Nilesh Kumar

The issue: While doing one assessment, we faced one issue of our ZAP proxy throwing response ‘401 Unauthorized’ while we were trying to fuzz one application. The application was using NTLM authentication, where the client needs to send the domain name, username and user-password’s hash combination to the server, in order to entertain the requests. NTLM is windows challenge/ response authentication protocol. For more info on NTLM working: http://msdn.microsoft.com/en-us/library/windows/desktop/aa378749%28v=vs.85%29.aspx . So, we were not able to fuzz the parameters as it was sending back ‘401 Unauthorized’ response, don’t know for what reason despite us providing the windows credentials to ZAP [Fig-1].  Fig-1 So, we had no other option except trying other similar web proxies. We tried WebScarab and provided Windows authentication by going Tools-> Credentials [Fig-2]             ...

The following functions needs to be inspected for XSS as they might be 'possible' pointers to XSS. They could be a pointer to possible xss attacks: eval() document.write() innerHTML() write() Safe function: Instead of using innerHTML, one should use innerText()   XSS payload in Jason and their effects: A nice example from iSec Partners: var inboundJSON = {"people": [ {"name": "Joel", "address": “<script>badStuff();</script>", "phone": “911"} ] }; someObject.innerHTML(inboundJSON.people[0].address);               // Vulnerable document.write(inboundJSON.people[0].address);                             // Vulnerable someObject.innerText(inboundJSON.people[0].address                     // Not Vulnerable

A nice article on a detailed assessment strategy of Android applications. Well explained and comprehensively written. Article describes different stages in android assessment, tools, methodologies and native tools with screenshots. You can find the article here: Android Application Assessmen t Also have a look at Web application Security Course offered by InfosecInstitute.

I just stumbled upon one great article. A nice article about what the arbitrary file download is and how dangerous it would be if exploited. Later the difference between arbitrary file download and LFI/ RFI has been discusses, which is a often confused topic. What is Arbitrary File Download? As the name suggests, if the web application doesn’t check the file name required by the user, any malicious user can exploit this vulnerability to download sensitive files from the server. What is LFI/ RFI: Often confused, LFI/RFI is different from the Arbitrary File Download vulnerability. However, both are used in combination if directory traversal is turned on in the server. LFI and RFI stands for Local File Inclusion and Remote File Inclusion vulnerability. Both are of similar nature, except the mode of exploitation. Both take advantage of unfiltered input file parameters used by web applications, predominantly PHP. LFI, while exploited uses any local file which is ...

Recently I came across an application which was preventing crsf attacks using a unique non-traditional approach. In traditional approach the csrf is thwarted by embedding unique random tokens, called nonce, in each sensitive page. But this application, which was making ajax calls and used jQuery, was creating a header to identify the valid and invalid requests altogether. The idea is to generate a custom header, x-session-token in this case, with every request which is considered sensitive and includes any sort of transaction. For example: xhr.setRequestHeader('x-session-token', csrf_token)   At the server level, server checks for this header if found request is fulfilled, otherwise rejected. We need to use xhr calls for making use of this technique, not useful in regular POST and GET requests. Since, I was not aware of this kind of countermeasures, probably, since most of the applications I did were using standard requests. So, I searched a bit and found even Go...

A web application is sending data in this format: {"t":1,"p":1,"r":1,"rows":[{"i":0,"c":["n","H, C","A","5","T","n"]}]} this is a valid JSON, before moving on lets understand an important concept: 1. Javscript expression 2. javascript statement javscript expressions are not executed by javascript parser, but statements are: for ex: <script> {"t":1,"p":1,"r":1,"rows":[{"i":0,"c":["n","H, C","A","5","T","n"]}]} </script> this will not be executed, that is, objects won't be created. The above example is for a javascript expression. But now when it is converted into a statement as given below: <script> [{"t":1,"p":1,"r":1,"rows":[{"i":0,"c":[...