Section 4: Mitigating the WebGoat lessons - Revision history

Stephen Evans: /* Concurrent file access */

2008-11-16T09:38:31Z

‎Concurrent file access

Stephen Evans: /* Lua security in ModSecurity */

2008-11-16T09:38:09Z

‎Lua security in ModSecurity

Stephen Evans at 09:36, 16 November 2008

2008-11-16T09:36:50Z

Stephen Evans at 09:31, 16 November 2008

2008-11-16T09:31:59Z

Stephen Evans at 09:27, 16 November 2008

2008-11-16T09:27:52Z

Stephen Evans: /* Unfinished business */ add content

2008-11-16T09:20:54Z

‎Unfinished business: add content

Show changes

Stephen Evans: added sec tion 'unfinished business

2008-11-16T09:02:03Z

added sec tion 'unfinished business

Stephen Evans: /* The mitigating solutions */

2008-11-13T09:33:27Z

‎The mitigating solutions

Stephen Evans: typos

2008-11-13T09:00:07Z

typos

Stephen Evans: /* Using the Lua scripting language */

2008-11-13T08:58:32Z

‎Using the Lua scripting language

← Older revision		Revision as of 09:38, 16 November 2008
Line 120:		Line 120:

	NEWBIE Question: LUA wait() function?		NEWBIE Question: LUA wait() function?
		+
	http://lua-users.org/lists/lua-l/2008-03/msg00209.html		http://lua-users.org/lists/lua-l/2008-03/msg00209.html

@@ Line 145: / Line 145: @@
 >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
 Security using Lua in ModSecurity is presented here as an opening discussion; anybody who wants to add to this section or have any other comments can email me at stephencraig_dot_evans_at_gmail_dot_com.
@@ Line 358: / Line 359: @@
 Re: Loose sandbox***: http://lua-users.org/lists/lua-l/2008-07/msg00406.html
 === Overall strategy ===

@@ Line 9: / Line 9: @@
 * 17.1  Create a SOAP Request
-Therefore there is a total number of 47 lessons to do; half is 24 so that was the goal of the first 50% of project completion. The lowest hanging fruit was taken first because considerable effort was put into: (1) setup and configuration of the environment; (2) getting familiar with WebGoat and taking all of the lessons; (3) learning ModSecurity (and Remo); (4) re-learning regular expressions; (5) learning Lua script; and (6) developing an efficient work methodology.
+Therefore there is a total number of 47 lessons to do; half is 24 so that was the goal of the first 50% of project completion. The lowest hanging fruit was taken first because considerable effort wasput into: (1) setup and configuration of the environment; (2) getting familiar with WebGoat and taking all of the lessons; (3) learning ModSecurity (and Remo); (4) re-learning regular expressions; (5) learning Lua script; and (6) developing an efficient work methodology.
 The total number of sublessons mitigated by ModSecurity rules: 25 - thereby achieving the goal of at least 50% of sublessons mitigated.
@@ Line 106: / Line 106: @@
 * 17. Web Services -> 17.2 WSDL Scanning
 === Unfinished business ===
@@ Line 335: / Line 337: @@
 <font><u>References</u></font>
-Lua script as data model (Lua security)
+Lua script as data model (Lua security): http://lua-users.org/lists/lua-l/2008-09/msg00399.html
-Re: Lua script as data model (Denial of Service)
+Re: Lua script as data model (Denial of Service): http://lua-users.org/lists/lua-l/2008-09/msg00408.html
-Re: function calls without brackets
+Re: function calls without brackets: http://lua-users.org/lists/lua-l/2008-06/msg00067.html
-Re: Execute a function
+Re: Execute a function: http://lua-users.org/lists/lua-l/2008-08/msg00291.html; http://lua-users.org/lists/lua-l/2008-08/msg00294.html
-Indirect call to function and passing arguments
+Indirect call to function and passing arguments: http://lua-users.org/lists/lua-l/2008-07/msg00267.html
-Secure tables in Lua?
+Secure tables in Lua?: http://lua-users.org/lists/lua-l/2008-07/msg00007.html
-Secure tables in Lua: Summary
+Secure tables in Lua: Summary: http://lua-users.org/lists/lua-l/2008-07/msg00065.html
-Sandboxing techniques
+Sandboxing techniques: http://lua-users.org/wiki/SandBoxes
-Sandboxing user code in Lua
+Sandboxing user code in Lua: http://lua-users.org/lists/lua-l/2008-07/msg00344.html
-Sandbox in Lua 5.1
+Sandbox in Lua 5.1: http://lua-users.org/lists/lua-l/2008-05/msg00812.html
-Re: Loose sandbox ***
+Re: Loose sandbox***: http://lua-users.org/lists/lua-l/2008-07/msg00406.html

@@ Line 111: / Line 111: @@
 The following topics need to be addressed in order to use the content of this project in a real world situation.
-==== Concurrent file access ====
+====     Concurrent file access ====
 In the real world, a file locking mechanism will need to be implemented for any solution that uses Lua persistence and writes data to a file. The implemention should be easy; something like the Unix file.lock mechanism: check for the lock file before opening and writing; if it doesn't exist, then create the lock and then delete when finished. For the rare occurrence that a requested file is in use, return an error message to the user saying "please try again", or implement a 'sleep' or 'wait' capability in Lua.
@@ Line 120: / Line 120: @@
 http://lua-users.org/lists/lua-l/2008-03/msg00209.html
-==== Lua security in ModSecurity ====
+====     Lua security in ModSecurity ====
 This section was created after project completion in response to 2 reviewer comments:
@@ Line 141: / Line 141: @@
 ) As previously commented, I am terrified with your usage of dofile(), coupled with dynamically-generated code based on external data. In fact, there may be a vulnerability or two in your code. Even if there isn't, the point is that we, security professionals, should be leading the way by using foolproof techniques. We mustn't rely on things that are so easy to do wrong.
 >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
 Security using Lua in ModSecurity is presented here as an opening discussion; anybody who wants to add to this section or have any other comments can email me at stephencraig_dot_evans_at_gmail_dot_com.
 <font><u>How this project uses Lua</u></font>
@@ Line 150: / Line 152: @@
 Inside of a Lua script, "Lua persistence" is used to read and write data to ModSecurity's SecDataDir (for this project it is '/etc/modsecurity/data'). Some of the data is for configuration such as the number of password retries. Another case is to record information culled from an HTTP response, then later compare that with user input in an HTTP POST request.
 <font><u>The Lua 'dofile()' function</u></font>
@@ Line 200: / Line 203: @@
 See Sublesson '4. Authentication Flaws -> 4.2 Forgot Password' for a more complicated use of 'dofile'.
 <font><u>Research sources for this section</u></font>
@@ Line 212: / Line 216: @@
 . Malicious user data
 <font><u>The Lua engine</u></font>
 There have been vulnerabilities in the C code that comprises Lua, e.g. buffer overflows which have caused Denial of Service but no known vulnerabilities that have allowed code execution. Of course, that doesn't mean that there is no possibility of it, plus there is no known "seal of approval" on the Lua engine. However, in the context of Lua in ModSecurity, full compromise would be restricted to the damage that can be done with the permission levels of the Apache process on Linux; on Windows it could be much worse.
 <font><u>Affecting the return value of the Lua script</u></font>
@@ Line 222: / Line 228: @@
 It must be taken into consideration that for this to occur, an attacker will already have write access to the SecDataDir with the privileges of the Apache process, and perhaps other important directories and files on the file system.
 <font><u>Malicous user data</u></font>
@@ Line 265: / Line 272: @@
 tempvar = reward
 </pre>
 <font><u>Execution of scripts and programs by Apache</u></font>
@@ Line 279: / Line 287: @@
 This can be tested by writing a malicious Lua script in a stand-alone environment, then including it in a variable that has been written to file. Then load the variable in a Lua script called by a ModSecurity rule and see if the malicious Lua script executes.
 <font><u>Potential secure Lua coding options</u></font>
@@ Line 310: / Line 319: @@
 require=nil
 loadstring = nil 	-- this one added is added for the project
-<pre>
+</pre>
 . Deploy other solutions such as sandboxing (see References below).
 <font><u>Conclusion</u></font>
@@ Line 321: / Line 331: @@
 To look on the bright side - the silver lining of the cloud - if Metasploit starts releasing exploits for Lua script in ModSecurity, then we've made it!
 <font><u>References</u></font>
@@ Line 357: / Line 368: @@
 Re: Loose sandbox ***
 http://lua-users.org/lists/lua-l/2008-07/msg00406.html
 === Overall strategy ===

@@ Line 124: / Line 124: @@
 This section was created after project completion in response to 2 reviewer comments:
-"""""""""""""""""""""""""""
+<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
 (1) I am pretty sure your Lua code is vulnerable to (Lua) Injection.
@@ Line 140: / Line 141: @@
 ) As previously commented, I am terrified with your usage of dofile(), coupled with dynamically-generated code based on external data. In fact, there may be a vulnerability or two in your code. Even if there isn't, the point is that we, security professionals, should be leading the way by using foolproof techniques. We mustn't rely on things that are so easy to do wrong.
-"""""""""""""""""""
+>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
 Security using Lua in ModSecurity is presented here as an opening discussion; anybody who wants to add to this section or have any other comments can email me at stephencraig_dot_evans_at_gmail_dot_com.

← Older revision		Revision as of 09:02, 16 November 2008
Line 106:		Line 106:

	* 17. Web Services -> 17.2 WSDL Scanning		* 17. Web Services -> 17.2 WSDL Scanning
		+
		+	=== Unfinished business ===
		+
		+	The following topics need to be addressed in order to use the content of this project in a real world situation.
		+
		+	==== Concurrent file access ====
		+
		+	In the real world, a file locking mechanism will need to be implemented for any solution that uses Lua persistence and writes data to a file. The implemention should be easy; something like the Unix file.lock mechanism: check for the lock file before opening and writing; if it doesn't exist, then create the lock and then delete when finished. For the rare occurrence that a requested file is in use, return an error message to the user saying "please try again", or implement a 'sleep' or 'wait' capability in Lua.
		+
		+	See this thread for more information on a Lua 'wait' function:
		+
		+	NEWBIE Question: LUA wait() function?
		+	http://lua-users.org/lists/lua-l/2008-03/msg00209.html

@@ Line 260: / Line 260: @@
 Two asterisks (**) next to a sublesson denotes that it has not been solved but there are suggestions to solve it.
-Four asterisks (****) next to a sublesson indicates that there is no solution and no suggestion for it.
+Four asterisks (****) next to a sublesson indicates that there is no solution and the reason.
 # [http://www.owasp.org/index.php/OWASP_ModSecurity_Securing_WebGoat_Section4_Sublesson_01.1 Sublesson 1.1: HTTP Basics]

@@ Line 232: / Line 232: @@
 The Implementation section of each sublesson explains in detail how Lua script is used.
-=== Using Javascript 'prepend' and 'append' ===
+=== Using JavaScript 'prepend' and 'append' ===
-The Javascript 'prepend' and 'append' ModSecurity actions and their applications are shown in sublessons:
+The JavaScript 'prepend' and 'append' ModSecurity actions and their applications are shown in sublessons:
 * 3. AJAX Security -> 3.1 LAB: DOM-Based cross-site scripting
 * 3. AJAX Security -> 3.7 Silent Transactions Attacks

@@ Line 190: / Line 190: @@
 === Using the Lua scripting language ===
-In some situations, ModSecurity's capability is not robust and flexible enough to prevent complex exploits. Enter Lua script, a tried-and-true programming language used mainly in the gaming industry but also used in other areas such as Nmap and the MySQL Proxy project.
+In some situations, the ModSecurity Rule Language is not flexible enough to prevent complex exploits. Enter Lua script, a tried-and-true programming language used mainly in the gaming industry but also used in other areas such as Nmap and the MySQL Proxy project.
 Some advantages are:
@@ Line 228: / Line 228: @@
 * 12. Insecure Communication -> 12.1 Insecure Login
-: Shows: (1) using Javascript injection that adds an MD5 library on the front end in order to hash a password before being sent; (2) rebuilding the Lua engine and including a 3rd party MD5 library; and (3) hashing the expected password within a Lua script and comparing it with the client side password.
+: Shows: (1) using JavaScript injection that adds an MD5 library on the front end in order to hash a password before being sent; (2) rebuilding the Lua engine and including a 3rd party MD5 library; and (3) hashing the expected password within a Lua script and comparing it with the client side password.
 The Implementation section of each sublesson explains in detail how Lua script is used.