Defense by Numb3r5Making problems for script k1dd13s
and scanner monkeys@ChrisJohnRiley
“THE WISEST MAN, IS HE WHO KNOWS, THAT HE KNOWS
NOTHING”SOCRATES: APOLOGY, 21D
I LIKE EDGE CASES
GLOBAL
INFRASTRUCTURE ISSUES
OS SPECIFICISSUES
APPLICATIONISSUES
TL;DR
Goals for this talk
Describe the defensive uses of HTTP status codes
1) What2) Why3) How4) Goals5) Bringing it together6) Review
1WHAT?
HTTP STATUS CODES
Seems like such a Small detail
… small detail,big impact
This talk contains:- Numbers
- Bad Jokes
- Traces of peanuts
- Did I mention numbers?
HTTP Status Codes
o Majority part of RFC 2616 (HTTP/1.1)o 5 main classes of responseo 1XX informationalo 2XX successo 3XX redirectiono 4XX client erroro 5XX server error
BASICSAKA: THE BORING THEORY BIT
1XX Informational
o Indicates response receivedo Processing is not yet completedo 100 Continueo 101 Switching Protocolso 102 Processing (WebDAV RFC 2518)
2XX Success
o Indicates response receivedo Processed and understoodo 200 OKo 201 Createdo 202 Acceptedo 203 Non-Authoritative Informationo 204 No Content
2XX Success (cont.)
o 205 Reset Contento 206 Partial Contento 207 Multi-Status (WebDAV RFC 4918)
o Codes not supported by Apacheo 208 Already Reportedo 226 IM Usedo 250 Low on Storage Space
3XX Redirection
o Action required to complete requesto 300 Multiple Choiceso 301 Moved Permanentlyo 302 Found / Moved Temporarilyo 303 See Othero 304 Not Modified
3XX Redirection (cont.)
o 305 Use Proxyo 306 Switch Proxyo 307 Temporary Redirect
o Codes not supported by Apacheo 308 Permanent Redirect
4XX Client Error
o Client caused an erroro 400 Bad Requesto 401 Unauthorizedo 402 Payment Requiredo 403 Forbiddeno 404 Not Foundo 405 Method Not Allowed
4XX Client Error (cont.)
o 406 Not Accessibleo 407 Proxy Authentication Requiredo 408 Request Timeouto 409 Conflicto 410 Goneo 411 Length Required
4XX Client Error (cont.)
o 412 Precondition Failedo 413 Request Entity Too Largeo 414 Request-URI Too Longo 415 Unsupported Media Typeo 416 Request Range Not Satisfiableo 417 Expectation Failedo 418 I’m a Teapot (WebDAV RFC 2324)
4XX Client Error (cont.)
o 419 / 420 / 421 Unusedo 422 Unprocessable Entity (RFC 4918)
o 423 Locked (RFC 4918)
o 424 Failed Dependency (RFC 4918)
o 425 No Code / Unordered Collectiono 426 Upgrade Required (RFC 2817)
4XX Client Error (cont.)
o Codes not supported by Apacheo 428 Precondition Requiredo 429 Too Many Requestso 431 Request Header Fields Too Largeo 444 No Response (NGINX)
o 449 Retry With (Microsoft)
o 450 Blocked by Win. Parental Controlso 451 Unavailable For Legal Reasons
4XX Client Error (cont.)
o Codes not supported by Apacheo 494 Request Header Too Large (NGINX)
o 495 Cert Error(NGINX)
o 496 No Cert (NGINX)
o 497 HTTP to HTTPS (NGINX)
o 499 Client Closed Request (NGINX)
5XX Server Error
o Server error occurredo 500 Internal Server Erroro 501 Not Implementedo 502 Bad Gatewayo 503 Service Unavailableo 504 Gateway Timeouto 505 Method Not Allowed
5XX Server Error (cont.)
o 506 Variant Also Negotiates (RFC 2295)
o 507 Insufficient Storage (WebDAV RFC 4918)
o 508 Loop Detected (WebDAV RFC 5842)
o 509 Bandwidth Limit Exceeded (apache ext.) o 510 Not Extended (RFC 2274)
5XX Server Error (cont.)
o Codes not supported by Apacheo 511 Network Authentication Required (RFC
6585)
o 550 Permission Deniedo 598 Network Read Timeout Error (Microsoft
Proxy)
o 599 Network Connect Timeout Error (Microsoft Proxy)
OMG Enough with the numbers already!!!!
2WHY?
It started as a simple idea…
… and I started to think
SCREW WITH
SCANNERS
… AND SCRIPT
K1DD13S
THAT SOUNDS LIKE FUN!
@thegrugq 26 Feb 2013
@thegrugq 26 Feb 2013
- When the tables turn (2004) - Roelof Temmingh, Haroon Meer, Charl van der Walt- http://slideshare.net/sensepost/strikeback
- Stopping Automated Attack Tools (2006)- Gunter Ollmann- http://www.technicalinfo.net/papers/
StoppingAutomatedAttackTools.html
Prior Art
3HOW?
BROWSERS HAVE TO BE
FLEXIBLE
THIS LEADS TO INTERPRETATIO
N
RFCS…THEY’RE MORE OF A GUIDELINE
REALLY
WHAT COULD POSSIBLY GO WRONG!
TESTINGTHE HOW OF THE THING!
o Restricted research to the big 3o Internet Explorero Chrome / Chromiumo Firefox
NO… SAFARI ISN’T IN THE
TOP 10 3
OPERA JUMPED…OR WAS IT PUSHED!
LYNXTHE UNREALISTIC OPTION
o MITMproxyo Python-basedo Simple to setup proxy / reverse proxyo Script-based actions
o PHPo Ability to set response code
o Must be at the top of the PHP codeo Can be added to php.ini
o auto-prepend-file=o Limited by web-server (apache)
o Testing browsers automaticallyo Created PHP file to set status code
- http://c22.cc/POC/respcode.php?code=XXX
BROWSERS… AND THEIR STATUS CODE HABITS
Miss
Firefox Chrome Internet Explorer
Response Code HTML iFrame JS HTML iFrame JS HTML iFrame JS
100 X X X X d/load X X X X
101 X X X X d/load X X X X
102 X X X X d/load X X X X
200
201
202
203
204 X X X X X X X X X
205 X X X X X X
206
207
300 X
301 X X X X
302 X X X X
303 X X X X
304 X X X X X X X X X
305 X
306 X
307 X X X X
Firefox Chrome Internet ExplorerResponse Code HTML iFrame JS HTML iFrame JS HTML iFrame JS
400 X X X X
401 X X X
402 X X X
403 X X X X
404 X X X X
405 X X X X
406 X X X X
407 X Proxy Proxy Proxy X
408 X X X X X X
409 X X X X
410 X X X X
411 X X X
412 X X X
413 X X X
424 X X X
425 X X X
426 X X X
Firefox Chrome Internet Explorer
Response Code HTML iFrame JS HTML iFrame JS HTML iFrame JS
500 X X X X
501 X X X X
502 X X X
503 X X X
504 X X X
505 X X X X
506 X X X
507 X X X
508 X X X
509 X X X
510 X X X
Browsers handle most things just like
they handle a200 OK?
YEP…MOSTLY
o HTML Responseso Almost all response codes are rendered by
the browser correctlyo iFrameso Some special cases for IE, but other
browsers handle this the same as HTML
o JavaScript/CSSo Limited accepted status codeso Limited 3XX support
o Chrome is the exception hereo No support for 4XX/5XX codes
So we know what browsers
interpret differently
What do all browsers have in common?
o 10X code handlingo Retrieso Confusion
o Chrome / IE6 try to download the page!o Fun on Android…
o Timeoutso Eventually
o 204 No Contento Um, no content!
o 304 Not Modifiedo Again, no content
WHAT ABOUT
HEADERS?
Just because the RFC says a specific status code
must have an associated header doesn’t mean it
HAS to…
o Redirection codes (301-304, 307)o No Location header, no redirect
o 401 Unauthorizedo No WWW-Authenticate header, no
authentication prompto 407 Proxy Authentication Requiredo No Proxy-Authenticate header, no prompt
Just because the RFC says a specific status code
shouldn’t have an associated header
doesn’t mean it can’t…
o 300 Multiple Choices w/ Location Headero Firefox/IE6 follows the redirecto Chrome doesn’t
o More research needed in this direction
EACH BROWSER HANDLES
THINGS A LITTLE DIFFERENTLY
I WONDER WHAT WE
CAN DO WITH THAT!
4GOALS
o Each browser handles things differentlyo Use known conditionso Handled codeso Unhandled codes
o Browser weirdness
BROWSER FINGERPRINTI
NG
o Doesn’t load JavaScript returned with a 300 ‘Multiple Choices’ status codeo Other browsers tested DO (IE/Chrome)
o Request JS from servero Respond using 300 ‘Multiple Choices’o If JS doesn’t run in the browser - it’s FF
Firefox
o Loads JavaScript returned with a 307 ‘Temporary Redirect’ status codeo Other browsers tested DON’T (IE/FF)
o Request JS from servero Respond with 307 ‘Temporary Redirect’o If JS runs in the browser - it’s Chrome
Chrome
o Loads JavaScript returned with a 205 ‘Reset Content’ status codeo Other browsers tested DON’T (FF/Chrome)
o Request JS from servero Respond using 205 ‘Reset Content’o If JS runs in the browser - it’s IE
Internet Explorer
o Other options to fingerprint browserso 300 Redirect (Chrome)o 305/306 JavaScript (Firefox)o 400 iFrame (Internet Explorer)o …
o There are probably more
BROWSER FINGERPRINTI
NGDEMO
USER-AGENTS CAN BE SPOOFED
BROWSER TRAITS CAN’T
PROXY DETECTIO
N
o Chrome handles proxy configuration differently to other browserso 407 status code isn’t rendered o Unless an HTTP proxy is set!
o Allows us to detect if an HTTP proxy is in useo Just not which proxy
o Can only detect HTTP proxies ;(
Chrome
o Request page from servero Respond using 407 ‘Proxy Authentication
Required’o - w/o Proxy-Authenticate header
o If Chrome responds, it’s configured to use an HTTP proxy
Chrome Proxy Detection
o Privoxy 3.0.20 (CVE-2013-2503)o 407 Proxy Authentication Required
o w/ Proxy-Authenticate headero User prompted for username/password
o Prompt appears to be from Privoxyo Privoxy passes username/password to
remote siteo Profit???
Side-Effect: Owning Proxies
5BRINGING IT TOGETHER
What we have
o Status codes all browsers treat as contento Status codes all browsers can’t handle
o 10X, etc..o Lots of browser quirks
What can we do
o F*ck with thingso Screw with scanner monkeyso Make RFC lovers cry into their beero Break things in general
Let’s try to…
o Use what we’ve discovered to…o Break spidering toolso Cause false positives / negativeso Slow down attackers
o The fun way!o Blocking successful exploitation
BREAKING SPIDERS
Simplistic view of spiders
o Access target URLo Read links / functionso Test them outo If true: repeato What is TRUE?
o What happens if:o Every response is a 200o Every response is a 404 / 500
200 OK
o IF 200 == True:o Problems!o Never-ending spider
404 Not Found
o IF 404 == False:o More problems!o What website?
500 Internal Server Error
o Skipfish != happy fish
False Positives
/Negatives
o Most scanners use status codeso At least to some extent
o Initial match (prior to more costly regex)o Speed up detection
o What happens if:o Every response is a 200o Every response is a 404 / 500o Every response is random*
* Using codes that are accepted by all browsers as content
Vulnerability Baseline
o w3afo Information 79 pointso Vulnerabilities 65o Shells 0 shells o Scan time 1h37m23s
Every response 200 OK
o No changeo All points discovered - per baseline
o 79/65/0o Scan time 9h56m55s
o Lots more to check ;)
Every response 404 Not Found
o Less to scan == Less to findo False negativeso 44 Information points (-35)o 37 Vulnerabilities (-28)
o Scan time 7m13so Much quicker scano Less paths traversed
Every response 500
o Server error == OMG VULN!o False positives+++o 9540 Information points (+9461)o 9526 Vulnerabilities (+9461)
Random Status Codes
o Multiple runso All tests produced False positives++o avg. 619 Information points (+540)o avg. 550 Vulnerabilities (+485)
o Avg. scan time 11m37so Much quicker scan
Random Status Codes
o Skipfish + $rand = chaoso False Positives and False Negativeso Scan jobs killed due to lack of resources
o Scan timeso 1st scan time 10h3m35so 2nd scan time 0h0m4so 3rd scan time 16h47m41s
Slowing attackers
down!
What does your WAF really do?
o OMG Attacko Return error (401?)o Profit???
Why?
Remember that list of status codes browsers don’t
handle well?
Yeah well, scanners don’t usually handle
them well either!
Especially the 1XX codes
o Remember LaBrea tarpit?o Tim Liston 2001 (labrea.sourceforge.net)o Designed to slow spread of Code Redo Slows down scans / attackers
How about an HTTP Tarpit!
HTTP Tarpit Scenario
o WAF detects scan / attacko Adds source IP to “naughty” listo All responses from the server are
rewritteno 100|101|102 status codes only (random)o 204|304 might also be useful (no content)
Let’s do some science!*
* Science not included
Nikto vs. HTTP Tarpit
Baseline HTTP Tarpit
Scan time
2m 18s
Findings
18
14h 33m 2s
10
W3AF vs. HTTP Tarpit
Baseline HTTP Tarpit
Scan time
1h 37m 23s
Findings
65
18m 10s
0
Skipfish vs. HTTP Tarpit
Baseline HTTP Tarpit
Scan time
18m 10s
Findings
Low: 2519Med: 2522
High: 12
Low:Med: High:
05s
003
HTTP Tarpit
o HTTP Tarpit Results*o Slow scans (nikto)
o 340x as longo Unreliable / aborted scans (w3af / skipfish)
o 100% less findings
* Not scientifically sound ;)
Blocking successful
exploitation
We’ve made it hard to find the vulnerabilities
We’ve made it time consuming
for attackers
Now let’s stop the sk1dd13s using
Metasploit to pop $hells
o How often does Metasploit reference status codes?
rgrep -E 'res[p|ponse]?\.code' *
846*
* Not scientifically sound ;)
rgrep -E 'res[p|ponse]?\.code' *
Lots of dependency on status codes*
* yep, even the stuff I wrote
if (res.code < 200 or res.code >= 300)
case res.codewhen 401
print_warning("Warning: The web site
asked for authentication: #{res.headers
['WWW-Authenticate'] || res.headers
['Authentication']}")end
fail_with(Exploit::Failure::Unknown,"Upload failed on #{path_tmp}[#{res.code} #{res.message}]")
end
No match, No shell*
* exploit dependent
6REVIEW
o Using status codes to our benefit is funo … and useful!
o Browsers can be quirkyo Scanners / attack toolkits are sometimes
set in their wayso Take the easy routeo Easy to fool
o WAFs need to get more offensive about their defenseo More than just blocking a request with a
snazzy messageo Hacking back is bado Slowing down known attacks is goodo Make life harder for skiddies is pricele$$
o Current tools are much the same as APTo APT (Adequate Persistent Threat)o Only as advanced as they NEED to be
Countering this research
o Less reliance on status codeso More reliance on content / headerso Proso Better matching / intelligence
o Conso Slower? (regex)o More resource intensive
Questions?
MITMPROXY SCRIPTS AVAILABLE
GITHUB.COM/CHRISJOHNRILEY/RANDOM_CODE
What doesn’t kill you,makes you
smaller!
Recommended
