RSS
 

Build ipa file using XCode without provisioning profile

26 Dec

To develop an application for iOS devices one should first obtain a provisioning profile by joining the iPhone Developer Program (which costs $99). However, some simple tricks can be used to build self signed applications using Xcode, that can be installed on Jailbroken devices. The steps provided below explains the detailed procedure to build ipa files without developer certificate for Jailbroken devices. This is tested on Mountain Lion 10.8, Xcode 4.5 and iOS 6 SDK.

Steps to build ipa file using Xcode:
1. Create a self signed code signing certificate.

On Mac OS X, go to Keychain Access -> Certificate Assistant -> Create a Certificate. It opens the certificate assistant window. Enter name (in my case it is securitylearn.net) and select certificate type as Code signing. Check let me override defaults option. Hit continue until it creates the certificate.

OS X self signed certificate

After creation of the certificate, the keychain looks as shown in the image below.

Certificate in keychain1

2. Copy /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/Info.plist to desktop. Edit the plist file and replace all occurrences of XCiPhoneOSCodeSignContext by XCCodeSignContext (3 places – defaultproperties, runtimerequirements, overrideproperties).

Before modification:

xcode info plist before modification

After modification:

xcode info plist after modification

3. Copy the modified Info.plist file to /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/ directory and replace the existing file.
4. Close and Restart the XCode.
5. Create your project in the XCode and in the project target settings choose the certificate created in step 1 as the code signing identity. Project target settings are shown below.

xcode project code signing settings

6. Build the project for iOS device (Project->Build).
7. Build creates the .app file in the build/Debug-iphoneos folder.

Xcode build app

Default location for .app file is -
/Users/[user name]/Library/Developer/Xcode/DerivedData/[your app]/Build/Products/Debug-iphoneos/

xcode build directory

8. Create a folder named Payload and copy the .app file into it.

Payload folder

9. Archive the Payload folder. It creates Payload.zip.
10. Rename the Payload.zip to [app name].ipa. We have successfully created the ipa file without developer certificate and this can be installed on a jailbroken device using iPhone configuration utility.

This comes handy for pentesters as well, if they want to create vulnerable demo apps.

Update on 16-Feb-2013: To install self signed ipa on iOS 6 devices, (Thanks to Leo for sharing this info) 
1. Go to Cydia->Manage and add http://gdeluxe.com/repo as a source.

appsync cydia

2. Download and install AppSync for iOS 6.x from Cydia.
3. Now you can install the ipa file using the iPhone configuration utility.

 
 

Exploit SQL Injection through SQLMap Burp Plugin

17 Dec

SQL Injection:

SQL Injection (SQLi) is a web based attack used by hackers to steal sensitive information from organizations through web applications. It is one of the most common application layer attacks used today. This attack takes advantage of improper coding of web applications, which allows hackers to exploit the vulnerability by injecting SQL commands into the prior web application.The underlying fact that allows for SQLi is that the fields available for user input in the web application allow SQL statements to pass through and interact with or query the database directly.

For example, let us consider a web application that implements a form-based login mechanism to store the user credentials and performs a simple SQL query to validate each login attempt. Here is a typical example:

select * from users where username=’admin’ and password=’admin123′;

If the attacker knows the username of the application administrator is admin, then he can log into the app as admin by entering the username as admin’– and without supplying any password. The query in the back-end looks like:

Select * from users where username=’admin’--’ and password=’xxx’;

Note the comment sequence (–-) causes the followed query to be ignored, so query executed is equivalent to:

Select * from users where username=’admin’;

Hence the password check is bypassed and the attacker is logged into the app as admin. SQL Injection can be tested in two ways - Manual Pen-Testing & Automation.

1) Manual Pen-Testing: This is the process of detecting & exploiting the vulnerability manually. We need to test the vulnerability manually by passing the malicious strings and exploit it. I’ll give a clear explanation of exploiting SQLi manually in my next post.

2) Automated: This can be done by running the tools. There are many tools to find and exploit the SQLi vulnerability, some of them are SQLMAP, ABSINTHE, SQL NINJA, The Mole, etc… . I would love to use some tool which can be attached to a proxy that I use in my work regularly. So I chose SQLMap plugin for burp.

SQLMAP:

SQLMAP is an open source penetration testing tool that helps in automating the process of detecting and exploiting SQL injection vulnerabilities and taking full access over the database servers. SQLMAP comes with powerful detecting engine, and many niche features for the penetration tester and wide range of switches lasting from database fingerprinting, data fetching from the database, accessing the underlying file system and executing the commands on Operating System via Out-of-band Connections.

Since SQLMAP is developed in python it is a portable application, meaning that it will work in any operating system that supports python.

SQLMAP burp plug-in:

When we audit a web application, we normally configure an intermediate proxy to have more control over the request and response parameters. SQLMAP plug-in is an add-on feature that we can configure to the burp through which we can redirect a URL or a request directly to the SQLMAP with a single mouse click.

Plug-in Setup:

1. Download the plugin zip file from the following URL: http://code.google.com/p/gason/downloads/list
2. Unzip the file and keep it in the same folder where burp proxy is located.
3. Then execute the following command to run the burp with plug-in.

Linux:

Java –classpath burpplugins.jar:”burpsuite_v1.4.0.1.jar” burp.StartBurp

Windows:

Java –classpath burpsuite_v1.4.0.1.jar;burpplugins.jar burp.StartBurp

*Replace the burpsutie with the appropriate version that you are using. In my case I am using burpsuite_v1.4.0.1.jar. We also need to download the SQLMAP tool as we need to supply the executable to the burp plug-in.

Setting up SQLMAP:

For Windows,
1. Download and Install python 2.7 -http://www.python.org/getit/
2. Download sqlmap - https://github.com/sqlmapproject/sqlmap
3. Unzip the name.zip file to sqlmap directory.

For Ubuntu or Linux, run the below commands from the terminal

> Sudo apt-get install python-tk python2.7
> git clone git://github.com/sqlmapproject/sqlmap.git
> cd sqlmap
> wget http://gui-for-sqlmap.googlecode.com/files/sqm-60712.zip
> unzip sqm-60712.zip

Setting up the environment:

- If you are using OWASP broken web application, then simply access one of the vulnerable site from your local browser where you are running SQLMAP.
- If you don’t use OWASP broken web application, then you need to set up a virtual machine that has a web server to host the vulnerable web application.
- Configure another VM with ubuntu where the attacker runs SQLMAP

Configuring the Proxy:

- If you are using Mozilla Firefox, then go to Edit > Preferences > Advanced > Network > settings and select “Manual Proxy Configuration” by enabling the radio button. Run the HTTP proxy with local-host and the port in which the proxy is running.
- If you are using Chrome, then go-to settings > Show Advanced Options > Network > Change proxy Settings > Connections > Lan settings.

How to use the plug-in:

Once you load the plug-in, then it is very easy to make use of it. Run the burp proxy with loaded plug-in. In the “site map” tab under the “target” you can see the particular domain that you are trying to test for SQLI and all the crawled pages related to the domain. On the right side click on the URL that you want to test, you can see the request parameters of the URL in the bottom panel. Right click on the request parameters and you can see the option “Send to sqlmap” as shown in the figure below.

Forward URL To Sqlmap burp plugin

Then you can see a new window (SQLMap wrapper) that will allow you to configure sqlmap. Below Image gives you a clear view of the wrapper.

sqlmap plugin window

Now lets have an over view of configuration features of the wrapper. In the “Target” text box specify the URL that you are willing to test. (Normally it will be filled by default as you have sent the request parameters previously, if needed you can change the URL).

Specify the method on which the domain is accessible (GET/POST).  In the “Bin-path” give sqlmap executable.

If you are aware of the DBMS of the web application, specify the database by selecting one of the options listed in the dropdown list. By default “auto” is selected which means that the SQLMAP wrapper tries with all the databases listed in the dropdown list to find out the database used by the application.

You can enumerate the database users, passwords, roles, privileges, databases etc by selecting the appropriate option from the Action drop down list. By default it is set to “auto” which means it will try to enumerate all the options listed in the drop down list in the sequential order.

If you are aware of the databases, users, tables, or columns, you can enumerate it by simply specifying it in the Database options.

Tampers are a kind of special characters or symbols that you are willing to insert into the query while pen-testing the application.

Once we configure the SQLMAP click on the “RUN”, this will open a new tab with execution of the program with the configuration that you have given to the wrapper or the SQLMAP. We can make any number of simultaneous execution tabs with difference instances. Below image shows the output tab.

Sqlmap output

Bored with theory, now lets see an example, the below URL is a vulnerable site for practicing the SQLI. You can also find the SQLI practice URL’s by goggling.

http://192.168.2.3/news-and-events.php?id=22

Id parameter in the above URL is vulnerable to SQLI; lets find it out through our SQLMAP wrapper (Burp suite plug-in).

Open the URL in the browser for which the proxy has been configured. In the proxy (burp) go to the “site map” and click on the URL and send it to the sqlmap by right clicking on the response parameters of the website, as I mentioned previously. Figure below shows you the wrapper opened for the above mentioned URL.

sqlmap plugin settings

The target specifies the URL we are testing, cookie specifies the cookie or session id.  Wrapper automatically identifies the positions in the URL where SQLI can be injected and specifies list of the parameters in “Parameters to test” text area (in our case we have only one possibility for injection which is “id” parameter).

In this example I have configured the SQLMAP wrapper to enumerate the list of databases that are configured in the backend database.

burp plugin sqlmap output

Above figure shows you the output tab which intend displays you how the plug-in tried to exploit the SQLI vulnerability in different ways

We can see that initially the wrapper tried to exploit the vulnerability by using “Boolean-based blind SQLI” by using AND operator. The payload shows how the tool tried to exploit the vulnerability. Here we can see the payload: id=22 AND 4626=4626, which is equivalent to the following URL:

http://192.168.2.3/news-and-events.php?id=22 AND 4626=4626

As the URL is always true, the above URL returns the same page as of the original URL.

In the second trail it tried “error-based SQLI”. Later by using UNION operator.

Retreive database with sqlmap

From the above figure  we can observe more server details like web server, Operating System, back-end DBMS.

“Information_schema”  and “nilakantatrust” are the two databases that are used by the web application.

Now let us try to enumerate all the tables and the columns of the tables from the above databases.  To do so configure the SQLMAP wrapper Action field with the option “Enumerate database tables and columns”.  Below Figure shows you the same.

extract tables and columns using sqlmap

Below figure shows us the tables of the database “nilakantatrust”.

extracted tables and columns

Let us see the columns of these tables. Figure below shows the columns and their data types of two tables “est_notice” and “est_news” of  nilakantatrust database.

columns retreived using sqlmap

We can also dump complete database by selecting the option “dump dbms databases”.  And also store complete data into a file by using the option “save to file” in the output tab.

sqlmap output to file

Above figure shows the dumped data of the table “est_admin” from “nilakantatrust” database and storing it into a file.

Conclusion:

SQLMAP is a powerful tool which is used to automate the process of detecting and exploiting the SQLI.

I have written this article for infosec institute. Take a look at the web application security course offered by infosecinstitute.

 
1 Comment

Posted by kamalb

 

Hacking and Securing iOS Applications : Video

13 Dec
 
 

Hacking and Securing iOS Applications : Slides

03 Dec

A deck of slides which I have used for my presentation @ Clubhack 2012, India.

Abstract
iOS applications share common set of classes and highly depends on the operating system solutions for data communication, storage and encryption. Solely depending on the Apple implementation made them less complex but it affects security of the applications. Though iOS comes with a great set of security features like code signing, ASLR, DEP, sand boxing and Data Protection, all of them are subject to attack. Relying only on the iOS security could lead to demise the sensitive data stored within the application when the iOS is compromised. Application security can be improved by understanding the weaknesses in the current implementation and incorporating own code that work better.

The presentation illustrates several types of iOS application attacks like run time manipulation, custom code injection, SSL session hijacking and forensic data leakage. It gives an insight into the iOS Keychain & data protection API and explains the techniques to circumvent it. The presentation will provide guidelines and suggests best practices for secure iOS application development.

Slides

 

Demo Videos
I want to thank my friend TC for helping me in developing couple of apps for the demos.

 

 

 

 

 
 

Installing Mac OS X Mountain Lion in VMWare

22 Nov

Apple is not releasing the updates for Mac OS Lion Developer edition, so DP4 vm became older now and the latest version of Xcode (4.5)  is not working on it. To install the Mountain Lion on Vmware follow the steps provided below.

Mountain Lion VM:
1) Download VMware workstation 8 – Torrent Link
2) Enable hardware virtualization in the computer BIOS – If you don’t know how to do this, Read this link
3) Download Mac OS X Mountain Lion Vmware Image - Torrent Link
4) Vmware does not support the virtualization of OS X. To unlock the Vmware, extract the Mountain Lion Vmware image and go to ‘VMware Unlocker – Mac OS X Guest\VMware 8.x Series\VMware Workstation Unlocker – Windows’ folder. Right click on the ‘Install.bat’ and run it as administrator. It patches the Vmware and allows the installation of Mac OS X.
5) In the extracted vmware image, click on the .vmx file and it will load the Mountain Lion VM.

Vmware Tools:
1. Edit virtual machine settings, go to ‘Cd/Dvd’ and use ‘VMware Unlocker – Mac OS X Guest\VMware 8.x Series\Tools\darwin.iso’ as iso image.

mountain lion vm settings

2. Power On the virtual machine and click on Finder. Click on the iSO image listed on the right side and install the vmware tools. Vmware tools installation displays ‘The Installation Failed’ message and that is expected.

mountain lion vmware tools

3. Restart the VM and now it supports the Full screen mode.

XCode
1. Open Mac AppStore and login with iTunes account.
2. Search for Xcode and install it. It installs the Xcode 4.5 & iOS 6 simulator.

mountain lion xcode

Note: I tried updating the VM to Mountain Lion 10.8.2 but not succeeded.

 
 

Safari/iOS – Cookies.binarycookies reader

27 Oct

Safari browser and iOS applications store the persistent cookies in Cookies.binarycookies file. This is different from other desktop browsers. For example Internet Explorer stores the persistent cookies in text files under Temporary internet files folder. Similarly Firefox and Chrome browsers store the cookies in Sqlite database files. It is very easy to read the cookies stored in the text files and Sqlite database files. But there is no tool available to read the cookies from Cookies.binarycookies binary file. So I wrote a python script (BinaryCookieReader.py), when executed takes a Cookies.binarycookies file as input and dumps all the cookies in that file.

Usage of BinaryCookieReader
1. Download and install Python.
2. Add python installation folder to system PATH.
3. Download BinaryCookieReader.py
4. Open command prompt and run the below command. It dumps all the cookies from Cookies.binarycookies file.

Python BinaryCookieReader.py [Cookie.binarycookies-file-path]

Cookies.binarycookies reader

On the iPhone, Safari browser and third party iOS applications store the cookies in Cookies.binarycookies files located at the path shown below. Cookies created only with the future expiration date (persistent cookies) are stored in the binary Cookies.binarycookies file.

Cookies.binarycookies location

Most of the iOS applications create session cookies with future expiration dates as they don’t want to prompt the user for login every time. Usually those cookies will never get expire unless the user logout from the application. Also, during the iTunes backup, the Cookies.binarycookies file is copied to the backup folder. So if some one gain access to your iPhone  backup folder (Metasploit: Apple iOS backup extraction module), they can also get access to your email accounts and social network websites by reading the cookies from Cookies.binarycookies file.

Cookies.binarycookies Format:

Cookies.binarycookies file is composed of several pages and each page can have one or more cookies. The complete file format is explained below:

File Format:
1. The file starts with a 4 byte magic string: cook. It is used to identify the file type.
2. Next four bytes is an integer specifying the number of pages in the file.
3. Following that, a 4 byte integer for each page, represents the page size.
4. Next to that, the file contains the actual page content. Each page is of length corresponding to the page size. Page format is explained below.
5. The file ends with an 8 byte value and it might be file checksum.

cookies.binarycookies-file format

Page Format:
1. Every page starts with a 4 byte page header: 0×00000100.
2. Next four bytes is an integer specifying the number of cookies in the page.
3. Following that, a 4 byte integer for each cookie, represents the cookie offset. Offset specifies the start of the cookie in bytes from the start of the page.
4. Next to that, the page contains the actual cookie contents. Each cookie is of variable length. Cookie format is explained below.
5. Page ends with a 4 byte value and it is always 0×00000000.

cookies.binarycookies- page format

Cookie Format:
1. First 4 bytes in the cookie is the size of the cookie.
2. The next 4 bytes are unknown (may be related to cookies flags).
3. The next four bytes are the cookie flags. This is an integer value (1=Secure, 4=HttpOnly, 5= Secure+HttpOnly).
4. The next 4 bytes are unknown.
5. The next 4 bytes is an integer specifying the start of the url field in bytes from the start of the cookie record.
6. The next 4 bytes is an integer specifying the start of the name field in bytes from the start of the cookie record.
7. The next 4 bytes is an integer specifying the start of the path field in bytes from the start of the cookie record.
8. The next 4 bytes is an integer specifying the start of the value field in bytes from the start of the cookie record.
9. The next 8 bytes represents the end of the cookie and it is always 0×0000000000000000.
10. The next 8 bytes are the cookie expiration date. Date is in Mac epoch format (Mac absolute time). Mac epoch format starts from Jan 2001.
11. The next 8 bytes are the cookie creation date.
12. Next to that, the cookie contains the actual cookie domain, name, path & value. The order is not specific and they can appear in any order.

Cookies.binarycookies cookie format

*LE – Little Endian
*BE – Big Endian

References:
Tengu-Labs: Miyake%20-%20Safari%20Cookie.binarycookie%20Format%200_2[Draft].pdf
StackOverflow: safari-5-1-cookie-format-specs
Toolbox: understanding-the-safari-cookiesbinarycookies-file-format-49980

 
 
Page 4 of 13« First...23456...10...Last »