Table Of ContentHackNote/ HackNotes Web Security Portable Reference / Shema / 2227842 /
Color profile: Generic CMYK printer profile
Composite Default screen blind folio i
H A C K N O T E S
™
Web Security
Portable Reference
P:\010Comp\HackNote\784-2\FM.vp
Friday, June 06, 2003 1:09:47 PM
HackNote/ HackNotes Web Security Portable Reference / Shema / 2227842 /
Color profile: Generic CMYK printer profile
Composite Default screen blind folio ii
This page intentionally left blank
P:\010Comp\HackNote\784-2\FM.vp
Friday, June 06, 2003 1:09:47 PM
HackNote/ HackNotes Web Security Portable Reference / Shema / 2227842 /
Color profile: Generic CMYK printer profile
Composite Default screen blind folio iii
H A C K N O T E S
™
Web Security
Portable Reference
MIKE SHEMA
McGraw-Hill/Osborne
New York Chicago San Francisco
Lisbon London Madrid Mexico City Milan
New Delhi San Juan Seoul Singapore Sydney Toronto
P:\010Comp\HackNote\784-2\FM.vp
Friday, June 06, 2003 1:09:47 PM
Color profile: Generic CMYK printerH apcrokfNiolete/ HackNotes Web Security Portable Reference / Shema / 2227842 /
Composite Default screen blind folio1
McGraw-Hill/Osborne
2100 Powell Street, 10thFloor
Emeryville, California 94608
U.S.A.
Toarrangebulkpurchasediscountsforsalespromotions,premiums,orfund-
raisers,pleasecontactMcGraw-Hill/Osborneattheaboveaddress.Forinforma-
tionontranslationsorbookdistributorsoutsidetheU.S.A.,pleaseseetheInterna-
tionalContactInformationpageimmediatelyfollowingtheindexofthisbook.
HackNotesTMWeb Security Portable Reference
Copyright©2003byTheMcGraw-HillCompanies.Allrightsreserved.Printed
intheUnitedStatesofAmerica.ExceptaspermittedundertheCopyrightActof
1976,nopartofthispublicationmaybereproducedordistributedinanyform
orbyanymeans,orstoredinadatabaseorretrievalsystem,withouttheprior
writtenpermissionofpublisher,withtheexceptionthattheprogramlistings
maybeentered,stored,andexecutedinacomputersystem,buttheymaynotbe
reproduced for publication.
234567890 DOC DOC 019876543
ISBN 0-07-222784-2
Publisher Proofreaders
Brandon A. Nordin Marian Selig
Vice President & Associate Publisher Susie Elkind
Scott Rogers Indexer
Editorial Director Claire Splan
Tracy Dunkelberger Computer Designers
Executive Editor Carie Abrew
Jane K. Brownlow Dick Schwartz
Acquisitions Coordinator Illustrators
Athena Honore Melinda Moore Lytle
Project Editor Kathleen Fay Edwards
Mark Karmendy Lyssa Wald
Technical Editor Series Design
Yen-Ming Chen Dick Schwartz
Copy Editor Peter F. Hancik
Claire Splan Cover Series Design
Dodie Shoemaker
This book was composed with Corel VENTURA™ Publisher.
InformationhasbeenobtainedbyOsborne/McGraw-HillandtheAuthorsfromsourcesbelievedtobe
reliable. However, because of the possibility of human or mechanical error by our sources, Osborne/
McGraw-Hill,theAuthors,orothers,Osborne/McGraw-HillandtheAuthorsdonotguaranteetheaccuracy,
adequacyorcompletenessofanyinformationandisnotresponsibleforanyerrorsoromissionsortheresults
obtained from use of such information.
P:\010Comp\HackNote\784-2 (reprint)\784-2\FM.vp
Wednesday, July 30, 2003 12:05:20 PM
HackNote/ HackNotes Web Security Portable Reference / Shema / 2227842 /
Color profile: Generic CMYK printer profile blind folio1
Composite Default screen
About the Author
Mike Shema
MikeShemaistheDirectorofResearchandDevelopmentatNTObjec-
tiveswhereheisworkingonautomatingandadvancingwebapplication
assessmenttechniques.Hepreviouslyworkedasaprincipleconsultant
and trainer for Foundstone. He has performed security tests ranging
fromnetworkpenetrationstofirewallandVPNreviewstoWebappli-
cation reviews. Mr. Shema is intimately familiar with current security
tools, vulnerabilities, and trends. Mr. Shema has also discovered and
submittedtoBuqtraqseveralzero-dayexploitsasaresultofhisexten-
sive experience with Web application testing.
PriortojoiningFoundstoneMr.Shemaworkedataproductdevelop-
ment company where he configured and deployed high-capacity
ApacheWebandOracledatabaseserversfornumerousInternetclients.
Mr.ShemapreviouslyworkedatBooz,Allen&Hamiltonaspartofthe
NationalSecurityTeamandperformedseveralsecurityassessmentsfor
governmentandmilitarysitesinadditiontodevelopingsecuritytrain-
ing material.
Mr.ShemaholdsaB.S.inElectricalEngineeringandaB.S.inFrench
fromPennStateUniversity.Mr.Shemaalsowasatechnicalreviewerfor
McGrawHill/Osborne’sIncidentResponse:InvestigatingComputerCrime.
About the Technical Editor
Yen-Ming Chen,Managing Director of Asia
Yen-Mingspecializesinwirelessnetworksecurity,webapplicationas-
sessment, product review, intrusion detection, and penetration tests.
Withmorethansixyears’experienceinsystemadministrationandIT
security,Yen-MinghasextensiveknowledgeintheareaofWebapplica-
tion,wirelessnetworking,cryptography,intrusiondetection,andsur-
vivability. His articles have been published in SysAdmin, UnixReview,
DevX, PCWeek, and other technology-related magazines in USA and
Taiwan.HeisaleadinstructorforUltimateHackingclassesandhehas
beenspeakingforMISTIandGlobalKnowledge.Heisalsoacontribut-
ingauthorforHackingExposed,3rded.,HackingExposedforWebApplica-
tion, and Windows XP Professional Security. Yen-Ming holds a B.S. in
Mathematics from the National Central University in Taiwan and an
M.S.inInformationNetworkingfromCarnegieMellonUniversity.He
also holds several professional certificates including CISSP and MCSE.
P:\010Comp\HackNote\784-2 (reprint)\784-2\FM.vp
Wednesday, July 30, 2003 12:05:50 PM
Color profile: Generic CMYK printerH apcrokfNiolete/ HackNotes Web Security Portable Reference / Shema / 2227842 /
Composite Default screen blind folio1
For Tera,
who really likes
the RenFaire idea.
P:\010Comp\HackNote\784-2\FM.vp
Friday, June 06, 2003 1:09:47 PM
HackNote/ HackNotes Web Security Portable Reference / Shema / 2227842 /
Color profile: Generic CMYK printer profile
Composite Default screen
AT A GLANCE
Reference Center . . . . . . . . . . . . . . . . . . . . . . . . . . . RC1
Part I Hacking Techniques & Defenses
■ 1 Web Hacking & Penetration Methodologies . . . 3
■ 2 Critical Hacks & Defenses . . . . . . . . . . . . . . . . . . . 23
Part II Host Assessment & Hardening
■ 3 Platform Assessment Methodology . . . . . . . . . . 75
■ 4 Assessment & Hardening Checklists . . . . . . . . . 99
Part III Special Topics
■ 5 Web Server Security & Analysis . . . . . . . . . . . . . 121
■ 6 Secure Coding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139
■ A 7-Bit ASCII Reference . . . . . . . . . . . . . . . . . . . . . . 151
■ B Web Application Scapegoat . . . . . . . . . . . . . . . . . 159
vii
P:\010Comp\HackNote\784-2\FM.vp
Friday, June 06, 2003 1:09:48 PM
Color profile: Generic CMYK printerH apcrokfNiolete/ HackNotes Web Security Portable Reference / Shema / 2227842 /
Composite Default screen blind folio1
This page intentionally left blank
P:\010Comp\HackNote\784-2\FM.vp
Friday, June 06, 2003 1:09:48 PM
HackNote/ HackNotes Web Security Portable Reference / Shema / 2227842 /
Color profile: Generic CMYK printer profile
Composite Default screen
CONTENTS
Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiii
Hacknotes: The Series . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xv
Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xix
Reference Center
Application Assessment Methodology Checklist . . RC2
HTTP Protocol Notes . . . . . . . . . . . . . . . . . . . . . . . . . . RC10
Input Validation Tests . . . . . . . . . . . . . . . . . . . . . . . . . RC13
Common Web-Related Ports and Applications . . . . RC16
Quick-Reference Command Techniques . . . . . . . . . . RC18
Application Default Accounts and
Configuration Files . . . . . . . . . . . . . . . . . . . . . . . . . RC21
“Wargling” Search Terms . . . . . . . . . . . . . . . . . . . . . . RC22
IIS Metabase Settings and Recommendations . . . . . RC23
Online References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . RC28
Useful Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . RC30
Part I
Hacking Techniques & Defenses
■ 1 Web Hacking & Penetration Methodologies . . . . . . . . . . . . . . 3
Threats and Vulnerabilities . . . . . . . . . . . . . . . . . . . . . . 4
Profiling the Platform . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Profiling the Application . . . . . . . . . . . . . . . . . . . . . . . . 9
Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
■ 2 Critical Hacks & Defenses . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Generic Input Validation . . . . . . . . . . . . . . . . . . . . . . . . 25
Common Vectors . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Source Disclosure . . . . . . . . . . . . . . . . . . . . . . . . . 28
ix
P:\010Comp\HackNote\784-2\FM.vp
Friday, June 06, 2003 1:09:48 PM
