A mini-review of Ninja Hacking by Wilhelm and Andress

I have just come off a vacation where I tried to disconnect from being overly technical.  Typically, on my breaks I read technical books to enhance something I know or I read something in-depth to learn a new skill.  This past week, I wanted something relevant, but not overly technical.  I saw an ad for "Ninja Hacking:  Unconventional Penetration Testing Tactics and Techniques" by Thomas Wilhelm and Jason Andreas, and decided this fit the bill perfectly.

To start off, let me say that the book is aptly named.  The use of the word "ninja" is not just used as the adjective to describe a good coder or pen tester; all of the concepts in the book relate to the ancient ninja of feudal Japan.  The point of the book is to introduce concepts of penetration testing with the arts and practices of the ninja.

So, here is what I liked:  First, the book devotes the first two chapters to the history of the ninja in Japan.  I can honestly say that prior to reading those two chapters, my concept of ninjas was what Hollywood depicts in movies.  The first two chapters shed light on what the ninjas were really like, how they operated, why they were necessary, and what tools the ninjas had at their disposal.  Succeeding chapters took those tools and applied them to how penetration testers should think differently to accomplish their goal.  I really liked the discussion on strategies and tactics.  Some of the examples given to disrupt a system administrator were:  call them at 2 A.M. with a trouble ticket, send them an email from HR with an issue about their insurance, or leave a note on their car that they have parked in the wrong space.  Good stuff.  All of those are activities that will have someone thinking differently when they should be paying attention.

Also, the chapters might have discussed various tools and methodologies, but not at a low level.  For example, the chapter on discovering weak points in area defenses had a discussion on sniffing network traffic.  In the discussion Kissmet and Wireshark were both discussed, but only to introduce the tools to the reader (if they did not know of them) and provide the reader with the resources to learn more about them.  Each chapter had a page of end notes that included links to tools, articles, and other references for further study.

A couple of issues I found:  the title of the book includes "unconventional penetration testing tactics..." and to me, penetration testing refers to systems, networks and applications.  I understand that a target may be a building or a person.  Many of the chapters discussed the latter, buildings and people and did not necessarily apply to computers.  There was a section of the book that discussed torture; and while interesting, is not something I'll be employing.  There was a section in the chapter on discovering weak points called "Gates, Guns, and Guards."  While these are valid security concerns, I don't think they come up in your average day-to-day penetration test.  However, the authors extrapolated the scenarios to the logical (cyber?) world and created successful analogies in how to employ the tactics to the computer or network. 

Overall, I enjoyed the book.  It opened me up to thinking of different ways to conduct penetration tests and employ some tactics I would not have thought of.  I really enjoyed that the book was not overly technical such that I read through and jot down areas for further exploration.  And, I liked the chapters on the history of the ninja as I could dispel some of the Hollywood myths and legends for what the ninja truly were.

Review: How to Break Web Software by Andrews and Whittaker

I haven't had to travel much over the last couple of weeks, which has been good for me in that I get to work on my reading list a bit.  I picked up "How to Break Web Software" for a trip a little while ago, and never got to the book.  Not having to travel coupled with the long weekend gave me some time to read and digest this book.  Here are a couple of things that I really liked about this book:

• I really liked the table of regular expressions that is included in chapter 2.  To me, this is great because after I have retrieved source code, I can script out exactly what I'm looking for; especially hidden fields.
• I liked the fact that the CD contained some older software that is not easily found on the web.  While the functionality of some of these tools is rolled up into newer software, there are times that I want to perform just what these tools do, and nothing more.  HttpPrint is highly useful to me as there are plenty of times I get on site and the client either doesn't know what they have, or doesn't want me to know all that they have.  SSLDigger is great for letting the client know how strong their SSL is.
• The book includes its own vulnerable web application where you can practice some of these attacks.
• I liked the chapter on Web Services.  More and more, I'm running into web services, and while some of the more advanced tools cover the services, it is good to have a primer on the various technologies involved.

Overall, I enjoyed the book.  In my estimation, the material is basic, and gives a great jumping off point for someone getting into testing/breaking web applications.  With the tools, a reader can dive into the material, practice, and really start to get a foundation for breaking web applications.

Review: Web Security Testing Cookbook by Paco Hope & Ben Walther

I’m not much for writing reviews of books that I read, but I wanted to heap some praise on this excellent book.  As a DoD auditor, more and more, especially in enterprise systems, we are running into applications; specifically web applications.  While auditing web servers, database servers, and operating systems is pretty generic (usually,) auditing the enterprise web applications is anything but.  To that end, I’ve picked up some books on (pen)testing web applications with the goal of sharpening my skills and better being able to answers the technical checks from the Application Security and Development checklist.

The Web Security Testing Cookbook by Paco Hope and Ben Walther is an excellent book for helping to be a better web application tester.  I should point out that the book is not aimed at pen-testers by any stretch; it is clearly aimed at in-house application testers.  But, that does not mean that the tools and concepts provided do not translate well to the auditor/pen-tester field.  In fact, it is with the eye of an auditor that I believe I was able to glean bits of information that I found useful that may not necessarily apply to an in-house application tester.

Like other books in the O’Reilly cookbook series, the book contains recipes to solving various problems.  Typically, within each chapter are a collection of like-recipes that have a problem, a solution, and a discussion.  Many tools are discussed (most of which are free or open source.)  And, many solutions are given to the various topics of testing.

Here is what I liked:

Chapter Two was awesome for me; a listing of the various tools that are used in the book.  Some of these tools I’ve heard of and used, some were new.  This was important to me because many times I am limited to “certified” tools for the networks we are auditing.  For example, most sites allow us to use Retina, but not Nessus.  On the application side, we are typically allowed to use HP’s WebInspect.  The tools listed in chapter two allow me to take a more “manual” approach to testing the application.  Specifically, I liked Firebug, EditCookies and TamperData, WebScarab, and ViewState Decoder.  One note, while testing Edit Cookies, I was not able to get it to work with FireFox 4, at the time of this writing.

The chapter on Basic Observation gave me a new appreciation for hidden fields and what you can do with them.

I do not have much experience with web encoding, so chapter four got me up to speed on the topic.  A recipe dealt with OWASP’s CAL9000, however another good encoder I have used is the one linked to by the Ethical Hacker:  http://yehg.org/encoding/.

Chapter 5, Tampering With Data, was one of my favorite chapters.  Many recipes were discussed, using the tools to show different ways to tamper with the data being sent to the application.  My favorite recipe in the book came from this chapter and discussed uploading of files with malicious files names; a concept I never gave much thought in the past.

Chapter 6 discussed the automation of some of the rudimentary tasks.  Some of the great tools discussed included wget, nikto, WSFuzzer, along with native *nix tools.

Chapter 7 dealt with cURL, a tool I’ve never used before but will probably add to the toolbox.  The first sentence in the chapter sums it up perfectly:  “cURL is a command-line URL tool that is ideal for automating simple web testing tasks.”  Many recipes were presented that gave examples of using cURL to accomplish common tasks.

Uploading viruses to an application (via EICAR), in chapter 8, was a that never dawned on me.  And, included with the concept is a snippet of Perl code that will do the trick.  Yet another great feature of the book is the inclusion of much Perl code to make the scripting of many of the recipes possible.

Chapter 11, on manipulating sessions, was enjoyable because I liked the presentation of the various tools to attack sessions and session state.  There are checks in the Application Development checklist that are specific to session state, so it was good to expand on my arsenal of tools to check sessions.

Probably the best feature of the book was that it gave me many "A-Ha" moments that will greatly expand my knowledge of auditing applications.  If you are in a position of having to audit web applications you will benefit from reading the recipes presented and using the tools described.

Book Review: SQL Injection Attacks and Defense by Justin Clarke

Wow!  What a great book.  But let me put this in perspective first.  As a DoD autditor, I do many audits where the enclave/system has a web server with application(s) residing somewhere on a web/application server.  Many times these are GOTS applications that need auditing under the auspices of the Application Security and Development checklist.  That checklist is rather large, and covers the whole spectrum of application development.  A good portion of the checklist is manual in nature; either looking at configurations, checking documentation, or interviewing the appropriate personnel with regards to the application.  There are a few controls for which we run an automated  tool looking for some of the major vulnerabilities (command injection, XSS, SQLi, limited buffer overflows, temp files, error messages, etc.)

I bought this book so I could understand the underpinnings of the SQL injection:  why it exists, how to make it work, and to some degree, how to fix them.  (I don't need to fix them, however, it's nice to be able to help the client mitigate open vulnerabilities.)  I have prior SQL experience (coming from the DBA/DBD world) so the concepts of SQL are quite familiar to me.  And of course, when most people think of SQLi, they think of the familiar ' or 1=1.  I wanted to know more, and I wanted a more advanced knowledge.  Sure, we run tools, but I wanted to be able to confirm our tool's output.  And, I wanted the ability to perform the analysis manually.  One other caveat worth mentioning, many of the systems I audit are CAC-enabled; which the tools we use do not handle too well.  It's easy to manually log in, authenticate, and manually exploit/search for vulnerabilities.

I admit it, I bought the book mainly for chapters 2, 4, 5, 6, and 7.  These chapters talk about testing for SQL injection, exploiting SQL injection, blind SQL injection, exploiting the operating system and advanced topics, respectively.  And those chapters were great.  I satisfied my objective to learn how to really accomplish the task of finding and somewhat-exploiting found inection-able fields.  (We're not hired to pen-test, just audit....so we can't go nuts with a finding once we find it.  The fact that the vulnerability is there is enough.)  Chapter 7 discussed advanced topics, and contained a sub-section on finding second-order vulnerabilities.  The topic presented made me think of this post, and other uses for SQL injection.

However, I got so much more from the book.  Chapter 3 discussed reviewing code for potential SQL injection.  What to look for, types of data, frameworks, and static code analysis tools were all discussed.  This was extremely beneficial because while we do not do code reviews, I can better speak to the client on how they can make their code reviews better; and what they should be looking out for (at least in a general sense.)

Chapter 8 is a great chapter on how to remediate findings; fixing code, both in the application and in the database.  Chapter 9 talked about platform-level defenses and remeditions that can be used to harden the servers and operating systems that house the data, web server or database server.  Many of the points mentioned in Chapter 9 are controls found in the Application Security and Development checklist.  These are issues that if employed will directly satisfy the requirement in the checklist.  Finally, chapter 10 includes a great reference on SQL and SQL injection.  As a former DBA/DBD, I could skip the SQL primer.  The chapter also included some of the databases that the book did not delve into; namely PostgreSQL, DB2, Informix and Ingres.  Finally, there were cheat sheets for the topics discussed throughout the book.

This is certainly one of the best books I've read in a bit.  I really could not find much that detracted from the book.  Go into the book knowing that the topics are geared towards MS SQL Server, Oracle, and MySQL; as they should be, they are the three widest-used databases.  Be prepared to learn a lot.  I'm looking for vulnerable web applications that I can install and use to reinforce the concepts so that I am better prepared when I go on audits.  I highly recommend the book; whether you are an application/sql developer, an auditor or a pen-tester.

Book Review: Seven Deadliest Web Applications by Mke Shema

I have been doing more and more testing of applications, and most of those applications have been web applications.  I think it is the nature of the beast.  Sure, sites have servers to manage their client workspace, and they handle mail.  But, if they have a web server and/or database server there's a good chance that they are hosting a web application.  Whether the organization "knows" it or not.

Last year I worked on the big application project where we had to test north of 80 applications in a very short time period.  My eyes were really opened during that project.  Since then, more and more, the sites we are going to have web applications.  I've taken it upon myself to improve my application (and by extension, web application) testing.  While the DoD has the Application Security and Development Checklist to guide them, actually testing the controls is not the easiest.  So, I've been trying to delve deeper into App testing.

I picked some books to start going through, and some of them are listed on my reading list.  The first one I've gotten to is Seven Deadliest Web Application Attacks by Mike Shema.  One of the reasons I picked this book is because the book just came out, literally, last week.  So, the book is current.  Mike is not a stranger to security or web applications and has a couple of books on web application security.

I have to say that I really liked the book.  Mike's style is easy to read and he's able to convey the knowledge and the points in each chapter concisely and in a matter that facilitates remembering the facts and putting them to use.  There are seven chapters that Mike focuses on:  Cross-site Scripting (XSS), Cross-site Request Forgery, Structured Query Language (SQL) Injection, Server Misconfiguration and Predictable Pages, Breaking Authentication Schemes, Logic Attacks, and Web of Distrust.

Each chapter goes into detail about the specific attack.  There are many good examples, code snippets, and current stories about relevant attacks in the real world.  Many of the attacks have analogies to reinforce the concept using non-technical language to put the attack in a different frame of mind.  The big three (XSS, CSRF, and SQLi) make up the first three chapters.  I admit, I come from more of a DBA background (from before my security days) so I didn't focus on SQLi as much.  However, I still picked up knowledge from the SQLi chapter.  We test for XSS a lot, and I was familiar with the information; but of the big three, I learned the most from the CSRF chapter.  Server Misconfiguration delves into attacks that are based on applications and servers that are not as hardened as they should be.  Breaking authentication discusses different methods to subvert and get around authentication.  I liked the chapter on logic attacks because it employed the use of thinking outside the box.  These attacks were not the result of fundamental coding errors; they were errors in the way the application was designed.  Finally, the last chapter (Web of Distrust) compiled a bunch of different attacks.  Malware, scareware, referer attacks, html, and DNS all were given sections.

Each chapter starts out by defining the specific attack; what it is composed of, how it works, and how to employ it.  The chapter also devotes a section to employing countermeasures and how to mitigate the specific attacks.  Finally, a summary puts it all together.  I really liked the small sections titled "Epic Fail" where a specific attack is given a real-world example.  Also, there are many URLs given for tools that are discussed and for points for further information.  There are a couple of tools that I'm actively researching and looking to use that I learned about from the book.

The book is not a cookbook or a how-to on performing the attacks.  While lines of code are given as examples, there are not step-by-step instructions on how to successfully exploit the attack.  And that was fine for me; that wasn't my goal.  There are other books out there; in fact, there are whole books devoted to some of the chapters.  So, if you are looking for step-by-step instructions, this book is not for you.

I rate the book very highly and would recommend it to anyone wanting a good overview and jumping off point for the seven major web application attacks.  I've brought the book into my office and hope others will get as much out of it as I have.  You will not go wrong in reading the book if you want to learn what the major attacks are, how they work, and some mitigations to lessening the threat of these attacks.

mini-book review: Incident Response & Computer Forensics (2nd Ed.) by Mandia, Prosise and Pepe

Before I took the SANS 504 course I had picked up the book Incident Response & Computer Forensic (2nd Ed.) by Kevin Mandia, Chris Prosise and Matt Pepe. I was well into the book before the class started, and I'm glad class began while reading the book. The book almost makes a perfect companion for the class. The book helped me re-enforce many of the concepts taught in the class.

I'll start out by saying the book is excellent, well written, easy to read; and chock full of sites to pick up the tools used in the examples written about in the book. I learned many new tactics that I have already put into practice and I believe have made me a better security warrior. Rest assured, the authors are well versed in the field and they rely on their vast experience to convey their points. Many chapters contain real-world anecdotes to cases the authors worked on/witnessed and lend credence to the points being discussed.

The book is divided up into four logical sections: an introduction to incident response, collecting data, analyzing data, and an appendix (one chapter of which contains common sample forms.) The introductory chapters explain the basics of IR, what to expect, creating a team, and establishing the processes. Specific chapters deal with preparing for incidents and what to do after an incident has been declared. I really liked the chapters on data acquisition as it applies the most to what I do. Chapters deal with Windows, unix/linux, network data collection, and an important chapter on evidence and evidence handling. (The latter chapter is important for everyone, but the authors stress why this would be important in a corporate setting.) I especially liked the tools discussed and the scripts that are presented with the methodology for using them. The next section presented how to analyze the data that has been collected. While there is heavy presentation on forensics duplication (and rightly so,) there are chapters on Windows analysis, unix/linux analysis, and network analysis. From the network analysis chapter, the points on network data capture and reconstruction helped me the most.

My only complaint about the book is no fault of the author's. The book is copyright 2003. And, while the processes and methodologies could be considered timeless, unfortunately; the links to some of the software is not. In the five years, some companies have gone out of business, some have been absorbed by other (larger) companies. And some tools are no longer available. A great benefit of the book is that much of the software is free (and open source.) However, there are instances where the software linked to now costs.

All in all, I highly recommend the book to anyone looking to get into the field, or, anyone charged with setting up (or running) an incident handling team in their company. The methodologies and processes should be employed in any company where an incident response team works so that incidents can come to their proper conclusion. Many tools are presented in the chapters along with insights on how to get the most out of those tools.