Advanced WebScarab
OWASP
AppSec
DC
October 2005
Rogan Dawes, WebScarab project lead
Senior Consultant, Deloitte South Africa
rdawes@deloitte.co.za
+27 82 784 9498
Copyright © 2005 - The OWASP Foundation
Permission is granted to copy, distribute and/or modify this document
under the terms of the GNU Free Documentation License.
The OWASP Foundation
http://www.owasp.org/
Who am I?
Day job
Senior Consultant, Deloitte South Africa, ERS
 Security Assessments
 Security Consulting
Night job
Self-taught Java programmer
 Exodus
 WebScarab
OWASP AppSec DC 2005
2
What is WebScarab?
A tool for anyone involved with HTTP-based
applications (e.g. web applications)
Key features
Full visibility into the HTTP protocol
Also supports HTTPS (incl client certs)
Persistent audit trail can easily be reviewed
Primary uses
Security analysis
Application debugging
OWASP AppSec DC 2005
3
What does WebScarab do?
Allows user to view HTTP(S) conversations
between browser and server
Allows user to review those conversations
Allows user to intercept and modify on the fly
Allows user to replay previous requests
Allows user to script conversations with full
access to the the request and response object
models
And much more!
OWASP AppSec DC 2005
4
Obtaining WebScarab
Hosted on Sourceforge
https://sourceforge.net/projects/owasp
Various package formats
webscarab-installer-<date>.jar
webscarab-selfcontained-<date>.jar
webscarab-src-<date>.jar
Windows IE Integration library
W32WinInet.dll
JavaHelp support
OWASP AppSec DC 2005
5
Setting up the environment
Upstream Proxies
Internet Explorer integration - “Get IE settings”
Exclusion list uses IE format
Certificates
PKCS#12 format files
Store password and key password usually identical
Server cert loaded from the .jar
MS CAPI integration coming (IE cert store)
Settings saved in properties file
${user.home}/WebScarab.properties
OWASP AppSec DC 2005
6
Useful Tools
Shared Cookies
List of cookies seen by various plugins
Maintains history of previous cookies
Can add and delete cookies
Can be used by Manual Request and Spider plugins
Transcoder
URL {en,de}code
BASE64 {en,de}code
Hashing
OWASP AppSec DC 2005
7
Conversation viewer
Remembers size and placement
Splitpanes allow resizing Request / Response
Different “editors” for various Content-Type
Hex
Text
Image
HTML
XML
URL Encoded
Multi-part
OWASP AppSec DC 2005
8
Configuring Proxy Listeners
Listens on 127.0.0.1:8008 by default
Supports multiple listeners if required
“Uses plugins” optional
Internet Explorer Integration
Primary listener hijacks IE proxy settings on startup
Reverse proxy support
For hard-coded applications
Cannot be primary!
Network simulators
Latency and bandwidth
OWASP AppSec DC 2005
9
Manual Request
Creating from scratch
Based on previous request via drop-down
Automatic Content-Length adjustment
Only if the header already exists
Change to the “Raw” tab to get new editors
Checks Content-Type header
“Get Cookies” updates from “Shared Cookies”
“Update CookieJar” adds to “Shared Cookies”
OWASP AppSec DC 2005
10
Session ID Analysis
Quickly collect a large sample of cookies
Convert String to a (BIG) number
Default Calculator – per position character set
Various calculation algorithms possible
Changing calculators requires recompilation
Table shows calculations and differences
Graph allows visual identification of patterns
OWASP AppSec DC 2005
11
Session ID Analysis
Based on previous request from drop-down
Manual editing if necessary (e.g. HEAD vs GET)
Choose location of Session ID, and Name
Regex describes substring to extract
Default regex is (.*)
“Test” to see what is extracted
Specify number of samples
OWASP AppSec DC 2005
12
Demonstration
Collecting and graphing sessionids from
WebGoat
OWASP AppSec DC 2005
13
Scripting support
Proxy beanshell
public Response fetchResponse(HTTPClient nextPlugin, Request request)
throws IOException {
// your request modifications here
response = nextPlugin.fetchResponse(request);
// your response modifications here
return response;
}
Tools -> Script Manager
Plugins export hooks
 Framework hook
 Proxy hooks
OWASP AppSec DC 2005
14
Scripting support continued
Scripted Plugin
Multiple language support via BSF
 BeanShell (tested)
 Javascript, Jython, Groovy, etc (untested)
Documentation in the source code
 ScriptedObjectModel.java
Most useful methods
public Request getRequest(int id)
public Response fetchResponse(Request request)
public ConversationID addConversation(Response response)
public void submitAsyncRequest(Request request)
public Response getAsyncResponse()
OWASP AppSec DC 2005
15
Demonstration
Brute forcing a session ID
OWASP AppSec DC 2005
16
New plugins
Fuzzer
Search
Compare
Web Services
OWASP AppSec DC 2005
17
Fuzzer
Specify the method, URL and Version
Add any additional headers
Specify the parameters
Location (Path, Fragment, Query, Cookie, Body)
Name
Type (only String)
Value (used if not fuzzing this parameter)
Priority (controls the permutation algorithm)
Fuzz Source (a named list of fuzz strings)
GO!
OWASP AppSec DC 2005
18
Creating fuzz sources
Description
File name and location
Internal interface also supports programmatic
generation of strings (e.g. length related), but
this requires some coding
Fuzzer is extremely stupid
Only stops on errors (400 or exception)
Just hit Start again if it stops
OWASP AppSec DC 2005
19
Demonstration
Fuzzing for SQL injection errors
OWASP AppSec DC 2005
20
Search plugin
How do we find interesting results then?
Search plugin performs arbitrary matches
against conversations
Description
Search expression
E.g:
new String(response.getContent()).matches("(?is).*(error|exception).*")
(?is) matches multi-line, case-insensitive
OWASP AppSec DC 2005
21
Demonstration
Finding conversations with SQL injection errors
OWASP AppSec DC 2005
22
Compare
Compares the body of various responses
Select a baseline to compare against
Conversation list shows the “distance” from
baseline (# words)
Can be sorted on any (combination of ) columns
Select a conversation to show both bodies
OWASP AppSec DC 2005
23
Web Services
Identifies WSDL in conversations
Can load from a file
Parses WSDL
Parses Schema (complex types!)
Presents Services and Operations
Constructs an Object hierarchy for editing
Converts to SOAP message
Invoke!
Currently RPC/encoded only
OWASP AppSec DC 2005
24
Questions?
OWASP
AppSec
DC
October 2005
Rogan Dawes, WebScarab project lead
Senior Consultant, Deloitte South Africa
rdawes@deloitte.co.za
+27 82 784 9498
Copyright © 2005 - The OWASP Foundation
Permission is granted to copy, distribute and/or modify this document
under the terms of the GNU Free Documentation License.
The OWASP Foundation
http://www.owasp.org/