1 00:00:00,250 --> 00:00:01,834 CHRIS: Apparently there was more sober people than I thought there were 2 00:00:01,834 --> 00:00:02,999 going to be. 3 00:00:02,999 --> 00:00:05,083 AUDIENCE MEMBER: Who said we're sober? 4 00:00:05,083 --> 00:00:06,209 CHRIS: Good point! 5 00:00:06,209 --> 00:00:06,209 Just before I start how many people have woken up especially early 6 00:00:06,209 --> 00:00:07,209 to come and see this? 7 00:00:07,209 --> 00:00:08,999 And how many people are still drunk? 8 00:00:08,999 --> 00:00:11,751 And you woke up and you're still drunk, even better! 9 00:00:11,751 --> 00:00:14,250 So, yeah, this is my first presentation at DEF CON. 10 00:00:14,250 --> 00:00:16,375 (Applause.) AUDIENCE MEMBER: Brink! 11 00:00:16,375 --> 00:00:17,375 Drink! 12 00:00:17,375 --> 00:00:17,375 CHRIS: So I've spent the are entire week thinking I can't drink 13 00:00:17,375 --> 00:00:17,375 because I'm presenting so this presentation would be better 14 00:00:17,375 --> 00:00:18,834 if I had drunk, pretty sure. 15 00:00:18,834 --> 00:00:20,000 Quick, one drink of Vodka. 16 00:00:20,000 --> 00:00:21,542 This is a little bit about me. 17 00:00:21,542 --> 00:00:24,751 No one cares about the speaker, so read this whenever you want. 18 00:00:24,751 --> 00:00:27,083 I do podcasting and blogging and shit like that. 19 00:00:27,083 --> 00:00:27,083 (Laughter.) I am the firm believer in the wisest man knows nothing 20 00:00:27,083 --> 00:00:29,751 and I am absolutely happy to admit I know nothing. 21 00:00:29,751 --> 00:00:29,918 I like edge case stuff, it's freaky, most people are just like, it's 22 00:00:29,918 --> 00:00:33,125 an edge case, no one cares, but the freaky stuff and weird stuff 23 00:00:33,125 --> 00:00:35,999 intrigues me, and it makes me think that's cool 24 00:00:35,999 --> 00:00:40,999 I should dive into that so that is part of the edge case stuff that people don't 25 00:00:40,999 --> 00:00:43,626 give a shit about but apparently you guys do, 26 00:00:43,626 --> 00:00:48,459 otherwise you wouldn't have woken up early to come and see this. 27 00:00:49,125 --> 00:00:51,792 I'm going to start with a quick warning. 28 00:00:51,918 --> 00:00:57,542 This presentation contains numbers and jokes and cases of pea nuts! 29 00:00:57,876 --> 00:01:02,125 Who has ever seen me talk about? 30 00:01:02,125 --> 00:01:03,876 If you had, you wouldn't be here. 31 00:01:04,209 --> 00:01:08,209 Anyone who has seen me give a talk about I'm sorry I use 32 00:01:08,209 --> 00:01:13,459 the same jokes every time so laugh when everyone else does! 33 00:01:14,542 --> 00:01:16,709 Not you, Ed, you have to stay! 34 00:01:17,292 --> 00:01:20,250 So I'm going to give everyone the TLDR on what I'm going 35 00:01:20,250 --> 00:01:22,709 to be talking about today. 36 00:01:23,626 --> 00:01:29,999 The goal is to describe the defensive uses of status codes, 37 00:01:29,999 --> 00:01:34,083 that sounds sexy, doesn't it? 38 00:01:34,083 --> 00:01:37,125 This is an absolute "must see" at DEF CON on a Sunday morning! 39 00:01:39,083 --> 00:01:42,542 Back to why are you guys awake again? 40 00:01:43,209 --> 00:01:47,083 I'm going to run through the why, the how, the goals and then we 41 00:01:47,083 --> 00:01:51,542 will bring it together and review what we have covered. 42 00:01:51,542 --> 00:01:55,250 I'm going to try and run through this reasonably fast so I can 43 00:01:55,250 --> 00:01:58,417 get everything in so HT to P status code, 44 00:01:58,417 --> 00:02:01,167 who has never seen what? 45 00:02:02,999 --> 00:02:06,542 We know what an HTTP request looks like, this 46 00:02:06,542 --> 00:02:09,709 is the status code or the response code, 47 00:02:09,709 --> 00:02:12,751 the terms are interchangeable depending 48 00:02:12,751 --> 00:02:15,999 on how much you had to drink. 49 00:02:16,918 --> 00:02:20,959 It it's like a small little thing, every time you make a request 50 00:02:20,959 --> 00:02:24,209 or every time you get an answer from a server it comes 51 00:02:24,209 --> 00:02:26,459 with a status code. 52 00:02:26,999 --> 00:02:31,667 No one cares what they are, the browser doesn't tell you what it 53 00:02:31,667 --> 00:02:36,501 is but it's an important feature of the HTTP standard. 54 00:02:36,709 --> 00:02:41,999 What I'm going to somehow you is a small detail but it's a big impact. 55 00:02:42,209 --> 00:02:45,709 If you don't pay attention to the status codes some bad things 56 00:02:45,709 --> 00:02:47,876 can seriously happen. 57 00:02:47,876 --> 00:02:52,751 A little bit of history on HTTP status codes, there is an RFC, 58 00:02:52,751 --> 00:03:00,999 I thought I couldn't sleep so I would read it last night, but that didn't happen. 59 00:03:01,417 --> 00:03:07,542 There are five classes of responses, you get the 100, informational stuff. 60 00:03:08,876 --> 00:03:12,999 You get the 200, which is most of the time success. 61 00:03:12,999 --> 00:03:15,250 Your web page is here, here is the content, thank you very much, 62 00:03:15,250 --> 00:03:17,083 please go away. 63 00:03:17,083 --> 00:03:20,918 You get the 300, the redirect stuff, the 400, which means you fucked up, 64 00:03:20,918 --> 00:03:24,125 the 500, which means they fucked up! 65 00:03:25,209 --> 00:03:27,292 Simple as that, okay? 66 00:03:27,292 --> 00:03:30,876 And there is a wonderful RFC and this is worth reading 67 00:03:30,876 --> 00:03:36,292 for the 700 codes, by John Bodin, if you go to his GitHub page there 68 00:03:36,292 --> 00:03:38,999 is an entire section. 69 00:03:44,083 --> 00:03:52,667 I specifically like this one, fucking "(Laughter.) And there 70 00:03:52,667 --> 00:03:57,584 is like 300 of these things. 71 00:03:57,751 --> 00:04:00,918 I have no idea how they squeezed it all into the 700 range 72 00:04:00,918 --> 00:04:04,959 because there are 300 of them but these are amazing and where did 73 00:04:04,959 --> 00:04:06,999 the 600 range go? 74 00:04:09,709 --> 00:04:11,626 (Chuckles.) I really hope they accept that RFC 75 00:04:11,626 --> 00:04:14,083 and start implementing that in stuff. 76 00:04:14,167 --> 00:04:18,083 Let's go through the basic stuff this is the theory bit, it's boring. 77 00:04:20,626 --> 00:04:25,375 You get the 100s, the protocols, so forth. 78 00:04:27,083 --> 00:04:32,167 Moving into the 200 stuff it means it worked, it understood so you're getting 79 00:04:32,167 --> 00:04:36,999 a 200 okay, which is most of the web is running at 200. 80 00:04:36,999 --> 00:04:37,999 Okay. 81 00:04:38,083 --> 00:04:41,792 You also get weird stuff that you don't get to see, like content, great, 82 00:04:41,792 --> 00:04:43,999 thanks for the header! 83 00:04:46,918 --> 00:04:49,999 (Laughter.) There is also some interesting stuff that isn't 84 00:04:49,999 --> 00:04:53,209 supported by Apache," low on storage space "I've never seen that 85 00:04:53,209 --> 00:04:56,417 returned by a server (Sneezing) Bless you! 86 00:05:05,876 --> 00:05:11,959 300 you don't get to see very much, what is it, like an exam? 87 00:05:11,959 --> 00:05:17,375 They give you tick boxes or something, 304 you see the way data flows, 88 00:05:17,375 --> 00:05:23,125 and weird stuff like switch proxy, that sounds fun and used proxy, 89 00:05:23,125 --> 00:05:28,542 if you return a proxy in a location header it says you should 90 00:05:28,542 --> 00:05:32,417 use this for your communications. 91 00:05:32,584 --> 00:05:35,876 I'm sure no one would use that for malicious purposes in any way. 92 00:05:36,834 --> 00:05:44,167 (Laughter.) So moving on to the 400, the you fucked up, usually stuff, 93 00:05:44,167 --> 00:05:47,918 404 being an unreasonable response 94 00:05:47,918 --> 00:05:54,709 for I search for random crap on the internet and I like the 407, 95 00:05:54,709 --> 00:05:58,125 authentication required. 96 00:05:58,626 --> 00:06:01,999 I will talk more about that later on and there are interesting ways 97 00:06:01,999 --> 00:06:04,792 to do malicious stuff with that. 98 00:06:05,125 --> 00:06:06,834 This is a long list. 99 00:06:06,999 --> 00:06:14,834 I quite like the 418, I'm a teapot, it's an April fools and web servers don't 100 00:06:14,834 --> 00:06:18,999 implement it but I am a teapot! 101 00:06:21,083 --> 00:06:24,959 Moving into the 500s, unfortunately used quite a lot 102 00:06:24,959 --> 00:06:28,375 for SQL injection, I got a 500 error that must be 103 00:06:28,375 --> 00:06:31,083 a SQL injection trigger. 104 00:06:32,083 --> 00:06:36,626 You don't get to see it very much if you're not abusing, sites. 105 00:06:37,375 --> 00:06:41,459 Wow, that's a lot of fuckin' numbers! 106 00:06:42,999 --> 00:06:48,209 (Laughter.) So everyone here knows every single response code, right? 107 00:06:48,209 --> 00:06:50,918 Great, now I don't have to talk about them anymore. 108 00:06:50,918 --> 00:06:52,083 Why are we doing this? 109 00:06:52,083 --> 00:06:56,083 It started off as a little idea, I wrote a couple of books, I do that 110 00:06:56,083 --> 00:07:01,167 on a few occasions, I don't know if any of the authors are in the room, 111 00:07:01,167 --> 00:07:04,375 sorry, plagiarizing your work! 112 00:07:11,292 --> 00:07:21,626 Screwing with Kitties is a life calling and that sounds like fun! 113 00:07:21,999 --> 00:07:25,083 (Laughter.) Something I thought I wanted to do on the weekend, 114 00:07:25,083 --> 00:07:27,999 everyone follows the Grec on Twitter. 115 00:07:27,999 --> 00:07:31,459 He's not here, he's drunk, or he should be. 116 00:07:32,209 --> 00:07:37,334 He said" Stop this missing object security in the object security, 117 00:07:37,334 --> 00:07:41,083 because unpredictability works to your advantage. 118 00:07:41,083 --> 00:07:42,167 " 119 00:07:49,209 --> 00:07:54,542 We can say that an attacker is going to waste 3 hours attacking 120 00:07:54,542 --> 00:07:58,334 a web site that's going to take three minutes, 121 00:07:58,334 --> 00:08:02,792 we should be more active on our defense. 122 00:08:02,792 --> 00:08:05,792 There is some prior art. 123 00:08:05,999 --> 00:08:09,459 I looked around, I was trying to find out who else has talked 124 00:08:09,459 --> 00:08:12,959 about this stuff before because in my mind this was 125 00:08:12,959 --> 00:08:17,083 obvious stuff, somebody is bound to have implemented this stuff, 126 00:08:17,083 --> 00:08:21,584 there was a 2004 talk by Ruan Mire and the guys at sense post where 127 00:08:21,584 --> 00:08:24,999 they used status codes to slow down appear tackers, 128 00:08:24,999 --> 00:08:28,375 there was one line in a presentation. 129 00:08:31,542 --> 00:08:33,292 There must be more! 130 00:08:33,542 --> 00:08:39,999 There was an interesting paper by Gunter Olam, there is a pdf where 131 00:08:39,999 --> 00:08:46,083 he stops about stopping attacks, and in it he doesn't dig deep 132 00:08:46,083 --> 00:08:51,334 in using HTTP status codes to do this stuff. 133 00:08:51,667 --> 00:08:57,999 So I carried op and I was informed of a mailing list comment where Ryan 134 00:08:57,999 --> 00:09:04,459 Bonnet said maybe we could retry to a 303 with a retry after header, 135 00:09:04,459 --> 00:09:10,876 that was interesting, I tried t they ignore retries after headers, 136 00:09:10,876 --> 00:09:15,999 bullet this was 2006, so maybe they do now. 137 00:09:15,999 --> 00:09:18,876 So, yeah, no one seems to have discussed this stuff. 138 00:09:18,876 --> 00:09:19,876 . 139 00:09:22,999 --> 00:09:30,834 Browsers have to be flexible, you get things written in note pads 140 00:09:30,834 --> 00:09:38,083 and the browser has to be able to support everything. 141 00:09:38,751 --> 00:09:42,709 This leads to a certain amount of flexibility 142 00:09:42,709 --> 00:09:47,417 on how things are understood and supported. 143 00:09:47,584 --> 00:09:49,999 Which obviously leads to the dark side. 144 00:09:49,999 --> 00:09:53,834 Then of course there are RFCs which some would say is the dark side. 145 00:09:53,999 --> 00:09:56,999 They're more of a guideline, really. 146 00:09:57,209 --> 00:10:00,000 This is the way you should do it but we're not going 147 00:10:00,000 --> 00:10:03,999 to tell you exactly how so depends how drunk you were when you read it, 148 00:10:03,999 --> 00:10:06,167 maybe this makes sense. 149 00:10:07,083 --> 00:10:10,626 What could possibly go wrong, a 300 page RFC and people who are 150 00:10:10,626 --> 00:10:14,999 going to interpret it and you implement it into a piece of software and it has 151 00:10:14,999 --> 00:10:19,751 to be as flexible as possible, things are going to start to go wrong. 152 00:10:19,834 --> 00:10:21,209 So I started to do testing. 153 00:10:21,375 --> 00:10:26,792 So I wanted to restrict myself to the big 3, Internet Explorer, chrome, 154 00:10:26,792 --> 00:10:28,709 and FireFox. 155 00:10:29,584 --> 00:10:40,626 (Laughter.) Apparently opera turned bad or there's links, who uses links! 156 00:10:40,999 --> 00:10:42,459 One guy. 157 00:10:42,542 --> 00:10:44,999 Welcome to the 20th century. 158 00:10:47,542 --> 00:10:52,000 (Laughter.) And I wanted to take the easy option on testing is the man 159 00:10:52,000 --> 00:10:55,709 in the middle proxy, it's a python based system for man 160 00:10:55,709 --> 00:11:00,834 in the middle connections and it allows you to set up these interesting proxy, 161 00:11:00,834 --> 00:11:04,334 and you write write something like this. 162 00:11:07,083 --> 00:11:08,125 Okay? 163 00:11:12,751 --> 00:11:15,626 That's easy, even I can code that sit! 164 00:11:16,417 --> 00:11:20,083 Unfortunately man in the middle proxy tends to use 165 00:11:20,083 --> 00:11:23,334 up all the memory you have on your machine, 166 00:11:23,334 --> 00:11:28,209 and I would highly recommend man in the middle dump. 167 00:11:28,459 --> 00:11:30,334 Catch into memory. 168 00:11:30,751 --> 00:11:32,999 Just a side note there. 169 00:11:41,918 --> 00:11:46,417 I also used PHP, it allows you to set these specific response codes 170 00:11:46,417 --> 00:11:50,209 in a file, the problem is if the web server says no this 171 00:11:50,209 --> 00:11:54,417 is an incorrect request, the PHP is never going to get to see 172 00:11:54,417 --> 00:11:59,209 the request so you can't set response codes so it's interesting stuff, 173 00:11:59,209 --> 00:12:03,501 for testing it's useful but in production it's not going to be 174 00:12:03,501 --> 00:12:06,626 as useful as it could be so I used a mismatch 175 00:12:06,626 --> 00:12:09,083 of Python and BHP PHP. 176 00:12:10,751 --> 00:12:17,375 You don't need to write this down, but simple testing of browsers, 177 00:12:17,375 --> 00:12:24,542 you call up the PHP page you code in the URL and you hope no one cross 178 00:12:24,542 --> 00:12:27,876 scripts your web site. 179 00:12:28,083 --> 00:12:33,751 You get a response code because with PHP you can set that 180 00:12:33,751 --> 00:12:40,250 to 999 if you want, but python is just going to say Apache is going 181 00:12:40,250 --> 00:12:47,459 to go I don't know where it is, which is the Code Section of" they fucked 182 00:12:47,459 --> 00:12:54,667 up "so you get to see the headers, and the response code and okay, great, 183 00:12:54,667 --> 00:12:59,209 I can run off and start testing these browsers, 184 00:12:59,209 --> 00:13:03,375 which seemed like an easy thing. 185 00:13:03,667 --> 00:13:09,292 I started to think, I've got all this data on how these browsers work 186 00:13:09,292 --> 00:13:14,999 and how can I graphically display that in a nice fashion? 187 00:13:15,417 --> 00:13:18,709 Let's just say that I'm not good at charting. 188 00:13:18,709 --> 00:13:22,667 (Laughter.) Sorry for women in the room I'm trying 189 00:13:22,667 --> 00:13:28,125 to keep this even across the sexes, and I didn't know how 190 00:13:28,125 --> 00:13:35,083 to display this and there were guys that said we could do this and that 191 00:13:35,083 --> 00:13:38,083 and it was all shit. 192 00:13:38,375 --> 00:13:42,209 So I ended up with a table! 193 00:13:47,334 --> 00:13:49,501 (Applause.) (Laughter.) Yeah, this is the reason why I cut it 194 00:13:49,501 --> 00:13:50,999 down to three browsers because otherwise 195 00:13:50,999 --> 00:13:53,083 the table would be this fucking wide! 196 00:14:00,083 --> 00:14:01,999 This is the core three. 197 00:14:01,999 --> 00:14:06,501 You start to see a lot of conformitity in the section about how 198 00:14:06,501 --> 00:14:11,959 the browsers respond to things and I run it in three sections, 199 00:14:11,959 --> 00:14:16,334 can you load HTML with a 100 response code, you can, 200 00:14:16,334 --> 00:14:21,999 the browser doesn't support it unless it's an iFrame with Chrome 201 00:14:21,999 --> 00:14:24,999 in which case it tries to download t 202 00:14:24,999 --> 00:14:29,999 because I guess Chrome likes to download sit! 203 00:14:29,999 --> 00:14:31,999 What's interesting if you have Chrome 204 00:14:31,999 --> 00:14:38,417 on an Android phone it tries to download it but it never finishes. 205 00:14:38,417 --> 00:14:43,584 So you have to restart your Android to get it to stop! 206 00:14:43,999 --> 00:14:45,250 Which is fun! 207 00:14:45,250 --> 00:14:49,792 (Laughter.) I'm sure no one would fuck with that, yeah! 208 00:14:50,167 --> 00:14:54,999 (Laughter.) So looking at this you're like all the browsers are mostly 209 00:14:54,999 --> 00:14:57,626 conforming, except IE which doesn't care 210 00:14:57,626 --> 00:15:00,959 about a 205 and renders the stuff. 211 00:15:01,667 --> 00:15:05,334 You start to see differences in looking at the 300 codes. 212 00:15:05,626 --> 00:15:08,751 For example, FireFox doesn't load Java Script 213 00:15:08,751 --> 00:15:13,083 if you respond with a 300 or 301, IE ignores everything 214 00:15:13,083 --> 00:15:16,751 if you respond with anything in the 300 range 215 00:15:16,751 --> 00:15:22,584 but Chrome accepts everything because it doesn't give a shit. 216 00:15:22,999 --> 00:15:25,626 It's the honey badger of browsers! 217 00:15:46,334 --> 00:15:49,083 The 400s, you see weird things start happening 218 00:15:49,083 --> 00:15:51,999 and if you have a proxy set, then Chrome will load 219 00:15:51,999 --> 00:15:57,250 the content when it's responded with a 407, if you don't then it won't. 220 00:15:58,999 --> 00:16:05,542 Again, things are standard, with IE being an outliar on things. 221 00:16:05,959 --> 00:16:09,292 So think about this, you have browsers that handle things 222 00:16:09,292 --> 00:16:14,417 in slightly different ways, what can we do with that stuff? 223 00:16:15,334 --> 00:16:21,501 A majority of stuff is like, okay, that's content, I don't care what it is, 224 00:16:21,501 --> 00:16:26,083 it's loading stuff, you get a 400 response and it's like, 225 00:16:26,083 --> 00:16:31,999 I see HTML I'm going to run that for you, and mostly things are loaded 226 00:16:31,999 --> 00:16:35,999 normally but there are weird outliars. 227 00:16:38,083 --> 00:16:42,999 With HTML responses almost all are rendered correctly, doesn't care. 228 00:16:42,999 --> 00:16:45,626 When you try and load an iFrame and it comes back 229 00:16:45,626 --> 00:16:50,542 with a response there are special cases for IE because IE is special but most 230 00:16:50,542 --> 00:16:54,999 of the time things are even and if you start look at Java Script there 231 00:16:54,999 --> 00:16:57,959 is limited support Chrome being the exception 232 00:16:57,959 --> 00:17:00,792 because they just don't care. 233 00:17:02,417 --> 00:17:06,292 We know what browsers interpret differently, so what do they have 234 00:17:06,292 --> 00:17:10,792 in common, what are they doing the same across the board? 235 00:17:10,999 --> 00:17:15,667 The 100 codes retries, confusion, Android, never ending down loads 236 00:17:15,667 --> 00:17:19,999 and it times out, eventually because the browser thinks there 237 00:17:19,999 --> 00:17:24,167 is more coming and it thinks you're going to send more data, 238 00:17:24,167 --> 00:17:27,417 I'll sit here and wait for you. 239 00:17:28,209 --> 00:17:30,417 Which is kind of interesting. 240 00:17:30,417 --> 00:17:34,292 The 200 code you get the no content or not modified you get headers saying 241 00:17:34,292 --> 00:17:38,083 no there is nothing here so as you would expect browsers ignore 242 00:17:38,083 --> 00:17:41,876 the content you're responding because it doesn't expect there 243 00:17:41,876 --> 00:17:45,083 to be any content within those things. 244 00:17:45,959 --> 00:17:47,542 What about headers? 245 00:17:49,083 --> 00:17:52,876 RFCs quite a lot of the time say in muddy language, 246 00:17:52,876 --> 00:17:56,083 if you're responding with a 3XX response code, 247 00:17:56,083 --> 00:17:59,125 whether it's 301, 302, 303, there should be 248 00:17:59,125 --> 00:18:01,999 a location header, okay? 249 00:18:02,334 --> 00:18:04,250 Doesn't mean it has to. 250 00:18:04,459 --> 00:18:06,959 If you respond and you don't have a location header it ignores 251 00:18:06,959 --> 00:18:09,918 the fact that it's meant to do a redirect and rendered whatever 252 00:18:09,918 --> 00:18:11,834 content you give it. 253 00:18:12,999 --> 00:18:17,083 Specifically no location header, no redirect, this makes sense. 254 00:18:18,876 --> 00:18:23,167 It's looking for the location header, doesn't find one, it's going 255 00:18:23,167 --> 00:18:27,999 to render what you returned and ignore, simple at that. 256 00:18:27,999 --> 00:18:28,999 Okay? 257 00:18:28,999 --> 00:18:30,542 So the 401, unauthorized, as well, if you're not sending back 258 00:18:30,542 --> 00:18:32,834 at www.authenticateheader. 259 00:18:34,999 --> 00:18:37,417 It's not going to send it back. 260 00:18:43,876 --> 00:18:49,083 If you're not requesting it's never going to prompt you. 261 00:18:49,709 --> 00:18:53,334 On the flip side just because something says it shouldn't 262 00:18:53,334 --> 00:18:56,709 have a header doesn't mean it can't. 263 00:18:57,501 --> 00:19:04,584 If you read the RFCs there is this 300 multiple choices. 264 00:19:06,959 --> 00:19:09,167 It doesn't redirect you, it should come 265 00:19:09,167 --> 00:19:12,292 up with an HTML where you can select where you would 266 00:19:12,292 --> 00:19:16,334 like to go unless you're FireFox or IE in which case if you give it 267 00:19:16,334 --> 00:19:20,834 a location header it's going to redirect, but Chrome isn't, okay accident 268 00:19:20,834 --> 00:19:24,542 and there are so many headers out there you can play with, most 269 00:19:24,542 --> 00:19:29,250 of them are not particularly interesting, unfortunately, but there is more work 270 00:19:29,250 --> 00:19:31,792 to be done in that area. 271 00:19:31,792 --> 00:19:32,918 There is a load of headers like the retry 272 00:19:32,918 --> 00:19:35,667 after header that can be played with and a little more research 273 00:19:35,667 --> 00:19:37,375 is required there. 274 00:19:37,667 --> 00:19:40,876 Each browser is handling things a little differently. 275 00:19:41,751 --> 00:19:44,918 We know how things are handled the same and we know how things are 276 00:19:44,918 --> 00:19:47,999 handled differently, what can we do with that? 277 00:19:51,501 --> 00:19:53,792 What are the goals? 278 00:19:53,999 --> 00:19:57,999 Each browser handles things differently, you have 279 00:19:57,999 --> 00:20:02,834 the handle codes and the unhandled codes and you get this 280 00:20:02,834 --> 00:20:08,125 browser weirdness stuff that you didn't expect it to do depending 281 00:20:08,125 --> 00:20:11,751 on the headers, so browser fingerprinting, 282 00:20:11,751 --> 00:20:16,918 you can check user strings and you can easily spoof that stuff 283 00:20:16,918 --> 00:20:20,292 but if you take the differences you can do 284 00:20:20,292 --> 00:20:23,501 fingerprinting work on FireFox and IE. 285 00:20:23,501 --> 00:20:26,999 So on FireFox it doesn't load Java Script 286 00:20:26,999 --> 00:20:28,918 with a 300. 287 00:20:29,042 --> 00:20:30,918 The others do. 288 00:20:39,667 --> 00:20:41,876 It loads it. 289 00:20:41,999 --> 00:20:44,999 With Chrome, without a location header it adds 290 00:20:44,999 --> 00:20:48,792 the redirect but the other browsers don't so we can 291 00:20:48,792 --> 00:20:51,999 do fingerprinting, and with IE it loads it 292 00:20:51,999 --> 00:20:55,292 with a reload content status, so if we can add 293 00:20:55,292 --> 00:21:00,083 all that stuff together you can get a nice way of fingerprinting 294 00:21:00,083 --> 00:21:04,999 the browsers without using the user agent header or you can use 295 00:21:04,999 --> 00:21:10,542 the user agent header and you can say I'm going to check that. 296 00:21:11,167 --> 00:21:15,083 I'm going to do a quick demo, run a video of a demo 297 00:21:15,083 --> 00:21:20,167 because I didn't want to connect to the network here! 298 00:21:20,167 --> 00:21:21,626 AUDIENCE MEMBER: Smart! 299 00:21:21,626 --> 00:21:24,999 CHRIS: First talk! 300 00:21:25,209 --> 00:21:28,584 All this is doing is loading a PHP page and running 301 00:21:28,584 --> 00:21:32,876 through and running three individual pages. 302 00:21:34,125 --> 00:21:37,584 It then checks the responses and the Java Script 303 00:21:37,584 --> 00:21:40,999 and says okay this Java Script ran, this didn't, 304 00:21:40,999 --> 00:21:44,999 so you must be using this specific browser. 305 00:21:44,999 --> 00:21:51,834 So if you zoom in well, if I zoom in, there you go. 306 00:21:51,834 --> 00:21:53,584 You can see the specific responses. 307 00:21:53,584 --> 00:21:56,834 You can see that it's loading an HTML, it's come being back with a 300, 308 00:21:56,834 --> 00:22:00,792 a 307 and a 205 which are the three different response codes we 309 00:22:00,792 --> 00:22:05,250 talked about for the different browsers and it's sending it to a PHP page 310 00:22:05,250 --> 00:22:10,417 and it's returning and saying, okay, this is the specific browser. 311 00:22:10,751 --> 00:22:16,250 So I'm returning this to say this is the browser. 312 00:22:16,250 --> 00:22:18,918 In most cases you're sending it to the server 313 00:22:18,918 --> 00:22:21,584 and never responding back. 314 00:22:21,999 --> 00:22:23,292 I know I'm running IE. 315 00:22:23,292 --> 00:22:25,959 I have the bar at the top. 316 00:22:25,959 --> 00:22:27,751 I don't need you to tell me. 317 00:22:30,626 --> 00:22:34,999 If you're spoofing a user agent string I can say, okay, 318 00:22:34,999 --> 00:22:39,292 you're running FireFox but you're actually running Chrome 319 00:22:39,292 --> 00:22:45,626 that's suspicious and it's something we should be looking at, okay? 320 00:22:52,709 --> 00:22:57,292 There is a 300 redirect and a 400 iFrame to explorer, if you want 321 00:22:57,292 --> 00:23:02,083 to look at the proof of concept, if you go to this site it will run 322 00:23:02,083 --> 00:23:06,667 the same example that I ran and you can look at the traffic and 323 00:23:06,667 --> 00:23:11,292 the code is available, I'll link to that at the end. 324 00:23:11,751 --> 00:23:16,083 User agents can be spoofed, even script Kitties know that. 325 00:23:19,334 --> 00:23:22,375 Your browser does things in different ways, 326 00:23:22,375 --> 00:23:26,334 so we can fingerprint browsers, what else? 327 00:23:26,334 --> 00:23:27,334 Proxy detections. 328 00:23:27,501 --> 00:23:31,083 We have talked about the way Chrome handles things 329 00:23:31,083 --> 00:23:34,542 and if you have a proxy set you're going 330 00:23:34,542 --> 00:23:39,667 to respond with a 407 if it loads the page then they're using 331 00:23:39,667 --> 00:23:41,751 a HTTP proxy. 332 00:23:48,083 --> 00:23:52,584 It's of limited interest but it's something that needs further, 333 00:23:52,584 --> 00:23:54,751 further testing. 334 00:23:54,751 --> 00:23:57,334 Again as I said, all you do is respond with a 407 335 00:23:57,334 --> 00:24:00,918 with a proxy authentication header or without one and 336 00:24:00,918 --> 00:24:04,626 if Chrome responds then HTTP proxy is set. 337 00:24:04,918 --> 00:24:10,167 While I was doing the research I tried a couple 338 00:24:10,167 --> 00:24:17,999 of proxies and one of the ones I selected was prove proxy. 339 00:24:22,083 --> 00:24:25,083 I found while I was testing if you respond 340 00:24:25,083 --> 00:24:29,209 with a 407 proxy authentication required you get the pop 341 00:24:29,209 --> 00:24:33,459 up in your browser but it doesn't say my web server asked 342 00:24:33,459 --> 00:24:37,417 you for a user name and password it says Provoxy asked 343 00:24:37,417 --> 00:24:42,083 for a user name and password which is interesting. 344 00:24:44,417 --> 00:24:49,999 I typed in" test test "and I clicked send and my web server gets my user name 345 00:24:49,999 --> 00:24:55,083 and password, that's interesting, we can use that for malicious stuff 346 00:24:55,083 --> 00:25:00,375 but this is a defensive talk so I'm not going to dive too much into this 347 00:25:00,375 --> 00:25:04,292 but it's interesting, let's say they're not configured 348 00:25:04,292 --> 00:25:07,459 as securely as they could be. 349 00:25:07,459 --> 00:25:10,918 There is a fix for that now and you can download 350 00:25:10,918 --> 00:25:14,999 the latest version but it's not just Provoxy, things 351 00:25:14,999 --> 00:25:20,999 like Burp or Zap do that, Burp Suite will pass it through to your browser, 352 00:25:20,999 --> 00:25:25,167 so you can screw with people who are doing malicious 353 00:25:25,167 --> 00:25:31,334 things on your sight with interproxies, of course if you're using Burp Suite 354 00:25:31,334 --> 00:25:36,542 and it asks for your user name and password and I'm probably not 355 00:25:36,542 --> 00:25:38,999 going to do that. 356 00:25:39,292 --> 00:25:42,083 But Kitties have some interesting passwords! 357 00:25:42,083 --> 00:25:47,501 Okay, so let's talk about you have some things that 358 00:25:47,501 --> 00:25:49,999 are possible. 359 00:25:59,999 --> 00:26:05,999 We can play with things, in case there are children in the room! 360 00:26:06,292 --> 00:26:09,999 We can make people who like RFCs cry into their beer. 361 00:26:11,375 --> 00:26:14,584 So let's try to use what we have discovered let's 362 00:26:14,584 --> 00:26:17,999 break some spidering tools, cause some false positives 363 00:26:17,999 --> 00:26:22,667 and negatives, slow down attackers, one of the most important things we 364 00:26:22,667 --> 00:26:26,667 can do, give us time to respond to how people are attacking us 365 00:26:26,667 --> 00:26:31,083 and block successful exploitation so even if they do manage to exploit 366 00:26:31,083 --> 00:26:35,459 the server if you're responding with different codes maybe it's not 367 00:26:35,459 --> 00:26:39,167 going to work, so let's talk about spiders. 368 00:26:47,250 --> 00:26:53,959 This is a simplistic Naive spider, if you get a 404 that's true, 369 00:26:53,959 --> 00:27:00,417 but if you get a 400 that's false and what happens if everything 370 00:27:00,417 --> 00:27:02,334 is a 500? 371 00:27:08,667 --> 00:27:10,584 Sometimes if everything is a 500 then everything 372 00:27:10,584 --> 00:27:12,667 is a SQL injection attack. 373 00:27:12,999 --> 00:27:16,417 So if everything is a 200 you end up with an interesting loop 374 00:27:16,417 --> 00:27:20,834 of oh I found another directory, I will keep scanning and scanning 375 00:27:20,834 --> 00:27:24,083 and you get this never ending spider. 376 00:27:24,083 --> 00:27:27,417 Unfortunately I couldn't find a picture of a spider eating itself so 377 00:27:27,417 --> 00:27:30,334 if anyone has one, send it to me! 378 00:27:31,125 --> 00:27:34,709 If everything is a 404 what web site? 379 00:27:34,876 --> 00:27:40,918 I don't know if you can see this in the back this is the Acunetix tool, 380 00:27:40,918 --> 00:27:47,083 the Script Kitty's tool of choice, it found 0 pages, validated 0 findings, 381 00:27:47,083 --> 00:27:49,626 so what web site? 382 00:27:50,999 --> 00:27:53,999 Skip Fish loves it keeps going and going 383 00:27:53,999 --> 00:27:59,999 until it kills itself (Laughter.) I'm guessing at this point my test server 384 00:27:59,999 --> 00:28:05,167 decided it didn't have enough memory to deal with all the responses, 385 00:28:05,167 --> 00:28:09,999 if you look closely there are 2,000 low, medium false findings 386 00:28:09,999 --> 00:28:12,459 on the scan alone. 387 00:28:12,501 --> 00:28:14,083 So, yeah. 388 00:28:14,250 --> 00:28:19,417 Playing with people's spiders is interesting, so false positives 389 00:28:19,417 --> 00:28:24,250 and false negatives, we can start to really screw with people 390 00:28:24,250 --> 00:28:29,918 and waste their time so most scanners use response codes in some way, 391 00:28:29,918 --> 00:28:31,959 they have to. 392 00:28:31,959 --> 00:28:35,125 You speed up detections, you can't use Regex for everything, 393 00:28:35,125 --> 00:28:37,792 it's the easy solution. 394 00:28:37,999 --> 00:28:42,959 So if we start to respond with, again, 200 okay, 400, 500 and if we start 395 00:28:42,959 --> 00:28:46,417 to play with them and respond with random codes, 396 00:28:46,417 --> 00:28:50,542 random being a selection of codes that are handled well 397 00:28:50,542 --> 00:28:54,417 by all normal browsers so the normal people browsing 398 00:28:54,417 --> 00:28:58,584 the web site are not going to be affected. 399 00:28:58,751 --> 00:29:01,999 You start to see interesting stuff so 400 00:29:01,999 --> 00:29:05,959 a quick baseline using w3IF, I didn't pick 401 00:29:05,959 --> 00:29:12,250 on these people it happens to be an interesting baseline, so 79 points, 402 00:29:12,250 --> 00:29:18,083 69 vulnerabilities, no shells, and it took 1 hour and 37 minutes 403 00:29:18,083 --> 00:29:20,250 to do a scan. 404 00:29:22,999 --> 00:29:25,999 You still get everything! 405 00:29:26,083 --> 00:29:28,167 So we're not winning on the false positives 406 00:29:28,167 --> 00:29:31,083 and false negatives, it takes you 9 hours to run 407 00:29:31,083 --> 00:29:34,334 the scan which is kinda interesting, it let us win time 408 00:29:34,334 --> 00:29:40,083 but it's not really working so 200 okay isn't going to do what we need it to do. 409 00:29:41,542 --> 00:29:43,667 If everything is a 404 it's quicker to do the scan 410 00:29:43,667 --> 00:29:46,334 because you're not finding everything but it's missing a majority 411 00:29:46,334 --> 00:29:49,459 of the interesting points and the vulnerabilities. 412 00:29:49,876 --> 00:29:51,584 So you're start to go see interesting stuff 413 00:29:51,584 --> 00:29:53,667 if we start responding with weird codes 414 00:29:53,667 --> 00:29:56,334 they don't find everything, okay? 415 00:29:56,334 --> 00:29:57,459 That's interesting. 416 00:29:57,959 --> 00:30:00,584 If you respond with everything with a 500, wow! 417 00:30:01,042 --> 00:30:05,918 False positives, fits a 500, like I said it's SQL injection, 418 00:30:05,918 --> 00:30:08,999 9,000 informational points! 419 00:30:09,334 --> 00:30:12,709 (Laughter.) Try digin' through that report, you know? 420 00:30:12,709 --> 00:30:17,626 (Laughter.) 9,000 confirmed vulnerabilities, I can see that pin test 421 00:30:17,626 --> 00:30:22,375 report, that vulnerability analysis, that's going to be 422 00:30:22,375 --> 00:30:27,000 a thousand pages long, we found IS vulnerability, it's 423 00:30:27,000 --> 00:30:33,834 an Apache server but we found these, anyone use Ness in the room? 424 00:30:33,834 --> 00:30:34,834 No? 425 00:30:34,834 --> 00:30:35,834 Okay. 426 00:30:41,792 --> 00:30:45,834 Maybe I had a bad run, it averaged out as giving you 427 00:30:45,834 --> 00:30:50,083 a reasonable amount of false positives and took less time 428 00:30:50,083 --> 00:30:52,375 to run the scan. 429 00:30:52,876 --> 00:30:54,834 What I found interesting is that the a majority 430 00:30:54,834 --> 00:30:58,125 of the things that it did find it didn't find the vulnerabilities, 431 00:30:58,125 --> 00:31:00,584 it just found weird stuff. 432 00:31:00,709 --> 00:31:03,292 So even though it found more vulnerabilities you, you get lots 433 00:31:03,292 --> 00:31:06,417 of false positives, they're pretty much all false positives, 434 00:31:06,417 --> 00:31:09,209 so the real stuff doesn't get found? 435 00:31:11,501 --> 00:31:17,250 Skip Fish and Random, it doesn't like Random, skip fish doesn't 436 00:31:17,250 --> 00:31:21,999 like random so the first one took 10 hours and then 437 00:31:21,999 --> 00:31:26,751 the next time 4 seconds and it would randomly flick 438 00:31:26,751 --> 00:31:32,999 between times so Skip Fish is a wonderful tool for web applications, 439 00:31:32,999 --> 00:31:37,292 and I think in my proxy it send 33,000 requests 440 00:31:37,292 --> 00:31:44,083 inside 5, 60 minutes, it will pretty much take down everything. 441 00:31:44,999 --> 00:31:49,959 So we're not really slowing attackers down so what can we do 442 00:31:49,959 --> 00:31:52,292 to slow them down? 443 00:31:52,959 --> 00:31:55,292 What's our WAF doing at the moment? 444 00:31:56,999 --> 00:32:02,167 A naive view, oh my God, I'm being attacked, blocked, return 445 00:32:02,167 --> 00:32:06,999 an roar, a 404 or a 200 with a nice message telling them 446 00:32:06,999 --> 00:32:09,083 to piss off! 447 00:32:09,999 --> 00:32:11,501 Profit? 448 00:32:11,501 --> 00:32:14,918 There is no profit, with my defender hat 449 00:32:14,918 --> 00:32:19,542 on we've won nothing, we've blocked an attack, 450 00:32:19,542 --> 00:32:25,292 they come back, we by pass it, game over, okay? 451 00:32:25,334 --> 00:32:28,209 So why are we doing that? 452 00:32:28,250 --> 00:32:31,584 Remember this big list of status codes that browsers don't 453 00:32:31,584 --> 00:32:34,999 handle very well, specifically the 100 stuff? 454 00:32:34,999 --> 00:32:37,083 Scanners don't like them either, surprising there 455 00:32:37,083 --> 00:32:40,834 because a scanner thinks it's going to be a browser, it's trying 456 00:32:40,834 --> 00:32:43,417 to do everything that a browser does so looking 457 00:32:43,417 --> 00:32:47,751 at the 100 codes we can start to really screw with stuff. 458 00:32:47,751 --> 00:32:54,417 So anybody in the room a topic, it should be timeless and not" Timless, 459 00:32:54,417 --> 00:32:57,501 "apologies," Tim "! 460 00:33:06,083 --> 00:33:07,999 This was a great idea. 461 00:33:07,999 --> 00:33:08,999 Did we forget that? 462 00:33:08,999 --> 00:33:09,999 Okay. 463 00:33:09,999 --> 00:33:10,999 It's been done now. 464 00:33:11,417 --> 00:33:14,209 In our drive to find new and interesting research it's 465 00:33:14,209 --> 00:33:18,292 been done once so we should ignore it for the rest of time? 466 00:33:18,501 --> 00:33:21,209 So I had this interesting idea. 467 00:33:21,375 --> 00:33:23,375 How about an HTTP tar pit? 468 00:33:23,959 --> 00:33:27,083 People have probably talked about this a thousand times 469 00:33:27,083 --> 00:33:30,125 before but it was interesting to me. 470 00:33:30,125 --> 00:33:31,125 Whoa! 471 00:33:31,125 --> 00:33:33,999 (Away from microphone.) CHRIS: This 472 00:33:33,999 --> 00:33:38,083 is the problem when you run PowerPoint! 473 00:33:38,083 --> 00:33:40,209 (Chuckles.) AUDIENCE MEMBER: Drink! 474 00:33:40,209 --> 00:33:51,501 (Applause.) Morning DEF CON, it's Sunday morning, 475 00:33:51,501 --> 00:33:59,083 you know what that means? 476 00:33:59,083 --> 00:34:00,459 AUDIENCE MEMBER: Drink! 477 00:34:00,459 --> 00:34:02,417 That's right, drink, round of applause 478 00:34:02,417 --> 00:34:07,709 for our first time speaker, how is he doing so far? 479 00:34:07,918 --> 00:34:09,667 Doin' okay? 480 00:34:09,834 --> 00:34:12,125 Hook us up! 481 00:34:12,292 --> 00:34:19,792 CHRIS: I am not drinking all of those! 482 00:34:19,792 --> 00:34:21,999 (Laughter.) Whose first time at DEF CON? 483 00:34:21,999 --> 00:34:24,167 Firsthand up, come on up on stage. 484 00:34:29,751 --> 00:34:32,083 (Applause.) Fits Sunday morning that means this 485 00:34:32,083 --> 00:34:36,125 is the hard core you guys all got up, good job, congratulations! 486 00:34:36,125 --> 00:34:45,375 (Applause.) CHRIS: Cheers! 487 00:34:45,959 --> 00:34:48,083 (Applause.) That reminds me of last night! 488 00:34:49,999 --> 00:34:51,999 (Laughter.) So where was I? 489 00:34:52,125 --> 00:34:55,250 Oh, yeah, I was in the tar pit! 490 00:34:55,250 --> 00:35:01,334 So simple scenario, the WAF detects the scan. 491 00:35:01,834 --> 00:35:05,959 We're at the oh my God attack section, and it adds the IP address 492 00:35:05,959 --> 00:35:10,751 to the" naughty "list and starts to rewrite responses. 493 00:35:11,083 --> 00:35:15,709 You get the usually 100, 101, 102 status codes we randomly rotate 494 00:35:15,709 --> 00:35:19,999 between them, depending on how board we are at the time 495 00:35:19,999 --> 00:35:24,459 and we could use 203 or 204 but it's not fun! 496 00:35:26,876 --> 00:35:29,083 Let's do some experimentation. 497 00:35:29,542 --> 00:35:37,792 There is no science in this, so NicTool, a wonderful tool, I especially 498 00:35:37,792 --> 00:35:40,334 like the logo. 499 00:35:40,667 --> 00:35:47,250 The baseline scan, 2:18 to find 18 findings, simple at that. 500 00:35:48,083 --> 00:35:50,876 With the tar pit AUDIENCE 501 00:35:50,876 --> 00:35:52,999 MEMBER: Wow! 502 00:35:52,999 --> 00:35:57,999 CHRIS: We're winning time there, let's say that, it's 340 fold increase 503 00:35:57,999 --> 00:36:02,876 in time but it's still finding quite a lot of stuff, okay, this 504 00:36:02,876 --> 00:36:07,999 is informational stuff like you have an Apache version of your server 505 00:36:07,999 --> 00:36:13,999 and even if you respond with a code it's going to get that header. 506 00:36:14,667 --> 00:36:19,417 Most of the stuff is interesting, the findings they disappear and 507 00:36:19,417 --> 00:36:23,792 the script Kitty spends 14 hours scanning your web server, 508 00:36:23,792 --> 00:36:28,083 so we're kind of winning, same baseline, 1 hour, 57 minutes, 509 00:36:28,083 --> 00:36:33,125 65 findings, but wait a minute, it 18 minutes instead of 1 hour, 37, 510 00:36:33,125 --> 00:36:38,250 weird, that shouldn't be happening but it didn't find anything so I'm 511 00:36:38,250 --> 00:36:41,999 guessing there was an algorithm that said I'm going 512 00:36:41,999 --> 00:36:47,459 to stop bothering your web server now because it's weird and I don't know 513 00:36:47,459 --> 00:36:50,375 what the fuck is going on! 514 00:36:50,792 --> 00:36:56,334 (Laughter.) So back to the denial of service Skip Fish tool, 18 minutes 515 00:36:56,334 --> 00:37:01,999 to find around two and a half how low, mediums, and a couple of highs, 516 00:37:01,999 --> 00:37:07,999 which were mostly false positives, whatever, each to their own. 517 00:37:07,999 --> 00:37:09,167 So 5 seconds! 518 00:37:09,709 --> 00:37:11,999 Again, we're going to the wrong direction okay 519 00:37:11,999 --> 00:37:15,999 but there was no lows and no mediums and only three highs. 520 00:37:15,999 --> 00:37:19,792 What I thought was interesting was the three highs that it found were not 521 00:37:19,792 --> 00:37:22,792 any of the 12 highs that it found previously, so 522 00:37:22,792 --> 00:37:25,999 not only false positives but different false positives 523 00:37:25,999 --> 00:37:28,209 to the normal scan. 524 00:37:28,959 --> 00:37:31,834 Okay, doin' weird stuff and we like that because we're mucking 525 00:37:31,834 --> 00:37:33,876 around with automated scanners and scooting 526 00:37:33,876 --> 00:37:36,417 the script Kitty so random is good. 527 00:37:38,834 --> 00:37:43,918 Acunetix, the Script Kitty tool of choice so you get stuff that you 528 00:37:43,918 --> 00:37:47,459 probably don't care about and, again we're going 529 00:37:47,459 --> 00:37:51,167 to the wrong direction, it should be slowing stuff 530 00:37:51,167 --> 00:37:54,459 down but it's making stuff faster depending 531 00:37:54,459 --> 00:37:59,542 on the scanner you're using but, again, that's an interesting ratio 532 00:37:59,542 --> 00:38:04,999 of complete false negatives, so it's just not finding stuff. 533 00:38:04,999 --> 00:38:08,417 Some of these scanners are just like, now this web server 534 00:38:08,417 --> 00:38:13,501 is playing silly burgers, it doesn't tell you it's going to give up, 535 00:38:13,501 --> 00:38:17,709 it just says" I'm finished "no, I'm done so you can slow 536 00:38:17,709 --> 00:38:21,542 down some scanners, things like NicTool, others give 537 00:38:21,542 --> 00:38:26,542 up quicker because they get tired of getting responses or they time 538 00:38:26,542 --> 00:38:30,209 out and say the servers are not there, if you look 539 00:38:30,209 --> 00:38:36,584 in the script you probably see the web server responding but it didn't. 540 00:38:41,250 --> 00:38:44,250 But this can be a win for us. 541 00:38:46,083 --> 00:38:49,999 Let's move on to blocking successful exploitation 542 00:38:49,999 --> 00:38:54,999 so if someone can get past all this and find a high criticality 543 00:38:54,999 --> 00:38:58,083 in your web server, and people are going 544 00:38:58,083 --> 00:39:04,250 to find these vulnerability, it's going to take them longer but they're going 545 00:39:04,250 --> 00:39:10,834 to find stuff so let's stop them from popping shells with Meta Split. 546 00:39:15,999 --> 00:39:22,999 How often does it it's about a thousand, it's not scientifically sound 547 00:39:22,999 --> 00:39:27,250 and depends on how people are using things 548 00:39:27,250 --> 00:39:33,626 and wording things and using their variables but this searches 549 00:39:33,626 --> 00:39:39,375 through response code and response code and there is lots 550 00:39:39,375 --> 00:39:42,959 of dependency on status codes even 551 00:39:42,959 --> 00:39:49,834 the stuff I wrote uses status codes, it's bad programming. 552 00:39:49,999 --> 00:39:53,918 It's quick and it's what we all do because we use status codes 553 00:39:53,918 --> 00:39:57,876 to check the response from servers so here is an example 554 00:39:57,876 --> 00:40:01,792 of a snip pet of code from the checks and all it's doing 555 00:40:01,792 --> 00:40:07,542 is check if the response code is less than a 200 or more than a 300. 556 00:40:07,584 --> 00:40:08,918 Okay. 557 00:40:08,918 --> 00:40:10,626 So I can return a 500. 558 00:40:10,751 --> 00:40:12,083 That's great. 559 00:40:12,083 --> 00:40:13,999 I can return the 500 with the content. 560 00:40:14,375 --> 00:40:15,999 That's failing. 561 00:40:16,542 --> 00:40:18,999 So if it's not anywhere in the 200 range which 562 00:40:18,999 --> 00:40:23,959 is the okay then the exploit fails, simple at that, great. 563 00:40:23,999 --> 00:40:25,501 So if we're spoofing 404 but giving you 564 00:40:25,501 --> 00:40:28,999 the content then this exploit is going to fail. 565 00:40:29,083 --> 00:40:31,125 If you're good enough to go in and edit 566 00:40:31,125 --> 00:40:33,999 the code and change things and you know what's going on, 567 00:40:33,999 --> 00:40:37,459 then you're not really the target of this talk. 568 00:40:37,459 --> 00:40:39,999 We're targeting script Kitties, all they know how to do is run 569 00:40:39,999 --> 00:40:43,999 the code and if it doesn't work they run to the corner. 570 00:40:45,000 --> 00:40:49,626 Interesting side affect if it is a 401 it starts to print 571 00:40:49,626 --> 00:40:54,999 out the response coders, like the authentication header. 572 00:40:55,250 --> 00:40:58,417 As I mentioned before we don't need to send those headers so 573 00:40:58,417 --> 00:41:00,125 what happens? 574 00:41:00,999 --> 00:41:04,751 You start to get errors because it's trying to print 575 00:41:04,751 --> 00:41:08,999 out stuff that should be there but it's actually a nill value 576 00:41:08,999 --> 00:41:13,501 because we haven't set it ought all because we haven't provided 577 00:41:13,501 --> 00:41:18,792 at present interesting side affect, no match, no shell, no cookie for you, 578 00:41:18,792 --> 00:41:20,876 simple as that. 579 00:41:20,999 --> 00:41:23,542 Quickly running through what we have talked about. 580 00:41:24,459 --> 00:41:28,083 We can use status codes to our benefit, it's fun, it's useful, 581 00:41:28,083 --> 00:41:31,083 we can slow people down with it. 582 00:41:31,167 --> 00:41:35,667 But browsers can be quirky so we need to do it in specific ways 583 00:41:35,667 --> 00:41:40,542 and scanners and attack tool kits are set in their ways. 584 00:41:40,626 --> 00:41:42,999 This is the way we did it in 1990 and God Damn it this 585 00:41:42,999 --> 00:41:46,999 is the way we're going to do it in 2013, get off my lawn! 586 00:41:48,999 --> 00:41:51,334 Just the way things are, why change things 587 00:41:51,334 --> 00:41:55,417 if it's working so my goal here is to make it not work. 588 00:41:55,417 --> 00:41:57,501 WAFs need to get more Afghan CIF 589 00:41:57,501 --> 00:42:02,334 about their defense because they're being far too passive, 590 00:42:02,334 --> 00:42:07,999 so just blocking a request, providing a ASCII art that tells someone 591 00:42:07,999 --> 00:42:14,083 to scan someone else's web server is great but it's not going to help us, 592 00:42:14,083 --> 00:42:17,667 I don't want to start hacking people well, 593 00:42:17,667 --> 00:42:19,876 actually I do. 594 00:42:20,083 --> 00:42:22,792 I don't want to start hacking back people who attack 595 00:42:22,792 --> 00:42:25,999 my web servers but I want to be active in fighting back 596 00:42:25,999 --> 00:42:30,751 and saying to people this is not right if you're scanning my server I'm going 597 00:42:30,751 --> 00:42:35,083 to screw with you until you cry, just the way things are. 598 00:42:35,083 --> 00:42:37,250 Slowing attackers down is good, making life harder 599 00:42:37,250 --> 00:42:39,709 for Kitties is priceless. 600 00:42:39,709 --> 00:42:43,834 I should have put the Master Card logo on that. 601 00:42:44,959 --> 00:42:50,083 Current tools are just the same as yeah, I said that. 602 00:42:51,083 --> 00:42:53,792 They are adequate and they do what they do and 603 00:42:53,792 --> 00:42:58,083 until someone fights back and says this is not good enough then they're going 604 00:42:58,083 --> 00:43:01,584 to keep doing what they are doing, they're only as advanced 605 00:43:01,584 --> 00:43:04,501 as they need to be, just like people attacking you, 606 00:43:04,501 --> 00:43:06,999 if they can get you with a phishing attack, 607 00:43:06,999 --> 00:43:10,584 why would I bother wasting a zero day on you? 608 00:43:14,417 --> 00:43:21,626 Skewing with script Kitties is fun, I've had this running on my web server, 609 00:43:21,626 --> 00:43:25,751 checking the logs it's hilarious the amount 610 00:43:25,751 --> 00:43:32,125 of automated scans that hit your web server searching for Tim Thumb, 611 00:43:32,125 --> 00:43:38,209 it spends days scanning your server for random stuff. 612 00:43:38,999 --> 00:43:41,375 How can people implement this? 613 00:43:41,375 --> 00:43:44,999 There is no point in me talking about it if we don't know how 614 00:43:44,999 --> 00:43:48,918 to implement it, let's talk about the ghetto option, 615 00:43:48,918 --> 00:43:53,083 we can implement it using PHP, people wrote it in note pad 616 00:43:53,083 --> 00:43:57,334 but that's life you can append a PHP file to say randomize 617 00:43:57,334 --> 00:44:02,417 a code within a specific section of response codes that are supported 618 00:44:02,417 --> 00:44:05,999 by the browsers but we're limit by resources, so 619 00:44:05,999 --> 00:44:11,459 if your web server starts to error out because people send stuff that isn't 620 00:44:11,459 --> 00:44:15,999 to be exported then the web server is going to respond back, 621 00:44:15,999 --> 00:44:20,709 limited functionality, man in the middle dump, a real memory hog, 622 00:44:20,709 --> 00:44:24,999 it will use everything you've got so if you put it in front 623 00:44:24,999 --> 00:44:30,167 of your web server you can have simple scripts that are going to change 624 00:44:30,167 --> 00:44:33,501 the response codes, that works. 625 00:44:33,959 --> 00:44:35,167 It's not the best solution. 626 00:44:35,542 --> 00:44:39,375 So what's this enterprise approved version? 627 00:44:49,501 --> 00:44:51,999 Everyone knows Engine X. 628 00:44:51,999 --> 00:45:00,083 If you use Engine X lure you can write interesting scripts and response codes 629 00:45:00,083 --> 00:45:07,125 that are going out of Engine X, so using Engine X you can set stuff 630 00:45:07,125 --> 00:45:12,709 and there are a few bugs in the nonGit version, tend 631 00:45:12,709 --> 00:45:18,999 to get returned is nil, but if you use the version from Git, 632 00:45:18,999 --> 00:45:23,083 it shouldn't be a problem, but if you do 633 00:45:23,083 --> 00:45:31,167 an app get install you're going to run across a couple of problems. 634 00:45:31,250 --> 00:45:35,292 So what does the future hold? 635 00:45:35,417 --> 00:45:36,999 What's the next step? 636 00:45:37,083 --> 00:45:41,083 I've been trying to get this into mod security to ease the option 637 00:45:41,083 --> 00:45:44,375 by implementing into something that people are using 638 00:45:44,375 --> 00:45:46,792 on a daily basis because no one wants 639 00:45:46,792 --> 00:45:50,792 to implement another layer of stuff because the more you install 640 00:45:50,792 --> 00:45:54,999 you're increasing your attack service so you want to change a couple 641 00:45:54,999 --> 00:45:58,999 of figures and do this stuff without you having to think about it 642 00:45:58,999 --> 00:46:01,876 but it's not simple or easy. 643 00:46:01,918 --> 00:46:04,250 I've been discussing it with various people 644 00:46:04,250 --> 00:46:09,292 for about a year and everyone is like, that should be possible, kinda. 645 00:46:16,542 --> 00:46:18,626 I'm not a C coder. 646 00:46:24,626 --> 00:46:28,501 I would appreciate the help. 647 00:46:29,999 --> 00:46:33,584 So we've told the scanners they're crap, we've told the scanners 648 00:46:33,584 --> 00:46:36,999 they aren't doing stuff in the right way. 649 00:46:37,083 --> 00:46:39,417 Really need a new microphone here. 650 00:46:39,876 --> 00:46:43,083 So less reliance on status codes. 651 00:46:43,083 --> 00:46:45,459 I know it's easy to say but we're going to have 652 00:46:45,459 --> 00:46:50,584 to slow scanners down in order for them to be more reliable. 653 00:46:50,709 --> 00:46:54,999 Because right now they're taking codes and ignoring everything else so start 654 00:46:54,999 --> 00:46:59,792 paying attention to the content of the site itself and some scanners are 655 00:46:59,792 --> 00:47:04,417 doing this already but things need to be double checked so you get better 656 00:47:04,417 --> 00:47:08,167 matching if you do that, problem is Reg X matching is slow, 657 00:47:08,167 --> 00:47:12,584 uses more memory, take more time, it's not easy but this is the cat 658 00:47:12,584 --> 00:47:14,542 and mouse game. 659 00:47:14,626 --> 00:47:17,959 Every time we come up with something new or increase our 660 00:47:17,959 --> 00:47:22,083 security, then people who are attacking web sites or testing them increase 661 00:47:22,083 --> 00:47:26,542 the productivity and increase the accuracy of their tools. 662 00:47:27,501 --> 00:47:29,999 Hopefully we can move this to the next level. 663 00:47:32,834 --> 00:47:34,417 That's all I've got! 664 00:47:34,417 --> 00:47:35,626 Any questions? 665 00:47:48,167 --> 00:47:49,334 Yeah? 666 00:47:49,334 --> 00:47:50,959 AUDIENCE MEMBER: (Away from microphone.) CHRIS: The 667 00:47:50,959 --> 00:47:53,250 question is have I looked at detecting specific scanners 668 00:47:53,250 --> 00:47:54,999 and how they look when they're attacking 669 00:47:54,999 --> 00:47:56,542 web server. 670 00:47:56,999 --> 00:47:59,709 Yes, I have looked at it not as part of this research, but as part 671 00:47:59,709 --> 00:48:01,542 of other research. 672 00:48:01,584 --> 00:48:02,999 It's interesting stuff. 673 00:48:02,999 --> 00:48:06,375 You can detect when this is attacking your web site. 674 00:48:07,542 --> 00:48:10,709 The problem is it's the same as this stuff. 675 00:48:10,709 --> 00:48:12,167 As soon as you start detecting how specific 676 00:48:12,167 --> 00:48:15,999 scanners look when they're hitting your web site they're going 677 00:48:15,999 --> 00:48:18,751 to randomize how they request stuff so it's sort 678 00:48:18,751 --> 00:48:21,918 of a step in the cat and mouse game. 679 00:48:22,083 --> 00:48:31,999 AUDIENCE MEMBER: (Away from microphone.) CHRIS: F5 you 680 00:48:31,999 --> 00:48:40,999 can write scripts to do this stuff it's interesting, 681 00:48:40,999 --> 00:48:48,459 I'm sure everyone here as an F5, yeah? 682 00:48:48,459 --> 00:48:48,999 AUDIENCE MEMBER: (Away from microphone.) CHRIS: Different 683 00:48:48,999 --> 00:48:51,584 versions of browsers respond in different ways? 684 00:48:51,584 --> 00:48:54,083 At the beginning of my testing I was using 685 00:48:54,083 --> 00:49:00,125 all the different versions of IE, IE6 tends to do things in a weird way, 686 00:49:00,125 --> 00:49:05,334 you get some weird stuff, like with the 100 codes. 687 00:49:05,334 --> 00:49:08,626 It tries to download stuff but it's between specific versions 688 00:49:08,626 --> 00:49:12,209 they don't tend to change the lodge logic. 689 00:49:12,250 --> 00:49:14,999 I'm getting the wave if you have further questions 690 00:49:14,999 --> 00:49:18,999 or comments the code is available on my GitHub sight and I would 691 00:49:18,999 --> 00:49:23,292 like to leave you with a thought of whatever doesn't kill you makes 692 00:49:23,292 --> 00:49:25,083 you smaller!