OWASP WS Amplification DoS Project - Revision history

Kait Disney-Leugers at 21:25, 9 May 2014

2014-05-09T21:25:40Z

Thomas Vissers at 16:15, 4 June 2013

2013-06-04T16:15:55Z

Thomas Vissers at 14:34, 2 June 2013

2013-06-02T14:34:55Z

Thomas Vissers at 14:33, 2 June 2013

2013-06-02T14:33:05Z

Thomas Vissers at 14:30, 2 June 2013

2013-06-02T14:30:44Z

Samantha Groves: Created page with "=Main= Project Leader’s content goes here =Project About= {{:Projects/OWASP_WS_Amplification_DoS_Project}} Category:OWASP Project"

2013-05-21T21:57:50Z

Created page with "=Main= Project Leader’s content goes here =Project About= {{:Projects/OWASP_WS_Amplification_DoS_Project}} Category:OWASP Project"

New page

=Main=
Project Leader’s content goes here

=Project About=
{{:Projects/OWASP_WS_Amplification_DoS_Project}}

[[Category:OWASP Project]]

← Older revision		Revision as of 21:25, 9 May 2014
Line 1:		Line 1:
		+	{\|
		+	\|-
		+	! width="700" align="center" \| <br>
		+	! width="500" align="center" \| <br>
		+	\|-
		+	\| align="right" \| [[Image:OWASP Inactive Banner.jpg\|800px\| link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Inactive_Projects]]
		+	\| align="right" \|
		+
		+	\|}
	=Main=		=Main=
	Currently, DNS servers are widely misused to amplify DoS traffic. This is called a [http://blog.cloudflare.com/deep-inside-a-dns-amplification-ddos-attack DNS Amplification or Reflective attack].		Currently, DNS servers are widely misused to amplify DoS traffic. This is called a [http://blog.cloudflare.com/deep-inside-a-dns-amplification-ddos-attack DNS Amplification or Reflective attack].

@@ Line 3: / Line 3: @@
 It appears that SOAP webservices that implement WS-Addressing might be vulnerable to similar abuse, as stated in this [http://www.fim.uni-passau.de/fileadmin/files/lehrstuhl/meer/publications/pdf/Jensen2009a.pdf paper]
 The aim of the project is to investigate web service frameworks and develop tools to test this vulnerability and determine the threat magnitude on a global scale.
 ==WS-Addressing default behaviours==
-In order to get a grasp of the magnitude of this threat, it is necessary to be aware of the default configurations in the existing web service frameworks. So far, Axis2 and JAX-WS (Metro) have been confirmed to enable it without the user specifying the need for it. Potentially creating a lot of web services that are unnecessarily prone to abuse.
+In order to get a grasp of the magnitude of this threat, it is also necessary to be aware of the default behaviour and settings in the existing web service frameworks. So far, Axis2 and JAX-WS (Metro) have been confirmed to enable it without the user specifying the need for it. Potentially creating a lot of web services that are unnecessarily prone to abuse.
-===Axis2===
+====Axis2====
 Axis2 enables WS-Addressing by default, as stated [http://axis.apache.org/axis2/java/core/modules/addressing/ here]
-===CXF===
+====CXF====
 CXF supports WS-Addressing, but [http://cxf.apache.org/docs/ws-addressing.html explicit configuration] is required to enable it.
-===JAX-WS & Metro===
+====JAX-WS & Metro====
 Metro is based on the JAX-WS API. The [https://metro.java.net/1.4/docs/wsaddressing.html documentation] says "In Metro, if WS-Addressing is explicitly disabled then the RI does not follow the rules of engagement. However if WS-Addressing is either implicitly or explicitly enabled then Metro engages WS-Addressing based upon the presence of wsa:Action header. "
-===.NET Framework===
+====.NET Framework====
-.NET/WCF supports WS-Addressing, but the default behaviour on a RepyTo field is unclear. More information is welcome!
+.NET/WCF supports WS-Addressing, but the default behaviour on a RepyTo field is unclear.
 =Project About=
 {{:Projects/OWASP_WS_Amplification_DoS_Project}}
 [[Category:OWASP Project]]

@@ Line 2: / Line 2: @@
 Currently, DNS servers are widely misused to amplify DoS traffic. This is called a [http://blog.cloudflare.com/deep-inside-a-dns-amplification-ddos-attack DNS Amplification or Reflective attack].
 It appears that SOAP webservices that implement WS-Addressing might be vulnerable to similar abuse, as stated in this [http://www.fim.uni-passau.de/fileadmin/files/lehrstuhl/meer/publications/pdf/Jensen2009a.pdf paper]
-The aim of the project is to develop tools to test this vulnerability and determine the threat magnitude on a global scale.
+The aim of the project is to investigate web service frameworks and develop tools to test this vulnerability and determine the threat magnitude on a global scale.
-If necessary, a publication involving awareness and countermeasures will follow.
-==WS-Addressing default behaviour==
+==WS-Addressing default behaviours==
 In order to get a grasp of the magnitude of this threat, it is necessary to be aware of the default configurations in the existing web service frameworks. So far, Axis2 and JAX-WS (Metro) have been confirmed to enable it without the user specifying the need for it. Potentially creating a lot of web services that are unnecessarily prone to abuse.
 ===Axis2===

@@ Line 1: / Line 1: @@
 =Main=
-Project Leader’s content goes here
+Currently, DNS servers are widely misused to amplify DoS traffic. This is called a [http://blog.cloudflare.com/deep-inside-a-dns-amplification-ddos-attack DNS Amplification or Reflective attack].
 ==WS-Addressing default behaviour==
 In order to get a grasp of the magnitude of this threat, it is necessary to be aware of the default configurations in the existing web service frameworks. So far, Axis2 and JAX-WS (Metro) have been confirmed to enable it without the user specifying the need for it. Potentially creating a lot of web services that are unnecessarily prone to abuse.