Security Testing: hijack

Showing posts with label hijack. Show all posts

Thursday, July 5, 2018

Denial of Service (DoS)

Denial of service attacks are most common to take website and servers down. It is easy to attack and hard to protect. The way to prevent of an attack is to block the response to the attackers. Catch the attacker as early as possible after the request has been received by the web server.

There are two challenges to blocking the attacks

Identify the attackers

Block the response only to the attackers

First to catch the request as early as possible, an HttpModule is the right place. It is executed before any page or any other handler so the impact on the server can be minimized. This HttpModule monitors all requests and block requests coming from IP addresses that make many requests in a short period of time. After a while the attacking IP address gets released from blocking.

Implementation

Download the DosAttackModule.cs file below and put it into the App_Code folder of your website. Then add the following lines to the web.config’s <system.web> section:

< httpModules >

< add type = " DosAttackModule " name = " DosAttackModule " />

</ httpModules >

SQL Injection

Nowadays SQL injection is a common attack that use malicious SQL injection code for database manipulation to access information.

When exploiting SQL injection, the web application display error message from the database. Database complaining that the query syntax is incorrect.

Gain the unauthorized access to the website through the SQL Injection and take the information.

How to exploit:-

Take a simple username (admin) and password we choose

‘ OR ‘a’=’a

From users WHERE user=’admin’ AND password=’ ‘ OR ’a’=’a’

‘a’ = ‘a is a true value

Let's analyze

Username=’admin’ AND Password=’’ OR ‘a’=’a’

Means username password true

Use Burp suite tool and inject the customize attack through Intruder

Here we introduce some SQL attack.

or 1=1
or 1=1--
admin' or '1'='1
admin' or '1'='1'--
admin' or '1'='1'# ………….etc

How to Fix:-

1. Use stored procedure

2. Use parameterize query

3. Limit database permission and privilege

4. Avoid display database error directly to the user

5. Use the regular expression to identify the text block and sql statements

Wednesday, June 6, 2018

Clickjacking Attack and Prevention

Clickjacking:-

This type of attack requires an attacker to use javascript. Attacker insists a user perform an undesired action by clicking on a concealed link. The attacker loads another page on it in a transparent layer.

The attacker hijacks the click event of their page and routing them to another page.

<HTML>

<head>

<title>click</title>

</head>

<body>

<p>website vulnerable clickjacking</p>

</body>

</HTML>

Defend:-

Use clear click functionality in No script. You can use the relaxed setting but make sure you can enable the clear click. This prevents the clickjacking attacks.

Server-side: Sending the proper Content Security Policy (CSP) frame-ancestors directive response headers

The two most popular are X-Frame-Options: Deny and X-Frame-Options: SameOrigin.

Client-side: Most commonly use frame busting code typically consists of a "conditional statement" and a "counter-action" statement. The aim of this technique is to prevent a site from functioning when it is loaded inside a frame.