Re: RES: Web site defacing





Fábio Soto wrote:
"XSS are common ways to achieve this by attacking the application itself"

XSS attacks client-side, not the application itself...

Not really.
Except DOM-based XSS that are completely triggered and executed without
sending any data to the server (thus, the application), reflected and
stored XSS are possible due to input validation flaws in the application.

So yes, malicious code sent as an XSS vector (JS/vbscript) is executed
client-side obviously, but in case of reflected and stored XSS the
application is contacted anyway. So this means that *if* you application
wouldn't be vulnerable to XSS, virtual defacement would be not possible.

Wth frameworks like BeEF (http://beefroject.com) you can play yourself
with these kinds of virtual defacements attacks, that are basically
about modifying the DOM of the page dynamically with Javascript, or
issuing redirects/creating overlaying iFrame...nothing rocket-science :-)

Cheers
antisnatchor


-----Mensagem original-----
De: listbounce@xxxxxxxxxxxxxxxxx [mailto:listbounce@xxxxxxxxxxxxxxxxx] Em
nome de Harshvardhan Parmar
Enviada em: terça-feira, 15 de novembro de 2011 05:18
Para: security-basics@xxxxxxxxxxxxxxxxx
Assunto: Re: Web site defacing

Hello

As mentioned by others, the primary requirement for defacement would
be some kind of access to your content.
SQL Injection and XSS are common ways to achieve this by attacking the
application itself.
CSRF could also be used, provided there is some option on your site
which allows adding/modifying content.
In case WebDAV is enabled and accessible remotely, it can also be used
for defacement.
Or I could use FTP to upload the defaced content, depending on how FTP
is configured.
Other ways would be using the file upload feature or SSI Injection.

The attacks mentioned above are not exhaustive ways of defacing a
website. In order to safeguard yourself, the following best practices
should help.
1. Your web application must not be vulnerable to attacks
2. Any service which is not required must not be exposed to the users
3. All the services running should be safeguarded with strong
authentication credentials
4. The folder where you store the code should only be accessible for
local users; no remote access allowed

These do not guarantee complete immunity to defacement but
considerably reduce the chances of a successful attack. Of course, if
you are using shared hosting, then a vulnerability on the co-hosted
site makes you vulnerable as well.

Regards
Harsh

On Mon, Nov 14, 2011 at 1:04 PM, a bv <vbavbalist@xxxxxxxxx> wrote:
Hi,

what kind of vulnerabilities , methodologies does it allow to deface a
web site? And what must be the countermeasures regarding these?


Regards

------------------------------------------------------------------------
Securing Apache Web Server with thawte Digital Certificate
In this guide we examine the importance of Apache-SSL and who needs an SSL
certificate. We look at how SSL works, how it benefits your company and how
your customers can tell if a site is secure. You will find out how to test,
purchase, install and use a thawte Digital Certificate on your Apache web
server. Throughout, best practices for set-up are highlighted to help you
ensure efficient ongoing management of your encryption keys and digital
certificates.

http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727
d1
------------------------------------------------------------------------


------------------------------------------------------------------------
Securing Apache Web Server with thawte Digital Certificate
In this guide we examine the importance of Apache-SSL and who needs an SSL
certificate. We look at how SSL works, how it benefits your company and how
your customers can tell if a site is secure. You will find out how to test,
purchase, install and use a thawte Digital Certificate on your Apache web
server. Throughout, best practices for set-up are highlighted to help you
ensure efficient ongoing management of your encryption keys and digital
certificates.

http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727
d1
------------------------------------------------------------------------


------------------------------------------------------------------------
Securing Apache Web Server with thawte Digital Certificate
In this guide we examine the importance of Apache-SSL and who needs an SSL certificate. We look at how SSL works, how it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates.

http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
------------------------------------------------------------------------


------------------------------------------------------------------------
Securing Apache Web Server with thawte Digital Certificate
In this guide we examine the importance of Apache-SSL and who needs an SSL certificate. We look at how SSL works, how it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates.

http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
------------------------------------------------------------------------



Relevant Pages

  • RES: Web site defacing
    ... XSS attacks client-side, not the application itself... ... Securing Apache Web Server with thawte Digital Certificate ...
    (Security-Basics)
  • Re: HOW TO PREVENT FHISHING ATTACKS
    ... I am preparing a set of recommendation for a client of mine which is a bank ... , a set of controls against fhisging attacks, besides of telling the bank to ... Securing Apache Web Server with thawte Digital Certificate ...
    (Security-Basics)
  • RE: Needs statistical data regarding recent attacks on the networks.
    ... Needs statistical data regarding recent attacks on the networks. ... Securing Apache Web Server with thawte Digital Certificate ...
    (Security-Basics)
  • Re: HOW TO PREVENT FHISHING ATTACKS
    ... I am preparing a set of recommendation for a client of mine which is a bank ... , a set of controls against fhisging attacks, besides of telling the bank to ... Securing Apache Web Server with thawte Digital Certificate ...
    (Security-Basics)
  • Re: RES: Web site defacing
    ... I'd consider a persitent xss to be an attack against the web app. ... Even if the attack technically originates/ occurs within the browser, the effects can certainly be felt server side. ... Securing Apache Web Server with thawte Digital Certificate ...
    (Security-Basics)