CYS405 · Chapter 8 · Annotated SlidesWeb and Database Hacking
Original
Overview

Web and Database Hacking

Web server operations and why servers get compromised, DNS hijacking and amplification, directory traversal, MITM, cache poisoning, DoS, session hijacking with cookies, the web-server attack methodology, web application and session attacks, database vulnerabilities and attacks, and testing.

How to read this page

Every original slide is shown unchanged. Yellow marks on a slide point to a numbered note: hover or tap a mark to jump to its note, and hover a note to see its marks. Questions tagged Past exam appeared on a real paper; Prediction questions are likely angles, not confirmed. Pick an answer to each question: a wrong pick tells you why it is wrong, so you can try again.

All 59 slides
  1. 1 Slide 1
  2. 2 Learning Objective
  3. 3 Key Concepts
  4. 4 Web Server Operations
  5. 5 Web Server Security Issues
  6. 6 ▪ Organizations can defend most network-level and OS-level attacks by using
  7. 7 Common Goals behind Web Server Hacking
  8. 8 Dangerous Security Flaws Affecting Web Server
  9. 9 Why Web Servers Are Compromised
  10. 10 Shift Toward Web Layer Attacks
  11. 11 Webmaster’s Perspective
  12. 12 Network Administrator’s Perspective
  13. 13 End User’s Perspective
  14. 14 Root Causes of Web Server Compromise
  15. 15 Configuration & Human Factors
  16. 16 Key Security Principle
  17. 17 Impact of Web Server Compromise
  18. 18 Slide 18
  19. 19 Improper or poor web design Source Code Example 1
  20. 20 Web Server Vulnerabilities
  21. 21 Slide 21
  22. 22 DNS Server Hijacking
  23. 23 DNS Amplification Attack
  24. 24 DNS Amplification Attack ( cont’d)
  25. 25 Directory Traversal Attack
  26. 26 Man-in-the-Middle/Sniffing Attack
  27. 27 Web Cache Poisoning Attack
  28. 28 DoS/DDoS Attack
  29. 29 Session Hijacking with cookies
  30. 30 Web Server Attack Methodology
  31. 31 Banner Information
  32. 32 Permissions
  33. 33 Unnecessary Features
  34. 34 User Accounts
  35. 35 Slide 35
  36. 36 Web Application Attacks
  37. 37 Web Application Attacks (cont’d)
  38. 38 Session Management Issues
  39. 39 Session Vulnerabilities
  40. 40 Encryption Weaknesses
  41. 41 Slide 41
  42. 42 Database Attacks and Vulnerabilities Overview
  43. 43 Database Vulnerabilities
  44. 44 Database Vulnerabilities (cont.)
  45. 45 Database Vulnerabilities (cont.)
  46. 46 Database Attacks
  47. 47 Database Attacks (cont.)
  48. 48 Impact of Database Attacks
  49. 49 Locating Databases on the Network
  50. 50 Network Database Scanner
  51. 51 Database Server Password Cracking
  52. 52 Locating Vulnerabilities in Databases
  53. 53 Out of Sight, Out of Mind
  54. 54 Web Server Penetration Testing
  55. 55 Slide 55
  56. 56 Slide 56
  57. 57 Slide 57
  58. 58 Slide 58
  59. 59 Summary
Slide 1 / 59

Slide 1

Slide 1: Slide 1
Slide 2 / 59

Learning Objective

Slide 2: Learning Objective
Slide 3 / 59

Key Concepts

Slide 3: Key Concepts
Slide 4 / 59

Web Server Operations

Slide 4: Web Server Operations
Slide 5 / 59

Web Server Security Issues

Slide 5: Web Server Security Issues
Slide 6 / 59

▪ Organizations can defend most network-level and OS-level attacks by using

Slide 6: ▪ Organizations can defend most network-level and OS-level attacks by using
Slide 7 / 59

Common Goals behind Web Server Hacking

Slide 7: Common Goals behind Web Server Hacking
Slide 8 / 59

Dangerous Security Flaws Affecting Web Server

Slide 8: Dangerous Security Flaws Affecting Web Server
Slide 9 / 59

Why Web Servers Are Compromised

Slide 9: Why Web Servers Are Compromised

Notes

  1. Why web servers are compromised: default settings, unpatched software, misconfiguration, weak permissions, unnecessary services, poor input validation.

Slide 10 / 59

Shift Toward Web Layer Attacks

Slide 10: Shift Toward Web Layer Attacks
Slide 11 / 59

Webmaster’s Perspective

Slide 11: Webmaster’s Perspective
Slide 12 / 59

Network Administrator’s Perspective

Slide 12: Network Administrator’s Perspective
Slide 13 / 59

End User’s Perspective

Slide 13: End User’s Perspective
Slide 14 / 59

Root Causes of Web Server Compromise

Slide 14: Root Causes of Web Server Compromise
Slide 15 / 59

Configuration & Human Factors

Slide 15: Configuration & Human Factors
Slide 16 / 59

Key Security Principle

Slide 16: Key Security Principle
Slide 17 / 59

Impact of Web Server Compromise

Slide 17: Impact of Web Server Compromise
Slide 18 / 59

Slide 18

Slide 18: Slide 18
Slide 19 / 59

Improper or poor web design Source Code Example 1

Slide 19: Improper or poor web design Source Code Example 1
Slide 20 / 59

Web Server Vulnerabilities

Slide 20: Web Server Vulnerabilities
Slide 21 / 59

Slide 21

Slide 21: Slide 21
Slide 22 / 59

DNS Server Hijacking

Slide 22: DNS Server Hijacking

Notes

  1. DNS server hijacking: attacker changes DNS records so users are sent to a malicious server.

Slide 23 / 59

DNS Amplification Attack

Slide 23: DNS Amplification Attack

Notes

  1. DNS amplification: spoofed small queries to open resolvers produce large replies aimed at the victim (DDoS).

Exam angle

PredictionQ1

Spoofed DNS queries that make open resolvers flood a victim with large responses are:

Slide 24 / 59

DNS Amplification Attack ( cont’d)

Slide 24: DNS Amplification Attack ( cont’d)
Slide 25 / 59

Directory Traversal Attack

Slide 25: Directory Traversal Attack

Notes

  1. Directory traversal: "../" sequences to read files outside the web root (../../etc/passwd).

Exam angle

PredictionQ1

The request /view?file=../../../etc/passwd is a:

Slide 26 / 59

Man-in-the-Middle/Sniffing Attack

Slide 26: Man-in-the-Middle/Sniffing Attack
Slide 27 / 59

Web Cache Poisoning Attack

Slide 27: Web Cache Poisoning Attack

Notes

  1. Web cache poisoning: inject malicious content into a cache so other users receive it.

Slide 28 / 59

DoS/DDoS Attack

Slide 28: DoS/DDoS Attack
Slide 29 / 59

Session Hijacking with cookies

Slide 29: Session Hijacking with cookies

Notes

  1. Session hijacking with cookies: steal the session ID (sniffing, XSS) and replay it.

Slide 30 / 59

Web Server Attack Methodology

Slide 30: Web Server Attack Methodology
Slide 31 / 59

Banner Information

Slide 31: Banner Information

Notes

  1. Banner information reveals server type and version: hide or change it.

Slide 32 / 59

Permissions

Slide 32: Permissions
Slide 33 / 59

Unnecessary Features

Slide 33: Unnecessary Features
Slide 34 / 59

User Accounts

Slide 34: User Accounts
Slide 35 / 59

Slide 35

Slide 35: Slide 35
Slide 36 / 59

Web Application Attacks

Slide 36: Web Application Attacks

Notes

  1. Web app attacks: SQL injection, XSS, CSRF, parameter tampering, cookie poisoning, input validation flaws.

Exam angle

PredictionQ1

Injecting a script into a page that runs in other users’ browsers is:

Slide 37 / 59

Web Application Attacks (cont’d)

Slide 37: Web Application Attacks (cont’d)
Slide 38 / 59

Session Management Issues

Slide 38: Session Management Issues

Notes

  1. Session management issues: predictable IDs, IDs in URLs, no timeout, no regeneration after login.

Slide 39 / 59

Session Vulnerabilities

Slide 39: Session Vulnerabilities
Slide 40 / 59

Encryption Weaknesses

Slide 40: Encryption Weaknesses
Slide 41 / 59

Slide 41

Slide 41: Slide 41
Slide 42 / 59

Database Attacks and Vulnerabilities Overview

Slide 42: Database Attacks and Vulnerabilities Overview
Slide 43 / 59

Database Vulnerabilities

Slide 43: Database Vulnerabilities
Slide 44 / 59

Database Vulnerabilities (cont.)

Slide 44: Database Vulnerabilities (cont.)
Slide 45 / 59

Database Vulnerabilities (cont.)

Slide 45: Database Vulnerabilities (cont.)
Slide 46 / 59

Database Attacks

Slide 46: Database Attacks

Notes

  1. SQL injection: user input changes the query (' OR 1=1 --). Defense: parameterized queries, input validation, least privilege.

  2. Memory trick ' OR '1'='1 makes the WHERE clause always true.

Exam angle

PredictionQ1

The best defense against SQL injection is:

Slide 47 / 59

Database Attacks (cont.)

Slide 47: Database Attacks (cont.)
Slide 48 / 59

Impact of Database Attacks

Slide 48: Impact of Database Attacks
Slide 49 / 59

Locating Databases on the Network

Slide 49: Locating Databases on the Network

Notes

  1. Locate databases with port scans: 1433 MS SQL, 3306 MySQL, 1521 Oracle, 5432 PostgreSQL.

Slide 50 / 59

Network Database Scanner

Slide 50: Network Database Scanner
Slide 51 / 59

Database Server Password Cracking

Slide 51: Database Server Password Cracking
Slide 52 / 59

Locating Vulnerabilities in Databases

Slide 52: Locating Vulnerabilities in Databases
Slide 53 / 59

Out of Sight, Out of Mind

Slide 53: Out of Sight, Out of Mind
Slide 54 / 59

Web Server Penetration Testing

Slide 54: Web Server Penetration Testing
Slide 55 / 59

Slide 55

Slide 55: Slide 55
Slide 56 / 59

Slide 56

Slide 56: Slide 56
Slide 57 / 59

Slide 57

Slide 57: Slide 57
Slide 58 / 59

Slide 58

Slide 58: Slide 58
Slide 59 / 59

Summary

Slide 59: Summary