Web Attacks and Countermeasures

Web Attacks and Defense

1. Introduction

What is a web application? Why web applications are the first target for hackers? What are the attacks Web applications usually face, how to prevent from these attacks. Lets start from the various web application attacks. This article is divided into three areas including types of attacks, countermeasures and risk factor.

2. ATTACKS

Following are the most common web application attacks.

a. Remote code execution

b. SQL injection

c. Format string vulnerabilities

d. Cross Site Scripting (XSS)

e. Username enumeration

Remote Code Execution

As the name suggests, this vulnerability allows an attacker to run arbitrary, system level code on the vulnerable web application server and retrieve any desired information contained therein. Improper coding errors lead to this vulnerability. At times, it is difficult to discover this vulnerability during penetration testing assignments but such problems are often revealed while doing a source code review. However, when testing Web applications is important to remember that exploitation of this vulnerability can lead to total system compromise with the same rights as the Web server itself is running with.

SQL Injection

SQL injection is a very old approach but it's still popular among attackers. This technique allows an attacker to retrieve crucial information from a Web server's database. Depending on the application's security measures, the impact of this attack can vary from basic information disclosure to remote code execution and total system compromise.

Format String Vulnerabilities

This vulnerability results from the use of unfiltered user input as the format string parameter in certain Perl or C functions that perform formatting, such as C's printf().
A malicious user may use the %s and %x format tokens, among others, to print data from the stack or possibly other locations in memory. One may also write arbitrary data to arbitrary locations using the %n format token, which commands printf() and similar functions to write back the number of bytes formatted. This is assuming that the corresponding argument exists and is of type int *.
Format string vulnerability attacks fall into three general categories: denial of service, reading and writing.

Cross Site Scripting

The success of this attack requires the victim to execute a malicious URL which may be crafted in such a manner to appear to be legitimate at first look. When visiting such a crafted URL, an attacker can effectively execute something malicious in the victim's browser. Some malicious JavaScript, for example, will be run in the context of the web site which possesses the XSS bug.

Username enumeration

Username enumeration is a type of attack where the backend validation script tells the attacker if the supplied username is correct or not. Exploiting this vulnerability helps the attacker to experiment with different usernames and determine valid ones with the help of these different error messages.

3. Countermeasures

Username enumerations:

Display consistent error messages to prevent disclosure of valid usernames. Make sure if trivial accounts have been created for testing purposes that their passwords are either not trivial or these accounts are absolutely removed after testing is over - and before the application is put online.

Cross site scripting:

Input validation, secure programming and usage of good language for dynamic web applications.

SQL Injection:

Avoid connecting to the database as a super user or as the database owner. Always use customized database users with the bare minimum required privileges required to perform the assigned task. Perform input validation and do not give error response on client side.

Format String:

Edit the source code so that the input is properly verified.
Remote code execution:
It is an absolute must to sanitize all user input before processing it. As far as possible, avoid using shell commands. However, if they are required, ensure that only filtered data is used to construct the string to be executed and make sure to escape the output

4. Risk Factors

SQL Injection:
Rating: Moderate to Highly Critical
Remote Code Execution:
Rating: Highly Critical
Cross Site Scripting:
Rating: Less Critical
User Name Enumeration
Rating: Less

5. Summary

This is the short article to develop awareness on web attacks and countermeasures, these are common web application attacks.

Keywords: