[번역/정리] thick-client-penetration-testing

http://blog.securelayer7.net/thick-client-penetration-testing-1/

 

서버와 통신할때 프록시 매핑에 대한 해결책

hostname 존재시 hostfile을 변경하여 127.0.0.1 루프백으로 매핑하여 사용할 수 있음

1. ping과 wireshark를 사용하여 URL에 해당하는 서버의 IP주소와 사용되는 포트 확인
2. hostname 파일에 서버 URL을 루프백으로 추가 / 127.0.0.1 "서버의URL"
3. burp Proxy Listener에 루프백 설정 + 1에서 확인한 사용되는 모든 포트 추가
4. support invisible proxy 체크 / 기본 프록시가 아닌 웹 서버 인터페이스로 애뮬레이트 하기 위한 설정임
5. 해피 해킹!

http://blog.securelayer7.net/thick-client-penetration-testing-2-traffic-analysis/

Detailed Traffic Analysis for Thick Client Penetration Testing - Part 2 - SecureLayer7

 

 

hostname이 존재하지 않는다면 hostfile을 조작한 매핑이 불가함
실제 서버의 IP를 부여하여 루프백 역할을 할 머신1과 게이트웨이 역할을 하는 머신2가 필요함

Prerequisites:

1. Two machines residing in the same network ,both having Burp Suite tool running
2. One machine (the testing machine) should have Microsoft Loopback Adapter configured.
3. The second machine acts as a gateway that forwards the requests to the internet.

1. 머신1에 테스팅할 app 및 윈도우에서 제공하는 루프백 어댑터를 추가

• Run cmd as Admin.
• Enter “hdwwiz.exe”.
• Welcome to the Add Hardware Wizard”, click Next.
• Install the hardware manually
• Network adapters
• Select “Microsoft” as the Manufacturer and then select the Network Adapter “Microsoft Loopback Adapter” and click Next.

3. 어댑터 추가 후 아래 설정을 통해 클라이언트 앱의 패킷을 머신1의 BURP에서 받게 됨
    캡쳐된 패킷을 실제 IP주소로 전송하기 위해서 머신2가 필요함

• Microsoft Loopback adapter is installed with the TCP/IP address of the actual server ( in our example: 172.32.23.23:891)
• Burp Suite is configured to listen on the Loopback adapters IP address.

• Burp Suite is configured to forward the requests to Machine 2

4. 머신1에서 보내는 자신의 IP 바인딩(머신2)
5. 실제 서버 주소와 포트번호로 requst handling 설정

1. Set up a Burp Suite Listener on the adapter with the IP address xx.xx.xx.x2
2. Configure redirection of  traffic to the actual server ( in our case, the actual ip of the server (172.32.23.23:891)
3. Burp listener on loopback IP moderates the requests for capture
4. Finally the redirect to host configuration forwards those requests to the destination server

6. 해피해킹!

 

 

 

---

아래는 테스트 체크리스트

 

http://blog.securelayer7.net/thickclient-pentesting-part-5/

 

 

What are the security testing methods feasible for Thick Client?

We can break down the different types of pen testing a thick client into:

• Dynamic Testing ( fuzzing, traffic interception, injections)
• System Testing ( checking for logs, data files, registry keys, process threads)
• Static Testing ( reverse engineering, binary analysis )

Dynamic testing generally follows data flow from the client side to server side.

This gives rise to the following test cases:

1. Dynamic test cases:

Input Validation (Fuzzing user input fields)

Here our main goal is to test all the input parameters for different types of attacks which includes:

• SQL injection
• Command injection
• Malicious input acceptance.

SQL injection is one of the prime attacks you can carry onto a thick client’s database. Do note performing thick client sql injection needs patience and is a time consuming task. You need to iterate multiple queries with a mix and match by observing response to each of them.

Some good links for a collection of sqli payloads:

1. https://github.com/fuzzdb-project/fuzzdb/tree/master/attack/sql-injection/payloads-sql-blind
2. http://pentestmonkey.net/cheat-sheet/sql-injection/mysql-sql-injection-cheat-sheet

You can crawl the net for multiple payloads to find the one which is appropriate for the application you are testing.

File Upload

Here our goal is to attempt to upload malicious files which can be injected into the application input request which can lead us to shell upload/ malicious code execution.

Here you can simply check for all the browse buttons and check the file upload logic.

Buffer Overflow

Here our goal is to examine C / C++ programmed thick clients majorly to test the memory functions deployed which will allow us to check how the buffer overflow vulnerabilities and memory violations.

Secure traffic analysis (protocols)

The testing for this case involves checking whether encryption is applied for sensitive data on the wire or not (example: clear text data transmission is a vulnerability)

Business logic validations

This has multiple sub test cases which can involve privilege escalation, price tampering, authorization bypass etc.

Error handling/ Info Leakage

Tester tries in this case to extract verbose error messages which may give information about underlying framework, application code and log details.

Session management

Test cases on session validity/ expiration/ fixation comes under this method.

Forced URL access via browser

Many a times, configuration URLs can be directly connected via the web browser

Log tampering

Most of the applications we test does not validate the timestamp directly accepting the local system time from user, performing malicious transactions via changing the system time leads to inconsistency of the application logs.

1. System Test cases:

Exfiltration of Sensitive data from memory

Many times applications store username passwords. Such information is lethal for compromising the application. There are multiple tools which help us to check the same (A free tool for the same is Winhex)

DLL High-jacking

Test case for this involves:  if the application validates the DLLs used by the application. If by replacing the actual DLLs with malicious file with the same name, this can lead to critical findings in the application.

1. Static Testing:

Analysing Config files

Many a times configuration files of the application reveals URL, Server credentials/ Cryptographic keys/ Hardcoded passwords. Even checking of certain parameters can be easily disabled with a value =yes with = no!

Reverse Engineering

Using reversing tools, executable file/ jar files can be decompiled which can be modified and repackaged.

Here is a list of tools which are commonly used for performing thick client pentesting:

Interception proxies:

• Burp Suite
• Fiddler
• Echo Mirage
• Charles
• Mallory
• JavaSnoop

Traffic Analysis:

• TCPDump
• Wireshark

Static Analysis:

• System Internals ( Process Monitor, Regedit, Regshot, AccessEnum)
• CFF Explorer

Decompilers:

• Java Byte Code Editor
• JD GUI
• Ollydbg

Packed executable checking tools:

• PE Explorer
• PEid
• UPX Decompression
• .Net Reflector
• IL Spy

Memory Analysis:

• Winhex
• Volatility
• Tsearch ( find and replace strings in memory)
• Userdump

Exploitation:

• Metasploit ( used for side loading/ DLL and Exe injection)

Key points:

That’s all readers for now. This article gave you a brief idea of how to go about testing an application.

In upcoming articles we will cover the following yet not limited to topics:

1. Intercepting thick client applications and tampering request/ response
2. Reverse engineering jar/ exe files
3. DLL Hijacking
4. Memory forensics
5. Deserialization of traffic analysis of java thick clients