1 of 16

Using Developer Tools

Laurie Williams

laurie_williams@ncsu.edu

2 of 16

Just signed up for this class?

When we are working … please come up and we can get you set up in Piazza and TopHat

Revisiting course website

Course content will NOT be in Moodle.

3 of 16

OWASP Juice Shop

OWASP = Open Web Application Security Project, an organization supporting the development of secure open source software, made up primarily of volunteers�
Juice Shop is writing in Node.js, Express and Angular�
“OWASP Juice Shop is probably the most modern and sophisticated insecure web application!”

Juice Shop can be used in “security trainings, awareness demos, CTFs and as a guinea pig for security tools”

4 of 16

TODO

Install JuiceShop.

You have several different options to install the web application:
https://github.com/juice-shop/juice-shop#setup
https://pwning.owasp-juice.shop/companion-guide/latest/part1/running.html
We highly recommend using the Docker image … see next slide for instructions.

Juice Shop will be at http://localhost:3000/#/

5 of 16

Juice Shop and Docker

Installation steps (HIGHLY recommended)

Install Docker from the website.
Run the following command from the terminal to pull juice-shop

docker pull bkimminich/juice-shop

Run docker run --rm -p 3000:3000 bkimminich/juice-shop
Browse to http://localhost:3000⁠ (on macOS and Windows browse to http://192.168.99.100:3000⁠ if you are using docker-machine instead of the native docker installation)

Troubleshooting Installation:

If you get a 403 Forbidden. Make sure you are logged into Docker and working as administrator.
If you are using Windows, try PowerShell.

6 of 16

OWASP Webgoat

Deliberately insecure application that allows interested developers to test vulnerabilities
Java-based applications that uses common and popular open source components.

7 of 16

TODO

Install Webgoat via Docker

docker pull webgoat/webgoat
docker run -p 127.0.0.1:8080:8080 -p 127.0.0.1:9090:9090 -e TZ=Europe/Amsterdam webgoat/webgoat

WebGoat will be located at: http://127.0.0.1:8080/WebGoat�
Webgoat lessons https://owasp.org/www-project-webgoat/

8 of 16

Software Security Ethics

Do not perform attacks on production applications without the permission of the organization or person who owns the website.

Doing so can have serious legal consequences.��

In this class, you only have permission to attack your local installations (such as of Juice Shop and OpenEMR)

9 of 16

HTTP Requests: GET vs POST

GET:

Requests data from a specified resource; form data sent as part of the URL

GET requests can be cached
GET requests remain in the browser history
GET requests can be bookmarked
GET requests should never be used when dealing with sensitive data
GET requests have length restrictions
GET requests should be used only to retrieve data

POST:

form data sent within message body

POST requests are never cached
POST requests do not remain in the browser history
POST requests cannot be bookmarked
POST requests have no restrictions on data length

http://www.w3schools.com/tags/ref_httpmethods.asp

10 of 16

URL Manipulation

There are two reasons why a parameter should not in the URL

The parameter is one the user should not be able to set the value of.
The parameter is one the user should not be able to see the value of.

See URL manipulation: http://www.cgisecurity.com/owasp/html/ch11s04.html#id2863856

Here is an example of using the GET method. The data for mid (or medical ID) is included as part of the URL. Having a medical id as part of the URL is bad for two reasons. First, we can envision that someone’s medical id is probably a sensitive number that we don’t want shared on a screen. Imagine that this is a system where a doctor selects a patient by name and now that person’s medical id is shown in plain text on the screen for a casual observer to see … such as janitor sweeping the floor near the doctor’s computer. The other problem with having the medical id as part of the URL is that is may be possible to just go up to a URL and type a different number and get easy access to a different record … possibly a different record the user should not otherwise have authority to see. Or, such a parameter as part of the URL may allow the user to “shop around” … just type different numbers and see whose records they could see. A friend once told me he had a baby and was logged into a website related to babies. Indeed, he could play with the userid in the URL and see information related to other babies. And, a student who took this class realized that his bank had the userid in the URL and he was able to have access to others banking records by manipulating the URL.

Sometimes the URL could have data such as quantity or price in the URL … to continue the example from two slides ago. I heard a talk by a security expert who talked about the time he chose a hotel because it advertised free internet. He was dismayed when he got to the hotel and they were asking for $9.99 for internet. He reluctantly agreed to pay $9.99 and clicked on the link, but realized the URL had the price ($9.99) and he was able to change the price to $0.00. He did just that … and then called technical support and told them what he was able to do, and offered his consulting services to help them solve their problem!

So the bottom line is … don’t use GET unless you don’t care if the user changes the value provided in the URL … it’s hard to imagine a useful case when you would not care if the user changed the value of your parameter, but maybe there is a case.

11 of 16

Hidden Variables

<input name=“MID" type="hidden" value=“90000000001">
<input name="masteraccess" type="hidden" value=“Y">

However, a malicious user can save the page; obtain and/or change the MID or masteraccess; and reload the page in his/her browser.

12 of 16

HTML is always editable!

13 of 16

Limited value of GUI controls on user input …

14 of 16

With client side validation only, you can do this …

15 of 16

What can be done with Browser Developer Tools?

Console

Scripting
Send commands

Sources

Set breakpoint

Network

Show actual network request�with payload

Application

See/set values

16 of 16

Use Developer Tools

https://www.youtube.com/watch?v=5mUUBkxayQ4

In pairs or threes:

Go to Juice Shop or Webgoat�
View source
Open up Developer Tools (preference for Chrome if you have it installed)

Look around the console, sources, network tabs as you play around

Play around with URL Manipulation
Try out changing the value of a cookie, local storage, etc.
Fetch and replay a query with different values
Can you find any table or field names by seeing SQL queries?
Share with the class when you can find something!