Web Application Security Testing on vanstechelman.eu

Testing for CVE-2018-11784 - Apache Struts 2 Open Redirect vulnerability

Thu, 04 Oct 2018 07:57:17 +0000

On Wednesday 3 October 2018 the Apache Software Foundation has released information about an Open Redirect vulnerability in Apache Struts 2. The vulnerability received identifier CVE-2018-11784.

The vulnerability announcements describes the vulnerability as follows:

When the default servlet returned a redirect to a directory (e.g. redirecting to ‘/foo/’ when the user requested ‘/foo’) a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.

Anatomy of the SQL injection in Drupal’s database comment filtering system SA-CORE-2015-003

Thu, 20 Aug 2015 20:54:03 +0000

In the Drupal security advisory that was released on August 19th, 2015 Drupal’s security team announced that it solved an SQL injection vulnerability in the Drupal database API.

The security advisory contained the following description of the SQL injection vulnerability:

A vulnerability was found in the SQL comment filtering system which could allow a user with elevated permissions to inject malicious code in SQL comments.

The following sections in this article explain where exactly the problem is located in Drupal and what the vulnerability is. Next it will explain when a Drupal site is vulnerable and how the vulnerability has been solved in the Drupal core code.

Cookie replay attacks in ASP.NET when using forms authentication

Sat, 13 Sep 2014 08:08:15 +0000

Microsoft ASP.NET 4.5 and earlier versions contain a weakness in the Forms Authentication functionality whereby user sessions are not properly terminated when a user logs out of the session. As a result, users are vulnerable to session hijacking even after logging out of the web application.\

This weakness isn’t new. There exists an article on Microsofts Knowledge Base that explains exactly this issue. So why is it important to mention it here again? Because the above KB-article was written for ASP.NET 2! The original KB publication date is unknown, but the revision information show that the KB-article was last updated in May 2007! This means that this issue in ASP.NET is already known for more than 7 years and it has survived several major ASP.NET versions.\

Solution for java.lang.ClassNotFoundException when loading your Burp Suite extention

Sat, 27 Jul 2013 15:00:18 +0000

When building your own Burp Suite extension, it can occur that compiling your code and creating the jar works find, but that you get the exception java.lang.ClassNotFoundException when loading your extention in Burp Suite. This article shows the solution to your problem.

Creating and building Burp Suite extention using Java command-line tools

Sat, 27 Jul 2013 14:35:58 +0000

Burp Suite allows you to easily write your own plugins, to perform complex and highly customized tasks within Burp. PortSwigger (the developer behind Burp Suite) created a series of blog posts wherein he explains what can be done with Burp Extensions. In his first blog post about the subject (see Writing your first Burp Suite extension) PortSwigger explains how you can build your own extension using an IDE. Some of us prefer however to not use a heavy IDE, but to compile the jar from the command-line. This article show how to use the javac and the jar command to create your Burp extension from the command-line.

Testing randomness with Stompy

Thu, 04 Apr 2013 13:27:11 +0000

Stompy is a fairly advanced entropy verifier for session cookies, XSRF tokens, OTPs, and other random data. It goes well beyond FIPS-140-2, performing n-dimensional spectral testing as well.

Backtrack 4 customization

Fri, 20 May 2011 07:37:11 +0000

This page is mainly a checklist for myself to know how I have to customize a freshly downloaded version of Backtrack 4. ### Change keyboard layout Use the following command to change the keyboard layout: dpkg-reconfigure console-setup Accept all default, except changing the origin to Belgium (if you want to use be-latin1). ### Update all packages apt-get update apt-get upgrade ### Configure SSH You still have to generate your SSH keys sshd-generate

Using SkipFish through Burp Suite

Wed, 18 May 2011 12:30:08 +0000

This how-to explains you how to use SkipFish through a proxy. It will show you how you have to configure Burp Suite and which parameters you need to supply to SkipFish so that all SkipFish’s traffic will flow nicely through Burp Suite.

HTML event handlers

Mon, 21 Dec 2009 13:31:13 +0000

The following is a list of event handlers which can be used in HTML code to execute Javascript code.

FSCommand(): attacker can use this when executed from within an embedded Flash object
onAbort(): when user aborts the loading of an image
onActivate(): when object is set as the active element
onAfterPrint(): activates after user prints or previews print job
onAfterUpdate(): activates on data object after updating data in the source object
onBeforeActivate(): fires before the object is set as the active element
onBeforeCopy(): attacker executes the attack string right before a selection is copied to the clipboard - attackers can do this with the execCommand(“Copy”) function
onBeforeCut(): attacker executes the attack string right before a selection is cut
onBeforeDeactivate(): fires right after the activeElement is changed from the current object
onBeforeEditFocus(): Fires before an object contained in an editable element enters a UIactivated state or when an editable container object is control selected
onBeforePaste(): user needs to be tricked into pasting or be forced into it using the execCommand(“Paste”) function
onBeforePrint(): user would need to be tricked into printing or attacker could use the print() or execCommand(“Print”) function
onBeforeUnload(): user would need to be tricked into closing the browser - attacker cannot unload windows unless it was spawned from the parent
onBlur(): in the case where another popup is loaded and window looses focus
onBounce(): fires when the behavior property of the marquee object is set to “alternate” and the contents of the marquee reach one side of the window
onCellChange(): fires when data changes in the data provider
onChange(): select, text, or TEXTAREA field loses focus and its value has been modified
onClick(): someone clicks on a form
onContextMenu(): user would need to right click on attack area
onControlSelect(): fires when the user is about to make a control selection of the object
onCopy(): user needs to copy something or it can be exploited using the execCommand(“Copy”) command
onCut(): user needs to copy something or it can be exploited using the execCommand(“Cut”) command
onDataAvailible(): user would need to change data in an element, or attacker could perform the same function
onDataSetChanged(): fires when the data set exposed by a data source object changes
onDataSetComplete(): fires to indicate that all data is available from the data source object
onDblClick(): user double-clicks a form element or a link
onDeactivate(): fires when the activeElement is changed from the current object to another object in the parent document
onDrag(): requires that the user drags an object
onDragEnd(): requires that the user drags an object
onDragLeave(): requires that the user drags an object off a valid location
onDragEnter(): requires that the user drags an object into a valid location
onDragOver(): requires that the user drags an object into a valid location
onDragDrop(): user drops an object (e.g. file) onto the browser window
onDrop(): user drops an object (e.g. file) onto the browser window
onError(): loading of a document or image causes an error
onErrorUpdate(): fires on a databound object when an error occurs while updating the associated data in the data source object
onExit(): someone clicks on a link or presses the back button
onFilterChange(): fires when a visual filter completes state change
onFinish(): attacker can create the exploit when marquee is finished looping
onFocus(): attacker executes the attack string when the window gets focus
onFocusIn(): attacker executes the attack string when window gets focus
onFocusOut(): attacker executes the attack string when window looses focus
onHelp(): attacker executes the attack string when users hits F1 while the window is in focus
onKeyDown(): user depresses a key
onKeyPress(): user presses or holds down a key
onKeyUp(): user releases a key
onLayoutComplete(): user would have to print or print preview
onLoad(): attacker executes the attack string after the window loads
onLoseCapture(): can be exploited by the releaseCapture() method
onMouseDown(): the attacker would need to get the user to click on an image
onMouseEnter(): cursor moves over an object or area
onMouseLeave(): the attacker would need to get the user to mouse over an image or table and then off again
onMouseMove(): the attacker would need to get the user to mouse over an image or table
onMouseOut(): the attacker would need to get the user to mouse over an image or table and then off again
onMouseOver(): cursor moves over an object or area
onMouseUp(): the attacker would need to get the user to click on an image
onMouseWheel(): the attacker would need to get the user to use their mouse wheel
onMove(): user or attacker would move the page
onMoveEnd(): user or attacker would move the page
onMoveStart(): user or attacker would move the page
onPaste(): user would need to paste or attacker could use the execCommand("Paste") function
onProgress(): attacker would use this as a flash movie was loading
onPropertyChange(): user or attacker would need to change an element property
onReadyStateChange(): user or attacker would need to change an element property
onReset(): user or attacker resets a form
onResize(): user would resize the window; attacker could auto initialize with something like: <SCRIPT>self.resizeTo(500,400);</SCRIPT>
onResizeEnd(): user would resize the window; attacker could auto initialize with something like: <SCRIPT>self.resizeTo(500,400);</SCRIPT>
onResizeStart(): user would resize the window; attacker could auto initialize with something like: <SCRIPT>self.resizeTo(500,400);</SCRIPT>
onRowEnter(): user or attacker would need to change a row in a data source
onRowExit(): user or attacker would need to change a row in a data source
onRowDelete(): user or attacker would need to delete a row in a data source
onRowInserted(): user or attacker would need to insert a row in a data source
onScroll(): user would need to scroll, or attacker could use the scrollBy() function
onSelect(): user needs to select some text - attacker could auto initialize with something like: window.document.execCommand("SelectAll");
onSelectionChange(): user needs to select some text - attacker could auto initialize with something like: window.document.execCommand("SelectAll");
onSelectStart(): user needs to select some text - attacker could auto initialize with something like: window.document.execCommand("SelectAll");
onStart(): fires at the beginning of each marquee loop
onStop(): user would need to press the stop button or leave the webpage
onSubmit(): requires attacker or user submits a form
onUnload(): as the user clicks any link or presses the back button or attacker forces a click

Using the WebScarab bean shell to modify requests/responses

Sun, 10 Feb 2008 11:40:57 +0000

This article shows how you can use the WebScarab bean shell to modify requests and responses that are transmitted and received by WebScarab.