CSC/ECE 517 Spring 2014/security audit - Revision history

Drfarrel: Added Overview section

2014-05-08T19:43:31Z

Added Overview section

← Older revision		Revision as of 19:43, 8 May 2014
Line 1:		Line 1:
	= ~~Results and Future Work~~ =		= Overview =

	This security audit ~~addressed~~ the ~~HTTP~~ server ~~software~~ and ~~configuration, SQL injection attacks, XSS attacks and privilege escalation attacks via poorly coded checks. The major vulnerability that was detected and exploited was a result~~ of the ~~site's use of HTTP (cleartext) for all communication~~. The ~~attacker was able to~~ use Wireshark ~~to quickly~~ and ~~easily intercept his own password. Perhaps more importantly, this audit should establish some confidence in the setup of the server used to host Expertiza~~. ~~It withstood serious attacks from major tools like Metaspolit, which~~ are ~~very~~ realistic examples of the types of automated scanning attacks the server is likely to face in practice. The site's use of cookies seems to be managed by Rails properly, preventing XSS attacks. The attacker was unable to find SQL injection attacks using sophisticated automated tools, ~~but did note some sections of~~ the codebase that don't follow SQL-related best practices. Two areas that need future study are the site's manual SQL code and privilege-related coding errors that could allow escalation attacks. The server itself and ~~the site's protection against XSS attacks should be considered fairly robust at this time~~.		This wiki documents the more interesting results of a security audit against the main Expertiza server and the latest version of the Expertiza code. The audit made extensive use of Metaspolit, NMap, Wireshark and a few additional online scanners. These are realistic tools, used in the wild by blackhats and whitehats alike.

	= Scans =		= Scans =
Line 232:		Line 232:
	[*] Auxiliary module execution completed		[*] Auxiliary module execution completed
	</pre>		</pre>

			= Results and Future Work =

			This security audit addressed the HTTP server software and configuration, SQL injection attacks, XSS attacks and privilege escalation attacks via poorly coded checks. The major vulnerability that was detected and exploited was a result of the site's use of HTTP (cleartext) for all communication. The attacker was able to use Wireshark to quickly and easily intercept his own password. Perhaps more importantly, this audit should establish some confidence in the setup of the server used to host Expertiza. It withstood serious attacks from major tools like Metaspolit, which are very realistic examples of the types of automated scanning attacks the server is likely to face in practice. The site's use of cookies seems to be managed by Rails properly, preventing XSS attacks. The attacker was unable to find SQL injection attacks using sophisticated automated tools, but did note some sections of the codebase that don't follow SQL-related best practices. Two areas that need future study are the site's manual SQL code and privilege-related coding errors that could allow escalation attacks. The server itself and the site's protection against XSS attacks should be considered fairly robust at this time.

Drfarrel: /* Overview */ Added notes about results and future work

2014-05-08T19:33:25Z

Overview: Added notes about results and future work

← Older revision		Revision as of 19:33, 8 May 2014
Line 1:		Line 1:
	= ~~Overview~~ =		= Results and Future Work =

	This ~~page will document~~ a ~~security~~ audit of Expertiza.		This security audit addressed the HTTP server software and configuration, SQL injection attacks, XSS attacks and privilege escalation attacks via poorly coded checks. The major vulnerability that was detected and exploited was a result of the site's use of HTTP (cleartext) for all communication. The attacker was able to use Wireshark to quickly and easily intercept his own password. Perhaps more importantly, this audit should establish some confidence in the setup of the server used to host Expertiza. It withstood serious attacks from major tools like Metaspolit, which are very realistic examples of the types of automated scanning attacks the server is likely to face in practice. The site's use of cookies seems to be managed by Rails properly, preventing XSS attacks. The attacker was unable to find SQL injection attacks using sophisticated automated tools, but did note some sections of the codebase that don't follow SQL-related best practices. Two areas that need future study are the site's manual SQL code and privilege-related coding errors that could allow escalation attacks. The server itself and the site's protection against XSS attacks should be considered fairly robust at this time.

	= Scans =		= Scans =

Drfarrel: /* Metasploit WebDAV IIS6 Unicode vulnerability */

2014-04-29T21:20:09Z

Metasploit WebDAV IIS6 Unicode vulnerability

← Older revision		Revision as of 21:20, 29 April 2014
Line 223:		Line 223:
	== Metasploit WebDAV IIS6 Unicode vulnerability ==		== Metasploit WebDAV IIS6 Unicode vulnerability ==
	<pre>		<pre>
			msf > use auxiliary/scanner/http/dir_webdav_unicode_bypass
			msf auxiliary(dir_webdav_unicode_bypass) > set RHOSTS 66.152.109.110
			RHOSTS => 66.152.109.110
	msf auxiliary(dir_webdav_unicode_bypass) > run		msf auxiliary(dir_webdav_unicode_bypass) > run

Drfarrel at 21:17, 29 April 2014

2014-04-29T21:17:34Z

@@ Line 46: / Line 46: @@
 Nmap done: 1 IP address (1 host up) scanned in 6.36 seconds
 </pre>
@@ Line 61: / Line 77: @@
 Nmap done: 1 IP address (1 host up) scanned in 6.15 seconds
 </pre>
@@ Line 169: / Line 195: @@
 msf > wmap_vulns -l
 msf > # No vuls discovered
 </pre>

Drfarrel: /* Nmap scans */ Added many more scan results

2014-04-21T07:31:53Z

Nmap scans: Added many more scan results

@@ Line 20: / Line 20: @@
 == Nmap scans ==
 <pre>
-[~]$ nmap -Pn 66.152.109.110                                                               3:18:22
+[~]$ nmap -Pn 66.152.109.110
 Starting Nmap 6.40 ( http://nmap.org ) at 2014-04-21 03:18 EDT
@@ Line 33: / Line 35: @@
 Nmap done: 1 IP address (1 host up) scanned in 7.26 seconds
-[~]$ nmap -Pn 198.105.251.210                                                              3:18:43
+[~]$ nmap -Pn 198.105.251.210
 Starting Nmap 6.40 ( http://nmap.org ) at 2014-04-21 03:18 EDT
@@ Line 44: / Line 46: @@
 Nmap done: 1 IP address (1 host up) scanned in 6.36 seconds
 </pre>

Drfarrel: Added basic nmap scans, better formatting

2014-04-21T07:20:30Z

Added basic nmap scans, better formatting

@@ Line 7: / Line 7: @@
 == Basic server info ==
 [~]$ nslookup http://expertiza.ncsu.edu
 Server:		209.18.47.61
@@ Line 16: / Line 17: @@
 Name:	http://expertiza.ncsu.edu
 Address: 66.152.109.110
 == Metasploit wmap ==

Drfarrel: Added nslookup results

2014-04-21T07:19:34Z

Added nslookup results

@@ Line 1: / Line 1: @@
-== Overview ==
+= Overview =
 This page will document a security audit of Expertiza.
 == Metasploit wmap ==

Drfarrel: Added basic wmap scan data

2014-04-21T06:53:35Z

Added basic wmap scan data

New page

== Overview ==

This page will document a security audit of Expertiza.

== Metasploit wmap ==

<pre>
[~]$ msfconsole

=[ metasploit v4.9.2-2014040906 [core:4.9 api:1.0] ]
+ -- --=[ 1299 exploits - 791 auxiliary - 217 post ]
+ -- --=[ 334 payloads - 35 encoders - 8 nops ]

msf > load wmap

.-.-.-..-.-.-..---..---.
| | | || | | || | || |-'
`-----'`-'-'-'`-^-'`-'
[WMAP 1.5.1] === et [ ] metasploit.com 2012
[*] Successfully loaded plugin: wmap
msf > wmap_sites -a http://expertiza.ncsu.edu/
[*] Site created.
msf > wmap_sites -l
[*] Available sites
===============

Id Host Vhost Port Proto # Pages # Forms
-- ---- ----- ---- ----- ------- -------
0 152.14.105.146 152.14.105.146 80 http 0 0
msf > wmap_targets -t http://152.14.105.146/home.html
msf > wmap_targets -t http://152.14.105.146/home
msf > wmap_targets -l
[*] Defined targets
===============

Id Vhost Host Port SSL Path
-- ----- ---- ---- --- ----
0 152.14.105.146 152.14.105.146 80 false /home.html
1 152.14.105.146 152.14.105.146 80 false /home
msf > wmap_run -t
[*] Testing target:
[*] Site: 152.14.105.146 (152.14.105.146)
[*] Port: 80 SSL: false
============================================================
[*] Testing started. 2014-04-21 02:33:20 -0400
[*] Loading wmap modules...
msf > wmap_run
[*] 39 wmap enabled modules loaded.
<snip>
[*] Done.
msf > wmap_vulns -l
msf > # No vuls discovered
</pre>