vasco/FSI
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

modsecurity

Browse Source
This commit is contained in:
vasco
2026-05-31 14:55:52 +01:00
parent a17feb0e1b
commit ded74f1a45
15 changed files with 215 additions and 76 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
SERVER.sh
View File

@@ -43,6 +43,7 @@ sudo iptables -t nat -A POSTROUTING -o enp0s8 -j MASQUERADE
sudo iptables-save > /etc/sysconfig/iptables sudo iptables-save > /etc/sysconfig/iptables
sudo cp conf/httpd.conf /etc/httpd/httpd.conf sudo cp conf/httpd.conf /etc/httpd/httpd.conf
sudo cp conf/modsecurity.conf /etc/httpd/conf/modsecurity.conf
# instalar juice-shop se nao existir # instalar juice-shop se nao existir
jspath="/var/juice-shop" jspath="/var/juice-shop"
@@ -54,10 +55,6 @@ if [[ ! -f "$jspath/package.json" ]]; then
sudo chown -R $USER:$USER "$jspath" sudo chown -R $USER:$USER "$jspath"
fi fi
# apache WAF (desativado por default)
s stop httpd
s disable httpd
# correr juice shop via npm # correr juice shop via npm
cd "$jspath" cd "$jspath"
npm start npm start

5
conf/httpd.conf
View File

@@ -4,8 +4,9 @@ User apache
Group apache Group apache
Include conf.modules.d/*.conf Include conf.modules.d/*.conf
IncludeOptional modsecurity.d/*.conf Include conf/modsecurity.conf
IncludeOptional modsecurity.d/activated_rules/*.conf # IncludeOptional modsecurity.d/*.conf
# IncludeOptional modsecurity.d/activated_rules/*.conf
<Directory /> <Directory />
AllowOverride none AllowOverride none

23
conf/modsecurity.conf Normal file
View File

@@ -0,0 +1,23 @@
SecRuleEngine On
SecRequestBodyAccess On
SecResponseBodyAccess Off
SecDebugLog /var/log/modsecurity/debug.log
SecDebugLogLevel 0
SecAuditLogParts ABIJ
SecAuditLogType Serial
SecAuditLog /var/log/modsecurity/audit.log
# SQL Injection protection
SecRule ARGS "(?i)(union(\s+all)?\s+select|select\s+.*\s+from|insert\s+into|update\s+.*\s+set|delete\s+from|drop\s+table|or\s+1=1|--|#|/\*|\*/|\bexec\b|\bexecute\b)" "id:'950001',phase:2,deny,status:403,msg:'SQL Injection Attack Detected',log"
# XSS / HTML Injection protection
SecRule ARGS "(?i)<script|javascript:|on\\w+=|<img|<svg|<iframe|<object|<embed|<form|<input|%3c|%3e|%22|%27|%60" "id:'950003',phase:2,deny,status:403,msg:'XSS/HTML Injection Detected',log"
# Remote File Inclusion protection
SecRule ARGS "(?i)(https?|ftp)://" "id:'950005',phase:2,deny,status:403,msg:'Remote File Inclusion Attempt',log"
# Command Injection protection
SecRule ARGS "(?i)(;|&&|\|\||\$\(|\`|\bexec\b|\bcmd\b|\bsystem\b)" "id:'950006',phase:2,deny,status:403,msg:'Command Injection Detected',log"
# Path Traversal protection
SecRule ARGS "(\../|\..\\)" "id:'950007',phase:2,deny,status:403,msg:'Path Traversal Attempt',log"

BIN
relatorio/imgs/dir-fuzzing.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 75 KiB

BIN
relatorio/imgs/ftp.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 47 KiB

BIN
relatorio/imgs/metrics.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 249 KiB

BIN
relatorio/imgs/suspiciouserrors.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 109 KiB

BIN
relatorio/imgs/suspiciouserrors2.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 72 KiB

BIN
relatorio/imgs/swagger.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 113 KiB

52
relatorio/relatorio.aux
View File

@@ -13,24 +13,40 @@
\@writefile{toc}{\contentsline {subsection}{\numberline {2.3}Services}{3}{subsection.2.3}\protected@file@percent } \@writefile{toc}{\contentsline {subsection}{\numberline {2.3}Services}{3}{subsection.2.3}\protected@file@percent }
\@writefile{toc}{\contentsline {section}{\numberline {3}Web application security testing}{4}{section.3}\protected@file@percent } \@writefile{toc}{\contentsline {section}{\numberline {3}Web application security testing}{4}{section.3}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {3.1}Information Gathering}{4}{subsection.3.1}\protected@file@percent } \@writefile{toc}{\contentsline {subsection}{\numberline {3.1}Information Gathering}{4}{subsection.3.1}\protected@file@percent }
\@writefile{lof}{\contentsline {figure}{\numberline {1}{\ignorespaces ftp}}{4}{figure.1}\protected@file@percent }
\newlabel{fig:ftp}{{1}{4}{ftp}{figure.1}{}}
\@writefile{toc}{\contentsline {subsection}{\numberline {3.2}Configuration and Deployment Management Testing}{4}{subsection.3.2}\protected@file@percent } \@writefile{toc}{\contentsline {subsection}{\numberline {3.2}Configuration and Deployment Management Testing}{4}{subsection.3.2}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {3.3}Identity Management Testing}{5}{subsection.3.3}\protected@file@percent } \@writefile{lof}{\contentsline {figure}{\numberline {2}{\ignorespaces metrics}}{5}{figure.2}\protected@file@percent }
\newlabel{fig:metrics}{{2}{5}{metrics}{figure.2}{}}
\@writefile{lof}{\contentsline {figure}{\numberline {3}{\ignorespaces swagger}}{5}{figure.3}\protected@file@percent }
\newlabel{fig:swagger}{{3}{5}{swagger}{figure.3}{}}
\@writefile{toc}{\contentsline {subsection}{\numberline {3.3}Identity Management Testing}{6}{subsection.3.3}\protected@file@percent }
\@writefile{lof}{\contentsline {figure}{\numberline {4}{\ignorespaces email-unique}}{7}{figure.4}\protected@file@percent }
\newlabel{fig:email-unique}{{4}{7}{email-unique}{figure.4}{}}
\@writefile{toc}{\contentsline {subsection}{\numberline {3.4}Authentication Testing}{7}{subsection.3.4}\protected@file@percent } \@writefile{toc}{\contentsline {subsection}{\numberline {3.4}Authentication Testing}{7}{subsection.3.4}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {3.5}Authorization Testing}{7}{subsection.3.5}\protected@file@percent } \@writefile{toc}{\contentsline {subsection}{\numberline {3.5}Authorization Testing}{7}{subsection.3.5}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {3.6}Session Management Testing}{7}{subsection.3.6}\protected@file@percent } \@writefile{lof}{\contentsline {figure}{\numberline {5}{\ignorespaces email-invalido}}{8}{figure.5}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {3.7}Input Validation Testing}{7}{subsection.3.7}\protected@file@percent } \newlabel{fig:email-invalido}{{5}{8}{email-invalido}{figure.5}{}}
\@writefile{toc}{\contentsline {subsubsection}{\numberline {3.7.1}Testing for SQL Injection}{8}{subsubsection.3.7.1}\protected@file@percent } \@writefile{lof}{\contentsline {figure}{\numberline {6}{\ignorespaces suspiciouserrors}}{8}{figure.6}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {3.8}Testing for Error Handling}{8}{subsection.3.8}\protected@file@percent } \newlabel{fig:suspiciouserrors}{{6}{8}{suspiciouserrors}{figure.6}{}}
\@writefile{toc}{\contentsline {subsection}{\numberline {3.9}Client Side Testing}{9}{subsection.3.9}\protected@file@percent } \@writefile{lof}{\contentsline {figure}{\numberline {7}{\ignorespaces suspiciouserrors2}}{9}{figure.7}\protected@file@percent }
\@writefile{toc}{\contentsline {section}{\numberline {4}Web Application Security Firewall}{10}{section.4}\protected@file@percent } \newlabel{fig:suspiciouserrors2}{{7}{9}{suspiciouserrors2}{figure.7}{}}
\@writefile{toc}{\contentsline {subsection}{\numberline {4.1}Information Gathering}{10}{subsection.4.1}\protected@file@percent } \@writefile{toc}{\contentsline {subsection}{\numberline {3.6}Session Management Testing}{9}{subsection.3.6}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {4.2}Configuration and Deployment Management Testing}{10}{subsection.4.2}\protected@file@percent } \@writefile{toc}{\contentsline {subsection}{\numberline {3.7}Input Validation Testing}{9}{subsection.3.7}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {4.3}Identity Management Testing}{10}{subsection.4.3}\protected@file@percent } \@writefile{toc}{\contentsline {subsubsection}{\numberline {3.7.1}Testing for SQL Injection}{10}{subsubsection.3.7.1}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {4.4}Authentication Testing}{10}{subsection.4.4}\protected@file@percent } \@writefile{toc}{\contentsline {subsection}{\numberline {3.8}Testing for Error Handling}{10}{subsection.3.8}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {4.5}Authorization Testing}{10}{subsection.4.5}\protected@file@percent } \@writefile{lof}{\contentsline {figure}{\numberline {8}{\ignorespaces stack-trace}}{11}{figure.8}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {4.6}Session Management Testing}{10}{subsection.4.6}\protected@file@percent } \newlabel{fig:stack-trace}{{8}{11}{stack-trace}{figure.8}{}}
\@writefile{toc}{\contentsline {subsection}{\numberline {4.7}Input Validation Testing}{10}{subsection.4.7}\protected@file@percent } \@writefile{toc}{\contentsline {subsection}{\numberline {3.9}Client Side Testing}{11}{subsection.3.9}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {4.8}Testing for Error Handling}{10}{subsection.4.8}\protected@file@percent } \@writefile{toc}{\contentsline {section}{\numberline {4}Web Application Security Firewall}{12}{section.4}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {4.9}Client Side Testing}{10}{subsection.4.9}\protected@file@percent } \@writefile{toc}{\contentsline {subsection}{\numberline {4.1}Information Gathering}{12}{subsection.4.1}\protected@file@percent }
\@writefile{toc}{\contentsline {section}{\numberline {5}Conclusions}{10}{section.5}\protected@file@percent } \@writefile{toc}{\contentsline {subsection}{\numberline {4.2}Configuration and Deployment Management Testing}{12}{subsection.4.2}\protected@file@percent }
\gdef \@abspage@last{10} \@writefile{toc}{\contentsline {subsection}{\numberline {4.3}Identity Management Testing}{12}{subsection.4.3}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {4.4}Authentication Testing}{12}{subsection.4.4}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {4.5}Authorization Testing}{12}{subsection.4.5}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {4.6}Session Management Testing}{12}{subsection.4.6}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {4.7}Input Validation Testing}{12}{subsection.4.7}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {4.8}Testing for Error Handling}{12}{subsection.4.8}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {4.9}Client Side Testing}{12}{subsection.4.9}\protected@file@percent }
\@writefile{toc}{\contentsline {section}{\numberline {5}Conclusions}{12}{section.5}\protected@file@percent }
\gdef \@abspage@last{12}

106
relatorio/relatorio.log
View File

@@ -1,4 +1,4 @@
This is pdfTeX, Version 3.141592653-2.6-1.40.29 (MiKTeX 26.2) (preloaded format=pdflatex 2026.5.30) 31 MAY 2026 13:33 This is pdfTeX, Version 3.141592653-2.6-1.40.29 (MiKTeX 26.2) (preloaded format=pdflatex 2026.5.30) 31 MAY 2026 14:43
entering extended mode entering extended mode
restricted \write18 enabled. restricted \write18 enabled.
%&-line parsing enabled. %&-line parsing enabled.
@@ -1297,24 +1297,71 @@ LaTeX Font Info: Font shape `T1/cmtt/bx/n' in size <9> not available
(relatorio.listing (relatorio.listing
LaTeX Font Info: Font shape `T1/Raleway-OsF/m/n' will be LaTeX Font Info: Font shape `T1/Raleway-OsF/m/n' will be
(Font) scaled to size 9.0pt on input line 1. (Font) scaled to size 9.0pt on input line 1.
) [4] )
<./imgs/ftp.png, id=199, 1587.9325pt x 401.5pt>
File: ./imgs/ftp.png Graphic file (type png)
<use ./imgs/ftp.png>
Package pdftex.def Info: ./imgs/ftp.png used on input line 103.
(pdftex.def) Requested size: 452.9679pt x 114.5267pt.
<./imgs/metrics.png, id=200, 1927.2pt x 1010.77625pt>
File: ./imgs/metrics.png Graphic file (type png)
<use ./imgs/metrics.png>
Package pdftex.def Info: ./imgs/metrics.png used on input line 109.
(pdftex.def) Requested size: 452.9679pt x 237.5633pt.
LaTeX Warning: `!h' float specifier changed to `!ht'.
<./imgs/swagger.png, id=201, 1923.185pt x 995.72pt>
File: ./imgs/swagger.png Graphic file (type png)
<use ./imgs/swagger.png>
Package pdftex.def Info: ./imgs/swagger.png used on input line 115.
(pdftex.def) Requested size: 452.9679pt x 234.5108pt.
LaTeX Warning: `!h' float specifier changed to `!ht'.
[4 <./imgs/ftp.png (PNG copy)>] [5 <./imgs/metrics.png (PNG copy)> <./imgs/swag
ger.png (PNG copy)>]
\openout6 = `relatorio.listing'. \openout6 = `relatorio.listing'.
(relatorio.listing) (relatorio.listing)
<./imgs/email-unique.png, id=205, 475.7775pt x 361.35pt> <./imgs/email-unique.png, id=218, 475.7775pt x 361.35pt>
File: ./imgs/email-unique.png Graphic file (type png) File: ./imgs/email-unique.png Graphic file (type png)
<use ./imgs/email-unique.png> <use ./imgs/email-unique.png>
Package pdftex.def Info: ./imgs/email-unique.png used on input line 148. Package pdftex.def Info: ./imgs/email-unique.png used on input line 172.
(pdftex.def) Requested size: 226.48395pt x 172.01245pt. (pdftex.def) Requested size: 317.07614pt x 240.82956pt.
[5]
<./imgs/email-invalido.png, id=228, 504.88625pt x 541.02126pt>
LaTeX Warning: `!h' float specifier changed to `!ht'.
[6]
<./imgs/email-invalido.png, id=241, 504.88625pt x 541.02126pt>
File: ./imgs/email-invalido.png Graphic file (type png) File: ./imgs/email-invalido.png Graphic file (type png)
<use ./imgs/email-invalido.png> <use ./imgs/email-invalido.png>
Package pdftex.def Info: ./imgs/email-invalido.png used on input line 159. Package pdftex.def Info: ./imgs/email-invalido.png used on input line 188.
(pdftex.def) Requested size: 226.48395pt x 242.69781pt. (pdftex.def) Requested size: 317.07614pt x 339.772pt.
[6 <./imgs/email-unique.png (PNG copy)> <./imgs/email-invalido.png (PNG copy)>
]
Overfull \hbox (6.24345pt too wide) in paragraph at lines 185--186 LaTeX Warning: `!h' float specifier changed to `!ht'.
[7 <./imgs/email-unique.png (PNG copy)>]
<./imgs/suspiciouserrors.png, id=249, 1150.2975pt x 568.1225pt>
File: ./imgs/suspiciouserrors.png Graphic file (type png)
<use ./imgs/suspiciouserrors.png>
Package pdftex.def Info: ./imgs/suspiciouserrors.png used on input line 207.
(pdftex.def) Requested size: 317.07614pt x 156.60258pt.
<./imgs/suspiciouserrors2.png, id=250, 900.36375pt x 471.7625pt>
File: ./imgs/suspiciouserrors2.png Graphic file (type png)
<use ./imgs/suspiciouserrors2.png>
Package pdftex.def Info: ./imgs/suspiciouserrors2.png used on input line 213.
(pdftex.def) Requested size: 317.07614pt x 166.13432pt.
LaTeX Warning: `!h' float specifier changed to `!ht'.
[8 <./imgs/email-invalido.png (PNG copy)> <./imgs/suspiciouserrors.png (PNG cop
y)>]
Overfull \hbox (6.24345pt too wide) in paragraph at lines 230--231
[]\T1/Raleway-OsF/b/n/10.95 Tentativa com Script Di-reto: \T1/Raleway-OsF/m/n/1 []\T1/Raleway-OsF/b/n/10.95 Tentativa com Script Di-reto: \T1/Raleway-OsF/m/n/1
0.95 In-se-ri-mos o pay-load tra-di-ci-o-nal \T1/cmtt/m/n/10.95 <script>alert(" 0.95 In-se-ri-mos o pay-load tra-di-ci-o-nal \T1/cmtt/m/n/10.95 <script>alert("
someones someones
@@ -1322,19 +1369,24 @@ someones
\openout6 = `relatorio.listing'. \openout6 = `relatorio.listing'.
(relatorio.listing) [7] (relatorio.listing) [9 <./imgs/suspiciouserrors2.png (PNG copy)>]
\openout6 = `relatorio.listing'. \openout6 = `relatorio.listing'.
(relatorio.listing)
<./imgs/stack-trace.png, id=245, 643.90562pt x 378.91562pt> (relatorio.listing)
<./imgs/stack-trace.png, id=268, 643.90562pt x 378.91562pt>
File: ./imgs/stack-trace.png Graphic file (type png) File: ./imgs/stack-trace.png Graphic file (type png)
<use ./imgs/stack-trace.png> <use ./imgs/stack-trace.png>
Package pdftex.def Info: ./imgs/stack-trace.png used on input line 235. Package pdftex.def Info: ./imgs/stack-trace.png used on input line 282.
(pdftex.def) Requested size: 452.9679pt x 266.56314pt. (pdftex.def) Requested size: 317.07614pt x 186.59535pt.
[8]
LaTeX Warning: `!h' float specifier changed to `!ht'.
[10]
\openout6 = `relatorio.listing'. \openout6 = `relatorio.listing'.
(relatorio.listing) [9 <./imgs/stack-trace.png>] [10] (relatorio.aux) (relatorio.listing) [11 <./imgs/stack-trace.png>] [12] (relatorio.aux)
*********** ***********
LaTeX2e <2025-11-01> LaTeX2e <2025-11-01>
L3 programming layer <2026-03-20> L3 programming layer <2026-03-20>
@@ -1343,10 +1395,10 @@ Package rerunfilecheck Info: File `relatorio.out' has not changed.
(rerunfilecheck) Checksum: 71F23F30E8D22A202B518A954FE83332;4897. (rerunfilecheck) Checksum: 71F23F30E8D22A202B518A954FE83332;4897.
) )
Here is how much of TeX's memory you used: Here is how much of TeX's memory you used:
31700 strings out of 467691 31781 strings out of 467691
636648 string characters out of 5414987 638393 string characters out of 5414987
1246039 words of memory out of 5000000 1247303 words of memory out of 5000000
60099 multiletter control sequences out of 15000+600000 60170 multiletter control sequences out of 15000+600000
791342 words of font info for 89 fonts, out of 8000000 for 9000 791342 words of font info for 89 fonts, out of 8000000 for 9000
1141 hyphenation exceptions out of 8191 1141 hyphenation exceptions out of 8191
113i,8n,122p,699b,1803s stack positions out of 10000i,1000n,20000p,200000b,200000s 113i,8n,122p,699b,1803s stack positions out of 10000i,1000n,20000p,200000b,200000s
@@ -1356,9 +1408,9 @@ Here is how much of TeX's memory you used:
ri/raleway/Raleway-Bold.pfb><C:/Users/lcorp/AppData/Local/Programs/MiKTeX/fonts ri/raleway/Raleway-Bold.pfb><C:/Users/lcorp/AppData/Local/Programs/MiKTeX/fonts
/type1/impallari/raleway/Raleway-Italic.pfb><C:/Users/lcorp/AppData/Local/Progr /type1/impallari/raleway/Raleway-Italic.pfb><C:/Users/lcorp/AppData/Local/Progr
ams/MiKTeX/fonts/type1/impallari/raleway/Raleway-Regular.pfb> ams/MiKTeX/fonts/type1/impallari/raleway/Raleway-Regular.pfb>
Output written on relatorio.pdf (10 pages, 263252 bytes). Output written on relatorio.pdf (12 pages, 869774 bytes).
PDF statistics: PDF statistics:
461 PDF objects out of 1000 (max. 8388607) 486 PDF objects out of 1000 (max. 8388607)
98 named destinations out of 1000 (max. 500000) 108 named destinations out of 1000 (max. 500000)
388 words of extra memory for PDF output out of 10000 (max. 10000000) 413 words of extra memory for PDF output out of 10000 (max. 10000000)

BIN
relatorio/relatorio.pdf
View File

Binary file not shown.

BIN
relatorio/relatorio.synctex.gz
View File

Binary file not shown.

66
relatorio/relatorio.tex
View File

@@ -80,7 +80,7 @@ Realisticamente estas etapas podiam continuar a repetir-se, até que estivessemo
Utilizámos a política por omissão (\textit{default policy}) para a realização do \textit{Active Scan} através do OWASP ZAP. Com esta abordagem, obtivemos múltiplos alertas automáticos. De forma a priorizar a análise, investigamos as alertas principais com base no maior nível de risco e grau de confiança reportados pela ferramenta. Utilizámos a política por omissão (\textit{default policy}) para a realização do \textit{Active Scan} através do OWASP ZAP. Com esta abordagem, obtivemos múltiplos alertas automáticos. De forma a priorizar a análise, investigamos as alertas principais com base no maior nível de risco e grau de confiança reportados pela ferramenta.
Para conseguir informação inicial realizamos um \textit{Active Scan} através do \textit{OWASP ZAP}, o policy utilizado para esse scan foi \textit{Default Policy}. Foi obtido vários aletas automáticos devido a esse scan e decidimos investigar as alertas principais com base no nível de risco e grau de confiança reportado pela ferramenta. % Para conseguir informação inicial realizamos um \textit{Active Scan} através do \textit{OWASP ZAP}, o policy utilizado para esse scan foi \textit{Default Policy}. Foi obtido vários aletas automáticos devido a esse scan e decidimos investigar as alertas principais com base no nível de risco e grau de confiança reportado pela ferramenta.
Adicionalmente, realizámos testes de infraestrutura utilizando ferramentas especializadas: Adicionalmente, realizámos testes de infraestrutura utilizando ferramentas especializadas:
@@ -93,11 +93,31 @@ Ao executar o \textit{sqlmap}, descobrimos que o sistema de gestão de base de d
Paralelamente, realizámos uma descoberta de ficheiros e diretórios através de técnicas de \textit{fuzzing} de URLs no OWASP ZAP recorrendo à lista de permissões da \textit{DirBuster}. Esta exploração revelou os seguintes endpoints publicamente expostos: Paralelamente, realizámos uma descoberta de ficheiros e diretórios através de técnicas de \textit{fuzzing} de URLs no OWASP ZAP recorrendo à lista de permissões da \textit{DirBuster}. Esta exploração revelou os seguintes endpoints publicamente expostos:
\begin{itemize} \begin{itemize}
\item \texttt{/ftp}: Servidor de armazenamento e transferência de ficheiros exposto. \item \texttt{/ftp}: Servidor de armazenamento e transferência de ficheiros exposto. (Figura \ref{fig:ftp})
\item \texttt{/metrics}: Métricas internas da infraestrutura expostas. \item \texttt{/metrics}: Métricas internas da infraestrutura expostas. (Figura \ref{fig:metrics})
\item \texttt{/api-docs}: Documentação e esquemas estruturais da API. \item \texttt{/api-docs}: Documentação e esquemas estruturais da API. (Figura \ref{fig:swagger})
\end{itemize} \end{itemize}
\begin{figure}[h!]
\centering
\includegraphics[width=\textwidth]{ftp}
\caption{ftp}
\label{fig:ftp}
\end{figure}
\begin{figure}[h!]
\centering
\includegraphics[width=\textwidth]{metrics}
\caption{metrics}
\label{fig:metrics}
\end{figure}
\begin{figure}[h!]
\centering
\includegraphics[width=\textwidth]{swagger}
\caption{swagger}
\label{fig:swagger}
\end{figure}
\subsection{Configuration and Deployment Management Testing} \subsection{Configuration and Deployment Management Testing}
@@ -113,6 +133,8 @@ Testámos os métodos HTTP permitidos pelo servidor através do envio de pedidos
Analisámos as permissões de acesso no diretório \texttt{/ftp}. Verificámos que a falta de restrições rígidas ao nível do sistema de ficheiros permite a qualquer utilizador anónimo listar o conteúdo de diretórios estruturais e descarregar ficheiros não indexados na interface principal da aplicação. Analisámos as permissões de acesso no diretório \texttt{/ftp}. Verificámos que a falta de restrições rígidas ao nível do sistema de ficheiros permite a qualquer utilizador anónimo listar o conteúdo de diretórios estruturais e descarregar ficheiros não indexados na interface principal da aplicação.
\subsection{Identity Management Testing} \subsection{Identity Management Testing}
\subsubsection*{Test Role Definitions} \subsubsection*{Test Role Definitions}
@@ -145,7 +167,12 @@ O servidor backend processou o pedido sem validar se o utilizador possuía autor
Ao tentar registar um utilizador com o e-mail \texttt{admin@juice-sh.op}, verificámos que a aplicação devolve uma mensagem de erro explícita indicando que o e-mail já se encontra registado no sistema. Este comportamento confirma a vulnerabilidade de enumeração de contas, permitindo a um atacante mapear quais os e-mails válidos na plataforma. Ao tentar registar um utilizador com o e-mail \texttt{admin@juice-sh.op}, verificámos que a aplicação devolve uma mensagem de erro explícita indicando que o e-mail já se encontra registado no sistema. Este comportamento confirma a vulnerabilidade de enumeração de contas, permitindo a um atacante mapear quais os e-mails válidos na plataforma.
\includegraphics[width=0.5\textwidth]{email-unique} \begin{figure}[h!]
\centering
\includegraphics[width=0.7\textwidth]{email-unique}
\caption{email-unique}
\label{fig:email-unique}
\end{figure}
\subsubsection*{Testing for Weak or Unenforced Username Policy} \subsubsection*{Testing for Weak or Unenforced Username Policy}
@@ -156,11 +183,16 @@ Após testar vários caracteres especiais no formulário de registo, criámos um
\end{itemize} \end{itemize}
A aplicação aceitou o registo sem validar a presença de carateres de injeção SQL ou tags HTML. Contudo, verificámos que é impossível efetuar login com esta conta posteriormente, uma vez que o processo de autenticação falha e resulta num erro genérico do tipo \texttt{[object Object]} no ecrã. A aplicação aceitou o registo sem validar a presença de carateres de injeção SQL ou tags HTML. Contudo, verificámos que é impossível efetuar login com esta conta posteriormente, uma vez que o processo de autenticação falha e resulta num erro genérico do tipo \texttt{[object Object]} no ecrã.
\includegraphics[width=0.5\textwidth]{email-invalido} \begin{figure}[h!]
\centering
\includegraphics[width=0.7\textwidth]{email-invalido}
\caption{email-invalido}
\label{fig:email-invalido}
\end{figure}
\subsection{Authentication Testing} \subsection{Authentication Testing}
Realizámos testes de \textit{fuzzing} automatizado contra o formulário de login utilizando dicionários de credenciais. Identificámos que a aplicação não implementa mecanismos de bloqueio de conta (*Account Lockout*) ou limitação de taxa de pedidos (*Rate Limiting*), permitindo ataques contínuos de \textit{brute force}. Realizámos testes de \textit{fuzzing} automatizado contra o formulário de login utilizando dicionários de credenciais. Identificámos que a aplicação não implementa mecanismos de bloqueio de conta ou limitação de taxa de pedidos \textit{rate limiting}, permitindo ataques contínuos de \textit{brute force}.
@@ -170,6 +202,19 @@ Testámos as permissões de acesso ao diretório \texttt{/ftp} e verificámos qu
Seguidamente, explorámos falhas na validação de inputs através de uma injeção de \textit{Null Byte} codificado (\texttt{\%2500.md} ou \texttt{\%2500.pdf}). O ataque foi bem-sucedido e contornou a validação de extensões do servidor, garantindo o acesso e descarregamento de ficheiros confidenciais restritos: \texttt{encrypt.pyc} e \texttt{suspicious\_errors.yml}. Seguidamente, explorámos falhas na validação de inputs através de uma injeção de \textit{Null Byte} codificado (\texttt{\%2500.md} ou \texttt{\%2500.pdf}). O ataque foi bem-sucedido e contornou a validação de extensões do servidor, garantindo o acesso e descarregamento de ficheiros confidenciais restritos: \texttt{encrypt.pyc} e \texttt{suspicious\_errors.yml}.
\begin{figure}[h!]
\centering
\includegraphics[width=0.7\textwidth]{suspiciouserrors}
\caption{suspiciouserrors}
\label{fig:suspiciouserrors}
\end{figure}
\begin{figure}[h!]
\centering
\includegraphics[width=0.7\textwidth]{suspiciouserrors2}
\caption{suspiciouserrors2}
\label{fig:suspiciouserrors2}
\end{figure}
\subsection{Session Management Testing} \subsection{Session Management Testing}
Identificámos que o cookie \texttt{token}, responsável por armazenar o identificador da sessão ativa do utilizador, possui a flag \texttt{HttpOnly} configurada como \texttt{false}. A ausência desta proteção significa que o token está totalmente exposto e pode ser lido por scripts do lado do cliente, tornando a sessão criticamente vulnerável a roubo por Cross-Site Scripting (XSS). Identificámos que o cookie \texttt{token}, responsável por armazenar o identificador da sessão ativa do utilizador, possui a flag \texttt{HttpOnly} configurada como \texttt{false}. A ausência desta proteção significa que o token está totalmente exposto e pode ser lido por scripts do lado do cliente, tornando a sessão criticamente vulnerável a roubo por Cross-Site Scripting (XSS).
@@ -232,7 +277,12 @@ Ao tentar forçar o acesso a uma página ou ficheiro inexistente no servidor de
\includegraphics[width=\textwidth]{stack-trace} \begin{figure}[h!]
\centering
\includegraphics[width=0.7\textwidth]{stack-trace}
\caption{stack-trace}
\label{fig:stack-trace}
\end{figure}
\subsection{Client Side Testing} \subsection{Client Side Testing}

34
relatorio/relatorio.toc
View File

@@ -7,22 +7,22 @@
\contentsline {section}{\numberline {3}Web application security testing}{4}{section.3}% \contentsline {section}{\numberline {3}Web application security testing}{4}{section.3}%
\contentsline {subsection}{\numberline {3.1}Information Gathering}{4}{subsection.3.1}% \contentsline {subsection}{\numberline {3.1}Information Gathering}{4}{subsection.3.1}%
\contentsline {subsection}{\numberline {3.2}Configuration and Deployment Management Testing}{4}{subsection.3.2}% \contentsline {subsection}{\numberline {3.2}Configuration and Deployment Management Testing}{4}{subsection.3.2}%
\contentsline {subsection}{\numberline {3.3}Identity Management Testing}{5}{subsection.3.3}% \contentsline {subsection}{\numberline {3.3}Identity Management Testing}{6}{subsection.3.3}%
\contentsline {subsection}{\numberline {3.4}Authentication Testing}{7}{subsection.3.4}% \contentsline {subsection}{\numberline {3.4}Authentication Testing}{7}{subsection.3.4}%
\contentsline {subsection}{\numberline {3.5}Authorization Testing}{7}{subsection.3.5}% \contentsline {subsection}{\numberline {3.5}Authorization Testing}{7}{subsection.3.5}%
\contentsline {subsection}{\numberline {3.6}Session Management Testing}{7}{subsection.3.6}% \contentsline {subsection}{\numberline {3.6}Session Management Testing}{9}{subsection.3.6}%
\contentsline {subsection}{\numberline {3.7}Input Validation Testing}{7}{subsection.3.7}% \contentsline {subsection}{\numberline {3.7}Input Validation Testing}{9}{subsection.3.7}%
\contentsline {subsubsection}{\numberline {3.7.1}Testing for SQL Injection}{8}{subsubsection.3.7.1}% \contentsline {subsubsection}{\numberline {3.7.1}Testing for SQL Injection}{10}{subsubsection.3.7.1}%
\contentsline {subsection}{\numberline {3.8}Testing for Error Handling}{8}{subsection.3.8}% \contentsline {subsection}{\numberline {3.8}Testing for Error Handling}{10}{subsection.3.8}%
\contentsline {subsection}{\numberline {3.9}Client Side Testing}{9}{subsection.3.9}% \contentsline {subsection}{\numberline {3.9}Client Side Testing}{11}{subsection.3.9}%
\contentsline {section}{\numberline {4}Web Application Security Firewall}{10}{section.4}% \contentsline {section}{\numberline {4}Web Application Security Firewall}{12}{section.4}%
\contentsline {subsection}{\numberline {4.1}Information Gathering}{10}{subsection.4.1}% \contentsline {subsection}{\numberline {4.1}Information Gathering}{12}{subsection.4.1}%
\contentsline {subsection}{\numberline {4.2}Configuration and Deployment Management Testing}{10}{subsection.4.2}% \contentsline {subsection}{\numberline {4.2}Configuration and Deployment Management Testing}{12}{subsection.4.2}%
\contentsline {subsection}{\numberline {4.3}Identity Management Testing}{10}{subsection.4.3}% \contentsline {subsection}{\numberline {4.3}Identity Management Testing}{12}{subsection.4.3}%
\contentsline {subsection}{\numberline {4.4}Authentication Testing}{10}{subsection.4.4}% \contentsline {subsection}{\numberline {4.4}Authentication Testing}{12}{subsection.4.4}%
\contentsline {subsection}{\numberline {4.5}Authorization Testing}{10}{subsection.4.5}% \contentsline {subsection}{\numberline {4.5}Authorization Testing}{12}{subsection.4.5}%
\contentsline {subsection}{\numberline {4.6}Session Management Testing}{10}{subsection.4.6}% \contentsline {subsection}{\numberline {4.6}Session Management Testing}{12}{subsection.4.6}%
\contentsline {subsection}{\numberline {4.7}Input Validation Testing}{10}{subsection.4.7}% \contentsline {subsection}{\numberline {4.7}Input Validation Testing}{12}{subsection.4.7}%
\contentsline {subsection}{\numberline {4.8}Testing for Error Handling}{10}{subsection.4.8}% \contentsline {subsection}{\numberline {4.8}Testing for Error Handling}{12}{subsection.4.8}%
\contentsline {subsection}{\numberline {4.9}Client Side Testing}{10}{subsection.4.9}% \contentsline {subsection}{\numberline {4.9}Client Side Testing}{12}{subsection.4.9}%
\contentsline {section}{\numberline {5}Conclusions}{10}{section.5}% \contentsline {section}{\numberline {5}Conclusions}{12}{section.5}%