October Singapore 2021

Overview

As applications and their vulnerabilities become more complex, penetration testers have to be able to handle advanced targets. We'll start the course with a warm-up pen test of a small application using Cross-Site Scripting based on the Document Object Model (DOM) to steal and use a Cross-site Request Forgery (CSRF) token. After our review of this exercise, we will explore some of the more advanced techniques for NoSQL Injection server-based flaws in MongoDB. We will then take a stab at Server-Side Request Forgery (SSRF), Lightweight Directory Access Protocol (LDAP) injection attacks, and Security Markup (SAML) Single Sign On (SSO) privilege escalation. HTTP Desynchronization attacks are also known as request smuggling, which can allow for Web Application Firewall (WAF) bypass. After discovering the flaws, we will work through various ways to exploit these flaws beyond the typical methods used these days. These advanced techniques will help penetration testers find ways to demonstrate these vulnerabilities to their organization through advanced and custom exploitation.

Overview

Cryptographic weaknesses are a major area of web application vulnerabilities, yet very few penetration testers have the skill to investigate, attack, and exploit these flaws. When we investigate web application crypto attacks, we typically target the implementation and use of cryptography in modern web applications. Many popular web programming languages or development frameworks make encryption services available to the developer. However, they often do not protect encrypted data from being attacked, or they enable the developer to use cryptography only weakly. These implementation mistakes are going to be our focus in this section, as opposed to the exploitation of deficiencies in the cryptographic algorithms themselves. We will also explore the various ways applications use encryption and hashing insecurely. Students will learn techniques ranging from identifying types of encryption to exploiting various flaws within encryption or hashing techniques.

Overview

Web applications are no longer limited to the traditional HTML-based interfaces. Web services and mobile applications have become more common and are regularly being used to attack clients and organizations. As such, it has become very important that penetration testers understand how to evaluate the security of these systems. We will explore various techniques to discover flaws within the applications and backend systems. These techniques will make use of tools such as Burp Suite and other automated toolsets. We'll use lab exercises to explore the newer protocols of HTTP/2 and WebSockets, exploiting flaws exposed within each of them. We'll then examine a mobile backend, Representational State Transfer (REST) and Simple Object Access Protocol (SOAP) Application Programming Interfaces ( APIs), Graph Query Language (GraphQL), XML XPath injection, and XML External Entity (XXE) attacks.

Overview

In this section we start exploring the underlying infrastructure of our frameworks and languages. It all begins with an exploration of the architecture of popular frameworks. There is coverage on architectural vulnerabilities found in frameworks even today, such as Mass Assignment. Newer frameworks such as server-side JavaScript frameworks with NodeJS show us some different exploitation options. Students will explore how to abuse vulnerabilities to append our JavaScript code blocks within these frameworks, leading to full system takeover. Next, we'll explore Modern PHP, and while it is a much-maligned language, it is still hugely popular. Our exploration of Modern PHP takes us into types-inference bugs and how these issues can be abused and lead to system manipulation or bypassing controls. We'll then turn to PHP deserialization bugs. Students will get to discover and build custom PHP deserialization payloads. We end the section with a lab that walks the student through building a PHAR payload that causes deserialization to occur, allowing us to exploit the underlying system. The topics covered in this section help us connect to the concepts that will be valuable in the next section, when weâÂÂll be dealing with much more complex frameworks.

Overview

This course section continues the topics of the previous section with web frameworks. We start with Ruby- and Rack-based applications such as Sinatra and Ruby on Rails. Developers can improperly set up the Rack-based applications, and as part of that misconfiguration, we explore the abuse of the middleware layer using Ruby deserialization techniques. Next we'll look at the Java Language and all its complexity. Some maintain that the Java language is a mature, enterprise language, while others claim it to be a complete security failure. Students will review Java's security features and its security failings to discover, assess, and exploit Java Applications. The section features a walkthrough on how to construct Java attacks through Reflection, Serialization Issues, RMI, and the use of Java-Jar-based payloads.

While the Modern Framework Sections ends in Java, students will continue on to the next topic on bypassing application protections. Applications today are using more security controls to help prevent attacks. These controls, such as Web Application Firewalls and filtering techniques, make it more difficult for penetration testers during their testing. The controls block many of the automated tools and simple techniques used to discover flaws. Students will use HTML5, UNICODE, and other encodings that enable discovery techniques to work within the protected application. In the final part of the class, we will abuse a PHP Language feature that uses operating system commands to do its work. Manipulating interpreter functionality like this can yield system compromise, and we demonstrate this in our final lab.