[Music]
thank you
[Music]
all right
foreign
last night I found the high security one
so I hadn't basically cemented to my
arrest today to get people to like come
and take them off of me so if they say
difficult they mean what they're saying
anyway so uh I'm gonna be talking about
headers today
made the slide deck two years ago
thankfully due to covet there's not two
of me up here
um used to live in Chicago used to work
as an app set consultant at rapid seven
now I measure it right at seven move to
Texas got a cowboy hat edited under my
picture
um I like doing lock picking not well at
it clearly uh SDR smoked food home
brewing I just like hotties so if you
guys like that too let me know
um
yeah
So today we're going to focus primarily
on HTTP response headers so last night
David uh you Allman I believe how you
say it did an SMTP talk so it was uh ehl
low hello is that you that was really
good for mail headers I'm gonna focus on
what you're going to see for web
applications
so what happened
if you headers do even if you're not
technical you know the 404 is because
you see it constantly
but when we're trying to convey State
you'll see 200 you'll see 403 418 I'm a
teapot the 403 401s those are probably
the kind of testers in the room
um they also suck cookies and form
control browser framing cross-site
scripting controls and the like but they
especially tend to over share
so when I think about over sharing we're
thinking market share so when you have
people putting out headers such as
Apache 2.4 or Ubuntu 1804 or 0.204 I'm
getting old
um different versions of PHP it was a
PHP that has to laugh at me now if you
want to take a moment
nothing come on all right
um dot net for example so all these
people who manufacture software want to
know what their Market penetration is
helps with funding helps with I don't
know it's kind of cool if I had more
than one percent of people in the world
using anything I built
so right here is an actual actual shot
of the default PHP ionite configuration
you'll see exposed PHP is turned on what
that does it says hey everybody I'm
running PHP and this is the version that
I'm using
they also assess Americans and no
security threat in any way but it makes
it possible to determine if your server
is running PHP or not
now if you haven't wondered besides
paying for a procurement and scope of
work and all that good stuff what is the
first step of a security audit
what do you guys recount it is
felt pretty proud of that one
um reconnaissance so when you go and
look at a web server and it says PHP
version 8. the first thing that you're
probably going to do with that
information is take it
to Google
so my first language was PHP 5.1.6 which
was before dinosaurs were invented
um and that one has six different CVS
running against it I think version of
PHP has 633.
so if you're over sharing information
you can take that information straight
to Google and instantly find
vulnerabilities
now a lot of folks think okay cool
that's security throughout security
hiding that information if you're right
but that's a good thing if you have any
sort of incident detection software in
place
are you going to detect somebody who's
sitting there banging on your server
trying to figure out what you're running
or somebody who found a nice CVSs V10 or
basically 10 severity to get directly
into your server that was probably a lot
better of an aid attack
so like I'm picking on PHP
iis.net
nginx Apache all these different web
servers in several languages
they also have CVS as well although
nginx at present has very few of them at
least based on my research if he has
them differently let me know but
so casual Googling got me to that uh
that answer
so I'm going to be uh reintroduce myself
again now apparently for the third time
I also built a site called header
inspector.com
and I also like hearing ATMs
I thought that was a clever photo for
this
it was actually pretty heavy and I
didn't even have the safe on me
so how do we inspect headers so the
started out is for Rapid seven I was
writing a Blog on HTTP headers and I
decided to write a script that would go
and just pull out a bunch of headers and
collect them and aggregate the
information
so that started up fine but then I
realized this was actually kind of
useful
so first thing I did is I changed it so
I was doing just a head request
what pulled out a bunch of sites
realized that not anybody supports had
requests which returned Just Tires
I was hitting 405 406 and so not
implemented method not allowed things
like that
and so I ended up doing something to
change it back to get which increased
how much data I was pulling down every
time I had a site and stored everything
in SQL
thank you
um the first scoring system I built if
you had a header set I would give you a
point if you didn't I would take a point
away
the problem with that is I was giving
you a point if you had something like
cfp headers set which is good I was
taking away a point if you didn't have
cash control and those two are just not
on the same tier at all CSP headers will
get into what those are if you're not
familiar already
so I figured it into a weighted system
so now I can say cookies are less
important or now cash controller that's
important and individual attributes
carry a certain weight as well
and who here has actually wrote PHP
okay we're doing four or five people
php.net docs how many times have you
seen people do user land reinventions of
the exact same thing like hey here's the
echo function and here's my userland
implementation of that
everybody does it so I decided I was
going to invent my own request Handler
or browser a client or how you want to
call that to go and pull down this
information for people's sites
that was a bad idea it was it was very
problematic and so I ended up just
moving to Kernel he was php's curl
library to just go and pull things down
also if you know PHP well enough
um it's not very good at synchronous
calls so pulling down sites I was doing
one at a time or having multiple request
handlers go in cold out this information
I also modularized it so I made a nice
little class instead of my giant
procedural monolithic script I pounded
out to get things done so I made it a
little bit prettier
where it stores the actual base it
stores all the functions it handles all
the output scoring output text messages
so if you go and run it The Messengers
are coming out of that code right there
for cookies at least
foreign
Direction there we go
so if you live in northern Northern
Hawaii or maybe even talk to Wisconsin I
have no idea how big com that is uh I
used to set a couple of sites that I
worked for powered by Hunter's comment I
thought it was pretty clever so there is
a billion dollar chicagoland-based
company running X powered by ComEd
inside of their headers on some pages
not all of them
so by the Numbers uh what I did is I
went and
aggregated the Mazda 500 which is pretty
accurate pretty up to date
and the Alexa top million of course you
can't really get a current copy of that
or at least I wasn't clever enough to so
I went to GitHub found an old version
and I ran that through my uh to my tool
so I ran 675
973 a number so you did reps
uh found two bad languages we're talking
profanities and the database was 14 gigs
in size
well I don't have to represent my house
anymore because I I just I guess I'm not
in that chair anymore so all this is in
digital ocean
and I crashed my uh droplet
so I let this thing run overnight woke
up in the morning my data was gone
thankfully I already had everything
pretty much backed up ready to go and I
was able to restart it
and expand the droplet but that was
Learning lesson don't let things run
overnight but just like grab things from
the interwebs
and it was very cheap droplet
so what do I mean by bad languages
we got some edgy ones in there some uh
server and I don't know maybe they so if
you look at uh
some sites your request with
digitalocean they'll see the as where
it's coming from and they'll just block
it they're like hey I don't want you
requesting my stuff because you're
probably attacking me they're probably
right
so I'm guessing these response however
put there as a response to them having
malicious activity in the past I have no
idea but it was entertaining nonetheless
so just like nobody's streaking through
the room right now although it would
make my talk a lot more interesting
interesting uh indecent exposure so
93.42 of what the websites out of skin
these top million sites
we're exposing what server they're
running
so that's that's pretty high and it's
also probably skewed for a few reasons
one Apache does not let you remove the
server colon Apache header
so that's part one part two is that if
I'm responding to see cloudflare Cloud
flare runs a lot of the West currently
that is also counted as a server header
I didn't go through and like pick this
one should count this one should
language version 34.28 of those we're
exposing what server software they are
running so php.net whatever else
via X powered by
and finally the OS versions of Ubuntu
windows or whatever else people use for
computers uh is showing up 38.75 of the
93 percent
so I mean that's kind of a lot right I
mean these are all large web
applications sharing this information
I'm not scanning geocities
a couple left sorry
this hair used to be full right here
that's how old like geocities is
um so I've seen ciphertown last night or
the night before I think that a 44.29
fail now is that a problem
probably not I mean cycle doesn't host
PCI HIPAA fur Bond much pii I mean the
pii it does have is the speakers names
and like I'm cool if you put my name in
there so that's not that important now
if you're Amazon account or your bank is
sitting there without hsts header set or
similar that's probably an issue
so what can we do about it
you can suppress the headers
so what you do is you telepathy hey
don't leak my server signature what that
does it says okay cool your directory
listing Pages your 404 403 don't say
Apache 2.4 about 2204 right
you also tell PHP or the languages not
to link the X powered by that's cool
um fun fact I had to move this side
around a couple times and up until a
couple days ago I actually had directory
indexing turned on on this box
so you kind of like stolen my sweet
images which are all pretty light and
handcrafted but yeah that was uh that
was a fun security finding if I own like
what happens if I do take the file off
and just look at that
cool so uh Apache as I mentioned is a
rule breaker the only way to remove sir
call an Apache out of the headers is to
recompile it
or if you run behind a reverse proxy or
something else to mask it but then at
that point is it really the direct
server probably not
uh IIs engine X
any other server tend to allow you to
remove it which is nice
also headers are there to inform so
whether it's HTTP s or not content
sources refer headers and frame ability
who knows that image
all right all right we've got some two
frame Roger Rabbit I'm uh in my later
30s and I still freak out think about
the acid scene because what I'm talking
about it's pretty rough and I think it
was like four when I saw that
all right so the first one this is
probably one of the more boring ones so
you're definitely familiar with this
cast control and pragma these headers
are from the 90s they've gone around
forever
um what this does it tells things
between the web server serving it and
you if it isn't how they should catch it
for how long so for example when you
make a request to a server there might
be caching as part of that language or
there might be something at the edge
like AJ proxy or some sort of caching
uh proxy there right
your ISP might have a proxy that caches
that as well especially if it's AOL
browser in about 2003. they used to do a
lot of that back before https
your local cash you might have squid
maybe you're in the middle of nowhere
and you have HughesNet and you're just
trying to catch all these images
that way when you re-request them you're
not requesting that logo a bunch of
times it makes sense
and finally your browser is cached
so if we're trying to cash your banking
information
that's probably a bad thing we want you
to make fresh requests every time you're
looking for that information but if it's
an image like a logo or whatever kind of
images you might like on the internet it
might be better to Cache into their
search quicker
another one is hsts or HTTP strict
Transport Security so when you request a
web application traditionally you hit
Port 80. whether you like it or not it
goes support 80 Sam's browsing such as I
do differently that part 80 says hey we
like security go to 443 now you're on
the secure protocol https
hsts
something nice where it informs a
browser I don't ever want you to support
the HTTP request for this duration of
time
so let's get a look at what that looks
like that's a typical nice header that's
my header that's why I call it nice
um max save Sharon is in seconds and
sets two years so for two years from the
last request I can't change my site to
http which is cool because I really
don't plan on changing that
um I also include sub domains so
www.henry inspector how to inspector
psych.com whatever else it is are all
encompassed in this hsts setting
and we do pre-loading so I'm going to
jump back aside to the one with the
image
that's
hstspreelab.org so Google runs that and
what that does is it allows you to
pre-load
and hard code
your site into a list that they'll use
when you're looking for https sites
so that's cool because now they know
right off the bat as soon as you get a
request it's already secure
content security policy this one's huge
this one replaces a lot of older ones
xss protection if you guys remember that
one that was kind of an Internet
Explorer this ask one
um what this does it says can I inline
my script so if you're familiar with how
a cross-site scripting attack works a
lot of times you'll start the URL bar
and it will affect the pages style sheet
or JavaScript or something similar to
allow cookies after whatever else you're
going for
if you tell that I can inline code
through the CSP that's going to fix that
problem for you
you can also specify what sources it
comes from so for example if I'm using
Google fonts
you can specify that here if I'm not
we'll do in one of the third parties you
use Google fonts probably not important
but if they're saying Bob's evilsite.com
which I don't know and then hosting a
bad font there I can inject that I don't
know I don't know what attack factors
exist we have fonts but I'm sure they
exist because computers
um let's see what else
so you have options for blocking which
means if this if there's a violation of
your CSP it will block that request so
if I'm trying to go off site to get a
font or an image or a script or a style
sheet
it will just block that
I'm jumping a little ahead in my head
here
um
which is certainly helpful it's
difficult for me to 100 inspect though
so my site doesn't go very far into that
because how do I know what resources
your site needs unless I literally call
your entire site at that point like I
don't know the laws I don't have time to
build a crawler that's going to do all
of that information
and give away for free because the
site's free like I'm not trying to make
money
so here's Facebook's content security
policy that's kind of a wreck
but it works you can see inside there I
used different colors the default Source
says I don't care what type of request
it is these are safe domains so Facebook
FBC the end whatever else
images are a little bit smaller uh
you'll see in we've got images connect
connect is for XML HTTP request and
similar or if you're using uh whatever
jQuery uses to do requests I'm drawing
the blanket right now but it helps
suggest where that is allowed to connect
to
content security policy Dash report
naturally just knocks on you right it
doesn't actually stop the attack
so if your organization is trying to
roll out CSP headers and you are very
opinionated about how you roll it up but
you don't know your application well
it's just been a break for people
you put it in report only it's going to
take a nice Json blob lab it over the
fence to a URL that you specify you
could track that and then use that to
later on
go through and say Hey you know I need
to adjust or add these domains or I keep
on getting attacked by this ipu whatever
it might be
extreme options so a little fun
backstory back a long time ago I decided
to make an in-browser operating system
which we all know is just kind of a joke
especially with JavaScript assembly
there's probably something you can do I
quite literally made a text editor with
the text area I made a calculator and I
made a browser with a frame and a little
input box
and I realized that I could go and hit
all these geocity sites no problem they
would get framed in my little web
browser no problem but what I couldn't
do is Google I couldn't figure out why I
can't type google.com and pull up in my
fake little browser well back then
Google was setting it where you could
not frame their site
so when you frame a site what you could
potentially do is use absolute
positioning of elements to put input
boxes over the top of login elements
so if somebody is trying to it's called
click jacking right if you go in there
and try to log into a site you're like
oh cool this looks like the default
login but it goes to my site
that's a problem so you have two options
for extreme options
you have deny and you have the same
origin deny means nobody could frame it
that's probably what you're going to use
unless it's you know 20 years ago
or you have same origin meaning your
site can
frame it but if you don't have that
excited at all everybody can frame your
site
something else that I mentioned in a
previous slide
RFC 6648 says that the to drop the X
prefix from non-standard headers
because standards are like the xkcd
uh cartoon
we have technical debt versus a best
practice of problems so this header
still has an X before even though since
2012 they said to drop the X on it
refer policy so this one is interesting
because traditionally what you would do
is you would go to a website click a
link so think in terms of forums or
Facebook or whatever and it will go to
another site and it will share where you
just came from
if you're on Dodge bank.com forward
slash account number and then I decided
to click off there to go somewhere else
they would theoretically have your
account number now there are some
exceptions there but if it was going
from the https site to http or to
another https it would not send those
headers over which is
nice
nowadays you can actually be a bit
opinionated on it so no referrer says I
don't care nobody should suddenly refer
from my site to anywhere else
a lot of people build security
applications and say oh my check refer
and make sure this request came from my
domain you want to use like cross-site
requests Mercury tokens for that you
don't want to use headers because
they're pretty simple to spoof
um you can start to strict origin one
cross origin that's not only a mouthful
I think it's about a terabyte to send
over the wire but it's still shorter
than the content security policy
but this is a default setting today so
don't send it to a protocol that is less
secure than the one you're currently on
so https down to http
and finally unstable URL so just like
PHP we got to have a very unsafe
dangerous option LOL security it's got
like Oprah with headers you get a header
if you get a header and you know it just
pans out to everybody
foreign
policy so I just came across this site
last night when I was bird watching
it's a bad joke
um controls what features your site
actually needs to use when you use it
right those permissions policy.com site
actually does a great job of building a
permissions policy so if your site
doesn't need to access my camera
you can specify that inside of the
headers
then when later somebody is attacking
your site or doing something to your
site to manipulate what it's requesting
the headers already specified they can't
go and exceeded look for GPS locations
or cameras or whatever else your site
May request
so this one will say hey accelerometer
autoplay and Battery how to play for
some content types you are allowed to be
used by the site however the camera is
not allowed
now Facebook metaverse Instagram
whatever they call it today
um likes access cameras regardless I'm
sure that they probably allowed their
commissions policy if they have one but
that's what that one's for
all right so useful header attributes so
I talked primarily about just headers
now when you think in terms of cookies
there are three attributes inside of
every size expires in value and
key right
first one is HTTP only
that one is a weird name book because
you think like who's going to use HTTP
only cookies
that does allow https as well I should
be clear about that what that doesn't
allow you to do is document.cookie to go
and pull a cookie out of a browser so it
enforces that is only sent across HTTP
protocol
not a not through JavaScript that helps
with crossover closing across a
scripting where people are trying to
steal cookies
the next one is secure that one is https
only which they don't call it that it's
called secure it because standards
so this one will only allow your cookie
to be transmitted over https so if some
parts of your web application are HTTP
for example if you have a good old mixed
content or the site is secure but you
have an image that isn't secure
traditionally that cookie would have
been sent along with that and for if
anybody doesn't know what a cookie is or
session is is basically your driver's
license from the interwebs so I can send
along somebody can identify you as your
current session or state within the
application
so that's kind of a problem because if I
could post an image to a site and pull
your cookie and your cook is transmitted
as part of that I could potentially get
into your account
and finally the same site this one's
viewer it's not used as often what that
does is it controls how cookies are
propagated between requests
so if I'm going from Bob's Bank to Bob's
Bank
that cookie is going to persist when I
land on that second page
if I'm going from Bob's evil Bank to
Bob's Bank
then I have same sites at the strings
what will happen is it will actually
remove those cookies so it will be set
to a not plugged in page
any questions on that so far
I'm doing towards the end so you start
thinking about questions okay
difficult ones too
so what's next what am I going to what
am I planning for the future of this it
has been stagnating for a little while
now
um it has
been saying for about two years but I
want to build in an API it already has a
fully functional API under the sheets I
just neglected adult Swagger dot for it
anybody who works with security
orchestration or automates things which
is probably everybody who's a developer
probably some security folks
probably a lot if I do folks you could
send automatic requests and just pull
this thing continuously or anytime you
do deployment and go and check and see
how are our headers if we forget
something do we forget to turn off
directory indexing like I did in mind
um what else
so it's getting beyond the better host
what it is if you post a request to this
it doesn't check the URL you've given it
goes to the base host requests that and
checks those headers it was easier to
basically contain the flow of where we
were going so if I wanted to see okay
every time you make a request your score
gradually goes up which you would be
surprised at how often that actually
happens and people actually use this as
a tool to fix things
um I can check that if I'm getting a
bunch of random URLs you might be
handling different parts or subdomains
or scripts on your site differently
which would impact results
also does this support any sort of
internal requests currently I might make
a Chrome extension I might not but
right now if you have inter or company
dot local I can't get to that because
it's not facing the internet unless you
like I don't know want me to come visit
you on your VPN
you probably don't want that either
um I won't go much beyond the header
inspection with it because there are gas
tools my cafe around seven I'm not
spamming but they make a pretty good
Dash tool themselves
so uh you can always dig into that
and finally better to find permissions
policy so I feel like we could probably
do a lot more work with that already
instead of just saying you have it it's
great and move on
but it falls into the same category as
content security policy where it's kind
of hard to check
what you're actually using with a new
robot application if you don't specify
it
Chicago
might be a little quick be a little
quick but
cool any questions
any thoughts anybody want to make fun of
PHP with me
I love it by the way
that's not even one it's because it's
lunch
it's doing you got to show up to my talk
well I appreciate that
there's no extra questions or anything
else that's pretty much all I have on
hunters for today
thank you
right here
foreign