7 ms·
Web hacking techniques of 2021
- adrianomartins 5y agoInteresting community built list of the top 10 web hacking vulnerabilities used in 2021. If you're making a web product you might want your team to quickly run over these.
- TheAdamist 5y agoIt's not the top 10 used, it's the top 10 new for 2021 techniques, and specifically excludes older techniques.
- _8j50 5y agoThis guy's work always impresses me. He had a nice Blackhat brief as well. This list is great and all for redteamers but as a defender, I would like to know if any actual threat actors used these techniques even after publication. Even with all the secret/private and public threat intel I am aware of, none of them register. Not knocking down on threat research, I am honestly curious because I can't tell if I should be on the look out for any real threat actors using these techniques.
- FastEatSlow 5y agoYes, actual threat actors use these techniques even after publication. There is a lot of outdated/misconfigured systems in the wild. A fairly recent example is the defacing of multiple Ukrainian government websites[1], through exploiting a vulnerability fixed and publicised in august 2021. There's also around 10,000 (can't remember where that statistic is from) Huawei routers on the internet vulnerable to an issue from 2015, which are constantly being infected with botnet worms. [1] https://www.bleepingcomputer.com/news/security/multiple-ukrainian-government-websites-hacked-and-defaced/ https://www.bleepingcomputer.com/news/security/multiple-ukra...
- _8j50 5y agoI know web exploits happen all the time first hand. > all 15 compromised Ukrainian sites were using an outdated version of the October CMS, vulnerable to CVE-2021-32648. That cve looks like it was caused by someone doing == instead of === in php. My question was things like request smuggling and protocol abuse attacks have ever been seen in the "wild".
- losthobbies 5y agoThe dependency confusion article on Medium was a great read.
- airstrike 5y agoIt's a really good article and apologies to the author for nitpicking but even as a bona fide Python fanboy I had to raise my eyebrows at this statement: > Some programming languages, like Python, come with an easy, more or less official method of installing dependencies for your projects.
- nawgz 5y agoI mean, have you ever used a language like Java? Python has a bad package manager story, sure, but it has a package manager story - that's not actually particularly global afaik
- remus 5y agoBeautifully simple! Exfiltrating data via a DNS request was a nice little trick too.
- deleted 5y ago[deleted]
- baobabKoodaa 5y agoIt's amazing that such a simple vulnerability can be leveraged in practice to gain access to so many machines on so many different organizations. Props to the researcher!
- btown 5y agoLink for those who went straight to comments: https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610 https://medium.com/@alex.birsan/dependency-confusion-4a5d60f...
- fendy3002 5y agoMan the JSON inconsistency one is creative. I know it's not consistent implementation across languages, but I don't know it can be used to such attacks.
- FabHK 5y agoYes. The big take-away for me, whether it's JSON or YAML or XML or whatever: never parse anything more than once (and definitely not with different parsers).
- furstenheim 5y agoIt got me thinking, is client side rendering intrinsically safer than SSR. SQL queries with params are safer because data and code flow separately. Similarly, if you query backend for data and then do textContent = response, that cannot do xss, right?
- jcims 5y agoAnytime is possible for the data that returns to be interpolated by the client, you could have xss or related attack. Client side rendering does help but mistakes are still regularly made. Sometimes by the app dev, sometimes by the framework dev. You could probably go to an extreme and return all of your application data as sprites.
- furstenheim 5y agoOf course you can still do <div> + input + </div> in CSR, but you can definitely not do myelement.textContent = whateverIGot in SSR, right?
- asddubs 5y agoyou can use a template engine that escapes all variables by default. in either case, it's just about coding defensively and being secure by default
- furstenheim 5y agoThen why is parameter query safer? And not just escapes variables? Escaping is hard, as shown in the article
- asddubs 5y agogenerating html using find and replace/regex safely is hard. escaping is easy. and the solution is to just not generate html using find and replace. You'll run into the exact same problem trying to do a bbcode/markdown/whatever parser using javascript
- TheAdamist 5y agoThe hn title needs updating as it's misleading, even if it reflects the title on the website. The first sentence even clarifies it's only new techniques. "Welcome to the Top 10 (new) Web Hacking Techniques of 2021, the latest iteration of our annual community-powered effort to identify the most significant web security research released in the last year". The top web hacking techniques used and the top new ones I would expect to be very different lists.
- formerly_proven 5y agoFive out of ten new techniques are langsec, which makes them inherently difficult to fix, yet we keep using unreasonably complex languages for protocols and keep stapling on more complexity, resulting in formally assured insecurity.
- nyanpasu64 5y agohttp://langsec.org/ http://langsec.org/ does a spectacularly poor job of introducing langsec to the uninitiated. It appears to be a list of conferences and papers for academics, followed by http://langsec.org/bof-handout.pdf http://langsec.org/bof-handout.pdf which makes unsubstantiated assertions and doesn't elaborate. I think more people would learn about langsec if the homepage contained an introduction followed by a guided tour of articles which incrementally teach the current state of the field in an organized accessible fashion. EDIT: I found https://scribe.rip/1b92451d4764 https://scribe.rip/1b92451d4764 which purports to be an "introduction followed by a tour", which links to “Security Applications of Formal Language Theory” and “The Seven Turrets of Babel: A Taxonomy of LangSec Errors and How to Expunge Them”. The second seems not very practical/applied or hands-on, and the first is quite long and academic (I haven't read it yet). It might be useful as reference material, but I'd be interested to see examples of designing/refactoring systems to be more secure based on langsec.
- jcims 5y agoI was full time infosec from 1998 until 2015 then moved into an adjacent role that is still technically infosec but is more infrastructure/platform controls. This is the first time i recall ever seeing the term. Based on reading the two sentence synopsis in Google results it’s largely indistinguishable from the more familiar “formal methods” or “formal verification”.
- the-alt-one 5y agoKTH has a course called Language based security ( https://www.kth.se/student/kurser/kurs/DD2525?l=en https://www.kth.se/student/kurser/kurs/DD2525?l=en ) which indeed does come from people involved in formal methods. Formal methods is a huge area though, but in essence it's about establishing proofs of correctness.
- bawolff 5y agoKind of feels a little repetitive to have request smugguling on the list 3 different times.
- hbn 5y agoNot super on topic, but every time this site is linked, I never properly read the URL correctly. My brain immediately thinks the space is between the 's' and 'w'
- thefreeman 5y agothanks, now i’ll never be able to read it properly again. :(
- mywacaday 5y agoSame with expertsexchange.com
- ooedemis 5y agoWhat about GWT-Google Web Toolkit its actually not so many updated and under top news but the idea is implement in a prooven language java both frontend and backend
- ackbar03 5y agoAnyone here that works on these kind of deep-dive type of security research? Can you give a TLDR of how do you usually set everything up to find these results? As in, do you set up some sort of test environment/website with full debug logs and take if one step at a time from there? If so, how to you ensure that it is realistic and relevant to real world use since real-world architecture might differ from a setup that worked in your experiments? I ask this because I used to do some bug bounties and it consisted of a lot of painful trial and error. I can't imagine anything new and profound can be found that way. (PS in case it isn't obvious I didn't open up the research links and read in detail, hence a tldr)
- EdOverflow 5y agoI am a security researcher referenced in the winning web-hacking technique on that list ("Dependency Confusion" by Alex Birsan [1]) and was ranked 7th in Portswigger's 2019 issue [2,3]. My motto has always been "Learn to make it; then break it." In other words, I invest a lot of time familiarising myself with technologies and specifications before examining how their implementation might lead to security flaws. This process usually requires reading a lot of technical documentation and source code, and becoming acquainted with how organisations implement said technologies. Once I feel comfortable with my understanding of the subject material, I start to think about how certain aspects of the technology could lead to security flaws or interesting areas of research. At times this may require out-of-the-box thinking or can even be the result of pure luck. The "bug bounty" aspect of this all tends to come into play once I want to find case studies for my research. [1]: https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610 https://medium.com/@alex.birsan/dependency-confusion-4a5d60f... [2]: https://portswigger.net/research/top-10-web-hacking-techniques-of-2019 https://portswigger.net/research/top-10-web-hacking-techniqu... [3]: https://edoverflow.com/2019/ci-knew-there-would-be-bugs-here/ https://edoverflow.com/2019/ci-knew-there-would-be-bugs-here...
- icare_1er 5y agoIt baffles me how convoluted and complex the webapp attacks have become over the past few years. I think this is an effect of bug-bounty hunting, which has pretty much opened the research on those topics to a massive community.
- Agamus 5y agoI'm not an expert here, but truly interested to hear responses to this question. To say that 1+1=2 is "true", does that not require a corollary in "reality" to something fundamental that can be called a "one" object? I believe this is called mathematical constructivism. Imagine, hypothetically, that we cannot identify something that is physically fundamental and individual. My question is whether any mathematics in that scenario could be considered "true" without such constructivism, in other words, without a physical correspondence to an unquestionably, physically fundamental "one" object.
- deleted 5y ago[deleted]
- dc-programmer 5y agoSir, this is a Wendy’s
- scanr 5y agoThe work on exploiting prototype pollution was excellent https://blog.s1r1us.ninja/research/PP https://blog.s1r1us.ninja/research/PP I didn’t know about the --disable-proto option in node or the Document Policy proposal for dealing with it. Amazing that 80% of nested query parameter parsers were susceptible to prototype pollution.
- clarnaskirq 5y agoAs a web programmer, for whom the majority of this article is not only new, but difficult to comprehend, it makes me yearn to improve my web security knowledge. Any pointers?
- orangepurple 5y agoGo through each line item in the article and create a proof of concept for yourself. You will learn a lot along the way too.
- ridiculous_leke 5y agoI suggest going through cheatsheets on OWASP. Most of it is comprehensible to any web programmer. Here's one example: https://cheatsheetseries.owasp.org/cheatsheets/PHP_Configuration_Cheat_Sheet.html https://cheatsheetseries.owasp.org/cheatsheets/PHP_Configura...
- ipnon 5y agoDo some of your own hacking on hackthebox.com. It is shocking what can be done with only a week of security training by an already experienced programmer. It becomes clear that the typical software engineer doesn't give a single thought to security.
- doopy1 5y agoYou can look at the disclosed reports on hackerone and get a feel for the kind of stuff that's being exploited and how it's being addressed.