Hacking websites using Cross Site Request Forgery(CSRF).

What is CSRF?

CSRF is one of the lesser known attacks against websites. In a nutshell CSRF allows you to make a user perform an action on a website without their knowledge. Say you are logged into a forum and it is vulnerable to CSRF. An attacker could send you a link to a completely unrelated website, but within the source code of the attackers website is the code to change the users password on the forum they are logged into.

How does this happen?

CSRF is possible when a website is using only cookies to manage a session. The "same-origin" functionality incorporated into HTTP still allows requests from another website but will not send any data back. This one way functionality is enough to perform simple once off tasks. So we can still change passwords and update accounts but will not see any response. This is fine because we do not need the response anyway. We just need to submit the criteria and submit the form. The victim must also be logged into the website for this to work. Because they are already logged in and our code sends them to the website, we do not need their password. There session cookie lets them in without needing to re-enter the password. 

The Attack

For this attack I will be using Mutillidae and burp suit for the interception proxy as usual. You can download it from http://sourceforge.net/projects/mutillidae/  

I will be using the Register account form in Mutillidae.

  

What we need to do is basically recreate the form for registering a user. We can do this by either checking the source code or my preferred way of capturing the request in an interception proxy. 

As you can see when submitting the form you can see the form fields we are required to create:

So now we simply have to recreate this form and submit it with some simple javascript like so:

Now we just send the victim a link to this page and the result is this:

This is a super simple proof of concept. Most times you will either have a meta tag redirect to another page or simply have this page load off screen while displaying another page within the users view.

Think about if this was sent to an administrator. Or if it was a change password form or a confirm bank transfer...

Prevention

Protecting against this attack is usually just a matter of providing anti-csrf tokens that are issued to the user and submitted with each form submission. This way in order for an attacker to perform the attack they need the anti-csrf token along with the other form data. Without the token the form will not submit. While there are ways to get the token such as XSS and some multi stage attacks, as long as the tokens are issued correctly CSRF attacks can be rendered impossible.

SQL Injection with SQL Map and bypassing JavaScript filters.

This post will go through what is required for a basic SQL Injection as well as how to bypass input filters enforced by javascript. 

What is SQL injection?

SQL injection is a technique used to manipulate a back end database by inputting specially crafted sql syntax into an input field and causing the back end database to run it. The most basic of injections and usually the first one you should try once you have found an injection point is simply admin' or 1=1 -- If you put this into a user name field the query that results is: SELECT * FROM users WHERE username = 'admin'' or 1=1 -- As you can see the username is closed off with the extra ' and then checks if 1=1 which it does and then comment out the rest of the query with -- to cancel the password check. So basically its saying if the username is admin OR if 1 = 1 log me in. This is if the database is mysql which is very common. Their are cheat sheets available for every database out there if this command does not work or it is not a MySQL database.

SQL is a huge topic and there are many different types of injections. The above is the most simplest and easiest to understand the concept. This post should give you an idea of how complex injections can get. Im currently waiting for the book "SQL Injections, Attacks and defence." by Justin Clarke to arrive in the mail so I can get a better grip on the more advanced injections that sqlmap may not pick up.

SQL Injection can be used for updating a database with new users and changing passwords, deleting data, bypassing logins, accessing and downloading databases and even completely compromising the underlying system.

How does this happen?

Injections happen when user input is not "sanitized", meaning any sql syntax is not filtered out so it gets interpreted by the database as a legitimate query. To avoid injections you should always sanitized and filter any user input on every single field that is interacting with a database. Even cookies and hidden fields. 

 I will cover the Javascript filter bypass as I go through the attack. 

For this attack I will be using the vulnerable web app "Mutillidae". It can be downloaded from: 

http://sourceforge.net/projects/mutillidae/files/mutillidae-project/

Il be using the vulnerable login screen located under: Owasp 2013, A1 Injection(SQL), SQLi Bypass Authentication. I have also set the security level to Arrogent to enable the javascript filter. 

Usually the first way to check for an injection point is to simply add the ' character. This closes off the statement and should result in an error if input is not sanitized. In this case the javascript filter is attempting to block the character. 

And important thing to note here is blacklisting is BAD because there are so many other characters that can get around and be used for the same purpose as the characters being blocked. If you do ever need to block characters, use a white list and white list the allowed characters so every other character is blocked by default. That stops the almost unlimited possibilities of bypassing a blacklist.

Ok so this is clearly javascript causing this alert so if we take a look at the source code we find the code that is doing this:

Its doing two checks here. The first is checking if the input length is greater than 15. And the second is the blacklist. 

The most simplest way to get around this by turning off JavaScript... Its literally that easy to get around javascript filters... However a more elegent way is to send a valid request and catch it after the java has run but before it has been sent to the server ;) 

To do this we use an intercepting proxy to catch every request we make. That way we can alter it after any javascript has been run and then send it on its way. The proxy I will be using is Burp Suite. Simply run burp and configure your browsers proxy to 127.0.0.1:8080. Enter allowed characters into the login, turn on intercept in burp and login:

Burp will catch it after the java filter has checked your input. Now you can add the ' after the username. Forward the request and check if you receive an error. Note, that in the event you do not receive an error that does not mean the application is not still vulnerable. It may just be filtering out the errors and returning you back to the login page. You may be able to still use other techniques such as BLIND injection to exploit it.

The '  character did confuse the database and caused it to throw us an error. This error gives us quite a lot of information about the back end database. We have a full path disclosure:

/var/www/mutillidae/classes/MySQLHandler.php

The  database version:

client_info: 5.5.40

That is running on Unix
host_info: Localhost via UNIX socket

The Database is MySQL
error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''asadf''' at line 1

The table that holds the username information and the database:

Query: SELECT username FROM accounts WHERE username='asadf''; (0) [Exception] 

So after that very informative error we know the database is MySQL and that it is vulnerable to injection. So as I stated at the start of this post the first query we should try is admin' or 1=1 -- Two things to note here is that admin can be anything and there needs to be a space after -- . Again catch a request to bypass the filter and change the username.

I did have to play with the syntax a bit. The one that worked was the one above. Adding spaces between each character did the trick. The query that got send to the server was:

SELECT username FROM accounts WHERE username='admin'' or 1 = 1 -- ; This returned true and let us in :)

Our result:

In this case injection was used to bypass the login and get admin access. If you performed this on a page where you where viewing your account or changing a password you may end up changing everyones password, or viewing everyones account. 

Introducing SQLMap

So what if you want more than just accessing the admin account or some usernames and passwords? What if you know there are more databases on the system and cant access them via manual injection? And what if all of your manual techniques have failed or are very slow? This is where sqlmap comes in. SQLMap is an extremely powerful tool and does have the ability for misuse by script kiddies. SQLmap automates every type of injection and can perform infinite amounts of techniques multiple times a second. SQLMap was written by: Bernardo Damele and Miroslav Stampar and can be downloaded from: http://sqlmap.org/

SQLMap is used via the console. Type in sqlmap -hh to get a list of options.

You will get a list of all of the options available to you. There are a lot and they are all well worth researching and learning if you want to use this tool effectively. It even includes a wizard for new users to use. sqlmap --wizard.

The way I will be using sql map is by saving my login request that I caught in burp. Simply login to your mutillidae login again and catch the request then right click and choose save to file. After you have done that run this command:

sqlmap -r ~/Desktop/mutilInject -p username --dbms mysql --dbs

-r = your request file you saved from the burp capture. The -r stands for request. -p is the username field. --dbms specifies the database since we found that in our initial injection test. --dbs means if you find an injection tell me all of the databases on the system. The other common option to save you using a saved request is to specify the url with -u instead of -r.

If you require anonymity you can go through the tor network by starting TOR service and adding the commands --use-tor --tor-type SOCKS5 --check-tor

I chose to add a random user agent so it randomizes my browser a bit.

Once you run the command it will go off and test different types of injections on the username field. As you can see it found that it is vulnerable to AND error based injection. A good practice is to turn up the verbosity with -v 6 so you can see exactly what it is doing and what queries it is trying so you can get a better understanding of every injection technique. -v has options 1 to 6 depending on how much you want to see. Here is a screen shot of a UNION attack with the verbosity turned to 3:

If you know what the application is vulnerable too you can specify what type of attack to use with the --technique U switch. In that case the U means UNION. By default sqlmap will check for every type of attack.

So as its found an injection there is no need to continue looking for more. After pressing N we can see the databases returned to us from the --dbs command. 

We have 5 databases on this server. The one we want is the Muttilidae one which is nowasp. So now we have choses our database and we want to see what information is inside it:

 sqlmap -r ~/Desktop/mutilInject --random-agent -p username --dbms mysql -D nowasp --tables

-D selects the database nowasp and --tables enumerates all of the tables inside it. After running the command we get the table listing:

Interesting that there is a table called "credit_cards". We could enumerate all of the columns inside the table with -D nowasp -T credit_cards --columns but lets just go ahead and download that entire table instead.

sqlmap -r ~/Desktop/mutilInject --random-agent -p username --dbms mysql -D nowasp -T credit_cards --dump

The --dump by default dumps into a csv file. After it completes sqlmap displays the dumped table onto the screen and lets you know where it saved the csv:

All of this was possible from a single input field that did not sanitize its input... Now if you think this is bad enough, it is sometimes possible to upload a meterpreter shell onto the box and completely own the entire network. All of this from one vulnerable input field... This screen shot shows some of the more destructive commands you could use.