- So Ron, we have an entire lesson dedicated
to hacking web applications,
why are we focusing so much on the web?
- Well, I'm sure you know
every day a new website comes online,
a new web application is being used.
Just think about Facebook.
Years ago Facebook was very small, it was not being used.
Now millions and millions of people use it
across the internet, right?
The other part of it too is that a lot of these sites
are not as secure as they should be
and that's why they lead to major data breaches.
Because usually the data, the content,
is stored in a back-end database and that can be
accessible through the web application if it's vulnerable.
Thinking of that, web applications have been around forever.
Websites have been around forever,
as long as the internet just about.
Why are we still dealing with vulnerabilities like this?
- That is a good question.
Every year, every day,
we're adding more functionality to these websites.
So as we add more functionalities
there is more risk involved as well.
A lot of times these applications
are developed and pushed out before
security teams have a chance to review them.
More and more people are using them
so the demands are keep adding more functionality
and pushing out faster as is happening
more and more rapid,
so it's hard to actually get a chance to secure them all
before they're actually put out there.
Additionally, a lot of these websites,
once the single one is compromised,
people always reuse their passwords on other sites as well.
So if your account was compromised in the Adobe breach
or the LinkedIn breach,
chances are you probably reused that password
on one of the other websites,
so that's how once one website is compromised,
others tend to follow suit as well.
- That's true.
Before we begin to talk about hacking a web application,
we first need to understand what it is that we're hacking.
A web application is a GUI front-end
to a web service that's running on a web server.
It's the graphical interface
you see rendered in your browser when you surf the web.
On the other hand, a web service is
an interface for a web server to
programmatically inter-operate between different servers,
mobile applications, APIs.
From a web services perspective,
they're typically used for
transferring pieces of data between applications.
The data is rendered elsewhere or
used in some other fashion.
Web applications are intended to be
the full GUI-based application accessible via a browser.
The data is actually rendered in the browser itself.
Whereas with web services, you can also provide
APIs that can be used to programmatically inter-operate
with web applications and mobile applications.
The web application will normally have a GUI front-end
and a database back-end.
It will include buttons for submitting commands,
it will also have input fields
to enter information into the database,
as well as a way to search and
pull information from the database.
From an attacker perspective, these are all targets.
In this demo, we're going to take a look
at a typical web application.
This is actually a web application
that we'll be using in our demo labs going forward.
It's a typical web shopping cart application.
However, this one is a purposely vulnerable application
that was built for testing and demonstration purposes.
It is built and maintained by Rapid7.
You can actually download the source code
and install it on your own lab for testing.
So as you can see, it looks like a normal shopping site.
It has search capabilities,
as well as user input in a few different forms.
For instance, the contact form,
here.
We can enter our information here.
There's also a place to add reviews to the different items.
And the shopping cart gives us the ability to change
the quantities before we add to the cart.
So we'll keep this in mind, because this is something
that we may want to look at attacking later.
So from an attacker perspective,
these are all things that we can target.
Every input, every modification that we can make
in the application that's sent back to the web server,
is something that we can modify and target.
From an application security perspective,
this is a large attack surface to defend.