Loading

Impact can differ based on the exploitation and the read permission of the web server user. Depending on these factors an attacker might carry out one or more of the following attacks:

• Gather usernames via /etc/password file
• Harvest useful information from the log files such as /apache/logs/error.log or /apache/logs/access.log
• Directly run commands by using functions like "echo" to create script files

Significant attacking skills are required because there is no tool or automated way to exploit this type of vulnerability. The attack consists of three phases. Detecting the vulnerability, then finding malicious code (or if possible create one, by uploading an image, etc.) on the targeted system and finally including that code via the identified vulnerability to run it. Generally the attacker needs to find the physical path of server access logs or needs to upload an image to server or abuse /proc/self/ functionality in Linux systems where possible. CloudScan Local File Inclusion 1-2-3 Step Process to Executing LFI Exploit Proof of Concept:

Local File Inclusion Exploit Instructions: 3 Step Manual Process

STEP 1 - Harvest /etc/passwd

Step 2 - Display a System Log File

Step 3 - Create a Local File; Include in URL LFI Exploit Completed XSS.CX of Applications used in wide scale deployment is ongoing. Research is focused on Applications used for Internet Service Provider (ISP) Operations. Target Platform Example: Plesk Parallels, Hosting Controller, Merak Mail, SmarterMail, SmarterTools and the related products bundled with these Applications and the Payment Platforms such as PayPal and Authorize.net focusing on Personal Information (PI) Laws and PCI Compliance. --------------------------------------------- All works and exhibits are released under Creative Commons with Attribution. You may use our Proof of Concepts (PoC), Code or Frameworks for private use, education or commercial profit. Please attribute any original exhibits to Hoyt LLC | http://hoytllc.com. --------------------------------------------- XSS.CX for Vulnerability Scanners and SAMATE Reference Dataset from the NIST. XSS.CX | Software Assurance Metrics and Penetration Test Evaluation: These are the coverage areas Hoyt LLC provides for Clients and Research for Manual Penetration Testing in addition to Vulnerability Scanner coverage: Hoyt LLC Research is provided to CERT, NIST, SMATE and DHS for use in the National Vulnerability Database and can be found with references at MITRE, Secunia, EDB, OSVDB, IBMand dozens of Academic and Research Institutions. XSS.CX is focused on: SANS Top 20 CWE Top 25 Cyber Security Engineering With emphasis on technical areas such as: CWE-22 - Path Traversal CWE-78 - OS Command Execution CWE-79 - Cross Site Scripting CWE-89 - SQL Injection CWE-209 - Information Exposure Through an Error Message CWE-285 - Improper Access Control (Authorization) CWE-306 - Missing Authentication for Critical Function CWE-362 - Race Condition CWE-732 - Incorrect Permission Assignment for Critical Resource CWE-770 - Allocation of Resources Without Limits or Throttling CWE-807 - Reliance on Untrusted Inputs in a Security Decision Personal Information Laws MASS 201 CMR 17 FTC Red Flag Rule ( and related) HIPAA PCI Compliance The OWASP Top Ten 2010 RC1, released in late 2009, is a valuable document for developers. Its focus is on web applications, and it characterizes problems in terms of risk, instead of weaknesses. It also uses different metrics for selection. In general, the CWE/SANS 2010 Top 25 covers more weaknesses, including those that rarely appear in web applications, such as buffer overflows. The following list identifies each Top Ten category along with its associated CWE entries. OWASP Top Ten 2010 RC1 2010 Top 25 A1 - Injection CWE-89 (SQL injection), CWE-78 (OS Command injection) A2 - Cross Site Scripting (XSS) CWE-79 (Cross-site scripting) A3 - Broken Authentication and Session Management CWE-306, CWE-307, CWE-798 A4 - Insecure Direct Object References CWE-285 A5 - Cross Site Request Forgery (CSRF) CWE-352 A6 - Security Misconfiguration No direct mappings; CWE-209 is frequently the result of misconfiguration. A7 - Failure to Restrict URL Access CWE-285 A8 - Unvalidated Redirects and Forwards CWE-601 A9 - Insecure Cryptographic Storage CWE-327, CWE-311 A10 - Insufficient Transport Layer Protection CWE-311