title: authentication
date: 2016-01-13 14:33:22 categories: information-security tags: authentication ---- Exercise1
There are many bugs and vulnerabilities in the current utility for transferring money.
Find as many bugs as you can. For now, just focus on bugs that an adversary can trigger by giving unanticipated values to the transfer page. Think carefully about what kinds of inputs an attacker might provide, and try them out by entering them on the transfer page. Please write down detail descriptions of your observation in bugs.txt. (You should find at least 4 different bugs.)这个网站存在以下漏洞： (1)没有判断转账金额和自己余额的大小 (2)没有判断转账金额是否为负数 (3)没有判断被转入用户的余额上界 (4)没有判断转出用户的余额下界 (5)没有判断被转账用户是否存在
- Exercise2
- Fix as many bugs as you can
在handle.c文件中的handlePostTransfer函数中 我们添加一条判断输入是否合法的语句 来控制是否修改数据库里面的金额。 if(money<0 || !Db_checkUser(to) || strcmp(from, to) == 0 ||(money > fromBalace) || (toBalace + money <0)) { handlePostLogin (fd, from, 0, 0); return; } 实验结果显示：能成功阻止E1中的漏洞。 Exercise3
Read the source code of the login web page (in your browser),and the server's source code.
Make sure that you make it clear that how the server identify who is transferring.首先，一个新的用户登录 server将会接收fd 发送给httpd进程 然后httpd进程开始发分析客户请求 GET请求将会发送给filesv进程 POST请求将会发给banksv进程 在交易之前 banksv进程处理request请求的body部分 得到交易金额、人员等信息 然后开始更新数据库 我们可以发送POST请求 伪装request请求的body部分 就可以达到偷偷转账的目的
- Exercise4
Try to construct a POST request about the money transferring,
which steal money from some account if you know the victim’s account. You can use browser.c or some tools, such as firebug to construct the request.Char *req="POST / HTTP/1.1\r\nHost: 127.0.0.1\r\n Content-Type: application/x-www-form-urlencoded\r\n Content-Length: 72\r\n\r\n transfer_from=a&transfer_to=b&transfer_money=20&submit_transfer=Transfer\r\n";
- Exercise5
用户登录时候生成cookie， 用户操作账户金额时验证cookie的机制来保护信息不被恶意操作， 为了每次cookie的值都不是固定的，我们可以通过登录时间和用户名的组合产生cookie。 产生cookie之后，服务器发送cookie给浏览器， 进行转账交易之前，将post请求中的cookie与服务器中的cookie做比较， 相同则进行转账，不同则拒绝转账。 现在我们进行转账的时候，抓包工具就可以抓取到cookie字段了 其中： 服务器在用户登录时候产生cookie并发送至浏览器： productCookie(name,logintime); strcpy(cookieGet,cookie); write(fd,cookieGet,strlen(cookieGet)); 从浏览器中获取cookie： Header_t head=tree->headers; while(head) { if(strcmp(head->key,"Cookie:")==0) strcat(cookieGet,head->value); head=head->next; } 验证请求： if(validCookie(cookieGet,from)) { handlePostLogin(fd,from,0,0); return; } 生成cookie函数： char cookie[100]="Set-cookie:mycookie="; static char cookieGet[100]=""; //product cookie void productCookie(char *name,char *time) { int len=strlen(time); char cookie1[100]="\0"; char cookie2[200]="\0"; strcat(cookie2,name); strcat(cookie2,"#"); strncpy(cookie1,time,len-1); strcat(cookie2,cookie1); strcat(cookie,cookie2); strcat(cookie,";path=/;domain=127.0.0.1\r\n\r\n"); } 验证cookie函数： int validCookie(char *parameter,char *name) { char cookie1[100]=""; char cookie2[100]=""; int i=0; int k=0; int flag=0; if(parameter[0]=='\0') return 1; for(;i - Exercise6
- Using the Wireshark to steal the cookie, and then use the cookie to make fake POST request. Send the request to the server and transfer some one else's money.
- 抓包偷cookie
char *req="POST /index.html HTTP/1.1\r\n Host: 127.0.0.1\r\n User-Agent: Mozilla/5.0 Firefox/43.0\r\n Cookie: mycookie=a#Sun Dec 27 22:20:52 2015\r\n Connection: keep-alive\r\n Content-Type: application/x-www-form-urlencoded\r\n Content-Length: 72\r\n transfer_from=a&transfer_to=b&transfer_money=20&submit_transfer=Transfer\r\n";
- Exercise7
Encrypt the cookie
Cookie加密：我们的cookie是明文传输的，现在通过简单的加密函数，让其以密文的形式在网络中传输。 生成cookie的时候加密： key(cookie2); 验证cookie的时候解密： unkey(cookie1); void key(char *test) { int i; int count=strlen(test); for(i=0;i