Bo mt ng dng WEB

GVHD:Thy Nguyn Chin Trinh

Mc Lc1Mc Lc

31CHNG 1: GII THIU TNG QUAN V NG DNG WEB

31.1Khi nim v ng dng web(website widget hay web application)

41.2Cu trc,chc nng,giao din&nguyn tc hot ng c bn ca ng dng web

41.2.1 Cu trc c bn ca mt ng dng web

51.2.2. Giao din ca mt ng dng web

61.2.3 Chc nng c bn ca cc ng dng web

71.2.4Nguyn tc hot ng c bn ca mt ng dng web

71.2.5 Vn bo mt ng dng web

CHNG 2:CC K THUT TN CNG NG DNG WEB C BN

10A.L thuyt

101.KIM SOT TRUY CP WEB (Web Access Control)

102.CHIM HU PHIN LM VIC(Session Mangement)

112.1n nh phin lm vic (Session Fixation)

112.2 nh cp phin lm vic (Session Hijacking)

113 LI DNG THIU ST TRONG VIC KIM TRA D LIU HP L (INPUT VALIDATION)

113.1 Kim tra tnh ng n ca d liu bng ngn ng pha trnh duyt

113.2 Trn b m (Buffer OverFlow)

113.3 M ho URL (URL Encoding)

123.4 Vt qua ng dn (Path Traversal):

123.6 Thm cu lnh h thng (OS Command Injection)

123.7 Chn cu truy vn SQL (SQL Injection)

123.8 Ngn ng pha my ch (Server side includes)

123.9 Thao tc trn tham s truyn (Parameter manipulation)

133.10 T chi dch v (Denial of service (DoS))

13B, Cc cch trin khai tn cng ng dng web

131.Thao tc trn tham s

131.1THAO TC TRN URL

131.1.1 Khi nim

131.1.2 Cch khc phc

141.2. THAO TC TRN BIN N FORM

141.2.1 Khi nim

141.2.2. Mt s bin php khc phc

152 .K thut tn cng gy trn b m v t chi dch v (Buffer overflow)

152.1 Khi nim

152.2 Cc i tng b nh hng bi kiu tn cng ny

162.3 Cc kiu tn cng DDos

162.3.1 Kiu tn cng th 1

162.3.2. Kiu tn cng th 2

162.3.3. Kiu tn cng vo ti nguyn h thng

162.4 Cch phng chng

17Chng 3: TNG QUAN V GIAO THC S-HTTP

173.1Gii thiu

173.2Giao thc S-HTTP

183.2.1Tiu .

193.2.2Negotiation

203.2.3nh dng bn tin.

213.3Cung cp bo v

213.4im yu

22Ti liu tham kho

1 CHNG 1: GII THIU TNG QUAN V NG DNG WEB

1.1 Khi nim v ng dng web(website widget hay web application)Di gc chc nng, ng dng Web l cc chng trnh my tnh cho php ngi dng website ng nhp, truy vn vo ra d liu qua mng Internet trn trnh duyt Web yu thch ca h. D liu s c gi ti ngi dng trong trnh duyt theo kiu thng tin ng (trong mt nh dng c th, nh vi HTML th dng CSS) t ng dng Web qua mt Web Server.1.2 Cu trc,chc nng,giao din&nguyn tc hot ng c bn ca ng dng web 1.2.1 Cu trc c bn ca mt ng dng web M hnh ca mt ng dng web n gin chnh l m hnh MVC (Model - View - Controller).Tng Model: cha cc code connect ti database,truy vn v thm xa sa d liu.Tng View: cha cc code to giao din tng tc vi ngi dng, d liu c v ra nh th no

Tng Controller: cha cc code iu khin dng d liu (flow control), gn kt tng Mode v tng View li vi nhau.ng dng c chia thnh cc layer nh th s tng tnh reuse v d dng m rng. Chng hn nu chng ta mun ng dng c th truy xut trn di dng, chng ta ch cn to mt tng view mi ring cho di ng, tng model v controller khng thay di. Hay nu chng ta mun thay i database, vic cng d dng hn, ch cn ta to tng model mi, phn view v controller khng b nh hng. M hnh th hin quan h ca ba lp trong ng dng web:

Hnh 1. m hnh 3 tng ca mt ng dng web

Cn y l m hnh ca mt dch v ng dng web:

Hnh 2. M hnh dch v ng dng web n ginTng Presentation: c dng giao tip vi ngi dng, nhim v chnh l hin th d liu v nhn d liu t ngi dng.

- Tng Business Logic: nhim v chnh l cung cp cc chc nng ca phn mm.

- Tng Data: lu tr d liu, cho php lp Business Logic c th tm kim, trch xut, cp nht d liu. 1.2.2. Giao din ca mt ng dng web

Giao din web t ra rt t gii hn kh nng ngi dng. Thng qua Java, JavaScript, DHTML, Flash v nhng cng ngh khc, nhng phng php ch ng dng mi c nh v trn mn hnh, chi nhc, v dng c bn phm v chut tt c u c th thc hin c Nhng k thut thng thng nh ko th cng c h tr bi nhng cng ngh trn.

Nhng nh pht trin web thng dng ngn ng kch bn pha ngi dng thm hiu qu cc tnh nng, c bit l to ra mt cm gic giao tip trc quan m khng cn phi ti trang li (iu m nhiu ngi dng cm thy ngt qung). Va ri, nhng cng ngh c pht trin phi hp ngn ng kch bn pha ngi dng vi cng ngh pha my ch nh PHP. Ajax, mt k thut pht trin web s dng kt hp nhiu cng ngh khc nhau, l mt v d v cng ngh hin ang to ra ngy cng nhiu tri nghim tng tc hn.1.2.3 Chc nng c bn ca cc ng dng webng dng web ph bin nh vo s c mt vo bt c ni u ca mt chng trnh. Kh nng cp nht v bo tr ng dng Web m khng phi phn phi v ci t phn mm trn hng ngn my tnh l l do chnh cho s ph bin ca n. ng dng web c dng hin thc Web mail, bn hng trc tuyn, u gi trc tuyn, wiki, din n tho lun, Weblog, MMORPG, H qun tr quan h khch hng v nhiu chc nng khc..

Web cng l knh bn hng thng minh cho hng nghn t chc, doanh nghip, ln c, nh c. Vi hn mt t ngi dng Internet ngy nay (ngun: Computer Industry Almanac 2006), thng mi in t M s dng khong 102 t la trong nm 2006 cho giao dch (ngun: comScore Networks 2007).

Tt c d liu nh vy cn phi c ng gi, lu tr, x l v truyn vn theo mt cch no , c th s dng ngay hoc vo mt ngy no sau ny. Cc ng dng Web, trong lnh vc ng k, trnh, truy vn, ng nhp, bn hng v h thng qun l ni dung chnh l cc website widget cho php thc hin tt c cng vic mong mun.

Web chnh l l yu t c bn gip doanh nghip tng cng hnh nh trc tuyn ca mnh trn th gii mng, to ra v duy tr nhiu mi quan h em li li nhun lu di vi khch hng tim nng v khch hng hin ti.

Khng nghi ng g l cc ng dng Web tr thnh th hin hu khp mi ni trn th gii. Nhng do tnh k thut cao v yu t tng hp phc tp t nhin nn chng khng c nhiu ngi bit n chnh xc, thm ch b hiu nhm trm trng trong cuc sng bn rn hng ngy.

Website ngy nay khc xa so vi kiu ha v vn bn tnh ca th k 19 hay thi k trc . Cc trang Web hin i cho php ngi dng ly xung ni dung ng c nhn ha theo thit lp v tham chiu ring. Hn na chng cng c th chy cc script trn my khch, c th thay i trnh duyt Internet thnh giao din cho cc ng dng nh th in t, phn mm nh x tng tc (Yahoo Mail, Google Maps).

Quan trng nht l website hin i cho php ng gi, x l, lu tr v truyn ti d liu khch hng nhy cm (nh thng tin c nhn, m s th tn dng, thng tin bo mt x hi ) c th dng ngay hoc dng nh k v sau. V, iu ny c thc hin qua cc ng dng Web. c th l thnh phn webmail (th in t), trang ng nhp, chng trnh h tr v mu yu cu sn phm hay hot ng mua bn, h thng qun l ni dung, pht trin website hin i, cung cp cho cc doanh nghip phng tin cn thit lin lc vi khch hng tng lai v khch hng hin ti.

1.2.4 Nguyn tc hot ng c bn ca mt ng dng web

Trong dng tnh ton ch-khch trc y, mi ng dng c chng trnh khch ring ca n s phc v nh giao din ngi dng v phi c ci t ring r trn mi my tnh c nhn ca ngi dng. S nng cp phn my ch ca ng dng s cn nng cp tt c my khch c ci trn mi my trm ngi dng, thm vo l chi ph h tr v gim nng sut.ng dng web linh hot to ra mt lot cc ti liu Web nh dng chun c h tr bi nhng trnh duyt ph bin nh HTML/XHTML. Ngn ng kch bn pha ngi dng dng ngn ng chun nh JavaScript thng c thm vo c thm nhng yu t ng trong giao din ngi dng. Ni chung, mi trang Web n l c gi ti ngi dng nh mt ti liu n nh, nhng th t cc trang c th cung cp cm gic trc quan, khi nhng g ngi dng nhp vo s c tr v thng qua thnh phn mu Web c nhng vo trong nh du trang. Trong qu trnh giao dch , trnh duyt Web s thng dch v hin th trang, v hot ng nh mt ngi dng chung cho bt k ng dng Web no

1.2.5 Vn bo mt ng dng web Khi m ng dng web pht trin rt nhanh v mi mt, kh nng ng dng mt cch rng ri th vn bo mt cho ng dng web cng c ch trng hn. Mc d khng th ph nhn nhng ci tin nng cao ng k hin nay, nhng vn v bo mt trong ng dng Web vn khng ngng tng ln. Nguyn nhn c th xut pht t cc on m khng ph hp. Nhiu im yu nghim trng hay cc l hng cho php hacker xm nhp thng v truy cp vo c s d liu tch ly d liu nhy cm. Nhiu c s d liu cha thng tin gi tr (nh chi tit c nhn, thng tin ti chnh) khin chng tr thnh ch nhm thng xuyn ca hu ht hacker. Mc d hot ng tn cng ph hoi website doanh nghip vn din ra thng xuyn, nhng by gi tin tc thch tng cng kh nng truy cp d liu nhy cm nm trn trnh ch cha database hn v li nhun khng l t cc v mua bn d liu em li.

Hnh 3 M hnh hot ng ca mt ng dng web

Trong khung hot ng m t trn, bn c th thy tht d dng cho mt hacker truy cp nhanh chng thng tin nm trn c s d liu ch vi mt cht sng to. Nu may mn hn chng c th gp l hng xut pht t s cu th hay li ngi dng trn cc ng dng Web.

Nh ni, website ph thuc vo c s d liu phn phi thng tin c yu cu cho ngi dng. Nu ng dng Web khng an ton (nh c l hng, gp phi mt kiu k thut hacking no ), ton b c s d liu cha thng tin nhy cm s gp nguy him nghim trng.

Mt s hacker c th chn m c hi vo ng dng Web c l hng la o ngi dng v dn h ti website phishing. K thut ny c gi l Cross-site Scripting, c th c dng ngay c khi bn thn Web Server v ni cha c s d liu khng c l hng no.

Mt cuc nghin cu gn y ch ra rng 75% cc cuc tn cng mng c thc hin mc ng dng Web.Website v cc ng dng Web lin quan lun phi sn sng 24/7 cung cp dch v theo yu cu khch hng, yu cu t pha nhn vin, nh cung cp v nhiu ngi lin quan khc.

ZF Tng la, SSL khng th bo v ng dng Web trc mi hot ng hacking, n gin v truy cp vo website phi ch public bt k ai cng c th gh thm website c. Tt c h thng c s d liu hin i (nh Microsoft SQL Server, Oracle, MySQL) u c th truy cp qua mt s cng c th (nh cng 80, 443). Nu mun, mt ngi no c th kt ni trc tip ti c s d liu mt cch hiu qu khi vt qua c ch bo mt ca h iu hnh. Cc cng ny m nhm cho php lin lc vi hot ng giao thng mng hp php, v do cng hnh thnh nn l hng ln nguy him.

Cc ng dng Web thng truy cp d liu cui nh c s d liu khch hng, iu khin d liu c gi tr v do rt kh c th tuyt i an ton. Lc ny truy cp d liu thng khng km script cho php ng gi v truyn ti d liu. Nu mt hacker nhn ra im yu trong mt script, anh ta c th d dng m li lu lng sang khu vc khc v chia l bt hp php chi tit c nhn ngi dng, d i khi khng h ch tm lm iu

Hu ht ng dng Web u l t to, do t c c cc kim tra trnh hn so vi phn mm cng loi. Do cc ng dng ty bin thng d b tn cng hn.

C th ni ng dng Web l mt cng vo (gateway) ca c s d liu, nht l cc ng dng ty bin. Chng khng c pht trin vi mc bo mt tt nht v khng phi qua cc kim tra bo mt thng thng. Ni chung, bn cn tr li cu hi: Phn no trn website chng ta ngh l an ton nhng li m ca cho cc cuc tn cng? v D liu no chng ta em vo mt ng dng khin n thc hin mt s iu khng nn lm?. l cng vic ca phn mm r sot l hng Web.

Hin nay , hacker c rt nhiu cch tn cng mt ng dng web t cc k thut c bn cho n nhng k thut i hi k thut v cng ngh cao cao. Cc cng c(tool) h tr ra i ngy cng nhiu , h tr rt nhiu cho ngi qun tr mng , tm ra nhng l hng c bn v li kp thi nhng ng thi n cng l mt con dao hai li. Hacker c th dng nhng tool ny pht hin nhng l hng ca mt ng dng web v t s c cch tn cng tng ng vo l hng ny gy ra rt nhiu tn thtV vy vic nghin cu v cc k thut tn cng v nhng tool c bn hin nay l mt nhu cu tt yu trong vic nghin cu bo mt ng dng web. CHNG 2:CC K THUT TN CNG NG DNG WEB C BN

A.L thuyt

1. KIM SOT TRUY CP WEB (Web Access Control)

Thm nhp h thng qua ca sau (Back door)

Trong qu trnh thit k ng dng, nhng ngi pht trin ng dng c th ci

mt ca sau (back door) sau ny c th thm nhp vo h thng mt cch d

dng.

2. CHIM HU PHIN LM VIC(Session Mangement)

2.1 n nh phin lm vic (Session Fixation)

L k thut tn cng cho php hacker mo danh ngi dng hp l bng cch gi mt session ID hp l n ngi dng, sau khi ngi dng ng nhp vo h

thng thnh cng, hacker s dng li session ID v nghim nhin tr thnh

ngi dng hp l.

2.2 nh cp phin lm vic (Session Hijacking)

L k thut tn cng cho php hacker mo danh ngi dng hp l sau khi nn

nhn ng nhp vo h thng bng cch gii m session ID ca h c lu

tr trong cookie hay tham s URL, bin n ca form.

3 LI DNG THIU ST TRONG VIC KIM TRA D LIU HP L (INPUT VALIDATION)

Hacker li dng nhng nhp d liu gi i mt on m bt k khin cho h thng phi thc thi on lnh hay b ph v hon ton.

3.1 Kim tra tnh ng n ca d liu bng ngn ng pha trnh duyt

(Client-Side validation)

Do ngn ng pha trnh duyt ( JavaScript, VBScript..) uc thc thi trn trnh duyt nn hacker c th sa i m ngun c th v hiu ha s kim tra.

3.2 Trn b m (Buffer OverFlow)

Mt khi lng d liu c gi cho ng dng vt qu lng d liu c cp

pht khin cho ng dng khng thc thi c cu lnh d nh k tip m thay vo phi thc thi mt on m bt k do hacker a vo h thng. Nghim trng hn nu ng dng c cu hnh thc thi vi quyn root trn h thng.

3.3 M ho URL (URL Encoding)

Li dng chun m ha nhng k t c bit trn URL m hacker s m ho t

ng nhng k t bt hp l-nhng k t b kim tra bng ngn ng kch bn- vt qua vng kim sot ny.

3.4 Vt qua ng dn (Path Traversal):

L phng php li dng ng dn truy xut mt tp tin trn URL tr kt qu v cho trnh duyt m hacker c th ly c ni dung tp tin bt k trn h thng.

3.5 Chn m lnh thc thi trn trnh duyt nn nhn (Cross- Site Scripting)

y l k thut tn cng ch yu nhm vo thng tin trn my tnh ca ngi

dng hn l vo h thng my ch. Bng cch thm mt on m bt k ( thng c lp trnh bng ngn ng kch bn nh JavaScript, VBScript), hacker c th thc hin vic nh cp thng tin quan trng nh cookie t tr thnh ngi dng hp l ca ng dngda trn nhng thng tin nh cp ny.

3.6 Thm cu lnh h thng (OS Command Injection)

Kh nng thc thi c nhng cu lnh h thng hay nhng on m c thm

vo trong nhng tham s m khng c s kim tra cht ch nh tham s ca form, cookies, yu cu HTTP Header, v nhng d liu nguy him trong nhng tp tin c a ln trnh ch. Thnh cng trong k thut ny gip hacker c th thc thi c nhng cu lnh h thng vi cng quyn ca trnh ch.3.7 Chn cu truy vn SQL (SQL Injection)

Trong lp trnh vi c s d liu, ngi lp trnh sai st trong vn kim tra

gi tr nhp vo t hacker li dng thm vo nhng cu truy vn hay nhng gi tr khng hp l d dng ng nhp vo h thng.

3.8 Ngn ng pha my ch (Server side includes)

L kh nng thm vo nhng cu lnh thuc h thng nh nhng file (include

file), truy xut c s d liu (jdbc)khin cho hacker c c hi truy xut n file, c s d lium bnh thng khng th xem c trn Web site.

3.9 Thao tc trn tham s truyn (Parameter manipulation)

Nhng thng tin trao i gia trnh ch v trnh duyt c lu tr trong nhng

bin nh bin trn URL, bin n form, cookieBi v vic kim sot bin cha c quan tm ng mc nn hacker c th li dng sa i gi tr bin nh cp phin lm vic ca ngi dng hay thay i gi tr mt mn hng.

3.10 T chi dch v (Denial of service (DoS))

Mt khi lng ln yu cu c gi cho ng dng trong mt khong thi gian nht nh khin h thng khng p ng kp yu cu dn n h thng b ph v.

B, Cc cch trin khai tn cng ng dng web

Phn trc trnh by s lc v cc cch tn cng ng dng web c bn. Phn ny s ni c th hn mt s cch tn cn bn v ph bin

1.Thao tc trn tham s

Thao tc trn tham s truyn l k thut thay i thng tin quan trng trn cookie, URLhay bin n ca form. K thut Cross-Site Scripting, SessionID, SQL Injection, BufferOverflowcng cn dng n cc tham s ny hon thin cc bc tn cng ca hacker. C th ni cc tham s truyn l u mi cho mi hot ng ca hacker trong qu trnh tn cng ng dng. V th y l ni dung chng u tin c cp trong phn ny , mc ch cng l h tr tt hn phn trnh by cc phn k tip.

1.1 THAO TC TRN URL

1.1.1 Khi nim

Khi nhp mt form HTML th kt qu s c gi i theo hai cch: GET hay POST. Nu dng GET, th tt c cc tn bin v gi tr ca n s xut hin trong chui URL.

1.1.2 Cch khc phc

chng li kiu thay i ni dung mt chui URL, ng dng c th p dng bin php sau:

` ng dng s dng c ch bng bm (hash table). Sau khi ngi dng chng thc thnh cng vi mt username , ng dng s sinh ra mt kho tng ng. Kho ny s c lu trn server cng vi bin username trong i tng bng bm. Mi khi ngi dng kt ni n ng dng, kho v username ny s c gi i v c so snh vi kho v username trong bng bm. Nu tng ng vi bn ghi trong d liu th hp l. Cn nu khng th server bit rng ngi dng thay i URL.

Ngoi ra, vi nhng thng tin c gi tr, cn m ho thng tin ny trc khi

cho hin th trn trnh duyt trnh hacker c th sa i ty .

1.2. THAO TC TRN BIN N FORM

1.2.1 Khi nim

Thng tin c th c chuyn i thng qua mt bin n ca form, gi l Hidden Form Field. Bin n form khng hin th trn mn hnh trnh duyt nhng ngi dng c th tm thy ni dung ca n trong view source , v th y l mt im yu hacker li dng bng cch lu ni dung trang web xung trnh duyt, thay i ni dung trang v gi n trnh ch.

Ngoi vic thay i ni dung bin n ca form, hacker cn bin i ni dung cc thnh phn trong form, nh chiu di ca mt nhp d liu thc hin vic tn cng BUFFER OVERFLOW, 1.2.2. Mt s bin php khc phc

Ch nn s dng bin n ca form hin th d liu trn trnh duyt, khng c s dng gi tr ca bin thao tc trong x l ng dng.

Dng bin HTTP_REFERER kim tra ngun gc ca yu cu gi n, tuy

nhin hacker c th s dng Proxy che du ngun gc thc ca n, v vy cng khng nn qu tin tng bin HTTP_REFERER kim tra.

Ghp tn v gi tr ca bin n thnh mt chui n. S dng thut ton m

ho MD5 hoc mt kiu hash mt chiu khc tng hp chui v lu n vo mt hidden field gi l Chui mu.

Khi gi tr trong form c gi i, cc thao tc nh trn c thc hin li vi

cng mt kho m ta nh trc. Sau em so snh viChui mu, nu chng khng khp nhau th chng t gi tr trong biu mu b thay i.

Dng mt sessionID tham chiu n thng tin c lu tr trn c s d

liu.

2 .K thut tn cng gy trn b m v t chi dch v (Buffer overflow)

K thut ny ch yu khai thc vic ngi dng m vt qu lng b nh cp pht ban u bi ng dng do gy choh thng lm vo tnh trng trn b nh, thm ch c th b chn thm mt on m bt k. Nu ng dng c cu hnh c thc thi nh root th ngi tn cng c th thao tc nh mt nh qun tr h thng ca web server.

y l mt cch tn cng c coi l kinh in . y s trnh by mt k thut tn cng gy trn b m v t chi dch v l Dos.

2.1 Khi nim

Tn cng kiu DoS l kiu tn cng lm cho cc dch v mng b t lit, khng cn kh nng p ng c yu cu na. Loi tn cng ny nh hng n nhiu hthng, rt d thc hin v li rt kh bo v h thng khi kiu tn cng DoS. Thng thng, kiu tn cng DoS da trn nhng giao thc (protocol). V d vi

giao thc l ICMP, hacker c th s dng bomb e-mail gi hng ngn thng ip

email vi mc ch tiu th bng thng lm hao ht ti nguyn h thng trn mail

server. Hoc c th dng phn mm gi hng lot yu cu n my ch khin cho

my ch khng th p ng nhng yu cu chnh ng khc.

2.2 Cc i tng b nh hng bi kiu tn cng ny

TN CNG TRN SWAP SPACE

Hu ht cc h thng u c vi trm MB khng gian chuyn i ( swap space) phc v cho nhng yu cu t my khch. Swap space thung dng cho cc tin trnh con c thi gian ngn nn DoS c th c da trn phng thc lm trn y swap space.

TN CNG TRN BANDWIDTH:

Phn bng thng dnh cho mi h thng l gii hn, v th nu hacker cng lc

gi nhiu yu cu n h thng th phn bng thng khng p ng cho mt khi lng d liu ln v dn n h thng b ph v.

TN CNG VO RAM:

Tn cng Dos chim 1 khong ln ca RAM cng c th gy ra cc vn ph

hy h thng. Kiu tn cng BufferOverflow l mt v d cho cch ph hy ny

TN CNG VO DISKS:

Mt kiu tn cng c in l lm y a cng. a cng c th b trn v khng

th c s dng na.

2.3 Cc kiu tn cng DDos

2.3.1 Kiu tn cng th 1

Hacker hon ton c kh nng lm ngp h thng v bng thng ca hacker ln

hn bng thng ca my ch. Kiu tn cng ny khng b hn ch bi tc

truyn mng.

v d: Hacker c mt ng truyn tc cao T1 ( 1.544- Mbps ) hay

ln hn c th d dng ph v mt h thng c ng truyn 56Kbps.

2.3.2. Kiu tn cng th 2

Kiu tn cng ny c s dng khi ng truyn mng ca hacker l qu thp so vi ng truyn ca my ch.

Khng ging nh kiu tn cng DoS truyn thng, kiu tn cng vo bng thng ln hn s li dng nhng gi tin t nhng h thng khc nhau cng mt lc tin n h thng ch khin cho ng truyn ca h thng ch khng cn kh nng p ng, my ch khng cn kh nng nhn mt gi tin no na. Kiu tn cng ny s loi my ch ra khi Internet.

y l phng php tn cng kiu t chi dch v nhng khng l DoS m gi l DDoS ( kiu t chi dch v phn tn ), ngha l cng mt lc nhiu my s c

pht ng gi gi tin n my ch, lm cho my ch khng cn kh nng tip nhn gi tin v b loi khi mng Internet.

Bng cch gi a ch IP ca my ch, hacker s cng lc gi nhiu gi tin

n cc h thng my mnh trn mng, cc h thng ny khi nhn gi tin SYN gi ny, chp nhn kt ni v gi tr mt gi tin SYN/ACK thng bo. V a ch IP ca gi tin SYN b hacker sa i thnh a ch IP my ch nn nhng gi tin SYN/ACK s c gi v cho my ch. Cng mt lc nhn c nhiu gi tin, ng truyn ca my ch khng kh nng p ng, h thng my ch t chi nhn bt k gi tin no v lc ny h thng my ch b sp .

2.3.3. Kiu tn cng vo ti nguyn h thng

y l kiu tn cng nhm vo ti nguyn h thng hn l ti nguyn mng nh

CPU, b nh, file h thng, tin trnh..Hacker l mt ngi dng hp l ca h thng, v c mt lng ti nguyn gii hn trn h thng. Tuy nhin, hacker s lm dng quyn truy cp ny yu cu thm ti nguyn. Nh vy, h thng hay nhng ngi dng hp l s b t chi s dng ti nguyn chia s.

Kiu tn cng s khin cho h thng khng th s dng c v ti nguyn b

s dng ht, khng cn tin trnh thc thi na

2.4 Cch phng chng

Kiu tn cng t chi dch v tuy ch khin cho h thng b ph v trong vi pht nhng hu qu th kh to ln (nh hng trn phm vi tin v uy tn). y l k thut thng c hacker s dng trong trng hp khng th chim quyn qun tr trn h thng hoc thng tin, hoc mun ph hy uy tn ca c quan .Thm vo vic gi mo a ch khin cho hacker cng d dng thc hin vic tn cng m khng s b pht hin.

Kiu tn cng t chi dch v l kiu tn cng gy nhiu kh khn trong vn bo v cng nh iu tra tm ra th phm nht, bi v hu ht hacker thay i a ch

IP ca my mnh nn rt kh xc nh ai l th phm.

phng chng kh nng khuych i ng truyn, cn:

- Hu kh nng broadcast ti router bin.

- Tng kch thc hng i kt ni.

Ta c th phng trnh kh nng trn hng i qua nhiu kt ni, nhng cch ny s dng nhiu ti nguyn:

- Gim thi gian thit lp kt ni.

- Dng nhng phn mm pht hin v ph hy kiu tn cng DoS:

Hu ht nhng h iu hnh hin nay u h tr kh nng pht hin v phng chng kiu tn cng lt SYN.

Chng 3: TNG QUAN V GIAO THC S-HTTP3.1 Gii thiu

S-HTTP c thit k bi E.Rescorla v A.Schiffman trong t chc EIT nhm tng cng bo mt cho kt ni HTTP. S-HTTP cung cp cc k thut khc nhau thc hin bo mt, xc thc v tnh ton vn ca d liu. Mi k thut c a ra nhm cc mc ch th hin chnh sch nht nh.

S-HTTP l mt supernet ca HTTP, cho php cc bn tin c ng gi theo nhiu cch khc nhau. ng gi c th bao gm m ha, ch k hoc chng thc da trn MAC. ng gi c th c quy v mi bn tin c nhiu phng php bo mt c p dng. S-HTTP bao gm c tiu nh ngha cung cp kha chuyn giao, chuyn giao xc nhn v ging nh chc nng ca ngi qun tr. S-HTTP thc hin cc k linh ng trong cc chng trnh thc hin. S-HTTP cung cp tim nng cho ngi s dng, gim st v cc hot ng chng thc, m ha.

S-HTTP khng da trn h thng chng nhn quan trng c bit. N bao gm h tr cho RSA, trong bng, ngoi bng v trao i kha Kerberos. Chng nhn kh c th cung cp di dng bn tin hoc nhn c t nhng ni khc. Ging SSL, kha ca khc hang khng yu cu.

3.2 Giao thc S-HTTP

Bn tin S-HTTP l bn tin yu cu hoc dng trng thi, tip theo tiu khc v ni dung. Cc ni dung c th l d liu, bn tin S-HTTP hoc bn tin HTTP. Dng yu cu c nh ngha nh sau:

Secure * Secure-HTTP/1.1 to which the response must be:

Secure-HTTP/1.1 200 OK

Dng trn xc nh loi tr tn cng, xc nhn yu cu bn tin l thnh cng hay tht bi. S-HTTP a ra cc thuc tnh lm sao cc thong tin cc b r r cng t cng tt.

3.2.1 Tiu .

C mt s trng nn c trong tiu ca S-HTTP. Cc tiu khc khi a vo tiu HTTP, c ng gi trong bn tin S-HTTP. Nhng tiu c quy nh trong S-HTTP, nhng c s dng nh l tiu trong ti liu HTTP. V d, chng khng th c s dng khi khng c bo v bi kiu ng gi S-HTTP.

Content-Privacy-Domain tng thch vi PEM da trn S-HTTP. Trng RSAs PKCS-7 (Public Key Cryptography Standard 7, "Cryptographic Message Syntax Standard"), RFC-1421 kiu PEM v nh dng PGP 2.6.

Content-Transfer-Encoding gii thch lm sao ni dng ca bn tin c m ha. 7,8 bit c th t gii thch, base-64 c nh ngha trong RFC-1421

Content-type l tiu chun ca tiu v chung ca cc ng dng http.

Prearranged-key-info l thong tin v kha c s dng ng gi bn tin. Trng dnh cho cc loi mt m, DEK (data exchange key) s dng m ha bn tin v inh ngha kha s dng m ha DEK. MAC-infor l bn tin xc thc chc chn bn tin khng b gi mo

y l nhng tiu S-HTTP c nh ngha trong spec. Tuy nhin, cng c mt s tiu HTTP mi c nh ngha. l Security Scheme, Encryption identity, DN-1485Name class, Kerberos Name class, Certificate Infom, Key Assign v Nonces.

Security Scheme l tn giao thc v phin bn. Encryption Indentity tn cc thc th m mi bn tin c m ha, trong trng hp ca mt my ch vi nhiu kha c cng b rng ri. Cc lp ty chn ( DN-1485 v Kerberos) cho php cc t chc xc nhn bn thn v chng l ai.

Certificate Info cho php ngi gi trao i kha cng khai trong bn tin vi mc ch khc.

Key Assign l bn tin c s dng cho vic trong i kha trong thc t v c gn ln trn tng phin trao i. Trao i kha c nhiu ty chn, cho php cc bn tin c ng gi trong nhiu cch khc nhau, c t tn tng trng v c thi gian sng c gn vo n.

None(s) l nh danh ca phin, c s dng ch ra qu trnh lm mi ca phin v ngn cn cc cuc tn cng phn hi. Bn tin bao gm mt s nonces, t s khng n mt khong. Cc my ch thng to ra chng v mong ch i khc hang p ng vi cng gi tr nonce tng ng. nonces thng da trn thi gian nhng S-HTTP cho thy mt gi tr ngu nhin c th s dng.

3.2.2 Negotiation

cunng cp s linh hot trong nhng ci tin m ha c s dng, khch hng v my ch c th thng lng v:

+ Sn sang s dng

+ Khng sn sng s dng

+ Yu cu c s dng.

Khi Negotiation c bn phn: property, value, direction v strength. Nu i l khng th pht hin ra tp hp chung c thut ton th cc hnh ng thch hp s c a ra. Tip tc yu cu mt ty chn t chi c coi l khng c hiu qu v ph hp.

An example negotiation line would be:

SHTTP-Key-Exchange-Algorithms: recv-required=RSA,Kerb-5

bn tin c ngha, bn nhn phi s dng Kerberos 5 hoc m ha RSA trao i kha.

Cc ch sn c (recv || orig) -(optional||required||refused). Cc t kha 'recv' v 'orig "th hin vic nhn c hoc c ngun gc tng ng. Variable mt m di kha c gi l thut ton m ha [di], hoc mt m [L1-L2], trong chiu di chnh l chiu di, hoc trong trng hp ca L1-L2, l gia L1 v L2, bao gm. Cipher m khng c mt k hiu di s ch ra mt s sn sng chp nhn bt k di kha nh ngha cho mt thut ton m ha.

Headers in the negotiation can be:

SHTTP-Privacy-Domains:

SHTTP-Certificate-Types:

SHTTP-Key-Exchange-Algorithms:

SHTTP-Signature-Algorithms:

SHTTP-Message-Digest-Algorithms:

SHTTP-Symmetric-Content-Algorithms:

SHTTP-Symmetric-Header-Algorithms:

SHTTP-Privacy-Enhancements:

Your-Key-Pattern:

SHTTP-Privacy-Domains c th l PEM, PKCS-7, or PGP.SHTTP-Certificate-Types: c th m rng PKCS-6, or X.509. Lin quan cht ch n nhng khng ph thuc vo SHHTP-Privacy- Domains.

SHTTP-Key-Exchange-Algorithms: c th l Outband, Inband, RSA, or Krb-kv(for Kerberos-version). Outband c s dng nhiu khi m rng hoc trong sp xp kha. i vi tnh hnh ca mt my ch ch c mt kha v khng hy vng cc khch hng c mt kha bt k, tin nhn c: SHTTP-Key-Exchange-Algorithms:orig-optional=Inband, RSA; recv-required=RSA

SHTTP-Message-Digest-Algorithms: c th l 'RSA-MD2,' 'RSA-MD5,' or 'NIST-SHS.'

SHTTP-Symmetric-Content-Algorithms: Can be any of

DES-CBC

DES in Cipher Block Chaining (CBC) mode (FIPS 81) [11])

DES-EDE-CBC2 Key 3DES using Encrypt-Decrypt-Encrypt in CBC mode

DES-EDE3-CBC3 Key 3DES using Encrypt-Decrypt-Encrypt in CBC mode

DESX-CBC

RSA's DESX in CBC mode

IDEA-CFB

IDEA in Cipher Feedback Mode [12]

RC2-CBC

RSA's RC2 in CBC mode

RC4

RSA's RC4

CDMF-CBC

IBM's CDMF (weakened key DES) [20] in CBC mode

c ci nhn tt p ca tt c cc thut ton m ha, ngoi tr RC4, DESX v CDMF, xem (Schneier, 1994). RC4 l mt thut ton b mt cho n khi n c ng Cypherpunks vo thng Mi nm 1994, ni mt s cuc tho lun din ra (xem Cypherpunks Archive). DESX l mt phin bn c tng cng ca DES. CDMF l mt thut ton m ha DES ging nh vi mt 40 bit keyspace thc.SHTTP-Symmetric-Header-Algorithms: Can be any of

DES-ECB

DES in Electronic Codebook (ECB) mode (FIPS 81 [11])

DES-EDE-ECB2 Key 3DES using Encrypt-Decrypt-Encrypt in ECB mode

DES-EDE3-ECB3 Key 3DES using Encrypt-Decrypt-Encrypt in ECB

mode

DESX-ECBRSA's DESX in ECB mode

IDEA-ECBIDEA

RC2-ECB

RSA's RC2 in ECB mode

CDMF-ECBIBM's CDMF in ECB mode

SHTTP-Privacy-Enhancements: c th l mt trong s ch k,m ha hay Auth. Auth khc c th cung cp kha hash trong bn tin MAC.

Your-Key-Pattern: Mt cch bn kia nhng kha s dng trong cc qu trnh m phn. C nhiu ty chn v kh nng.

S-HTTP nh ngha mc nh cho tt c cc gi tr. Nhng gi tr mc nh c th c m phn ln hoc xung, v: s dng PKCS-7 hoc PEM m ha tin nhn; trao i cc kha, v ch k bng RSA. MD5 c s dng nh thng ip tiu ha, v (single) DES, trong cc ch khc nhau, c s dng nh cc thut ton m ha vi s lng ln.

3.2.3 nh dng bn tin.

nh dng ca bn tin c th ch nh bi cc Conntent-Privacy-Domain trong dng tiu S-HTTP. C mt s c chp nhn Content-Privacy-Domain nh PEM, PGP, PKCS-7. i vi PKCS-7, cc trng m rng c th nm trong bn tin. Cho php ngi thc hin mt cch linh hot. PKCS-7 m rng bao gm m ha (vi kha cng khai v mt s thit lp trc). S dng tn min PEM hoc PGP, bn tin c th mn ha vi straight PGP hoc PEM. Vi mt s thay i tiu nh, cc giao thc HTTP c th c thc hin tng thch vi cc nh dng PEM.

3.3 Cung cp bo vCc ch hot ng mc nh ca S-HTTP l kh nng chng tn cng ng k hn so vi SSL. N chng li vic gii m m on m ha. Man In The Middle, v tn cng li. l im mnh hn so vi SSL, bi v nhng ty chn m phn v gi li c cp php.

Ngoi ra, chi ph ca vic gii m on m ha ca DES l cao hn ang k so vi RC4-40 (cn xem li rng DES l thut ton m ha mc nh cho S-HTTP, v RC4-40 l m mc nh cho SSL). ph v mt kha RC4-40 trong mt thng vi gi l 125$. ph v mt kha DES trong mt thng vi gi khong 10000$ (c ly t Wiener, 1994).

56 bit kha DES c chi ph 1 triu ph v trong 7h (Wiener, 1994). Quy m chi ph ny ln v xung trong thi gian tuyn tnh. (IE., mt thit b tiu s mt 14h). Mt thng c 720h (24h x 30 ngy). Gi pht v mt kha DES trong vng mt thng khong 10000$, tri ngc vi 125$ cho 40bit RC4.

3.4 im yuVic s dng trong s thay i kha bng l rt kh nng c vn . Khng dnh thi gian m bo cc kha c chuyn ng. Vi mi kha chuyn khng ng cch s c s l nh nhng kha gi B vi Ea(B). iu ni rng, kha B thay th kha A khng th c gi bng cch s dng kha A m ha n. Nu k tn cng ph v kha A, sau hn s c kha B, v s thay i kha l mt s lng ph thi gian (i vi k tn cng). Chnh xc li ny c thc hin thng xuyn bi ngi Nht trong chin tranh th gii th 2. (Kahn) S mong i vi cc lp trnh vin tm ra nhng sai lm ny cho n nhng sai lm khc (c bit l li 50 nm trc).

S-HTTP rt linh hot, c th a ra mt trng trnh lm treo chnh chng, Phi tha nhn rng, n khng cung cp nhiu ty chn ph v, nhng n dng nh khng c bt c iu g ging nh SSL. Mt lp trnh vin, c bit l mt ngi khng quen thuc vi cc vn an ninh, mt m, c th ngh rng s dng S-HTTP s bo v ti v hon ton khng cung cp bt k s bo v mt m cho thng tin ca mnh. Kh nng xy ra iu ny c th l mt cu hi m nhng vn l phi xem xt v nh gi vn ny.Ti liu tham khoLun vn tt nghip Nghin cu mt s vn bo mt ng dng web trn internet ca Nguyn Duy Thng v Nguyn minh Th.

ETHICAL HACKING 1-5 by EC-Councilhttp://vietbao.vn/Vi-tinh-Vien-thong/Tim-hieu-ve-cac-ung-dung Web/65082882/229/ http://iht.vn/mang-bao-mat/505-tim-hieu-ve-cac-ung-dung-web.html

http://www.onboom.com/kien-thuc-ve-web/quang-ba-website/1598-kien-truc-net-trong-mo-hinh-ung-dung-thuong-mai-dien-tu.html

http://www.vnsolutions.net/cms/vi/chi-tiet/ung-dung-web-(webapp)-la-gi/30

http://vovanhai.wordpress.com/web/jsp/mo-hinh-mvc-va-1-vi-d%E1%BB%A5-%E1%BB%A9ng-d%E1%BB%A5ng/

http://web.dongtak.net/spip.php?article125

http://Cht xu v bo mt trang web cho ngi khng chuyn.htm

http://CCH HACK WEBSITE - YuMe_vn.htm

http://Cch tn cng h thng Cisco(Trang 1) - H thng mng CISCO - Din n trung tm Zonotek - Powered by Discuz! Archiver.htm

http://thuynt' Blog - Nhng l hng bo mt thng gp trn website.htm

The end

PAGE

1Nhm 11