Software Security

Software Security
Lecture 4
Fang Yu
Dept. of MIS,
National Chengchi University
Spring 2011
Today we will have Adam presenting how to
attack authentications (Ch6)
Before his presentation, I will continue
Command Injections (Ch9), and also I will
present my recent research on how to prevent
and remove injection vulnerabilities
The rest of your presentations have been
scheduled. Please check the course web page
and plan ahead. Let me know if you have any
The course website :
Injecting Code II
Chapter 9
The Web Application Hacker’s
Interpreted Languages
Recall that an interpreted language is one
whose execution involved a runtime
component that interprets the code of the
language and carries out the instructions
that it contains
For example, SQL, Perl, ASP, PHP, etc.
Interpreted Languages
In most applications, the code processed by
the interpreter is a mix of instructions written
by a programmer and data supplied by a
An attacker can supply crafted input that
breaks out of the data context, usually by
supplying some syntax that has a special
significance within the grammar of the
interpreted language.
Command Injection Attacks
Main problem: Incorrect or completely lack
of validation of user input that results in the
execution of commands on the server
We have discussed SQL injections last
week. Today we will discuss OS command,
Web scripting language, SOAP and SMTP
injection attacks.
OS command: Injecting via
Consider a Perl CGI Code that allows
administrators to specify a directory and
view a summary of its disk usages
use strict;
use CGI qw(:standard escapeHTML);
print header, start_html(“”);
print “<pre>”;
my $command = “du -h --exclude php*
$command= $command.param(“dir”);
print “$command\n”;
print end_html;
When used as intended:
Injecting via Perl
“|” is used to redirect the output of a process
to the input of another process
This enables multiple commands to be
chained together
Inject code: (cat /etc/passwd)
OS Command: Injecting via ASP
Consider an ASP code that allows administrators to
view the contents of a requested log file
type the log file
cmd executes the command
Set oScript = Server.CreateObject(“WSCRIPT.SHELL”)
Set oFileSys = Server.CreateObject(“Scripting.FileSystemObject”)
szCMD = “type c:\inetpub\wwwroot\logs\“ & Request.Form(“FileName”)
szTempFile = “C:\“ & oFileSys.GetTempName()
Call oScript.Run (“cmd.exe /c “ & szCMD & “ > “ & szTempFile, 0, True)
Set oFile = oFileSys.OpenTextFile (szTempFile, 1, False, 0)
When used as intended: (submit last5.log)
Use && to batch multiple commands together
Last5.log && dir c:\
Dynamic Execution
The PHP function eval() is used to
dynamically execute code that is passed to
the function at runtime
Consider a search function that enables
users to create stored searches:\$myse
The server side implementation:
creating a mysearch variable with the
value wahh
$storedsearch = $_GET[‘storedsearch’];
Dynamic execution in PHP
The semicolon character can be used to
batch commands together in a single
For example, to retrieve the contents of the
file /etc/password, you could use either the
file_get_contentsor the system command:\$mysearch%3
File Inclusion Attacks
Consider an application that delivers
different content to people in different
A request looks like:
The application processes as follows:
$country = $_GET[‘Country’];
include( $country . ‘.php’ );
File Inclusion Attacks
If the request has been intercepted:
The sever side may include an arbitrary
remote file
$country = $_GET[‘Country’];
.‘.php’ );
What’s the main cause of injection
How to prevent injection vulnerabilities?
Let’s talk a little bit about Stranger
Next week
We will have Juilette presenting Attacking
Session Management (Chapter 7), Jorina
presenting Attacking Access Controls
(Chapter 8)
We will also have Hsing Hunag presenting
Burp Suite, a tool set for analyzing and
attacking web applications

similar documents