CSE 365 F23 11-15-23 "Web Security Pt. 1"

somebody saying no all right okay hello everyone I assume everyone missed me terribly I'm not looking so I'm assuming you're all nodding along where is is anybody on the twitch and can confirm that we are in fact here we go okay thank you but I don't want to make sure I get a okay people are in here okay so uh You The Chosen Few who have decided to attend uh in class and online uh can I'll give you you can give input on the plan for the next two remaining modules yeah we have web security and we're going to do binary security so we're going to end with a bunch of hacking and exploitation uh I here I had this thought I will throw it out there tell me if you like it or hate it I think my idea was today after class sometime tonight I'll just relaunch both modules at once web security and binary security they'll both be due uh whenever the late policy is so I think that's the very last day that it could possibly be um the the 10th yeah December 10th let's double check that so I don't like just straight lie to people yeah I try to avoid that whenever possible as an educator oh that's not helpful yeah so December 10th so that way you'd have till the 10th to finish them we obviously won't have any in-person lect on binary security I actually think we'll cover everything we need to for web security right now in today's lecture so you should be well prepared for that and the remaining classes will cover binary security and any remaining classes after that we can cover some cool topics like cyber crime or other things um so but that way if you want to get started on the binary security stuff you can watch the lectures that will be in there from prior semesters uh to get caught up on that material yeah well ter sign now on 10 yeah it would allow people more time actually do like Parts but feel end last days yeah I don't know like do you want to be adults with your time or not I guess is the question I can make it be do earlier but I feel late as possible okay so you're all willing to be to shoot yourselves in your own feet okay I like that very adult mindset at least I'm going to wait until like study time maybe I don't know but you can do it all now you can do it all before Thanksgiving you'll know exactly what your grade is I'll try to put um I won't make any promises because I don't know how fast this process is but I'll try to load in all the thanks and meme extra credit stuff into the grades so you'll be able to see your current grades up to there yeah the the equal weighting that's the only they'll just they're all equally weighted I didn't know how many we had so I didn't want to mess with that weight but it shouldn't change anything correct cool all right yeah yep late submission policy so until the 10th you can do uh you can solve them late and those will be worth 50% yeah for sure like you can go to recitation and get help on any stuff and they will happily help you uh we'll have to talk about I don't we obviously don't have any recitations during finals week so this is why when you're doing your finals week stuff I think a lot of the te will actually be physically gone and stuff so you're kind of on your own as you get out of the semester uh but the you'll have the Discord online to ask questions yeah no absolutely not [Music] yeah to get a grade no to get a grade the only thing you need is your ASU ID to be linked but yeah so that's like we don't know if we can't link everything we don't know any of your activity on the Discord so whatever you're doing there is all just kind of we can't see it and link it and give you credit for any of that stuff that happens there yeah what's the last thing for also this date I think unless codebreaker is after here how long does codebreaker go to good question the last Daye for any credit related things is the 10th yeah good good question cool any other questions you guys know there's like spiders and lizards out there it's like a whole zoo along that Corridor and snakes yeah it's like absolutely crazy sleep so you don't even have to pay to go to the zoo you you go here as a student you can just uh go look it up creepy okay so then let's go to back to the web so that's what I was thinking of thinking of spiders and the web um so we've looked at the web what aspects of the web have we looked at so far somebody remind me yes yes but now you have to answer my question what did we learn about the web this semester to hijack communication even further back somebody else how to talk over the web using what what was the protocol HTTP HTTP yes use it every day literally every single day go to a website anybody go to a website today yeah cool so now we're gonna look at how the web can break uh but to do that we need to first introduce some more Concepts and peel back the layers a little bit so when we looked at it we looked at the you have your web browser your client you make an HTTP request um and how did and you got and understood that what server to talk to with the URL remember we talked about how do you parse a URL and turn that into an HTTP request and the web server does something and send you back some HTML is the normal process however these uh result in very boring web pages right very static web websites that don't actually do anything now this was the original kind of uh idea of the web but what we actually want to happen is some kind of dynamic functionality that that interacts with our requests and parses our request so this is where usually actually behind the web server there's some web application that's running some custom server side code that does something interpret your request can parse your get parameters which p in where oh no tests yeah no I don't forgot it on already staring at you all yeah I don't know if that's true but um no my question was so let's broaden it up a little bit what are the ways that a client can pass data to a web server or web application through an HTTP request yeah uh that's the method so those are the methods but technically you can use any type of method yeah Jon Json yeah Json where in the HTTP request though that's more of a data format thing in the body so we can pass it in the body usually with a post request um what else somebody said headers on Twitch true but not a common one not one of the two I'm thinking of yeah yeah exactly part of the URL right so those are question part of the URL syntax after the question mark is all the query parameters and we have our parameters in key equals value and percent say key equals value right that's another way of passing and we can pass by name awesome so the web application is running some code inspects those values sees what things you're trying to query generates a custom response an HTTP response this is usually in the form of the other part that we haven't talked about yet of the H here so what's the H in HTTP hypertext yeah awesome so now we're going to look at hypertext so hyper HTML the hypertext markup language what is a very simple data format that's been used to create documents that have links to other documents that's fundamentally what it is at the at the base level of where how it was created um it was based on an original technology from 1986 uh what's super interesting is seeing how the HT HTML protocol has evolved um so you can go look up all these standards to see exactly what HTML looks like we'll go through the basics this is important um part of what to me is so interesting about the web is you have all these different Technologies so way back when we talked about web Basics we talked about URLs HT uh HTTP and HTML but we didn't actually talk about HTML we only talked about two of those now we're completing that so looking at this picture you have your browser which is running on somebody's machine which the user clicks on a URL which makes an HTTP request which gets gets processed by some backend web application running who knows what code in whatever language they want because it doesn't actually matter what language that server is written in then passes the response the HTTP response back with an HTML payload and that HTML tells the browser how to render that so that the user can click on different things to go to different HTML pages and make different HTTP requests and this process repeats but this is part of the reason why the web is so complicated and actually the picture gets even worse we'll talk about later how web applications use database to store information so you add more Technologies and each of these has a different syntax and everything and um the web is honestly like literally like a complicated mess of different Tech that's part of why I love it because you have to learn all these different things and we'll see a lot of the breakdown and the security problems come at the interactions between these layers okay cool but uh yeah brief history um so HTML went through several revisions uh but now it is a HTML 5 is kind of was the current standard it actually went through this thing anybody familiar with XML anybody play with XML yeah what's XML like what's it Fork yeah so it's another type of markup language what have you used it for let's say in your yeah is also look for like local resource ah so yeah it can be used for it can be used for almost anything it's just a data storage mechanism you could do that technically in Json it's all just about different ways of storing data the interesting thing is actually XML came from HTML so HTML was created first then they standardized XML and then they tried to make HTML like XML so that's where this xhtml was came from and remember he said that's really stupid we're used to this HTML and we don't like these stupid differences which I'll allude to later but they kind of don't matter um and then finally so you can see actually the super interesting thing here like a lot of innovation between these 95 97 99 2000 and then the next version was in 2014 right and then actually 5.1 they kind of started developing further uh revisions of 5.0 but now HTML is considered a living standard so they don't have specific versions part of that is this problem that the web application needs to generate some HTML page that needs to be parsed by a browser and shown to a user so it requires this complex dance between people that want to build web applications and people that build browsers because if you say hey the HTML standard does this but no browser supports it then who cares U and it's kind of a useless feature so it's uh pretty interesting so the basic idea is really the m in HTML is from markup so we're adding what technically a lot of people call tags it's also technically uh oh I should change these slides it's technically not not the proper term but that's okay uh basically to add meaning to text so we're going to mark up the text and add meaning to it so a couple key Concepts a start tag looks like this this is the tag Fu it starts with an open square bracket and a Clos square bracket that whole thing is considered the start tag then there can be text h as much text as we want uh then it can be there can be end tags so end tags are just like this but with a slash so start curly or start angle brace back slash Fu so this is said to close the start tag so everything between there and the text is is as we'll see this actually creates a tree document um sometimes you don't have any text between the tags so you can have a self closing tag by adding a slash at the end so this is functionally equivalent to having start tag bar close tag bar with nothing in between uh void tags are tags that have no end so IMG so before we've been using Fu and bar IMG is an image tag there's no closing for uh an image tag and so it's called a void tag this was actually the key distinction between HTML and XML if you've ever done XML anything you start with an open tag has to be has to have a close a matching Clos tag and that's what they tried to add to HTML and everyone revolted and said this is stupid because images are always void like this they have no end there's like an implicit end anyways um cool so tags form a hierarchy and a tree structure so here we can look at uh an HTML document so we have uh HTML tags and again what these mean you can look up in the standard the standard says exactly how the browser should interpret these and show them uh so this is like a typical HTML 5 page so we have the HTML tags we have head tags inside the head tags we have a child tag and inside there we have the text example in and then we also have the body tags and inside there we have P tags that have I am the example text questions on this cool so we can represent these as a tree so this is like a sideways tree so the root is the HTML tag it has two children head and body head has one child title title has one child the text example body has one child the P tag the P tag has one child I am the example text cool all right now if we just had tags we could probably get around get uh be able to maybe be able to use these but for instance if we want to have an image and include an image in our HTML page we want to be able to say where that image comes from so we need another Concepts and that's attributes so tags can have attributes that provide metadata about the tag so they live in inside of the start tag after the tag name and before the ending closing brace uh again as we'll talk about we're going to get to uh vulnerabilities in web applications that allow people to inject arbitrary HTML content in a page and so the syntax this is why this stuff is important uh so you can do this in four different ways so this is the tag Fu has an attribute bar with no value you can have Fu bar equals baz this is an tag named Fu that has an attribute bar with a value Bas uh same thing in single quotes and same thing in double quotes these are the exact same thing and multiple attributes are separated by space cool okay so we can put all this together to actually do hyperlinks these are the things that you've seen all the time right blue little underline thing that you click on um so the anchor the A and the anchor tag is used to create a hyperlink href uh I believe it's hyper text reference is what that stands for is where you provide the URI and the text inside of the anchor tag is the text of the link so if you had a link an HTML tag that looks like this so the a tag hrf equals google.com example that will render by the browser into this thing that you've probably seen many times before that you know now you've maybe been trained to think aha I can click on that thing what does it mean that this is purple and not blue what is it yeah I visited it before right so browsers also have a way this actually has been a way that um websites have it used to be a flaw in browsers where a website could know what websites you visited because it would create a bunch of links to sites like google.com or sites you don't want people to know you visit and would be able to ask the browser what's the color of these links and would be able to use that color to say if you visited it or not um pretty interesting privacy web security implications there and so we can throw this together uh build a a basic HTML 5 page that you can go online and look at uh this is just the key problem when you have all this Tech that's been built up over time is uh browsers still want to run websites that were built in 1999 that were expected to run on Internet Explorer version six and so by default they will try to if they don't know how to parse it they'll try to parse it uh in a mode that supports older styles of HTML so by setting this dock type is a special thing to communicate to the browser no no I'm using the HTML 5 standard don't worry like we're doing some good stuff here uh so we can have just like this uh I use this metat to say my text file is in utf8 so it actually knows how to parse everything but that's okay and then I can have a body with an anchor tag and the cool thing is this exact thing then gets sent to a browser the browser responsibility again the the important thing to remember the browser only gets this stream of bytes right and it needs to parse this and understand what is this what type of HTML document is this what does the user want to do just like you all did in the access control modules with level 7 17 18 and 19 is you're parsing some input file and trying to derive some meaning from it right different time because this is way more structured and easy to parse than maybe the random output that I gave you there but the ideas are the same um and this is what you also will get into with 340 when you talk about 340 you'll talk about parsing these kinds of things um cool so the browser responsibility is this so you can take the same website open it up in a browser it'll show something like this you can also use many different types of browsers so there's like the browser on your phone which is different but also you can have browsers this is uh what is the name of this uh links I think I usually use it in emac so I don't remember the exact name uh but this is a text based web browser so it renders the HTML document in text and you can navigate through it I actually I now I'm worried I'm gonna sound super old but I actually do use this sometimes when I'm in emac so I'll have a text editor in one thing and then you can open inside emac a browsing window to like some documentation of python and you can have it inside the python window so I can search for it and do nice things there huh that's true no ads uh yeah so this is links thank you for uh confirming so you can do all that there now there's a very specific thing like we talked about so we talked about this with URLs so this is how an HTML page looks what are the special characters in the HTML language would it be yeah the the angle brackets did I keept saying square brackets I guess I should meant angle brackets I don't know what I was saying but I was doing this so yeah looks like those potentially be the only special characters because everything that's like something that's HTML specific is already with in those so the program only needs to be able to recognize those particular characters to tell whether something is meant to be a part of the actual not page or what it is yeah so for example like if I wanted to write a web page that said hey here's how you create a an a hyperlink to the URL example.com use this code bracket a HF equals blah blah blah this whole thing but if I put that in the HTML Source the browser thinks that I want a tag called a with HF and not text with the angle bracket so there's uh just like with URLs right we had the same problem with Amper Sands question marks equal signs uh so there's a way to include so for HTML the brackets are special also single quote and double quote can be special inside of an attribute because they can specify the end or start of attributes uh ampersands and equal are guess not Amper Sands that's interesting I know they do cause problems I don't remember the specifics po Escape yeah you you need to escape them but anyways because it's the escape code oh du yeah that's right like there's definitely a reason yeah the reason is as we'll see the reason why uh cool so just like any problem like when we had we talked about uh strings in our programming language when we have back sln to specify a new line that backslash is an escape character but now you need an escape character how do you do the Escape character so this uh all these character references start with an Amper sand and end with a semicolon and so that's why the Amper sand itself needs to be encoded specially uh you can name things specifically so there's a a look of predefined names but it's basically Amper sand uh either a name and semicolon or a the normal one that you'll see is a decimal or uh heximal so you can reference it in heximal or decimal I for sure have an example oh yeah this is and again as we talked about this is actually the key to understanding a specific type of web security problem so we just look an example so Amber sand amp semicolon this is the named entity of the Amber sand character so when the browser gets this and parses it and knows aha they're using they want a textual Amper sand to appear here not an Amper sand that's going to start some named entity uh so this would be whatever 38 in decimal is anybody have an asky chart handy so I don't have to look it up whatever 38 is in decimal uh x26 would be hex 26 whatever that is and you can have leading zeros there why don't I have these on these slides and now going to make me look it up come on Twitch what are you good for if you can't look this stuff up for me yeah exactly you're all on the internet right now all right I will look it up it is the Amper sand they're all the same thing that's very smart of me if I do say so myself okay yeah it is all right perfect yay exactly like I thought okay so these are all different ways of doing the same character encoding this actually is [Music] used not this specific concept but uh well maybe this idea is actually used to get around a lot of um web application fire walls and stuff if you're trying to exploit a vulnerability often times uh by using different types of encoding the same payload like they'll detect maybe Amper sand amp but not these other ones or they even may do all of them but not with leading zeros uh so there's all kinds of cool stuff you can get around there all right uh cool this is the E on my last name if you ever feel like using that for some reason uh cool and we talked about so the less the angle bracket has to be encoded whenever you want to use it because otherwise the part doesn't know are you actually trying to uh do a math equation or are you trying to start a new tag right think about it from the perspective of the browser's parser it needs to know what you're actually trying to do so this is why in a proper application uh this will be encoded as end LT for less than so that's the angle bracket which can also be in all these same ways okay questions on HTML these are like the Bare Basics of HTML and note we didn't go into like stylesheets or anything the other crazy stuff of like how to actually build a nice looking website but this is the basics of how this stuff works questions cool okay so let's get to an example of how we're going to apparently rob a VK um cool so imagine this scenario so now we have an example of we have uh the red computer the blue computer the green computer so we have the and we have an HTTP request and the bank is running some backend web server just like we talked about right so we talk to the initial web server and it's running some backend web application and so we're saying hey bank transfer and we don't know exactly what's going to happen again this is the interesting thing and what I love about uh web security is we can try to infer what's going to happen but fundamentally the backend web server code or the web application code is what will guarantee what happens we can try something like hey what if we uh try to access a URL called bank transfer and pass in the query parameters from Blue to Red amount that's a pretty large amount a million let's hope those are in dollars and not like cents or Pico dollars or something or what's a currency that's very bad inflation anybody know it's in bobway something anyways yeah that's right Venezuela but I don't know if you can like transfer stuff in there anyways whatever doesn't matter but the point is we can try making this request as red but the web server May block us so why would the web server block us yeah what's a theory yeah you just raised your hand you're on the hook it's see say you're from Blue you're blue exactly so it's it's maybe doing some internal checks right maybe it's using we talked about cookies I think when we talked about web Basics right so it's maybe looking at our cookies validating it saying wait a minute you're not blue so you don't have the ability to transfer that um it may if it's bad it may be using like our IP address in which case we could use our intercepting communication and maybe spoof a request from the other IP address do you have other thoughts okay then don't worry about it um but the question is yeah so one of the key aspects of web security that's very different from and one of the principal tenants of web security is that so what can red get blue to do here so h i I can't let's say I can't directly Force blue to make any request I want right because let's say I mean I don't know I maybe I could if I knew who blue was maybe I break into their account and I uh or break into their computer right I know their password I log in I make that request right I could potentially do it that way but let's say I I don't know that right so I maybe can't directly make them but could I well could I trick them to click on a site that I control right have you ever clicked a link in an email before never you've never clicked on a link anytime in an email that's yeah it's a straight up lie I don't believe it for a second i' I click on links and emails all the time right your friend ever send you something in iMessage on Discord you click it you go visit the thing right it's like trivial you can you see some post on social media you click either to uh social media or whatever anyways the point is it's very trivial to get people to click on links so I can convince blue so one of the principles of web security is that I can convince somebody to click on a link of my choosing and it should be safe right the web should be safe I should be able to visit any website and not have that uh fundamentally alter the security of my system so but as it turns out and we'll get into this a little bit more later is we can actually convince by having blue access a web page that our server that read controls we can send specifically an HTML p payload that causes blue to make a web request specifically we can use the image tag so we looked at the image tag we can set the source of that to be uh green bank transfer yeah so the to the green server bank transfer from Blue to Red amount a million and so what's the browser going to do it parses this just like anything it goes makes that request also includes the cookie because it's making the request from from blue to green and will the bank allow this or deny this hopefully you know some kind of two Factor thing that notify you something that happening yeah but maybe I don't know it's not a great Bank we can uh right so if we go based off on our previous things it says okay now we can theorize one possibility that this Bank web application may do look at this cookie validate is the cookie blue does this match the from user great they're logged in they are the from user they have access so let's make this request and then the bank says great okay this happened and so we were able to trick and convince somebody to exploit uh to make a web request on our behalf just by visiting our server so this is part of what we need to uh think about when we're we are um approaching and thinking about web security is that we can fundamentally get somebody to access any web server including a web server of our choosing that has arbitrary HTML content on the page this can make the client's browser do things like uh render the page this is a a super interesting attack here is called clickjacking that's when you go to a page and it's like hey have you ever seen those things of like hey play this game and win a free iPhone and it like oh yeah you've seen that so you go to the page don't click on those those are bad because uh depending on what browser you're using what they do is they um uh they'll underlay like a content of like a Facebook page like a follow link or something like that something from another website it used to be Facebook it can be any kind of anything although there are defenses now but anyways they put some content that you want to click on and they make you play a game where you're clicking on things and then right before you're going to click they swap so the thing they want you to click on is on top of the ball or whatever so you end up AC accidentally clicking on something from another website to like add a Facebook friend or follow something or something like that um so that's called the clickjacking um so yeah crazy stuff they can also also like I mentioned so I talked about the being able to leak information about what websites you visited uh so they fixed that a a lot of those they fixed like a website can't ask for colors from a thing if it's been visited or not but they used to do very clever things like um I think they could change the font size of whatever if you if it was visited or not so if it was visited the link would be large otherwise it would be small and then using JavaScript they could query the size of things so they could figure things out that way anyways they can do a whole lot of stuff to try to get information about you um they can also make additional HTP requests to other servers as we saw using image tags and fundamentally the crazy thing is they can run arbitrary code so part of what makes the web uh so HTML is incredibly static what makes the web Dynamic and interesting is Javascript which is literally a programming R language where other people have written code that runs in your browser on your system it's like actually insane when you think about it like every website you visit is downloading random crappy JavaScript code and it actually I think still is kind of a problem but some bad websites or sometimes criminals would hack into a website they would uh inject JavaScript code on that website so that when you visited it it start mining cryptocurrencies for them and so your CPU usage would go up and any stuff that they would find would get sent to you cool and when we're thinking about servers we can receive arbitrary data so we can um as we'll talk about like the data may this is when we think about attack Services how do we attack things um we can access or modify database data interact with the server or influence other web clients which we'll look at okay uh somebody's asking online they're freaked out because I said no we have four modules to get through so we're don't worry plenty of content four slides now we got to get to okay I want to build a web application one one of the most common ways of storing data on a web application is with SQL so we talked about how does a web application how does http keep State recall you did this in one of the um talking web modules you had to make a request and keep state with that request right you had to make like 10 different requests how did the web server know to link one request of the other louder cookies yes our I don't know hopefully some people's favorite things um but if you think about how much data do you have on something like Facebook or Instagram or Twitter right a lot of data is stored there much more so than could be stored in a cookie so web applications want to store persistent state so that way they may maintain information about you request to request otherwise it would be very very difficult to make any kind of real application so the question is where to store that state we could sort in memory just of the web application what would be a problem there I don't remember enced it is definitely not well depends on the system but not encrypted but to get access actually you can did I talk about this there was a paper while back that showed for like a a server or desktop system so you know like a memory module looks like like the dim so they had showed that you could actually get access to a system uh unplug the power and use one of those uh air can blowers turn it upside down so it outputs cool air you like freeze the memory take it out of one computer into another and enough data will have kept around in memory that you can still recover that it's really crazy um but one of the big things is what happens after you reboot your computer how come all your stuff's not there yeah it goes into persist storage yeah so memory is non-persistent right as soon as power's gone memory gone so not a useful place to store data that you want to last for a long time um the file system we could use the file system for storage um on clean this up since I'm here if I don't do it now we could use uh the just like flat file system store files into directories um we could use like we learned about the access control the Unix Access Control permissions a set of permissions of who can access what we can use XML files to store data some applications actually do this or the most common thing is to actually use a database and we're not going to get into like the theory behind databases how databases exist what they do all that kind of stuff take a database class if you're super interested in that uh but we will understand um why it's useful one of the key things that offers is acid compliance I think it's atomicity consistency integrity and durability so this ensures that when you've committed something to the database or made a change that it actually has changed and if you're doing things concurrently and querying and storing things uh that everything is done correctly it's a really good guarantee on a database um thought the C stands for concurrency can you check what the C and acid s form um yeah what was it okay thank you I thought so and I was weird to see this here um you can run a database on another server so you can physically separate your machines which can be very useful if there's any performance problems with one server and another to have a database on a SE separate machine Connor I'm looking at you that can be very helpful um and you can easily scale this allows you to have one database machine several front-end web application machines that all connect to the same backend database all kinds of cool stuff uh it adds yet another technology to the web application stack so in addition to URLs HTTP HTML JavaScript now we have SQL that web applications in addition to we've been talking about the web application language that you're uh backend web app is written in the most common and well I guess we're technically not using this here I just like talking about it because this was the classic web application model was what they called the lamp stack that was Linux Apache MySQL and PHP this is where like PHP is actually one of the most used um web application languages although it's a lot of that is WordPress installs but uh the idea is you can swap out any of these things you can run it on Windows you don't have to use Apache you can use engine X as a web server but you basically need some underlying OS a frontend web server that's going to parse the HTP requests some backend web application like PHP and uh some database like MySQL or postgress or you can even get away with like SQL light for a lot of things so I like using my SQL we'll just uh talk about this really here it's oh this is a good thing so it's currently the second most used open source relational database I guess I I see a bug there um anybody know what the first is of those ones that I mentioned my SQL postgress SQL light I can guarantee you that you're using one right now huh mango mango DB definitely not I hope not mango doesn't offer any of the acid stuff so it's already out equal light why least sh on Mac OS your iPhones all of your Android phones every single one of those devices has SQL light uses SQL light at the operating system level to store data yeah it's absolutely crazy uh all of your like I know on the iPhone all of your messages are like in iMessage are stored in a sqlite database um it's used in tons of places so you think about that that's like literally billions of devices that this software is running on it's absolutely nuts anyways my sequel uh I like because I like history stuff uh was released in 1995 so Sun the company eventually purchased my sequel for a billion dollars uh which is pretty cool and okay so let enough history where's my mouse there we go let's get into what does SQL look like so it is a special again another special purpose language to interact with something right it used to be we saw HTML and again the exact same Concepts will come up being able to alter and change a SQL query will have massive security problems so the idea being there's kind of four basic things you can do you want to get data from the database you're going to select data you can update data so change data that's already stored in the database you can insert new data into the database uh you can delete things from the database there are slight differences between SQL implementations so uh view whichever one that can get up when you're doing like complicated SQL injection stuff but let's look at some examples so we first can we want to so everything is table based so you have a database it has several different tables each table has uh columns pre-specified columns and then you insert rows into into there you can select rows that match different things that's how you get data in and out of there uh so to create table Yeah so we can do something like create table users that has the columns username and password we can also give these types they can be integers they can be and this helps the database uh store things in an efficient way but again we're not going to get into that okay so we can create a table now we have this table users it has no rows but it has two columns username and password we can insert things into the database we can insert into users values admin admin so this would be inserting a new row into the database where the username is admin and the password is admin if it was values fuar which one's the username and which one's the password fu is the username bar is the password why exactly because of the order yep so there's an inherent order here where these map exactly has we created them username password when we insert them it's exactly the same username password cool and we can insert more ones nobody try this on the dojo actually that'd be great if you had a fake user with this name um so we can keep inserting and these will be different rows in the database and we can keep going I'm gonna add myself in here there we go perfect cool oh no but now we're going to select on them all right I'll change it back okay so creating things creating an entire table has a certain structure with columns inserting data same number of columns now we can do things like select information from there so we can say hey select only these certain columns from this table we can specifically select star which will select all columns from the table uh if we don't add a where it will give us everything back or we can specify in the very specific in the SQL specific language how to specify these conditions but this is the general idea of what we're trying to do here so we can do things like here select username password from users will give us the results of all the usernames and all the passwords from this table we can also if we just want the usernames just say hey give us just the usernames from users we can also say get everything and that way we don't have to specify in advance which ones we'll just get everything in the order that that uh we want we can also say things like hey get everything from users where username equals admin so this will turn us if there exists a user it will return just that row or if there are multiple usern names with admin it'll return multiple rows or it'll be empty row of zero cool we can even do things like hey select star from users where username equals admin and password equals password guess what this is almost how authentication is done in almost every web application you operate on uh we didn't get into it but hopefully the web application is not storing your password in the database as we'll see any uh vulnerability on the system can not any but some vulnerabilities on the system can allow the attacker to leak the database so usually they hash your password but again it's some kind of password check to check if this user exists or not so this returns a row and the user gave you that username password you know they know the username password if it doesn't and it returns zero rows then you say error invalid username or password questions on select inserts creates all right and we can delete things so we can delete from users where username equals kenck and that deletes that Row from from the database and that will delete all rows that match this query this is one of the very important things if you just did delete from users that will delete every single Row in your database and you better hope that you have backups because it does not back anything up by default we may want to update so as our users want to change passwords or do anything like that we can say update table set uh as we'll see assignments where conditions so we can do things like update users set pass password equals password 456 where username is Connor so Connor says oh no the students found out my password I need to change it from password 123 let's change it to password 456 which is way more secure so that will go through every row that matches where username equals Connor it will change the password to be password 456 cool all right there's one more two more things that we need to cover that are going to be useful this is like as your writing applications this is almost all you need to do for the basics um it gets very very complicated of how to do things in a so that it's very efficient as databases grow to hundreds thousands of gigabytes what do you do how do you make it efficient to query the data uh not going to cover any of that here you'll have to like look into that stuff but but there are important things to cover when it comes to exploiting and and extracting information so another type of query that is basically when you want to Union the results of two queries so you want to make two different queries but use the results uh for one so this is a entire select statement Union with another select statement so for instance we could say select username from users Union select passwords from users and this would select all the usern names and also all of the passwords from users into one um so normally like so what why would a web application write a query like this yeah it's kind of a trick question I don't think an application ever would there'd be it'd be silly like why would you want the list of usernames and passwords but not linked together just in one giant list like what are you gonna do with that list go through it and I don't know see if anybody has any bad words in their new names or passwords it just it fundamentally doesn't make sense but you may say hey on a page that's listing all of the usernames on the site you may have a page that says hey select username from users now we'll get to it later but let's say you as an attacker could control the query that comes after that so you can't control anything select username from users but you can control what happens after there let's say I gave you a magic wand you may say oh what if I change it to a instead of Select user name from users I say select username from users Union select password from users now in the list of all the usernames I get also all the passwords you can then change this other select statement to be anything you want to select anything from the entire database and just leak out the whole database using this we'll get more detailed in there but I want to show you why this Union is important for you to learn now cool and one of the ways to do that of what to leak there's actually um so all of the specific query languages uh sorry not query languages but all the specific database engines have ways to query like what are the tables because you may not from the outside know what the tables are so this is a select table name from sqlite Master this is specific for sqlite this will return all of the table names so for instance if you did here select username from users Union select table name from like sqlite Master it would return admin Connor and then it would return users and any other tables maybe Flags or something like that so this is actually how this is a technique that when you're able to control and alter the uh SQL commands that get executed or the SQL queries that get executed you can use this to actually steal all the data from the database okay we can also uh drop not just uh we cannot just delete data we can drop a whole table so coming full circles from creating a table to deleting it we can drop the table users and then this arrow is super great it's uh why do you need access to the camera okay I don't like that anyways and then after this arrow is to nothingness because this table no longer exists boom all the table's gone all of our users are gone questions on SQL it's actually a fairly straightforward is language but it has a lot of nuances and as you get like deeper into web security and you start uh exploiting different types of web applications or there's things that prevent certain characters there's all kinds of crazy stuff you can do um but I want to go over the basics so you have an understanding of SQL so that that way when you're working on the the modules and you come across a web challenge that clearly has some SQL you can refer to this in this lecture so you can say oh yeah that's right this is what this does this is what this does I guess I didn't stop questions all right now we get to the fun part injections okay so all of these classes of vulnerabilities that we're going to look at essentially follow a similar pattern where the web application wants [Music] to create either a SQL query or a bash command or a HTML page and does so by concatenating strings together everybody know how to concatenate strings how you do that in Python how a concatenate strings what is it yeah the plus sign not a trick just the plus sign right and uh then other languages like C you can do it but it's more of a pain you can do stir cat uh you can do all kinds of stuff but fundamentally web applications like to concatenate strings together to do a query and that string is passed to some other system to parse it just like when the web request the HTTP response is sent back that HTML page needs to be parsed by the browser similarly when we make a SQL query the SQL query that we send has to be parsed by the SQL engine and so if we as an attacker can control that parsing we can get it to do something it's not supposed to do so we'll start with the easiest case this is a so often times web applications will want to use the underlying system so rather than uh reuse or reimplement or like so rather than figure out in Python how to give the date I could just call the date command and send that response back with the web page so we can do this in four three different ways here this is in C cish but the concepts apply to any language so let's look at the system command I want to start me a server please okay I will start a web security module I think because I'll show that off in a second but for right now okay so if we look at system system passing a string the system Library function uses Fork to create a child process that executes the shell command specified in command using Excel as follows SL bsh sh- C and the command that we pass in so what this means that anything we pass into system will is just like we passed it into the shell right just as if we were using bsh and type that command in ourself so bsh has to then parse our string whatever string we pass it to figure out which is the command to execute what other parameters to specify all that fun stuff ah so this is exactly what happens so this is the sequence of operations here so we call system system system internally calls execve bsh and passes in sh- C date so the whole entire string that got passed to system is passed to an argument here then bsh has to parse that and then by parsing it looks up okay they're talking about date I need to figure out the path so let me figure out where date is oh there's a date in user bin date so now I actually execute it by calling execve user bin date and passing in date as the argument and it will return this this Thursday oh January I guess it's zero date Zero I guess it's consistent cool everyone understand system yeah yeah so we are not passing so we only pass in to system so this is the this is the argument to system what system does under the hood is it calls execve bsh and then it calls that with the arguments sh- C date so it's exactly so if we have something that's like uh system well date like this that's exactly the same as if we did uh Bin sh- C date and we can actually watch this yeah so we can see should be able to see oh it does clone instead of exective DF oh because it has to follow it there we go there we go okay there we go execve so we can see that it calls exec V user bin date but that is bsh that's doing it so that's what's happening under the hood and that's the um the reason is because you want to be able you can do things like with system uh let me look at the parameters of date uh you can do things like oh I don't want to look at the format you can specify the format specify different parameters and so with system you can do system date uh whatever Fu bar blah like whatever just like you would on the command line so from a programming perspective it's can be very nice uh so let's look so yeah we can do things like we can use system to Define uh environment variables so this is saying when we execute the command date set times the TZ environment variable equal to UTC so we can look and see that like date uses this environment variable to figure out so this changes and specifies here and so we can see that this entire string is could passed to sh- C as this argument it again has to parse it and now it executes date with this as our environment and we can change that we can change that UTC to MST so this allows us a lot of control in executing date we didn't have to create a date functionality to change based on time zones and blah blah blah blah blah I can specify the time zone in here and then specify it in here so now because that's all Happening by the date program and me as a programmer I'm like this is great I can reuse this function that exists this program that exists on Linux and I know it'll work and it will tell me the time specifically in MST now the question is if this comes from the user so if the string UTC or MST if the attacker is able to control that right what can they do so if let's think that like let's say the yeah I know this isn't real code that's okay so like we had some code that kind of looks like this we have system time zone equals to some argument zero that comes from the user and then space date so again just like I said earlier string concatenation we're concatenating strings together we have the string TZ equal equals we have the string space date and then we have some argument that comes from the user all of this is then get going to get passed to s-c and executed just as if it was on the command line so what things can we do in bash or in the shell so if you were sitting here at my shell right now what would you do files and yeah how send some kind of a system command like access certain files file system yeah you want me to type something in what do you want me to type in yeah I'm definitely not doing that but maybe like cat flag would be a thing that you would want to do I don't have permissions to do that but let's say you did right so I'm at let's say let's just try doing this here so I have this blah I can write anything here for blah right per a command to change the permissions on the flag so if I did wait let's look at this so if I did cat flag like this what's gonna happen when I hit enter what was it some kind of erir what kind of air yeah so let's think about what this is gonna do right this is going to set an environment variable TZ equals the cat and then it will try to execute slash flag passing it the parameter date and it gets permission denied why we looked at permissions that's not executable right that file is only readable and only by root so we can't execute it or read it so that didn't work but why didn't that work because of the space exactly because space here The Bash parser is using that space to delineate between the environment variables we want to set here and the command that we actually want to execute so what if we did something like this put double quotes around it did that work well it didn't cause an error I should have asked that is it going to cause an error a good friend the error why is that not working to yeah but I don't like that because that's part of EST okay I guess I could do it with beness and all that oh that is what I did before right uh okay yeah let's do that oh no now we're nesting things but that's okay okay okay so we saw it ex I was hoping it would show us why does it show us the 12 variables all right uh I think I do know how to fix this but I'm not going to bother anyways okay so let's execute this again so we got here it's telling us cat super weird that this actually works that it doesn't say that that's an error so but now what's happening is now we're not executing this command we're just setting an environment variable like if we do EnV here we can see that this environment variable TZ is equal now to the string cat space flag so okay we got rid of the space issue being included now but what we really want to do is execute this program right so luckily in bash there's actually two ways to do this uh the symol and easy way is actually back ticks so bash when it parses uh let's actually can I is this in here yeah there we go wait no double quotes there we go command substitution so I just did mansh there's a whole thing command substitution allows the output of a command to be substituted in place of the command name itself command substitution occurs when the command is enclosed as follows so you can use dollar sign start parenthesis the command end parenthesis or qued versions so you can use backtick command backtick and what the shell does is when it sees those it takes that executes that command and puts the resulting output where that command went that's not we wanted dat so why did we get this cat flag permission tonight because he still tried to execute a flag the command on something that doesn't have the permission yeah so I actually don't have the permissions to read this flag so your your whole reason here is terrible but if I had uh let's Echo oh no I hacked into uh I just want to really hope that this doesn't exist but huh why doesn't it show there I was hoping show there the date showed it okay that worked there we go was getting some output there and you can actually like like I guess if you only had the output here you could get different parts you could uh cat the file and then GP for different things you could do honestly anything you want you can do head to get the first end characters and read it bite by bite you could do all kinds of crazy stuff but fundamentally here because and we'll go back to system but when we call system on something like this right we have to be careful because now bash is parsing the attacker string as if we the programmer wrote that and so we get access to everything in here about command substitution uh where was what was it called yeah so command substitution arithmatic expansion all kinds of crazy stuff and so this is uh so this is an example of showing this exact thing right so we do TZ equals tick who am I tick back tick uh date so this string gets passed to sh- C as this whole argument that sh parses it actually executes first who am I so we can see this who am I gets executed as root and then that gets passed in the result of that output gets passed in as root here and so we see that output here just like we saw the Hacked of reading the content of that file the other cool thing let's go back here so think about this this is incredibly important part of injections all these Concepts so we're able to control the content here after TZ equals can we change what happens before our injection point no this is hardcoded part of the application right if we looked at this uh my wait where's my right I had system TZ equals plus arg0 plus space date right can you if you control Arc zero can you ever control what happens at the start here with these TZ equals no the program will always take your input and concatenate TZ equals with your input so you can't change what happens before it can you change what happens after it no similar logic there's always Stu that will be appended to your input so the cool thing for you as an attacker is to think about okay but what if I don't want that stuff after it so if we look at man sh why does not does it not say anything about comments in Shell scripts yeah I'm totally ruining my flow uh comments in cool there we go anyways so you look up I thought it would I hoped it would be in the manual it's not but you look up yeah this actually makes sense but anyways any line starting with a hash becomes a comment or any anything that starts with a comment is part of starts with a hash so if I did LS uh so back to this example if I did well if I commented out this whole thing this does nothing but I can't do that if I comment out here that's weird because that's part of there anyways if I comment out here so now date never actually happens so we can use this technique and prevent date oh so yeah here we're being even more clever we are now saying okay I don't want to set any environment variables I want to do TZ equals and then everything in red here is what I'm injecting semicolon what's the semicolon for what's the semicolon mean in in Shell scripting I just saw it yeah the semi semicolon Terminator causes the proceeding and or no that's not it yeah so it's used to separate commands so so normally when we type in commands we do LS and then ls- LA and who am I but we can do who am I LS to execute two commands on one line so it parses it based on those semic Cults oh shoot we're out of time uh okay all right we'll pick back up on this on Monday