Intro to Web App Hacking
Today I attended an “Intro to Web Application Hacking” class hosted by http://twitter.com/alphaonelabs hackerspace and sponsored by OWASP. This is the first class of its kind that I have attended, so I will do a short writeup on what I learned today.
For starters everyone was excepted to show up with the following installed:
- Linux
- VirtualBox or a VM containing windows XP
- IE6 or IE7 with these plugins: Fiddler, Tamper IE and Web Scarab
- FireFox with these plugins: XSS Me, SQL Inject Me and Hacker Bar
A one time use VM may be provided for attendees on premises for anyone who didn’t get a chance to install the required applications.
The presenter began by going over the agenda for the day then quickly moved into the fun hands on portion, and as mentioned several times in the class today “only proform these test on a site that you have been given permission” to test.
Below are list of sites that were used today in class, and are publicly available for anyone wanting to practice there web testing kung fu:
http://www.bayden.com/sandbox/shop
http://www.fiddler2.com/sandbox/shop
http://testaspnet.acunetix.com
http://zero.webappsecurity.com
You can also setup your own environment at home by using any of the following:
Damn Vulnerable Web App by http://twitter.com/ethicalhack3r –> http://www.dvwa.co.uk/download.php
Mutillidae by http://www.irongeek.com –> www.irongeek.com/downloads/mutillidae1.3.zip
The first exercise was simply running THC SSLCHECK , THC SSL Check is a small tool that checks the remote SSL stack for supported ciphers and versions. Useful for pen-testing for weak SSL configuration discovery. This is a command line tool that runs on Windows
Fig 1
As you can see from the above image the host is not using SSLv2 and for good reasons since they are a few security related issues that pertains to this version. If you look a bit closer you will see the host is also using 128 bit encryption which shows that someone knows what the are doing.
Next we went on to test a few demo shopping sites by using Tamper IE to change the price of the item from the intended price to one of our liking. Before performing this test you have to insure that you configure Tamper IE to tamper with both POST and GET request.
Demo site used: http://www.bayden.com/sandbox/shop
Original item price for the Laptop was $1095
Fig2
After hitting the checkout button on the demo site you will be prompted with the Temper IE edit request box. Click the” PretyPost” button then click on the cost line and just type in the price you would like to pay for the Laptop, I choose $95 and I also changed the quantity to 2, lastly click “send alerted data” to complete your request.
Fig 3
Fig 4
As you can see in the end I paid what I desired instead of what the item was listed for. The later end of the class was about Q&A as well as using XSS ME/SQL Inject Me as well as http://ha.ckers.org/sqlinjection/ to try and break into http://demo.testfire.net.
For an intro class I have to say I didn’t except to learn so much, so special thanks to Alphaone Labs!
