July 2019 Summaries

Gwendal Le Coguic's blog post offers a detailed tutorial on bypassing Cloudflare's Web Application Firewall (WAF) by identifying the origin server IP address. It highlights that Cloudflare, despite being a popular WAF provider used by over 16 million internet properties, can be susceptible to bypasses, emphasizing the need for continuous security testing. The post outlines methods to uncover the origin IP, such as leveraging DNS tools, examining mail headers, or exploiting XML-RPC pingbacks. It underscores the limitations of relying solely on WAFs, advocating for a combination of WAFs with other security measures like scanning tools to enhance web application protection. Detectify, a tool that uses crowdsourced hacker insights to test security, is recommended for users to reinforce their defenses. The article concludes by stressing the importance of identifying weak links in security configurations and invites readers to contribute additional strategies for bypassing Cloudflare protections.

The article serves as a comprehensive resource for both hackers and WordPress plugin developers to understand and address security vulnerabilities in WordPress plugins, such as Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF), and SQL injection. It emphasizes the importance of plugin security in the context of WordPress's extensive ecosystem, which includes over 55,000 plugins and powers a significant portion of the web. The article explains how WordPress hooks, such as actions and filters, can be leveraged by developers and highlights common pitfalls like improper use of is_admin(), which can lead to security issues. It also underscores the necessity of using WordPress's built-in functions for sanitizing and encoding data to prevent vulnerabilities. Additionally, the article provides insights into PHP Object Injection vulnerabilities and suggests using tools like RIPS for static code analysis to enhance plugin security. By understanding these vulnerabilities, developers can contribute to a more secure WordPress ecosystem, reducing the risk of exploits and enhancing the overall security posture of WordPress sites.

Blind vulnerabilities, which occur when an attacker receives no immediate feedback from a system, present unique challenges in cybersecurity. Detectify's scanner addresses these by employing methods like local systems analysis, time-based responses, and out-of-band detection. Local systems allow attackers to test vulnerabilities in a controlled environment without needing server feedback. Time-based detection involves manipulating server response times to infer vulnerabilities, though it's prone to false positives and can disrupt legitimate users. Out-of-band detection, preferred by Detectify, involves sending a unique ID to the server and waiting for an external request to confirm a successful exploit, minimizing false positives and allowing for more comprehensive data extraction. While blind vulnerabilities can be harder to detect, they do not diminish the potential impact, as they are variations of existing vulnerabilities, such as SQL injection or cross-site scripting (XSS). Detectify's automated web app scanner, which is available for a free trial, uses these sophisticated techniques to provide reliable results and enhance security against blind vulnerabilities.

Anne-Marie Eklund Löwinder, the CISO of The Internet Foundation in Sweden and a key holder for DNSSEC key generation, is a renowned figure in the cybersecurity field, inducted into the Internet Hall of Fame. Her journey into information security began with her curiosity and dissatisfaction with conventional roles, leading her to study computer science despite initial academic hurdles. Eklund Löwinder emphasizes the importance of baseline security, monitoring, and the collective responsibility of protecting personal and organizational information. She identifies common security oversights like lack of encryption and highlights the need for companies to understand the business implications of security risks. Eklund Löwinder also stresses the value of open-source security solutions and bug bounty programs, while advocating for a more inclusive work environment to attract more women into technical roles. Her role involves not only coordinating security efforts at her organization but also speaking at numerous events, discussing emerging threats like crypto-mining, and fostering collaboration with security researchers.

Content Security Policy (CSP) is a security feature that helps protect websites from header exploits and cross-site scripting (XSS) vulnerabilities by controlling which sources a browser can load resources from. By allowing web developers to specify trusted domains for different resource types, CSP provides an additional layer of defense against potential attacks. However, CSP does not prevent HTML injection or data leakage, and it requires careful implementation to avoid common bypass techniques such as callback exploits and misuse of content delivery networks (CDNs). Inline scripts and functions like eval pose vulnerabilities unless properly managed, and developers are advised to avoid enabling unsafe-inline and unsafe-eval features. To ensure proper CSP implementation, developers can use attributes like report-uri and report-to for generating reports on blocked activities, helping to identify policy misconfigurations or ongoing attacks. Throughout its deployment, CSP must be applied universally across all pages, including error pages, to prevent bypass attempts. Automated tools like Detectify can assist in scanning for vulnerabilities in response headers and help maintain robust web security.

Xavier Blasco, also known as Lerhan, is a 23-year-old security researcher who identified a significant security flaw in Jazztel's URL shortening system, which allowed unauthorized access to sensitive client contracts. After receiving a suspicious SMS link from Jazztel, Blasco used a tool called Gobuster to brute force potential URL combinations, revealing that Jazztel's system used only five-character shortened URLs, making them vulnerable to exploitation. This flaw enabled him to access contracts containing personal client information such as names, phone numbers, and national identity numbers. Recognizing the potential for widespread exposure, Blasco reported the vulnerability to Orange CERT, Jazztel's parent company, which quickly responded by increasing the URL path length to ten characters, effectively mitigating the risk of brute force attacks. This incident underscores the importance of implementing robust security measures, such as authentication, high-entropy strings, and rate-limiting, when using URL shortening systems for sensitive data.