book

Hunting Security Bugs

by Bryan Jeffries, Tom Gallagher, Lawrence Landauer

June 2006

Intermediate to advanced

590 pages

19h 30m

English

Microsoft Press

Read now

Unlock full access

Hunting Security Bugs
Dedication
Foreword
Introduction
Who Is This Book For?Organization of This BookSystem RequirementsTechnology UpdatesCode Samples and Companion ContentSupport for This BookQuestions and CommentsAcknowledgments
1. General Approach to Security Testing
Different Types of Security TestersAn Approach to Security TestingUnderstanding Deeply What You Are TestingTaking It ApartThinking Maliciously About Your TargetCallback VerificationMerchandise Returns at a Retail StoreSoftware ReturnsAttacking the ProductStay Informed About New AttacksSummary
2. Using Threat Models for Security Testing
Threat ModelingHow Testers Can Leverage a Threat ModelData Flow DiagramsEnumeration of Entry Points and Exit PointsEnumeration of ThreatsHow Testers Should Use a Completed Threat ModelThreats May Be Erroneously DismissedTest Cases for the Spam ThreatTest Cases for the Mail Bombing ThreatTest Cases for the Repudiation ThreatTest Cases for Denial of Service and Code Execution ThreatsImplementation Rarely Matches the Specification or Threat ModelSummary
3. Finding Entry Points
Finding and Ranking Entry PointsAssessing the Risk of Entry PointsCommon Entry PointsFilesImportance to an AttackerRegistered File TypesUnregistered File TypesHow to Find This Entry PointFiles Being Accessed by the ApplicationFile PermissionsFilename Extension InformationSocketsImportance to an AttackerHow to Find This Entry PointEnumerating the Open SocketsMonitoring the Network TrafficHTTP RequestsImportance to an AttackerHow to Find This Entry PointNamed PipesImportance to an AttackerHow to Find This Entry PointChecking the PermissionsHijacking a Named PipeImpersonating the ClientClient SecurityPluggable Protocol HandlersImportance to an AttackerHow to Find This Entry PointMalicious Server ResponsesImportance to an AttackerHow to Find This Entry PointProgrammatic InterfacesImportance to an AttackerHow to Find This Entry PointSQLImportance to an AttackerRegistryImportance to an AttackerHow to Find This Entry PointDetermining the Registry Keys Being AccessedDetermining Permissions of Registry KeysUser InterfacesImportance to an AttackerHow to Find This Entry PointE-mailImportance to an AttackerHow to Find This Entry PointCommand-Line ArgumentsImportance to an AttackerHow to Find This Entry PointEnvironment VariablesImportance to an AttackerHow to Find This Entry PointSummary
4. Becoming a Malicious Client
Client/Server InteractionFinding Requests the Server Normally AcceptsSniffing Network TrafficManipulating Network RequestsUsing a Proxy to Modify TCP TrafficTesting HTTPUnderstanding a Stateless ProtocolTesting Methods of Receiving InputUnderstanding HTML FormsForm ControlsTampering with URL Query String ParametersTampering with POST DataTampering with CookiesKey Properties of CookiesHow Cookies Are Issued by the ServerRetrieving CookiesTesting CookiesTampering with HTTP HeadersTesting Specific Network Requests QuicklyTesting TipsSummary
5. Becoming a Malicious Server
Understanding Common Ways Clients Receive Malicious Server ResponsesDoes SSL Prevent Malicious Server Attacks?Manipulating Server ResponsesCommon Vulnerabilities Found When Sending Malicious ResponsesExamples of Malicious Response BugsExample: Telnet Client Environment Variable DisclosureExample: File Caching Allows Arbitrary Code ExecutionMyth: It Is Difficult for an Attacker to Create a Malicious ServerEvilServerUnderstanding Downgrade MITM AttacksTesting TipsSummary
6. Spoofing
Grasping the Importance of Spoofing IssuesCaller ID SpoofingSpoofing as a Social Engineering AideCompromising Voice Mail Using SpoofingFinding Spoofing IssuesGeneral SpoofingIP Address SpoofingTCPUDPMAC Address SpoofingSpoofing Using Network ProtocolsReverse DNS LookupsSMTP E-mail MessagesHTTP RefererHTTP User-AgentUser Interface SpoofingRewording Dialog BoxesReformatting Using Control CharactersWildcard DNSZ-Order SpoofingMisleading URLs and FilenamesHomograph AttacksURL Redirection AttacksUsername@URL Syntax AttacksTesting TipsSummary

7. Information Disclosure
Problems with Information DisclosureLocating Common Areas of Information DisclosureDisclosure in FilesFinding Which Files Are UsedProcess ExplorerFile MonitorHow Files Are StoredEnsure Data Is Written to a Safe LocationEnsure the Permissions Are Not WeakCheck Predictability of a Filename or PathInspecting the Contents of FilesEmbedded MetadataViewing the DataDisclosures over a NetworkDetermine What Data Goes over the NetworkProviding Too Much InformationHTTP RefererWeb BeaconsError MessagesIdentifying Interesting DataObfuscating DataImplied DisclosuresSummary
8. Buffer Overflows and Stack and Heap Manipulation
Understanding How Overflows WorkStack OverflowsInteger OverflowsHeap OverrunsOther AttacksTesting for Overruns: Where to Look for CasesNetworkDocuments and FilesInformation Shared Between Users with Higher and Lower PrivilegesProgrammable InterfacesBlack Box (Functional) TestingDetermining What Data Is ExpectedUsing Data You RecognizeKnowing the Limits and BoundsAsking or Reading the CodeTrying the Maximum Intended Allowable LengthsUsing Common LimitsSlowly Growing the InputUsing an Iterative ApproachMaintaining Overall Data IntegrityEncodings/Compression/EncryptionCompound DocumentsOffsets/SizesReferencesFixed-Width FieldsLimited Values (Enumerations)DependenciesDelimitersStrategies for Transforming Normal Data into OverrunsReplacing Null ValuesInserting vs. OverwritingAdjusting String LengthsRecognizing Data StructuresTesting Both Primary and Secondary ActionsPrioritizing Test CasesWhat to Look ForCrashesExceptionsMemory SpikesChanges in BehaviorRuntime ToolsBounds CheckerDebuggerGflags.exeFuzzingWhite Box TestingThings to Look ForData CopyingDuplicate Lengths or Size DataParsersIn-Place Expansion of DataANSI/OEM to and from UnicodeRelative Path ExpansionEncoding or DecodingFailing to Null TerminateFailing to Reset Freed PointersOverflow ExploitabilityUnicode DataFiltered DataAdditional TopicsNoncode Execution Overflows Can Be Serious, Too/GS Compiler SwitchTesting Whether the Binary Was Compiled Using /GS/GS Information Disclosure VulnerabilityTesting TipsSummary
9. Format String Attacks
What Are Format Strings?Understanding Why Format Strings Are a ProblemAnatomy of a printf CallMisinterpreting the StackOverwriting MemoryTesting for Format String VulnerabilitiesReviewing CodeBlack Box TestingWalkthrough: Seeing a Format String Attack in ActionFinding the Format String BugAnalyzing ExploitabilityDigging Deeper: Working Around Exploitability ProblemsProblem: Getting ECX to a Useful ValueOverwriting the Stack Return AddressProblem: Limits on Output per Format SpecifierProblem: No Null Bytes AllowedAnother Format String Specifier ChallengeBuilding a Simple PayloadThe Compiler Is the Payload Coder’s FriendDraft Exploit Based on WinExec DisassemblyFilling in the Details: What Do You Want to Run Today?Testing the PayloadTesting TipsSummary
10. HTML Scripting Attacks
Understanding Reflected Cross-Site Scripting Attacks Against ServersExample: Reflected XSS in a Search EngineUnderstanding Why XSS Attacks Are a Security ConcernExploiting Server-Reflected XSS BugsPOSTs Are Exploitable, TooExample: Exploiting POST Data in helloPostDemo.aspGetting Victims to Submit Malicious POST DataCreating a Test to Exploit This VulnerabilityUnderstanding Persistent XSS Attacks Against ServersExample: Persistent XSS in a Web GuestbookExploiting Persistent XSS Against ServersIdentifying Attackable Data for Reflected and Persistent XSS AttacksSometimes More Than the <script> Tag Is NeededCommon Ways Programmers Try to Stop AttacksHTML-Encoded Data Doesn’t Always Stop the AttackStuck in a Script BlockUsing EventsUsing StylesScripting ProtocolsUnderstanding Reflected XSS Attacks Against Local FilesExample: Local HTML File Reflected XSSExploiting Reflected XSS Bugs in Local FilesUnderstanding Why Local XSS Bugs Are an IssueUsing Local XSS Bugs to Run Binaries on the Victim’s MachineHTML ResourcesFinding HTML Resources in FilesExample of Running Script Through HTML ResourcesCompiled Help FilesUsing HTML Help Workshop to Decompile a CHM FileExample of XSS in a CHM FileExploiting CHMs Using Protocol HandlersFinding XSS Bugs in Client-Side ScriptUnderstanding Script Injection Attacks in the My Computer ZoneExample: Script Injection in Winamp PlaylistNon-HTML Files Parsed as HTMLWays Programmers Try to Prevent HTML Scripting AttacksFiltersRemoving Strings from Input Before Returning ItBlocking Breaking Out of an Attribute by EscapingGaining In-Depth Understanding of the Browser’s ParserComments in StylesCharacter SetsASP.NET Built-in FiltersUnderstanding How Internet Explorer Mitigates XSS Attacks Against Local FilesLinks from the Internet to the My Computer Zone Are BlockedScript Disabled in the My Computer Zone by DefaultIdentifying HTML Scripting VulnerabilitiesFinding HTML Scripting Bugs Through Code ReviewIdentifying All Places Content Is Returned to the Web Browser or File SystemDetermining Whether Output Contains Attacker-Supplied DataVerifying That Attacker Data Is Properly Validated and/or EncodedASP.NET Automatically Encodes the Data... SometimesSummary
11. XML Issues
Testing Non-XML Security Issues in XML Input FilesWell-Formed XMLValid XMLIncluding Nonalphanumeric Data in XML InputCDATACharacter ReferencesTesting Really Simple SyndicationTesting XML-Specific AttacksEntitiesInfinite Entity Reference LoopsXML BombsExternal EntitiesXML InjectionXML Data InjectionExtensible Stylesheet Language (XSL)XPath/XQuery InjectionLarge File ReferencesSimple Object Access ProtocolTesting SOAPSOAP Array DoS AttacksSOAP XML BombsTesting TipsSummary
12. Canonicalization Issues
Understanding the Importance of Canonicalization IssuesFinding Canonicalization IssuesFile-Based Canonicalization IssuesDirectory TraversalDefeating Filename Extension ChecksUnderstanding Filename Extension PrecedenceUsing Trailing CharactersNTFS Data StreamsWhen Filename Extensions Do Not MatterOther Common Mistakes That Lead to Canonicalization IssuesUsing Short Filenames vs. Long FilenamesExploiting Casing IssuesSpecifying DOS Device NamesAccessing UNC SharesUnderstanding Search PathsWeb-Based Canonicalization IssuesEncoding IssuesUsing Hexadecimal Escape CodesUsing Overlong UTF-8 EncodingUsing UCS-2 Unicode EncodingSelecting Other Character EncodingsDouble Encoding CharactersUsing HTML Escape CodesHTML EntitiesURL IssuesHandling SSL URLsHandling Domain Name ParsingDotless IP AddressesIPv6 FormatsHandling Credentials in a URLTesting TipsSummary
13. Finding Weak Permissions
Understanding the Importance of PermissionsFinding Permissions ProblemsUnderstanding the Windows Access Control MechanismWhat Is a Securable Object?What Is a Security Descriptor?What Is an ACL?What Is an ACE?Finding and Analyzing Permissions on ObjectsUsing the Windows Security Properties Dialog BoxUsing AccessEnumUsing Process ExplorerUsing ObjSDUsing AppVerifierRecognizing Common Permissions ProblemsWeak DACLsGiving Everyone AccessGiving Large Groups AccessGiving Too Much Access to the ContainerUsing a Deny ACENULL DACLsImproper Ordering of ACEsObject CreatorAccessing Resources IndirectlyForgetting to Revert PermissionsSquatting AttacksExploiting Race ConditionsFile LinksSymbolic LinksJunctionsHard LinksSecurity Concerns with File LinksDetermining the Accessibility of ObjectsRemotely Accessible ObjectsWindows ServicesDCOM ObjectsLocally Accessible ObjectsOther Permissions Considerations.NET PermissionsSQL PermissionsSQL TriggersSQL Security FunctionsGlobal Temporary Stored ProceduresRole-Based SecuritySummary
14. Denial of Service Attacks
Understanding Types of DoS AttacksFinding Implementation FlawsApplication CrashesPoorly Designed FeaturesResource LeaksDOS Device Names HandlingConnection TimeoutsFinding Resource Consumption FlawsCPU ConsumptionAnalyzing Algorithm CostsUnderstanding Recursive CallsMemory ConsumptionDisk Space ConsumptionDisk QuotaLogging ErrorsDecompression BombsBandwidth ConsumptionFinding Solutions for a Hard ProblemTesting TipsSummary
15. Managed Code Issues
Dispelling Common Myths About Using Managed CodeMyth 1: Buffer Overflows Don’t Exist in Managed CodeMyth 2: ASP.NET Web Controls Prevent Cross-Site ScriptingMyth 3: Garbage Collection Prevents Memory LeaksMyth 4: Managed Code Prevents SQL InjectionUnderstanding the Basics of Code Access SecurityUser Security vs. Code SecurityOverview of CASAssembliesMicrosoft Intermediate LanguageStrong NamesEvidencePermissionsPoliciesCode GroupsPolicy ExampleFullTrustPartial TrustSandboxingGlobal Assembly CacheStack WalksFull DemandsLink DemandsInheritance DemandsStack Walk ModifiersAssertDenyPermitOnlyFinding Problems Using Code ReviewsCalling Unsafe CodeUsing Unverifiable CodeUsing Win32 APIsMarshaling DataFinding Problems with AssertsComplement an Assert with a DemandDon’t Assert Too Much PermissionReduce the Scope of the AssertFinding Problems with Link DemandsCalling the Public Method Does Not Enforce the Link DemandThe Interface the Method Implements Does Not Have the Link DemandRecognizing Poor Exception HandlingFinding Elevation of Privilege BugsFinding Information Disclosure BugsUnderstanding the Issues of Using APTCADetermining If an Assembly Is Marked APTCAUnderstanding Why the Assembly Is Marked APTCAUnderstanding What Functionality the Public Interface ProvidesTesting for Luring AttacksDecompiling .NET AssembliesTesting TipsSummary
16. SQL Injection
Exactly What Is SQL Injection?Understanding the Importance of SQL InjectionAssessing the Vulnerability of ApplicationsFinding SQL Injection IssuesUsing a Black Box Testing ApproachDetermine Which SQL Statements Are ExecutedDetermine Whether User-Supplied Data Is Used in SQL StatementsUsing Techniques to Break Out of SQL QueriesString FieldsNumber FieldsUsing SQL CommentsORDER BY ClauseLIKE ClauseSQL FunctionsUsing Square BracketsUsing Double Quotation MarksInjection in Stored ProceduresInjection by Data TruncationBatch TransactionsUsing Code ReviewsIdentifying Places That Construct and Execute SQL StatementsSanitizing User-Supplied DataAvoiding Common Mistakes About SQL InjectionEscape Single Quotation Marks in InputRemove Semicolons to Block Multiple StatementsUse Only Stored ProceduresRemove Unwanted Stored ProceduresPlace the Computer That Runs SQL Server Behind a FirewallUnderstanding Repurposing of SQL Stored ProceduresExample: Backing Up DocumentsHunting for Stored Procedure Repurposing IssuesRecognizing Similar Injection AttacksTesting TipsSummary
17. Observation and Reverse Engineering
Observation Without a Debugger or DisassemblerComparing OutputOutput Can Become InputHow Does Comparing Output Help Your Testing?Using Monitoring ToolsLogger/Log ViewerUsing a Debugger to Trace Program Execution and Change its BehaviorModifying Execution Flow to Bypass RestrictionsPatching BinariesExample: Challenging the Robustness of a Copy Protection Check from a BinaryReading and Modifying Memory Contents Under a DebuggerExample: Setting a Breakpoint on Memory to Understand How User Input Is UsedUsing a Decompiler or Disassembler to Reverse Engineer a ProgramUnderstanding Differences Between Native Code and Bytecode BinariesSpotting Insecure Function Calls Without Source CodeExample: Finding Format String Vulnerabilities Without Source CodeReverse Engineering Algorithms to Identify Security FlawsExample: Finding an Implementation Flaw in Authentication CodeAnalyzing Security UpdatesTesting TipsLegal ConsiderationsSummary
18. ActiveX Repurposing Attacks
Understanding ActiveX ControlsCreating ActiveX Controls in Internet ExplorerInitializing and Scripting ActiveX ControlsRepurposing ActiveX ControlsUsing ActiveX SiteLockActiveX Repurposing: CausesUnderstanding the ActiveX Control Security ModelInstallationInstantiation (Instance Creation)InitializationScriptingUsing the ActiveX Control Testing MethodologyDiscovering How the Control WorksTools of InterestTool: Object BrowserTool: OLEViewTool: ActiveX Control Test ContainerTool: COMRaiderMember-Level Threat ModelingAdditional Testing Tricks and TechniquesException Handlers: Using try-catchReturn ValuesNested ObjectsControl Persistence – Browser Helper Objects (BHOs)Server RedirectionBypassing Browser Security SettingsNamespaces and BehaviorsActiveX Control Testing WalkthroughClearClipboardCopyClipboardPasteInvokeRTFEditorHow Can an Attacker Specify the Editor InvokeRTFEditor Uses?Can an Attacker Bypass the Prompt?Can an Attacker Spoof the Prompt?How Is the Editor Launched?Which Component Creates the TomCC9.tmp File?Where Is the TomCC9.tmp File Stored?Is Data from the Control Pumped into the Editor? How?But Wait, There Is More!LoadRTFNumCharsRTFEditor PropertyRTFEditor PARAMRTFEditorOverrideChallengeTesting TipsSummary
19. Additional Repurposing Attacks
Understanding Document Formats That Request External DataCommon Mitigation for Document Formats Requesting External DataTesting Document Formats That Request External DataWeb Pages Requesting External DataCSRF Through Query String URLsCSRF Through POST DataCommon Ways to Prevent CSRF AttacksCSRF Through SOAP DataTesting for CSRF AttacksUnderstanding Repurposing of Window and Thread MessagesTesting for Shatter AttacksSummary
20. Reporting Security Bugs
Reporting the IssueContacting the VendorWhat to Expect After Contacting the VendorDealing with Unresponsive VendorsPublic DisclosureDeciding on the Amount of DetailTiming the DisclosureAddressing Security Bugs in Your ProductCommunicating with Bug FindersIdentifying the Root CauseLooking for Related BugsDetermining Affected Products and VersionsTesting the FixDetermining Mitigations and WorkaroundsReleasing Patches Simultaneously for All Affected Products and VersionsSummary
A. Tools of the Trade
GeneralActiveX/COMCanonicalizationCode AnalysisDebuggingDocuments and BinariesFuzzersMemory/RuntimeNetworkPermissionsSQL
B. Security Test Cases Cheat Sheet
Network Requests and ResponsesSample Test CasesSpoofingSample Test CasesInformation DisclosuresSample Test CasesBuffer OverflowsSample Test CasesFormat StringsSample Test CasesCross-Site Scripting and Script InjectionSample Test CasesXMLSample Test CasesSOAPSample Test CasesCanonicalization IssuesSample Test CasesWeak PermissionsSample Test CasesDenial of ServiceSample Test CasesManaged CodeSample Test CasesSQL InjectionSample Test CasesActiveXSample Test Cases
C.
Tom GallagherBryan JeffriesLawrence Landauer
Index
About the Authors
Copyright

Content preview from Hunting Security Bugs

Foreword

When Jesse James, the famous outlaw of the American West, was asked why he robbed banks, he replied, “That’s where the money is.” Similarly, any modern company that is likely to employ your services as a security tester has significant assets on its internal networks, and malicious people will attempt to get in and steal those assets. No matter what kind of software you test—software for internal use, external Web sites, or commercial off-the-shelf software—someone will be motivated to attack your products. Improving application security involves designers, developers, and testers, and the role of security testers is one that cannot be underestimated.

With all the books out there on software security, why read this one? I know a lot of ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

The .NET Developer's Guide to Windows Security

Publisher Resources

ISBN: 073562187XErrata Page

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Hunting Security Bugs

by Bryan Jeffries, Tom Gallagher, Lawrence Landauer

Foreword

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.