Re: RES: Web site defacing

[Michele Orru <antisnatchor () gmail com>]

Fábio Soto wrote:
> "XSS are common ways to achieve this by attacking the application itself"
>
> XSS attacks client-side, not the application itself...

Not really.
Except DOM-based XSS that are completely triggered and executed without
sending any data to the server (thus, the application), reflected and
stored XSS are possible due to input validation flaws in the application.

So yes, malicious code sent as an XSS vector (JS/vbscript) is executed
client-side obviously, but in case of reflected and stored XSS the
application is contacted anyway. So this means that *if* you application
wouldn't be vulnerable to XSS, virtual defacement would be not possible.

Wth frameworks like BeEF (http://beefroject.com) you can play yourself
with these kinds of virtual defacements attacks, that are basically
about modifying the DOM of the page dynamically with Javascript, or
issuing redirects/creating overlaying iFrame...nothing rocket-science :-)

Cheers
antisnatchor

> -----Mensagem original-----
> De: listbounce () securityfocus com [mailto:listbounce () securityfocus com] Em
> nome de Harshvardhan Parmar
> Enviada em: terça-feira, 15 de novembro de 2011 05:18
> Para: security-basics () securityfocus com
> Assunto: Re: Web site defacing
>
> Hello
>
> As mentioned by others, the primary requirement for defacement would
> be some kind of access to your content.
> SQL Injection and XSS are common ways to achieve this by attacking the
> application itself.
> CSRF could also be used, provided there is some option on your site
> which allows adding/modifying content.
> In case WebDAV is enabled and accessible remotely, it can also be used
> for defacement.
> Or I could use FTP to upload the defaced content, depending on how FTP
> is configured.
> Other ways would be using the file upload feature or SSI Injection.
>
> The attacks mentioned above are not exhaustive ways of defacing a
> website. In order to safeguard yourself, the following best practices
> should help.
> 1. Your web application must not be vulnerable to attacks
> 2. Any service which is not required must not be exposed to the users
> 3. All the services running should be safeguarded with strong
> authentication credentials
> 4. The folder where you store the code should only be accessible for
> local users; no remote access allowed
>
> These do not guarantee complete immunity to defacement but
> considerably reduce the chances of a successful attack. Of course, if
> you are using shared hosting, then a vulnerability on the co-hosted
> site makes you vulnerable as well.
>
> Regards
> Harsh
>
> On Mon, Nov 14, 2011 at 1:04 PM, a bv <vbavbalist () gmail com> wrote:
> > Hi,
> >
> > what kind of vulnerabilities , methodologies does it allow to deface a
> > web site? And what must be the countermeasures regarding these?
> >
> >
> > Regards
> >
> > ------------------------------------------------------------------------
> > Securing Apache Web Server with thawte Digital Certificate
> > In this guide we examine the importance of Apache-SSL and who needs an SSL
> certificate.  We look at how SSL works, how it benefits your company and how
> your customers can tell if a site is secure. You will find out how to test,
> purchase, install and use a thawte Digital Certificate on your Apache web
> server. Throughout, best practices for set-up are highlighted to help you
> ensure efficient ongoing management of your encryption keys and digital
> certificates.
> >
> http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727
> d1
> > ------------------------------------------------------------------------
>
> ------------------------------------------------------------------------
> Securing Apache Web Server with thawte Digital Certificate
> In this guide we examine the importance of Apache-SSL and who needs an SSL
> certificate.  We look at how SSL works, how it benefits your company and how
> your customers can tell if a site is secure. You will find out how to test,
> purchase, install and use a thawte Digital Certificate on your Apache web
> server. Throughout, best practices for set-up are highlighted to help you
> ensure efficient ongoing management of your encryption keys and digital
> certificates.
>
> http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727
> d1
> ------------------------------------------------------------------------
>
>
> ------------------------------------------------------------------------
> Securing Apache Web Server with thawte Digital Certificate
> In this guide we examine the importance of Apache-SSL and who needs an SSL certificate.  We look at how SSL works, 
> how it benefits your company and how your customers can tell if a site is secure. You will find out how to test, 
> purchase, install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for 
> set-up are highlighted to help you ensure efficient ongoing management of your encryption keys and digital 
> certificates.
>
> http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
> ------------------------------------------------------------------------

------------------------------------------------------------------------
Securing Apache Web Server with thawte Digital Certificate
In this guide we examine the importance of Apache-SSL and who needs an SSL certificate.  We look at how SSL works, how 
it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, 
install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are 
highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates.

http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
------------------------------------------------------------------------