「w3afでWeb脆弱性スキャンをやってみる」では、w3afを使ってWeb脆弱性のスキャンを行った。 Web脆弱性のスキャンツールには、w3afの他にArachniがある。 ArachniはヘッドレスブラウザPhantomJSを利用しており、高精度な脆弱性テストを行うことができる。ここでは、Arachniを使ったWeb脆弱性のスキャンをやってみる。

環境

Ubuntu 14.04.3 LTS 64bit版、Docker 1.9.1

$ uname -a
Linux vm-ubuntu64 3.19.0-25-generic #26~14.04.1-Ubuntu SMP Fri Jul 24 21:16:20 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux

$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 14.04.3 LTS
Release:        14.04
Codename:       trusty

$ sudo docker version
Client:
 Version:      1.9.1
 API version:  1.21
 Go version:   go1.4.2
 Git commit:   a34a1d5
 Built:        Fri Nov 20 13:12:04 UTC 2015
 OS/Arch:      linux/amd64

Server:
 Version:      1.9.1
 API version:  1.21
 Go version:   go1.4.2
 Git commit:   a34a1d5
 Built:        Fri Nov 20 13:12:04 UTC 2015
 OS/Arch:      linux/amd64

脆弱性のあるWebアプリケーションを用意する

まず、SQL injection脆弱性のあるWebアプリケーションを用意する。ここでは、「脆弱性テスト・学習用Webアプリケーションのメモ」にも書いたDamn Vulnerable Web Application (DVWA)を利用することにする。

Dockerイメージを使い、localhostの80番ポートからDVWAにアクセスできるようにするには次のようにする。

$ sudo docker run -d -p 80:80 citizenstig/dvwa

コンテナが起動したら、ブラウザからhttp://localhost/にアクセスすることでDVWAのトップページが表示される。

初期状態ではMySQLテーブルが作成されていないので、トップページの指示に従いテーブルを作成する。その後、ログイン画面からadmin/passwordでログインを行う。さらに、「DVWA Security」のページからSecurity Levelをデフォルトのhighからlowに変更しておく。

Arachniのダウンロード

公式サイトのDownloadページに従い、Arachniをダウンロードする。

$ wget https://github.com/Arachni/arachni/releases/download/v1.4/arachni-1.4-0.5.10-linux-x86_64.tar.gz
$ tar xvf arachni-1.4-0.5.10-linux-x86_64.tar.gz
$ cd arachni-1.4-0.5.10

ArachniでWeb脆弱性スキャンをやってみる

Arachniでは、さまざまな種別の脆弱性スキャンを行うことができる。スキャン種別のリストは、次のようにして調べることができる。

$ bin/arachni --check-list
Arachni - Web Application Security Scanner Framework v1.4
   Author: Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>

           (With the support of the community and the Arachni Team.)

   Website:       http://arachni-scanner.com
   Documentation: http://arachni-scanner.com/wiki




 [~] Available checks:

(snip)

 [*] sql_injection:
--------------------
Name:           SQL Injection
Description:
SQL injection check, uses known SQL DB errors to identify vulnerabilities.

Severity:       High
Elements:       link, form, cookie, header, link_template, json, xml
Author:         Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
Version:        0.2.3
Path:   /home/user/tmp/arachni-1.4-0.5.10/system/gems/gems/arachni-1.4/components/checks/active/sql_injection.rb

(snip)

上に記したsql_injection以外にも、xssやos_cmd_injectionなどがある。これらをまとめてスキャンすることもできるが、時間がかかる上に不正確な結果となる場合もあるため、ここでは単一の種別のみを選択してスキャンすることにする。

事前に、ログイン済みのブラウザの開発者コンソールなどからCookieの値を調べておく。

> document.cookie
"PHPSESSID=betdbm3fogs180hulbtff53i36; security=low"

調べたCookieの値をもとに、SQL injection脆弱性のスキャンを行うには次のようにする。なお、スキャン対象としてhttp://localhost/を指定することができないため、ここではホストが持っているアドレスをもとにhttp://192.168.56.2/に対してスキャンを行っている。また、--scope-auto-redundant=2で探索ページ数の削減、--scope-exclude-pattern logoutでログアウトページへのアクセスの除外を行っている。

$ bin/arachni http://192.168.56.2/ --checks=sql_injection --scope-auto-redundant=2 --http-cookie-string="PHPSESSID=betdbm3fogs180hulbtff53i36; security=low" --scope-exclude-pattern logout
Arachni - Web Application Security Scanner Framework v1.4
   Author: Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>

           (With the support of the community and the Arachni Team.)

   Website:       http://arachni-scanner.com
   Documentation: http://arachni-scanner.com/wiki


 [~] No element audit options were specified, will audit links, forms, cookies, UI inputs, UI forms, JSONs and XMLs.

 [*] Initializing...
 [*] Preparing plugins...
 [*] ... done.
 [*] BrowserCluster: Initializing 6 browsers...
 [*] BrowserCluster: Spawned #1 with PID 2390 [lifeline at PID 2387].
 [*] BrowserCluster: Spawned #2 with PID 2413 [lifeline at PID 2410].
 [*] BrowserCluster: Spawned #3 with PID 2436 [lifeline at PID 2433].
 [*] BrowserCluster: Spawned #4 with PID 2459 [lifeline at PID 2456].
 [*] BrowserCluster: Spawned #5 with PID 2482 [lifeline at PID 2479].
 [*] BrowserCluster: Spawned #6 with PID 2505 [lifeline at PID 2502].
 [*] BrowserCluster: Initialization completed with 6 browsers in the pool.

 [*] [HTTP: 200] http://192.168.56.2/
 [~] Identified as: linux, apache, php
 [~] Analysis resulted in 18 usable paths.
 [~] DOM depth: 0 (Limit: 5)
 [*] SQL Injection: Auditing link input 'page' pointing to: 'http://192.168.56.2/vulnerabilities/fi/'
 [*] SQL Injection: Auditing link input 'page' pointing to: 'http://192.168.56.2/vulnerabilities/fi/'
(snip)
 [~] BrowserCluster: Pending jobs: 2
 [~] BrowserCluster: Pending jobs: 1


================================================================================


 [+] Web Application Security Report - Arachni Framework

 [~] Report generated on: 2016-02-20 12:58:10 +0900
 [~] Report false positives at: http://github.com/Arachni/arachni/issues

 [+] System settings:
 [~] ---------------
 [~] Version:           1.4
 [~] Audit started on:  2016-02-20 12:57:27 +0900
 [~] Audit finished on: 2016-02-20 12:58:10 +0900
 [~] Runtime:           00:00:42

 [~] URL:        http://192.168.56.2/
 [~] User agent: Arachni/v1.4

 [*] Audited elements:
 [~] * Links
 [~] * Forms
 [~] * Cookies
 [~] * XMLs
 [~] * JSONs
 [~] * UI inputs
 [~] * UI forms

 [*] Checks: sql_injection

 [*] Filters:
 [~]   Exclude:
 [~]     (?i-mx:logout)

 [~] ===========================

 [+] 2 issues were detected.

 [+] [1] SQL Injection (Trusted)
 [~] ~~~~~~~~~~~~~~~~~~~~
 [~] Digest:     2260652924
 [~] Severity:   High
 [~] Description:
 [~]
Due to the requirement for dynamic content of today's web applications, many
rely on a database backend to store data that will be called upon and processed
by the web application (or other programs).
Web applications retrieve data from the database by using Structured Query Language
(SQL) queries.

To meet demands of many developers, database servers (such as MSSQL, MySQL,
Oracle etc.) have additional built-in functionality that can allow extensive
control of the database and interaction with the host operating system itself.

An SQL injection occurs when a value originating from the client's request is used
within a SQL query without prior sanitisation. This could allow cyber-criminals
to execute arbitrary SQL code and steal data or use the additional functionality
of the database server to take control of more server components.

The successful exploitation of a SQL injection can be devastating to an
organisation and is one of the most commonly exploited web application vulnerabilities.

This injection was detected as Arachni was able to cause the server to respond to
the request with a database related error.

 [~] Tags: sql, injection, regexp, database, error

 [~] CWE: http://cwe.mitre.org/data/definitions/89.html
 [~] References:
 [~]   UnixWiz - http://unixwiz.net/techtips/sql-injection.html
 [~]   Wikipedia - http://en.wikipedia.org/wiki/SQL_injection
 [~]   SecuriTeam - http://www.securiteam.com/securityreviews/5DP0N1P76E.html
 [~]   OWASP - https://www.owasp.org/index.php/SQL_Injection
 [~]   WASC - http://projects.webappsec.org/w/page/13246963/SQL%20Injection
 [~]   W3 Schools - http://www.w3schools.com/sql/sql_injection.asp

 [~] URL:        http://192.168.56.2/vulnerabilities/sqli/
 [~] Element:    form
 [~] All inputs: id, Submit
 [~] Method:     GET
 [~] Input name: id

 [~] Seed:      "\"'`--"
 [~] Injected:  "1\"'`--"
 [~] Signature: You have an error in your SQL syntax;
 [~] Proof:     "You have an error in your SQL syntax;"

 [~] Referring page: http://192.168.56.2/vulnerabilities/sqli/

 [~] Affected page:  http://192.168.56.2/vulnerabilities/sqli/?id=1%22'%60--&Submit=Submit
 [~] HTTP request
GET /vulnerabilities/sqli/?id=1%22%27%60--&Submit=Submit HTTP/1.1
Host: 192.168.56.2
Accept-Encoding: gzip, deflate
User-Agent: Arachni/v1.4
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.8,he;q=0.6
Cookie: PHPSESSID=betdbm3fogs180hulbtff53i36;security=low



 [+] [2] SQL Injection (Trusted)
 [~] ~~~~~~~~~~~~~~~~~~~~
(snip)
 [+] Plugin data:
 [~] ---------------


 [*] Health map
 [~] ~~~~~~~~~~~~~~
 [~] Description: Generates a simple list of safe/unsafe URLs.

 [~] Legend:
 [+] No issues
 [-] Has issues

 [+] http://192.168.56.2/
 [+] http://192.168.56.2/about.php
 [+] http://192.168.56.2/dvwa/css/help.css
 [+] http://192.168.56.2/dvwa/css/main.css
 [+] http://192.168.56.2/dvwa/css/source.css
 [+] http://192.168.56.2/dvwa/js/dvwaPage.js
 [+] http://192.168.56.2/favicon.ico
 [+] http://192.168.56.2/ids_log.php
 [+] http://192.168.56.2/instructions.php
 [+] http://192.168.56.2/phpinfo.php
 [+] http://192.168.56.2/security.php
 [+] http://192.168.56.2/setup.php
 [-] http://192.168.56.2/vulnerabilities/brute/
 [+] http://192.168.56.2/vulnerabilities/captcha/
 [+] http://192.168.56.2/vulnerabilities/csrf/
 [+] http://192.168.56.2/vulnerabilities/exec/
 [+] http://192.168.56.2/vulnerabilities/fi/
 [-] http://192.168.56.2/vulnerabilities/sqli/
 [+] http://192.168.56.2/vulnerabilities/sqli_blind/
 [+] http://192.168.56.2/vulnerabilities/upload/
 [+] http://192.168.56.2/vulnerabilities/view_help.php
 [+] http://192.168.56.2/vulnerabilities/view_source.php
 [+] http://192.168.56.2/vulnerabilities/xss_r/
 [+] http://192.168.56.2/vulnerabilities/xss_s/

 [~] Total: 24
 [+] Without issues: 22
 [-] With issues: 2 ( 8% )

 [~] Report saved at: /home/user/tmp/arachni-1.4-0.5.10/192.168.56.2 2016-02-20 12_58_10 +0900.afr [0.01MB]

 [~] Audited 58 pages.

 [~] Duration: 00:00:42
 [~] Processed 489/489 HTTP requests.
 [~] -- 43.428 requests/second.
 [~] Processed 116/116 browser jobs.
 [~] -- 1.0 second/job.

 [~] Currently auditing          http://192.168.56.2/vulnerabilities/xss_s/
 [~] Burst response time sum     0.136 seconds
 [~] Burst response count        13
 [~] Burst average response time 0.01 seconds
 [~] Burst average               2.317 requests/second
 [~] Timed-out requests          0
 [~] Original max concurrency    20
 [~] Throttled max concurrency   20

上の結果から、二つのページでSQL injection脆弱性が見つかったことがわかる。スキャン結果は拡張子afrのファイルとして記録されており、次のようにしてHTML形式のレポートに変換することができる。

$ ls
192.168.56.2 2016-02-20 12_58_10 +0900.afr  bin/  LICENSE  README  system/  TROUBLESHOOTING  VERSION

$ bin/arachni_reporter "192.168.56.2 2016-02-20 12_58_10 +0900.afr" --reporter=html:outfile=report.html.zip
Arachni - Web Application Security Scanner Framework v1.4
   Author: Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>

           (With the support of the community and the Arachni Team.)

   Website:       http://arachni-scanner.com
   Documentation: http://arachni-scanner.com/wiki



 [*] HTML: Creating HTML report...
 [*] HTML: Saved in 'report.html.zip'.

$ unzip -d report report.html.zip

HTML形式のレポートのスクリーンショットを次に示す。

f:id:inaz2:20160220141823p:plain