Web Application Obfuscation

'-/WAFs..Evasion..Filters//alert(/Obfuscation/)-'

Mario Heiderich, Eduardo Alberto Vela Nava, Gareth Heyes, David Lindsay

• Publisher: Syngress
• Year: 2011
• Print ISBN: 9781597496049
• eBook ISBN: 9781597496056
• Topic: Computer Science
• Subtopic: Computer Science General
• Index: Computer Science

Web applications are used every day by millions of users, which is why they are one of the most popular vectors for attackers. Obfuscation of code has allowed hackers to take one attack and create hundreds-if not millions-of variants that can evade your security measures. Web Application Obfuscation takes a look at common Web infrastructure and security controls from an attacker's perspective, allowing the reader to understand the shortcomings of their security systems. Find out how an attacker would bypass different types of security controls, how these very security controls introduce new types of vulnerabilities, and how to avoid common pitfalls in order to strengthen your defenses.- Named a 2011 Best Hacking and Pen Testing Book by InfoSec Reviews- Looks at security tools like IDS/IPS that are often the only defense in protecting sensitive data and assets- Evaluates Web application vulnerabilties from the attacker's perspective and explains how these very systems introduce new types of vulnerabilities- Teaches how to secure your data, including info on browser quirks, new attacks and syntax tricks to add to your defenses against XSS, SQL injection, and more

Chapter 1. Introduction

Information in this chapter:

• Audience

• Filtering Basics

• Regular Expressions

• Book Organization

Abstract:

It seems like everyone is connected to the Internet nowadays. Whether it is to watch a favorite TV show, read the latest best-seller, pay bills, or socialize with friends near and far, people are turning to their Internet connection for its speed, flexibility, and reach. Enabling this connectivity are Web applications that allow access to the resources necessary to perform these activities. Unfortunately, many of the security measures used to protect Web applications are inadequate, allowing attackers to identify and exploit weaknesses to compromise the applications. This chapter discusses the goal of this book, which is to highlight the weaknesses in Web application security measures today. In addition to discussing the book's audience, the chapter explains how filtering works and introduces the subject of regular expressions. The chapter concludes with a preview of the remaining chapters, which include obfuscation and attack techniques related to HTML, JavaScript, VBScript, CSS, PHP, and SQL.

Key words: Web obfuscation, Filter, Blacklist, Whitelist, Regular expression, Regular expression pattern, Regular expression character, Greedy, Nongreedy, Restricted repetition

The reach of the Internet is expanding on a daily basis. Devices such as thermostats and televisions include Internet connectivity. Offline activities such as reading a book and socializing are increasingly becoming online activities. Behind the scenes, enabling this connectivity are countless Web applications allowing devices, people, and other applications to access whatever resources they need. Having access to these Web applications is quickly turning from a nicety to a necessity.

Consider the security aspects of a simple transaction such as buying a book from an online retailer. After selecting the book you wish to purchase on the retailer's Web site, you enter your password to authenticate yourself to the shopping cart application. The network traffic between you and the server is encrypted to ensure the confidentiality of your password and your credit card number used to pay for the book. You provide certain personal details about you and your credit card to ensure that no one has stolen your card. Each of these steps includes security measures to ensure the confidentiality of the transaction. Although these security measures are directly visible to end users, the book retailer likely takes many other security measures to protect the application and end users. For example, the Web application may validate data coming from the user to ensure that it does not contain malicious data. Queries to the database may be parameterized so that an attacker cannot send malicious queries to the database. Transaction tokens may be used to ensure that the incoming requests were not maliciously initiated.

Unfortunately, many of the security measures used to protect Web applications are frequently inadequate. An attacker who can identify weaknesses in various security measures can usually find ways to exploit the weakness to compromise the application in one form or another. The purpose of this book is to highlight many types of weaknesses in Web application security measures. In particular, we will focus on little-known obfuscation techniques that can be used to hide malicious Web attacks. These techniques are starting to be actively used in Web attacks, and by shining a light on them, people will be better able to defend against them.

Audience

The information contained in this book is highly technical. Nevertheless, the intent is to present the information in understandable and accessible ways. Penetration testers, security researchers, incident responders, quality assurance testers, application developers, and application architects will all greatly benefit from the contents herein. Additionally, information security and software development prof...

Table of contents

• Cover Image
• Table of Contents
• Front matter
• Copyright
• Acknowledgments
• About the Authors
• About the Technical Editor
• Chapter 1. Introduction
• Chapter 2. HTML
• Chapter 3. JavaScript and VBScript
• Chapter 4. Nonalphanumeric JavaScript
• Chapter 5. CSS
• Chapter 6. PHP
• Chapter 7. SQL
• Chapter 8. Web application firewalls and client-side filters
• Chapter 9. Mitigating bypasses and attacks
• Chapter 10. Future developments
• Index