90 likes | 193 Views
Automating Exploits for Web Applications. Ft Smith 2600 August 2007. Web Apps. Examples Forums Google Maps just about anything ”Web 2.0”. Web Apps. most apps need information from you Example address for directions an email address registration info for a purchase. Tools. *nix
E N D
Automating Exploits for Web Applications • Ft Smith 2600 • August 2007
Web Apps • Examples • Forums • Google Maps • just about anything ”Web 2.0”
Web Apps • most apps need information from you • Example • address for directions • an email address • registration info for a purchase
Tools • *nix • Curl http://curl.haxx.se/ • Libcurl http://curl.haxx.se/libcurl/ • lynx -dump (whereever you get lynx) • Windows • Curl • Really Bored • don't automate. do it by hand
Web Apps • This is an example of an application that accepts input from a user
Web Apps • What is normally sent using curlip.sh
Web Apps • what could be sent using a malicious script
Why bother? • Fuzzing • testing parameters with seemingly valid data until it breaks • Denial of Service • take up all available usernames on a website • Code injection • see what, if any, code is deemed valid
Other sort of related materials • curlip.tgz • utility I wrote when learning about curl • posts your external ip address to http://shyft.us/ip.php • sort of a poor man's dyndns • whatsmyip.pl • utility for windows to retrieve your external ip written in perl • again by me • either of these could easily be used to pull down every forum post or post arbitrary data to a server