Web Application Obfuscation This Page Intentionally Left Blank Web Application Obfuscation ‘-/Wafs..Evasion..Filters//Alert (/Obfuscation/)-’
Total Page：16
File Type：pdf, Size：1020Kb
Web Application Obfuscation This page intentionally left blank Web Application Obfuscation ‘-/WAFs..Evasion..Filters//alert (/Obfuscation/)-’ Mario Heiderich Eduardo Alberto Vela Nava Gareth Heyes David Lindsay AMSTERDAM • BOSTON • HEIDELBERG • LONDON NEW YORK • OXFORD • PARIS • SAN DIEGO SAN FRANCISCO • SINGAPORE • SYDNEY • TOKYO Syngress is an imprint of Elsevier Acquiring Editor: Rachel Roumeliotis Development Editor: Matthew Cater Project Manager: Danielle S. Miller Designer: Alisa Andreola Syngress is an imprint of Elsevier 30 Corporate Drive, Suite 400, Burlington, MA 01803, USA # 2011 Elsevier Inc. All rights reserved. No part of this publication may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or any information storage and retrieval system, without permission in writing from the publisher. Details on how to seek permission, further information about the Publisher’s permissions policies and our arrangements with organizations such as the Copyright Clearance Center and the Copyright Licensing Agency, can be found at our website: www.elsevier.com/ permissions. This book and the individual contributions contained in it are protected under copyright by the Publisher (other than as may be noted herein). Notices Knowledge and best practice in this field are constantly changing. As new research and experience broaden our understanding, changes in research methods or professional practices, may become necessary. Practitioners and researchers must always rely on their own experience and knowledge in evaluating and using any information or methods described herein. In using such information or methods they should be mindful of their own safety and the safety of others, including parties for whom they have a professional responsibility. To the fullest extent of the law, neither the Publisher nor the authors, contributors, or editors, assume any liability for any injury and/or damage to persons or property as a matter of products liability, negligence or otherwise, or from any use or operation of any methods, products, instructions, or ideas contained in the material herein. Library of Congress Cataloging-in-Publication Data Heiderich, Mario. Web application obfuscation / Mario Heiderich ... [et al.]. p. cm. Includes bibliographical references. ISBN 978-1-59749-604-9 (pbk.) 1. Internet programming. 2. Computer security. 3. Web site development. 4. Application software–Development. 5. Cryptography. I. Title. QA76.625.H46 2010 005.8–dc22 201004209 British Library Cataloguing-in-Publication Data A catalogue record for this book is available from the British Library. ISBN: 978-1-59749-604-9 Printed in the United States of America 10 11 12 13 14 10 9 8 7 6 5 4 3 2 1 For information on all Syngress publications visit our website at www.syngress.com Contents Acknowledgments .................................................................................................. ix About the Authors .................................................................................................. xi About the Technical editor ................................................................................. xiii CHAPTER 1 Introduction ......................................................................... 1 Audience ....................................................................................... 2 Filtering basics.............................................................................. 2 Regular expressions...................................................................... 3 Book organization ........................................................................ 9 Chapter 2: “HTML” ................................................................... 9 Chapter 3: “JavaScript and VBScript” ...................................... 9 Chapter 4: “Nonalphanumeric JavaScript”.............................. 10 Chapter 5: “CSS” ..................................................................... 10 Chapter 6: “PHP” ..................................................................... 10 Chapter 7: “SQL”..................................................................... 10 Chapter 8: “Web application firewalls and client-side filters” 10 Chapter 9: “Mitigating bypasses and attacks” ........................ 11 Chapter 10: “Future developments” ........................................ 11 Updates ....................................................................................... 11 Summary..................................................................................... 11 CHAPTER 2 HTML ................................................................................ 13 History and overview ................................................................. 13 The document type definition.................................................. 14 The doctype declaration ........................................................... 14 Tags........................................................................................... 15 Entities ...................................................................................... 17 CDATA sections....................................................................... 18 Comments ................................................................................. 20 Markup today............................................................................ 21 Why markup obfuscation? ....................................................... 24 Basic markup obfuscation.......................................................... 26 Structure of valid markup ........................................................ 27 Playing with the markup .......................................................... 28 More ways to execute JavaScript ............................................ 42 Advanced markup obfuscation................................................... 49 v vi Contents Conditional comments.............................................................. 50 URIs ............................................................................................ 53 JavaScript URIs ........................................................................ 53 Broken protocol handlers ......................................................... 54 Data URIs ................................................................................. 56 Beyond HTML ........................................................................... 71 XML.......................................................................................... 71 Summary..................................................................................... 79 CHAPTER 3 JavaScript and VBScript ..................................................... 81 Syntax ......................................................................................... 81 JavaScript background.............................................................. 81 Browser quirks.......................................................................... 84 Encodings.................................................................................... 87 Unicode escapes ....................................................................... 87 Hexadecimal escapes................................................................ 89 Octal escapes ............................................................................ 90 Combining encodings............................................................... 90 Javascript Variables.................................................................... 91 User-defined variables.............................................................. 91 Built-in variables ...................................................................... 92 VBScript ..................................................................................... 97 Comments ................................................................................. 97 Events........................................................................................ 97 Functions................................................................................... 97 End of statement....................................................................... 98 VBScript encoding ................................................................... 98 The execScript function in VBScript .................................... 99 JScript ....................................................................................... 100 The jscript.compact value .................................................. 100 The jscript.encode value.................................................... 100 Conditional comments............................................................ 101 The execScript function in JScript ...................................... 102 E4X ........................................................................................... 102 Summary................................................................................... 104 CHAPTER 4 Nonalphanumeric JavaScript............................................. 105 Nonalphanumeric JavaScript.................................................... 106 Advanced nonalphanumeric JavaScript ................................. 112 Creating characters ................................................................. 116 Use cases................................................................................... 119 Contents vii Minimalistic sets....................................................................