Nilesh Kumar

In my last post , I had described about how to set up Paros with Ntlmaps to do security assessment of the application requiring NTLM authentication. It always works for me properly, until today! After a long time , I stumbled upon one application which requires NTLM authentication. As a Paros lover (no reasons, just due to its simple interface, I love it), I launched Paros and Ntlmaps. But badluck for me, couldn't figure out why Ntlmaps was unhappy with me. My whole day went in troubleshooting! Even I ended up un-installing and installing Ntlmaps. Even I locked my Windows user-credentials after exceeding maximum no of attempts from my system to the application. Anyways I got it unlocked. Even my colleagues were absent today (Ronnie, Thyagu) who might have helped me in configuring Ntlmaps. Anyways, it's funny that I had never paid attention to a functionality already there in Burp and WebScarab- I was laughing at myself! These proxies already have built-in functionality for wo...

Today I was having a chat with my friend Vaibhav about few vulnerabilities in one of the applications. In order of that he asked me it's really necessary to mark cookie as "Secure". Well, depends...if your whole application is on https then you should always go for "Secure" attribute. Cookies set with the "Secure" keyword will only be sent by the browser when connecting by a secure means (HTTPS). Apart from that there is no distinction - if "Secure" is absent, the cookie may be sent over an insecure connection. We have seen a lot of cases where the cookie is leaked and sent over from https to http: 1. If your page contains mixed contents, ie. if you are including some links that is on http then the cookie may be leaked. For example, if your application uses url https://example.com and you are including someother links in the page using http://, the browser may warn you as "this page contains both secure and nonsecure items". 2. ...

While doing code review usually I find various misconfigurations. I am trying to compile them here. Although they might not be a comprehensive list and something I may miss, but will touch most of the common points: Refer-http://software-security.sans.org 1. Authentication & Authorization Bypass: <security-constraint> <web-resource-collection> <web-resource-name>secure</web-resource-name> <url-pattern>/secure/*</url-pattern> <http-method>GET</http-method> <http-method>POST</http-method> </web-resource-collection> <auth-constraint> <role-name>admin</role-name> </auth-constraint> </security-constraint> The above configuration shows how to setup web-based control. Here the assumption is that the everything in 'secure' directory must be accessible by 'admin' user only by using methods listed in tags i.e, GET and POST. No other methods should be allowed. B...

Is it a problem? I think no, as long as the token is Per Page, One-time use token. Actually in one of the application, we had recommended to implement anti-CSRF tokens. When the application came back to us for verification process, we found that the application was implementing some sort of CSRF tokens, which were: 1) Going in GET request ie. were being added to URL. 2) Were being generated per page. 3) Were one-time tokens. The only concern was the token in GET request. I mean it can be said that it is certainly not a best practice but the potential risk is very minimal. In a scenario where it can be exploited depends on following constraints: 1. The victim should be logged into the application (obvious). 2. The CSRF token must be transmitted in a GET request. 3. The attacker must be able to capture the token or from a repository (log files, browser cache etc). 4. The attacker needs to trick the victim to click on the crafted link. 5. The victim's session that holds the exposed to...

We had a discussion with our colleagues over XSS issue found in one application. Initially there was not input validation at all-you can insert simple script tag and execute XSS. Following our recommendations they filtered out certain special characters like (>,<," etc) also they encoded them at time of output. Fair enough? No. Actually they implemented half of the recommendations- ie. they worked on blacklisting and left out whitelisting. There are a number of models to think about when designing a data validation strategy, which are listed from the strongest to the weakest as follows. 1.Exact Match (Constrain) 2.Known Good (Accept) 3.Reject Known bad (Reject) 4.Encode Known bad (Sanitize) They were implementing last two of strategies only. So the application was now filtering out normal XSS vectors like "><script>alert(...);</script> based attacks. But what happens when we provide eventhalders like onmouseover,onload etc-XSS executed. When we brought...

Beware! Now even any Jack can hijack your session with a new Firefox plugin tool- Firesheep . All what he needs to do is to just install this tool in Firefox and start sniffing the communications on a public unencrypted Wi-Fi. Public Wi-Fi systems are generally unencrypted at Airports, Cafes etc. Some web sites like Facebook serves the login page on https but all the internal pages at http, once authenticated. That makes this kind of websites more prone to sniffing, and an unencrypted Wi-Fi adds more problems. After authentication this kind of websites generally assigns some session identifiers to the user which can be easily sniffed and can be used to impersonate. Surely, it's not a new concept, but what makes Firesheep more dangerous is that it's just a click-and-hijack tool that a novice user can also use at the public places to sniff other's credentials. The author's of this tool wanted to draw attention of people on those kind of websites which don't implement ...

This is in continuation of my previous post on How to use NTLMAPS tool for pen-testing application requiring NTLM authorization. I was quite thorough and detailed about the steps about how to connect the tool in between the proxy and server-until one day I found a mail from Mark Wityszyn : Hi Nilesh , I've been struggling with the same problem for while now and keep coming back to NTLMAPS but have never manage to get it to work for web server authentication. Would you be willing to share you configuration options from NTLMAPS ? Then I realized, I have missed the configuration settings that is to be made in the server. cfg file of NTLMAPS . Here it is: Go to the server. cfg file which will be in the ntlmaps folder and search and change the following lines with your settings: PARENT_PROXY_PORT: specify here your Paros/Burp 'local' proxy port no. NT_DOMAIN: domain name of the network USER: userid which needs to be authenticated PASSWORD: password for user-id above H...