WebBackdoors , Attack, Evasion and Detection

Abstract:
This paper provides insight on common web back doors and how simple manipulations could make them undetectable by AV and other security suits. Paper explains few techniques that could be used to render undetectable and unnoticed backdoor inside web applications.
This paper is mainly an update for an old paper of ours Effectiveness of Antivirus in Detecting Web Application Backdoors, which mainly questioned the effectiveness of AV with respect to web shells and analysis of a couple of web shells. Current paper takes this topic further and explains a couple of methodologies that could be used to make stealth application layer backdoors using web scripting languages .This paper explains various Web Backdoor attacks and evasion techniques that could be used to stay undetected

Download PDF: http://www.garage4hackers.com

DNS poisoning via Port

Watchfire released a very interesting whitepaper which describes a DNS poisoning attack against stub resolvers.

It discloses two vulnerabilities:

A vulnerability in Java (CVE-2011-3552, CVE-2010-4448) which enables remote DNS poisoning using Java applets. This vulnerability can be triggered when opening a malicious webpage. A successful exploitation of this vulnerability may lead to disclosure and manipulation of cookies and web pages, disclosure of NTLM credentials and clipboard data of the logged-on user, and even firewall bypass.

A vulnerability in multiuser Windows environments which enables local DNS cache poisoning of arbitrary domains. This vulnerability can be triggered by a normal user (i.e. one with non-administrative rights) in order to attack other users of the system. A successful exploitation of this vulnerability may lead to information disclosure, privilege escalation, universal XSS and more.

Download Whitepaper: http://blog.watchfire.com/

Video Demo: http://blog.watchfire.com

Remote and Local File Inclusion Vulnerabilities

Introduction: 

Remote and local file inclusion (RFI/LFI) attacks are a favorite choice for hackers and many security professionals aren’t noticing.


Why is RFI/LFI attractive to hackers? A successful attack allows the execution of arbitrary code on the attacked platform’s web application. With RFI/LFI, a hacker can take over a web server.Surprisingly, however, RFI/LFI has not been taken seriously by the security community. In real-world hacking attacks, RFI/LFI attacks made up 21 percent of all observed application attacks.For hackers, RFI/LFI attacks are very attractive since they target PHP applications. With more than 77 percent of today’s websites running PHP, RFI should be on every security practitioner’s radar but isn’t. Some notorious RFI/LFI examples include:


› Lulzsec, using RFI bots to attack their targets. 


› TimThumb, a WordPress add-on, which was vulnerable to LFI and paved the way to 1.2 million infected websites.


In one hacker forum, several discussion shed light on the value of RFI/LFI:

Download PDF: http://www.imperva.com