It's important for the exam that you can recognize the ways that websites and in particular are web
apps are attacked.
So in this episode what I want to do is cover Well basically you've been following along in the series.
I've got a whole other episode called attacking applications and everything that is in there also works
for web apps as well so I just want to add to that a little bit.
Some very specific type of attacks that are unique to Web sites and web apps so with that understanding
if you're going to recognize an attack you need to be able to read log files and the exams are going
to challenge you on your ability to read log files.
Now luckily for us any good web app is going to have tons and tons of log files.
But the first one I want to talk about right now is the common long format the CLX.
Now these are the standard types of logs that every single type of web server generates.
And they all generated in the same format.
So lets go through one of these real quick to make sure you understand common long format.
Here is a very specific line of a log from a common log format web server.
So now if you take a look at this theres a few things you absolutely need to be able to recognize So
just going from left to right.
First of all you're going to see either an IP address in this case we've got 127 0 0 out one but it
could also be a fully qualified domain name.
And that's basically who is talking to this web server right now.
Your next to.
And I just show them as dashes because they're pretty uncommon.
These are different ways to do authentication within HTP not HDTV.
Yes this is kind of old school stuff.
It's not used very often anymore so let's skip those next two dashes they're known equally as ident
which is the identity check.
And the second one is called authorized user.
But again they're not used that often.
Get the next one is the date and time and I'm hoping you can read that and pretty much figure out the
date and then the time and then that little dash on the end.
That's just the offset from Greenwich Mean Time OK.
The next one is the big one.
This is actually the request or whatever is coming in from the client This is the data payload.
In this case we can take a look at this and see this is just a simple HTP get command that's asking
for a Jeff file.
So that's the file itself.
And then the next two values are first of all that 200 shows everything's OK.
It sent it to Jeff while everything's good and the actual bite size of that payload itself now come
and log format is important and you need to be comfortable with that format for the actual exam itself.
Now the next thing I want to talk about are other types of logs you might run into.
Now I've got a web app that I use here at total seminars and this web app works underneath a control
panel tool called See panel it's very popular it's been around forever and see panel can actually phone
home send me emails and can do a lot of different stuff.
I've got mine configured to send me emails whenever something that is scary looking shows up.
So let me show you an example e-mail that I get from my SEE panel applet.
Now I've taken a lot of stuff out but this is the actual e-mail that I've got from my C panel applet.
Something's going on that it doesn't like.
So if you take a look here there's a lot of good information.
So I get process IDs here up at the top.
I know what account is that has logged in to my C panel applet in this case it's just an administrative
account.
Now it's going to show me what's interesting.
So it's telling me that an executable has been run but it's asking very very interesting stuff is trying
to run something called Run call HP.
And last.
It shows me if there's a network connection on it.
In this case the network connection.
Now you have to read these.
Notice that it's the same IP address.
Somebody is working locally on the server itself and they are running this program for one reason or
another.
Now that we're comfortable with logs I want to talk about two very specific types of attacks that are
going to be unique to Web sites Web applications.
That's going to be cross-site scripting or ex-MIL injection.
Now both of these are kind of like injection attacks where somebody tries to put in some extra information
into an HDTV request to do something naughty.
Now they're going to do this one of two ways.
Number one they're actually going to go into a form or something like that and try to add that extra
information they might have a malicious add on that they've intentionally installed on their web browser
to type in extra information they could do it that way.
But more often than not you're going to see tools like I've got a picture of one right here.
This is a x accessor and this is of on my colleague Linux box and this tool is designed to simply go
to a Web site and try to do both cross-site scripting and SML injection attacks.
OK so understanding how people do this stuff.
Let's talk about each one of these.
And I'd like to start with cross-site scripting cross-site scripting and we usually just show it as
x x x is when somebody tries to get another person to run a script from another site.
So what we're going to do is let's take a look into a particular log file and we get something that
looks like this.
So we could say this is coming from a form or something.
However the Web site sees that they're trying to enter this kind of data.
Now depends on the field.
Let's say this is a last name field and all of a sudden we're seeing all this script information.
You're also going to notice that there's a source that is from a different web site that is a very strong
clue of cross-site scripting SML injection simply means to insert SML information that shouldn't be
there.
So what I want to do now is let's take a look at this one particular command here.
So in this particular case we've got a form that's being generated from this Web site and this form
asks for a user name and see it says Mike.
It's got a password it's a pretty weak password.
There's a voucher in here looks like they're buying a voucher off of my web site.
There's a price here of $450.
Don't worry they're not really that expensive.
And then an e-mail address so what we're looking at is form data that is being set up in just such a
way so somebody could get this information.
Now let's just say for a minute that people don't actually type in the price that they're going to pay.
They just pick a particular product and then the price is filled in automatically.
But what if they had a tool that would allow them to change this SML information where they could go
ahead and just insert $50 instead of $450 without any other type of control they're going to get themselves
a very cheap voucher.
The big takeaway I need you to get from this episode is that you need to be comfortable reading log
files.
Luckily for us any web server any Web site any web app is going to come with plenty of log files.
And if you take the time and read them you should be able to easily recognize SML and cross-site scripting.
Also keep in mind that these are still applications even though there are Web applications.
So you might want to review my attacking applications and see if there's anything in there that might
come into play.
You never know when you're going to get a buffer overflow.