Advanced Filter Evasion and Web Application Firewall Bypassing



Similar documents
COURSE DETAILS. Introduction to Ethical Hacking. FootPrinting. What is Hacking. Who is a Hacker. Skills of a Hacker.

Ethical Hacking & Countermeasure Specialist. Course Title: Ethical Hacking & Countermeasure Specialist: Web Applications and Data Servers

Alexsys Team 2 Service Desk

The Acunetix Web Vulnerability Scanner

WEB APPLICATION SECURITY TESTING

Bitrix Intranet. Product Requirements

CNS-205: Citrix NetScaler 11 Essentials and Networking

(WAPT) Web Application Penetration Testing

Responsive Design Fundamentals Chapter 1: Chapter 2: name content

2. When logging is used, which severity level indicates that a device is unusable?

Web Application Hacking (Penetration Testing) 5-day Hands-On Course

The user authentication process varies from client to client depending on internal resource capabilities, and client processes and procedures.

Arjun V. Bala Page 25

CNS-205 Citrix NetScaler 10.5 Essentials and Networking

RedCloud Security Management Software 3.6 Release Notes

McAfee Host Intrusion Prevention Content 4865

Instructions for Configuring a SAFARI Montage Managed Home Access Expansion Server

esafe SmartSuite Release Notes

Citrix XenApp 6.5 Basic Administration

Acunetix Website Audit. 5 November, Developer Report. Generated by Acunetix WVS Reporter (v8.0 Build )

Readme File. Purpose. What is Translation Manager 9.3.1? Hyperion Translation Manager Release Readme

Polymorphic Shellcodes vs. Application IDSs

Avatier Identity Management Suite

EC-Council Certified Secure Programmer-.NET

Web Application Attacks And WAF Evasion

Serv-U Distributed Architecture Guide

Nex-Gen Web Load Balancer

Ten Steps for an Easy Install of the eg Enterprise Suite

Introduction LIVE MAPS UNITY PORTAL / INSTALLATION GUIDE Savision B.V. savision.com All rights reserved.

Improved Data Center Power Consumption and Streamlining Management in Windows Server 2008 R2 with SP1

Copyright 2013, SafeNet, Inc. All rights reserved. We have attempted to make these documents complete, accurate, and

1. Can you access the login screen for Blackbaud s online learning environment Centra?

SBClient and Microsoft Windows Terminal Server (Including Citrix Server)

JAVA/J2EE Course Syllabus

SortSite Technical Overview White Paper

Using Sentry-go Enterprise/ASPX for Sentry-go Quick & Plus! monitors

CallRex 4.2 Installation Guide

Best Practice - Pentaho BA for High Availability

Client Application Installation Guide

An Overview of Honeywell s Secure Remote Access to Process Control Systems

MANAGED VULNERABILITY SCANNING

Detecting and Exploiting XSS with Xenotix XSS Exploit Framework

McAfee Enterprise Security Manager. Data Source Configuration Guide. Infoblox NIOS. Data Source: September 2, Infoblox NIOS Page 1 of 8

ACTIVITY MONITOR Real Time Monitor Employee Activity Monitor

ASL IT SECURITY BEGINNERS WEB HACKING AND EXPLOITATION

What's New. Sitecore CMS 6.6 & DMS 6.6. A quick guide to the new features in Sitecore 6.6. Sitecore CMS 6.6 & DMS 6.6 What's New Rev:

1 GETTING STARTED. 5/7/2008 Chapter 1

Considerations for Success in Workflow Automation. Automating Workflows with KwikTag by ImageTag

Welcome to Remote Access Services (RAS)

Integrating With incontact dbprovider & Screen Pops

CryptoMate64. USB Cryptographic Token. Technical Specifications V1.03. Subject to change without prior notice.

Webalo Pro Appliance Setup

ASL IT Security Advanced Web Exploitation Kung Fu V2.0

CXA-204-1I Basic Administration for Citrix XenApp 6

Installation Guide Marshal Reporting Console

GUIDANCE FOR BUSINESS ASSOCIATES

Session 9 : Information Security and Risk

Datasheet. PV4E Management Software Features

How to deploy IVE Active-Active and Active-Passive clusters

Ads SPA with AngularJS Lab

Network Layout. Browser/Client Requirements. Features. Graphics

Chapter 1 Web Application (In)security 1

A Tale of the Weaknesses of Current Client-side XSS Filtering

IS 218 Introduction to Website Development Fall Course Syllabus

Product Documentation. New Features Guide. Version 9.7.5/XE6

MaaS360 Cloud Extender

EC-Council CAST CENTER FOR ADVANCED SECURITY TRAINING. CAST 619 Advanced SQLi Attacks and Countermeasures. Make The Difference CAST.

METU. Computer Engineering

Cloud Services Frequently Asked Questions FAQ

Volume 2, Issue 11, November 2014 International Journal of Advance Research in Computer Science and Management Studies

Web-Application Security

What about MongoDB? can req.body.input 0; var date = new Date(); do {curdate = new Date();} while(curdate-date<10000)

CXA Citrix XenApp 6.5 Basic Administration

Extending Microsoft Dynamics CRM 2013 Online Training

Plus500CY Ltd. Statement on Privacy and Cookie Policy

E-Biz Web Hosting Control Panel

Deployment Overview (Installation):

Implementing ifolder Server in the DMZ with ifolder Data inside the Firewall

Using Sitecore Fast Query

EVALUATING COMMERCIAL WEB APPLICATION SECURITY. By Aaron Parke

Exercise 5 Server Configuration, Web and FTP Instructions and preparatory questions Administration of Computer Systems, Fall 2008

Last update: February 23, 2004

Transcription:

Advanced Filter Evasin and Web Applicatin Firewall Bypassing Encding and Filtering - understanding what kind f data encding us being used and hw it wrks is fundamental in ensuring that tests are perfrmed as intended Data Encding basics Dissecting encding types URL Encding HTML Encding Dcument character encding Character references Base (36 64) encding Unicde encding Multiple (De En)cdings Filtering basics Regular Expressins Metacharacters Shrthand character classes Nn-printing characters Unicde Web Applicatin Firewall WAF Detectin and Fingerprinting Client-side Filters Evasin Basic - advanced cverage f the mst mdern filter evasin techniques using different client side and server side languages. T have cmplete understanding f filters and encding this sectin intrduces the main Evasin Techniques that start frm Base64 and lesser knwn URI bfuscatin techniques and cncludes with JavaScript and PHP Obfuscatin techniques Base64 evasin URI Obfuscatin techniques URL shrtening URL Hstname bfuscatin JavaScript Obfuscatin Techniques JavaScript Encding Nn-alphanumeric JavaScript Cmpressing Minifying Packing PHP Obfuscatin Techniques Basic Language Reference Type Juggling Numeric Data types String Data types Array Data types Variable Variables Nn-alphanumeric Cde String generatin

Crss-Site Scripting - advanced attack techniques and extic XSS vectrs, hw t explit any kind f XSS with the mst advanced tls available Crss-Site Scripting Reflected XSS Persistent XSS DOM XSS Universal XSS XSS Attacks Ckie Grabbing Script Injectin Ckie Recrding and Lgging Bypassing HTTPOnly flag Crss-site Tracing(XST) CVE: 2012-0053 BeEF s Tunnelling Prxy Defacements Virtual Defacement Persistent Defacement Phishing Keylgging Keylgging with Metasplit Keylgging with BeEF Netwrk Attacks IP detectin Subnet detectin Ping Sweeping Prt Scanning Simple Prt Scanner HTML5 alternatives Self-XSS Brwsers security measures Chrmium based brwser Mzilla Firefx based brwser Internet Explrer Safari JavaScript cnsle limitatins Extic XSS Vectrs Mutatin-based XSS mxss Examples mxss Multiple Mutatins XSS Filter Evasin and WAF bypassing techniques - Starting frm simple Blacklisting filters t different mechanisms t bypass cmmn input sanitizatin techniques, brwser filters and much mre. Bypassing Blacklisting Filters Injecting Script Cde Bypassing weak <script> tag banning MdSecurity > Script tag based XSS Beynd <script> tag - using HTML events Keywrd based filters Character escaping Unicde Decimal, Octal, Hexadecimal Cnstructr Strings

Executin Sinks Pseud-prtcls data vbscript Bypassing Sanitizatin String manipulatins Remving HTML Tags Escaping Qutes Escaping Parenthesis Bypassing Brwser Filters (Un)Filtered Scenaris Injecting inside HTML Tag Injecting inside HTML attributes Injecting inside SCRIPT tag Injecting inside event attributes DOM Based Other Scenaris SQL Injectin - Advanced Attack Techniques n different DBMS's SQL Injectin Expliting SQLi Techniques Classificatin Gathering Infrmatin frm the envirnment Identify the DBMS Errr Cde Analysis > MySQL Errr Cde Analysis > MSSQL Errr Cde Analysis > Oracle Banner Grabbing Educated Guessing String Cncatenatin Numeric Functins SQL Dialect Enumerating the DBMS Cntent MySQL MSSQL Oracle Tables and Clumns Users and Privileges Advanced SQLi Explitatin Out-f-Band Explitatin Alternative OOB Channels OOB via HTTP Oracle URL_HTTP Package Oracle HTTPURITYPE Package OOB via DNS DNS Exfiltratin Flw Prvking DNS requests MySQL MSSQL Oracle Expliting Secnd-Order SQL Injectin First-rder example Security Cnsideratins Autmatin Cnsideratins

SQLi Filter Evasin and WAF Bypassing - Advanced Attack Techniques n different DBMS s. Recgnizing the presence f WAF s and filters and implement effective bypassing techniques. SQLi Filter Evasin and WAF Bypassing DBMS gadgets Functins Cnstants and variables System variables Typecasting Bypassing Keywrds filters Using cmments Case changing Replaced keywrds Circumventing by Encding URL encde Duble URL encde Characters encding Inline cmmnets Allwed Whitespaces Bypassing Functins Filters Bypassing Regular Expressin filters Crss-Site Request Frgery - explit Weak Anti-CSRF mechanisms cncluding with Advanced Explitatin techniques XSRF Vulnerable scenaris Attack Vectrs Frce Brwsing with GET Example - change email address Pst Requests Aut-submitting frm > v1 Aut-submitting frm > v2 Expliting Weak Anti-CSRF Measures Using Pst-nly requests Multi-Step Transactins Checking Referer Header Predictable Anti-CSRF tken Unverified Anti-CSRF tken Secret Ckies Advanced CSRF Explitatin Bypassing CSRF defences with XSS Bypassing Anti-CSRF Tken Request a valid frm with a valid tken Extract the valid tken frm the surce cde Frge the frm with the stlen tken HTML5 - what are the mst cmmn security mechanisms develper use: these are critical t understand hw t leverage even mre sphisticated attacks. Analysis f UI rendering attacks and an verview f related new Attack Vectrs intrduced with HTML5 HTML5

Semantics New attack vectrs Frm Elements Media Elements Semantic/Structural Elements Attributes Offline and Strage Web Strage > Attack Scenari Sessin Hijacking Offline Web Applicatin > Attack Scenati Device Access Gelcatin > Attack Scenari Fullscreen mde > Attack Scenari Phishing Perfrmance, Integrity and Cnnectivity Attack Scenaris Expliting HTML5 CORS Attack Scenari Universal Allw Allw by wildcard value * Allw by server-side Weak Access Cntrl Check Origin Example Intranet Scanning JS-Recn Remte Web Shell The Shell f the Future Strage Attack Scenari Web Strage Sessin Hijacking Crss-directry attacks User Tracking and Cnfidential Data disclsure IndexedDB IndexedDB vs WebSQL Database Web Messaging Attack Scenaris Web Messaging DOM XSS Origin Issue Web Sckets Attack Scenris Web Sckets Data Validatin MiTM Remre Shell Netwrk Recnnaissance Web Wrkers Attack Scenaris WebWrkers Brswer-Based Btnet Distributed Passwrd Cracking DDS Attacks HTML5 Security Measures Security Headers X-XSS-Prtectin X-Frame-Optins Strict-Transprt-Security X-Cntent-Type-Optins Cntent Security Plicy UI Readressing: The x-jacking Art ClickJacking LikeJacking StrkeJacking

New Attack Vectrs in HTML5 Drag-and-Drp Text Field Injectin Cntent Extractin XML Attacks - mst mdern related attacks such as XML Tag Injectin, XXE, XEE, Path Injectin. Fr each f them basic and advanced explitatin techniques are analysed XML Attacks Entities blck XML Dcument with External DTD + Entities XML Tag Injectin Testing XML Injectin Single/Duble Qutes Ampersand Angular parentheses XSS with CDATA XML external Entity Taxnmy External Entities: Private vs Publix Resurce Inclusin Resurce Inclusin - Imprved Invalid resurce t extract CDATA Escape using Parameter Entities PHP://I/O Stream Bypassing Access Cntrl Out-Of-Band Data Retrieval OOB via HTTP OOB via HTTP using XXEServe XML Entity Expansin Recursive Entity Expansin Billin Laugh Attack Generic Entity Expansin Quadratic Blwup Attack Remte Entity Expansin XPath Injectin XPath 1.0 vs 2.0 New Operatins and Expressins n Sequences Functins n Strings Functin accessrs FOR Operatr Cnditinal Expressin Regular Expressin Assemble/Disassemble String Data Types Advanced XPath Explitatin Blind Explitatin Errr Based Blean Based OOB Explitaitn HTTP Channel DNS Channel