithm known as the Dutch National Flag algorithm, which specializes in sorting 0s and 1s.
  • Alternatively, you can implement the Quick Sort algorithm.

References

What is Dutch National Flag algorithm

What is Quick Sort

Github Link

https://github.com/eunhanlee/LeetCode_75_SortColors_Solution.git

Logic Algorithm Time Complexity: O(n), Space Complexity: O(1)

/**
 * The Solution class provides a method to sort an array containing only 0, 1, and 2.
 */
public class Solution {

    /**
     * Sorts the given array using the counting technique. The array should contain only 0, 1, and 2.
     *
     * @param nums The array to be sorted.
     */
    public void sortColors(int[] nums) {
        int Zero = 0, One = 0, Two = 0; // Variables to count the occurrences of 0s, 1s, and 2s
        int idx = 0; // Index to track the position in the array

        // Count occurrences of 0s, 1s, and 2s
        for (int num : nums) {
            if (num == 0) Zero++;
            if (num == 1) One++;
            if (num == 2) Two++;
        }

        // Fill the array with 0s, then 1s, and finally 2s based on their counts
        for (int i = 0; i < Zero; i++) {
            nums[idx] = 0;
            idx++;
        }
        for (int i = 0; i < One; i++) {
            nums[idx] = 1;
            idx++;
        }
        for (int i = 0; i < Two; i++) {
            nums[idx] = 2;
            idx++;
        }
    }
}

Dutch National Flag Algorithm Time Complexity: O(n), Space Complexity: O(1)

public class Solution {
    /**
     * Sorts the given array containing only 0, 1, and 2 using the Dutch National Flag algorithm.
     *
     * @param nums The array to be sorted.
     */
    public void sortColors(int[] nums) {
        int low = 0;  // Pointer to 0
        int mid = 0;  // Pointer to 1
        int high = nums.length - 1;  // Pointer to 2

        while (mid <= high) {
            if (nums[mid] == 0) {
                // If the current element is 0, swap it with the element at the low pointer.
                swap(nums, low, mid);
                low++;  // Increment low pointer
                mid++;  // Increment mid pointer (since the swapped element is 1)
            } else if (nums[mid] == 1) {
                // If the current element is 1, move the mid pointer forward.
                mid++;
            } else if (nums[mid] == 2) {
                // If the current element is 2, swap it with the element at the high pointer.
                swap(nums, mid, high);
                high--;  // Decrement high pointer
                // Note: Here, the mid pointer is not incremented yet as the swapped element's value is uncertain.
            }
        }
    }

    /**
     * Swaps two elements in the array.
     *
     * @param nums The array containing the elements.
     * @param i    Index of the first element to be swapped.
     * @param j    Index of the second element to be swapped.
     */
    private void swap(int[] nums, int i, int j) {
        int temp = nums[i];
        nums[i] = nums[j];
        nums[j] = temp;
    }
}

Quick Sort Time Complexity: O(n log n), Space Complexity: O()

public class Solution3 {
    /**
     * Sorts the given array using the Quick Sort algorithm.
     *
     * @param nums The array to be sorted.
     */
    public void sortColors(int[] nums) {
        quickSort(nums);
    }

    private static void quickSort(int[] input) {
        quickSortRecur(input, 0, input.length - 1);
    }

    /**
     * Recursively implements Quick Sort using the Lomuto partition scheme.
     * pivot: Rightmost element
     * Starting point for selected value (left): 0
     * Starting point for comparison value (right): 0
     *
     * @param input The array to be sorted.
     * @param left  Starting index of the array to be partitioned.
     * @param right Ending index of the array to be partitioned.
     */
    private static void quickSortRecur(int[] input, int left, int right) {
        // Quick Sort termination condition: array length is 1 or less
        if (left >= right) {
            return;
        }

        // Find the partition point using the Lomuto partition scheme
        int pivotPos = partition(input, left, right);

        // Recursively sort the left partition
        quickSortRecur(input, left, pivotPos - 1);
        // Recursively sort the right partition
        quickSortRecur(input, pivotPos + 1, right);
    }

    /**
     * Swaps the positions of two elements in an array.
     *
     * @param input The array containing the elements.
     * @param a     Index of the first element.
     * @param b     Index of the second element.
     */
    private static void swap(int[] input, int a, int b) {
        int temp = input[a];
        input[a] = input[b];
        input[b] = temp;
    }

    /**
     * Uses the Lomuto partition scheme to partition an array and returns the position of the pivot.
     *
     * @param input The array to be partitioned.
     * @param left  Starting index of the array to be partitioned.
     * @param right Ending index of the array to be partitioned.
     * @return The position of the pivot.

Logic Gate Truth Tables & Definitions

Logic Gate Truth Tables Java Code !A // NOT A&B // AND ~(A&B) // NAND A|B // OR ~(A|B) // XOR A^B // XOR ~(A^B) // XNOR ~A // Inve...