Web Application Hacking

The Art of Exploiting Vulnerable Web Application

Seminar Prodi Informatika | 24 Agustus 2019

Eryk Budi Pratama, S.Kom, MM, CEH, OSWP, CSCU, CSX-F

proferyk@gmail.com
WHO AM I?

• Cyber Security & Community Enthusiast

• Cyber Security Professional, Global Consulting Firm
• Cyber Security Strategy & Governance, Technical
Assessment, Cloud Security, Emerging Technology,
DevSecOps
• IT Advisory, Audit, Governance, Risk, & Compliance
• Knowledge Hunter
• @proferyk

proferyk@gmail.com
Overview
 Survey
Application breaches by initial attack type

Breaches by root cause

Source: https://www.f5.com/content/dam/f5-labs-v2/article/pdfs/F5Labs_2018_Application_Protection_Report.pdf
 Common Web Application Vulnerabilities (1/2)

Source: https://www.edgescan.com/wp-content/uploads/2019/02/edgescan-Vulnerability-Stats-Report-2019.pdf
 Common Web Application Vulnerabilities (2/2)

Source: https://www.edgescan.com/wp-content/uploads/2019/02/edgescan-Vulnerability-Stats-Report-2019.pdf
Case Studies - Indonesia
Cyber Attack Map
Vulnerability Stack
User – Login Form

Internet

Firewall

Web Server

Web Application

DBMS

OS System Call DB Output

Application Sub-Tiers and Components
Services Access Control Transport Domain Name Network

 App source  Authentication  Encryption  DNS servers  Global ISPs

code  Authorization  Certificate  Registrars  Last mile
Internal code  Identity authorities  Internet routing
External code  Federation
 Server-side
infrastructure
Web server
CDN
Data storage
 Server-side
frameworks

Data flow within the application

Application Threats at Each Tier
Services Access Control Transport Domain Name Network

 API attacks  Credential theft  DDoS  Man-in-the-middle  DDoS

 Injection  Credential stuffing  Key disclosure  DNS cache  Eavesdropping
 Malware  Session hijacking  Protocol abuse poisoning  Protocol abuse
 DDoS  Brute force  Session hijacking  DNS spoofing  Man-in-the-middle
 Cross-site scripting  Phishing  Certificate spoofing  DNS hijacking
 Cross-site request  Dictionary attacks
forgery  DDoS
 Man-in-the-middle
 Abuse of
functionality

Cross-site request forgery Man-in-the-middle Malware

Client
Cross-site scripting Session hijacking Social Engineering
 Sample Attack via Transport Layer

Source: https://www.f5.com/content/dam/f5-labs-v2/article/pdfs/F5Labs_2018_Application_Protection_Report.pdf
 Sample Attack via Compromised Digital Certificate

Source: https://www.f5.com/content/dam/f5-labs-v2/article/pdfs/F5Labs_2018_Application_Protection_Report.pdf
 Sample Attack via DNS

Source: https://www.f5.com/content/dam/f5-labs-v2/article/pdfs/F5Labs_2018_Application_Protection_Report.pdf
 Web Hacking Tools

Source: https://www.statista.com/statistics/800916/worldwide-useful-software-hacking/
How to Prevent Web Application
Attack
Primary Application Protection Steps

1 Understand your environment

2 Reduce your attack survey

3 Prioritize defenses based on RISK

Select flexible and integrated

4
defense tools

5 Integrate security into development

Earn Money from
Ethical Hacking
Bug Bounty Program – Crowd sourced
Bug Bounty Program – Individual
 Bug Bounty Flow - Sample

Find Bug(s) Report Bug Bug Validation Bug Rating Bug Fixing Rewards

Source: https://bugbounty.linecorp.com/en/faq/
Bug Bounty Rewards - Sample
Live Demo
Thank You

proferyk@gmail.com