Networking Chapter 10 Odbc Explain How Ole Uses Connection Strings And Providers Connect Different Dbmss

Hands-On Ethical Hacking and Network Defense, Third Edition 10-1

Chapter 10

Hacking Web Servers

At a Glance

Instructor’s Manual Table of Contents

• Overview

• Objectives

• Teaching Tips

• Quick Quizzes

Hands-On Ethical Hacking and Network Defense, Third Edition 10-2

Lecture Notes

Overview

This chapter describes Web applications and their components. Students will learn about Web

applications and their vulnerabilities. The chapter also explores several tools used to attack

Web servers.

Chapter Objectives

After reading this chapter and completing the exercises, the student will be able to:

Teaching Tips

Understanding Web Applications

1. This section will cover several aspects of Web applications such as its components, the

Web Application Components

1. Explain the difference between a static Web page and a dynamic Web page. Static Web

Web Forms

1. Describe the use of Web forms to allow users to send information that can be processed

by Web applications at the Web server.

2. Provide an example of a Web form and explain why using Web forms can produce

security vulnerabilities.

Teaching

Tip

Check out http://www.microsoft.com/technet/security/bulletin/MS00-100.mspx

for an example of a Web form vulnerability.

Hands-On Ethical Hacking and Network Defense, Third Edition 10-3

Common Gateway Interface

1. Explain the Common Gateway Interface (CGI), another standard that handles moving

Third Party Frameworks and Libraries

1. Explain that frameworks are typically called on for a specific purpose and are designed

to make programming easier.

Active Server Pages

1. Explain the differences between HTML Web pages and ASP Web pages. ASP Web

3. Illustrate what an ASP Web page looks like with an example from the book.

Security

Tip

Read https://www.sans.org/reading-room/whitepapers/securecode/security-

checklist-web-application-design-1389 an article about a security checklist for

web application design.

Apache Web Server

Using Scripting Languages

1. Explain that Web pages can be developed with several scripting languages, such as

VBScript and JavaScript. This section explains several scripting languages that can be

Hands-On Ethical Hacking and Network Defense, Third Edition 10-4

PHP Hypertext Processor

1. Describe PHP, an open-source server-side scripting language that allows Web

2. Provide an example of a PHP Web page.

ColdFusion

1. Introduce ColdFusion, a server-side scripting language that allows Web developers to

VBScript

1. Describe VBScript, another scripting language developed by Microsoft. VBScript is

used to convert static Web pages into dynamic Web pages.

2. Provide an example of VBScript code.

Teaching

Tip

Check out http://www.tutorialspoint.com/vbscript/ for a VBScript tutorial.

JavaScript

2. Provide an example of a JavaScript Web page.

Teaching

Tip

Check out http://www.w3schools.com/js/default.asp for a JavaScript tutorial.

Connecting to Databases

1. Explain that most Web pages displaying company information to users are stored on a

database server. This section explains three technologies used to connect databases to

Hands-On Ethical Hacking and Network Defense, Third Edition 10-5

Open Database Connectivity

1. Describe ODBC as a standard database access method developed by the SQL Access

Group.

Object Linking and Embedding Database

2. OLE DB was developed by Microsoft and was designed to be faster, more efficient, and

more stable than its predecessor, ODBC.

ActiveX Data Objects

2. Enumerate the steps used to access a database from a Web page.

a. Create an ADO connection

b. Open the database connection you just created

Quick Quiz 1

1. Which type of Web page displays the same information regardless of the time of day or

the user who activates the page?

2. In order to allow customers to submit information to the Web server, which element is

used in an HTML document?

3. True or False: Many dynamic Web pages are created with CGI and scripting languages.

4. True or False: Apache Web Server cannot run on Microsoft platforms.

5. Which server-side scripting language used to develop dynamic Web pages is now

owned by Adobe Systems?

A. VBScript

B. PHP Hypertext Processor

C. JavaScript

D. ColdFusion

Understanding Web Applications Vulnerabilities

1. Explain that many security professionals pay attention only to network security details

and forget about application security.

2. Enumerate the problems a company may face once an attacker gains control over a Web

server.

a. Deface the Web site

Application Vulnerabilities Countermeasures

1. Introduce the Open Web Application Security Project (OWASP), a not-for-profit

3. Explain the WebGoat project and illustrate some of tests that can be accomplished using

Web Application Test Execution

1. Discuss the two techniques by which an application can be tested:

a. Static Application Security Testing (SAST)

Hands-On Ethical Hacking and Network Defense, Third Edition 10-7

Information Gathering and Architecture Mapping

1. Point out to students some questions that should be considered during this phase:

a. Does the application have a database?

b. Does the application require authentication?

Platform Security and Configuration

Authentication and Session Testing

1. Explain that many Web applications require a server other than the Web server to

authenticate users. In this case, you should examine how authentication information is

Authorization Testing

1. Explain to students that authorization is the act of checking a user’s privileges to

2. Point out that authorization testing can reveal major areas of concern and is an

Input Validation

1. Describe SQL injection as a type of attack where the attacker can pass SQL commands

when asked to fill a Web application form field.

3. Provide some testing recommendations. Basic testing should look for:

a. Whether you can enter text with punctuation marks

Hands-On Ethical Hacking and Network Defense, Third Edition 10-8

Security

Tip

Read a SQL Injection Walkthrough available at

http://www.securiteam.com/securityreviews/5DP0N1P76E.html.

Error Handling

1. Explain that developers should minimize the amount of information shared with

Cryptography Testing

1. Discuss some of the problems that occur in cryptography:

Business Logic Testing

1. Explain that business logic refers to the flow a user is expected to follow in an

Client-Side Testing

1. Discuss client-side issues that arise from code executing on the user’s machine.

Tools of Web Attackers and Security Testers

1. This section describes several Web tools used to attack or test Web applications and

servers.

Web Tools

2. Explain to students that Firefox and Chrome each come with a similar set of developer

3. Introduce students to Burp Suite, which is included in Kali Linux. Explain that it allows

4. Discuss the similarities that Burp Suite has with Zed Attack Proxy, which was described

in Chapter 5.

5. Introduce Wapiti, a Web application vulnerability scanner that uses a black box

approach, meaning it doesn’t inspect code.

Teaching

Tip

Read more about Wapiti at http://wapiti.sourceforge.net/.

6. Describe Wfetch, a GUI testing tool that you can download for free from Microsoft.

This tool queries the status of a Web server and attempts authentication using any of the

following methods:

a. Multiple HTTP methods

b. Configuration of host name and TCP port

c. HTTP 1.0 and HTTP 1.1 support

Quick Quiz 2

1. True or False: No matter how efficient a company’s firewalls or intrusion detection

systems are, most systems ignore the content of HTTP traffic.

2. Which of the following is an open, not-for-profit foundation dedicated to finding and

fighting the causes of software vulnerabilities?

A. DSS

B. OWASP

C. PCI

D. AJAX

3. Which vulnerability relies on social engineering to trick a user into visiting a

maliciously crafted link or URL?

A. Stored XXS

B. Cross-site request forgery

C. Unvalidated redirects

D. Reflected XXS

4. Which of the following involves the attacker supplying SQL commands when prompted

to fill in a Web application field?

A. SQL injection

B. authorization testing

C. error handling

D. business logic testing

5. What term refers to the flow a user is expected to follow in an application to accomplish

a goal?

A. client-side

B. cryptography

C. business logic

D. error handling

Class Discussion Topics

1. If static Web pages are used, there is less likelihood of an attacker inserting program

code into forms or fields displayed in the Web browser. Does this mean that static Web

pages are more secure than dynamic Web pages? If so, why do Web developers insist

on using dynamic Web pages?

2. Many Web applications require that a server other than the Web server authenticate

users. What are the advantages and disadvantages of authenticating users in this way?

Additional Projects

1. Ask your students to install Java 2 Standard Runtime Environment (J2SE) and Apache

on a computer running Linux. How different is this process from installing J2SE and

Apache on a Windows system?

2. In this chapter, your students practiced running OWASP’s WebGoat against an Apache

Web server. This time, ask them to repeat the exercise but against a Microsoft IIS

Hands-On Ethical Hacking and Network Defense, Third Edition 10–11

Additional Resources

1. IIS 7.0 and later Security:

2. IIS Lockdown and Urlscan:

4. SQL Injection Attacks – What is it and how to prevent it?:

5. PHF Prober Perl Script:

Key Terms

See Glossary for definitions of Key Terms.

Active Server Pages (ASP)

ActiveX Data Objects (ADO)

Dynamic Application Security Testing (DAST)

Object Linking and Embedding Database (OLE DB)

Open Database Connectivity (ODBC)

Open Web Application Security Project (OWASP)

PHP Hypertext Processor (PHP)

Hands-On Ethical Hacking and Network Defense, Third Edition 10–12

SQL injection (SQLi)

static Web pages

Technical Notes for Activities

Activity 10-1: This activity requires a computer running Windows 10, an Internet

connection, and a Web browser.

Activity 10-2: This activity requires a computer running Windows with IIS.