DEFCON-23-Nadeem-Douba-BurpKit

BURPKIT
Using WebKit to Own the Web
1
2015-07-15
Presented by:
Nadeem Douba

INTRODUCTION
• Nadeem Douba
• Founder of Red Canari, Inc.
• Based out of Ottawa, ON.
• Hacker
• Interests:
• Exploiting stuff
• Building hacking tools
• Prior work:
• Sploitego (presented at DEF CON XX)
• Canari (used by Fortune 100s)
• PyMiProxy (used by Internet Archive)
BurpKit - UsingWebKit to Own the Web
2
2015-07-15

OVERVIEW
• WebKit
• What is it?
• Why use it?
• How can we use it?
• BurpKit
• Design Considerations
• Implementation
• Demos!
• Conclusion
• Questions?
2015-07-15BurpKit - UsingWebKit to Own the Web
3

THE WEB PEN-TESTER’S
CONUNDRUM
• Today’s web applications are
complex beasts
• Heavy use of JavaScript for:
• Rendering pages
• Rendering page elements
• Performing web service requests
• ¿But our security tools are still
scraping HTML!?
4

OUR TOOLKIT
5
• Reconnaissance & Scanning:
• Most tools (nikto, cewl, etc.) just
scrape HTML
• Attack:
• BurpSuite Pro/Community
• Lobo-based Renderer tab (Burp’s
neglected child) !
• No JavaScript/HTML5 support
• Charles & Zed are just proxies
• WebSecurify’s Proxy.app only has a
web view

MODERN TOOLKIT REQUIREMENTS
6
• Web penetration testing tools that:
• Have modern web browser
capabilities
• Parse and interpret JavaScript
• Dynamically render and inspect
content
• Most importantly:
• Our tools need to be able to
interact with the DOM!

WEBKIT
What is it good for? - Lots of things!
2015-07-15BurpKit - UsingWebKit to Own the Web 7

WHAT IS WEBKIT?
“WebKit is a layout engine software
component for rendering web pages
in web browsers. It powers Apple's
Safari web browser, and a fork of the
project is used by Google's Chrome
web browser.”
- Wikipedia (https://en.wikipedia.org/wiki/WebKit)
8
Image credit: Smashing Magazine

(UN)OFFICIAL DEFINITION…
9

WEBKIT API
• Made up of two major components.
• JavaScriptCore - responsible for
everything JavaScript:
• JavaScript/JSON parsing & execution
• Garbage collection
• Debugger
• Etc.
• WebCore – responsible for everything
else:
• Resource loading
• Content parsing & rendering
• Web Inspector
• Etc.
10

KNOWN IMPLEMENTATIONS &
FORKS
11
• Apple’s Safari
• Android’s web browser
• Nokia QT
• JavaFX WebView
• WebKitGTK+
• PhantomJS
• Google Chromium
• Node WebKit
• Many more…
(https://trac.webkit.org/wiki/Applicatio
ns%20using%20WebKit)
Image credit: http://bitergia.com/public/reports/webkit/2013_01/

WHY USE WEBKIT?
Pros
"Widespread adoption
"Lots of language support: Java,
Python, C/C++, JavaScript, etc.
"Portable across many platforms
"Can interact with the DOM and JS
Engine.
Cons
✗ Your code will be susceptible to the
same bugs that plague modern
browsers
✗ Tools will be hungrier for system
resources (i.e. RAM, CPU).
12

HOW CAN YOU USE WEBKIT?
Language
• JavaScript (NodeJS)
• Python
• JAVA
• Swift/ObjC
• Ruby
• C/C++
Libraries
• Node WebKit
• WebKitGTK+, PyQt
• FX WebView, Qt Jambi, JxBrowser
• UIWebView
• WebKitGTK+, Qt
• Chromium, WebKit
13

BURPKIT
How we used WebKit.
+ =

WHAT IS BURPKIT?
• BurpKit = BurpSuite + WebKit
• Used JavaFX’s implementation of
WebKit
• WebView & Debugger
• WebEngine
• Provides a real rendering tab (that’s
right… no more lobo)
• Has a bidirectional bridge between
BurpSuite & WebKit!
• And more!
BurpSuite
Extender-
API
Java4based-
WebKit API
Rendering-
engine
15
BurpKit

DESIGN DECISIONS
• Chose to go with JavaFX over
JxBrowser – why?
• Redistribution:
• JavaFX comes with Java 1.8+.
• JxBrowser needs bundling (>250MB)
• Cost:
• JavaFX is FREE!
• JxBrowser is not!
• API:
• JavaFX has a cleaner API
• JxBrowser’s is a bit ¿clunky?
16

JAVAFX: PROS AND CONS
Pros
"Easy-to-use & clean API
"Complete JavaScript bridge
"Portable across many platforms
"Leverages the Java URL framework
(hookable)
"Does provide debugging/profiling
information (with some hacking)
"Bundled with Java 1.8+
Cons
✗ API is incomplete – under
development
✗ No GUI components for
WebInspector and friends
✗ Little documentation on advanced
features (must look at code)
✗ Still a bit buggy
17

IMPLEMENTATION
Nerd Rage

CHALLENGES
• Burp uses Swing for its GUI
• WebView and WebEngine need to run
on FX event loop
• WebEngine does not have a
loadContentWithBaseUrl(content,6url)
method - only has:
• loadContent(content,6type); and
• load(url)
• BurpSuite had to be able to interact
with JavaScript and vice-versa
19

CHALLENGE: SWING/FX INTEROP
• Solution:
javafx.embed.swing.JFXPanel
• Gotchas:
• Must avoid interweaving blocking
calls
• i.e. Swing # JavaFX # Swing =
¡DEADLOCK!
• Always check if you’re on the right
event loop!
• Workarounds:
• Eagerly initializing resources
sometimes necessary
• Lots of wrapping code!
20

CHALLENGE: LOADING CONTENT
WITH A BASE URL
21
Credit: http://media.techtarget.com/tss/static/articles/content/dm_protocolHandlers/j ava_protocol.pdf
• Why?
• Required to render responses for
repeated requests
• Solution: hook java.net.URL
protocol handling framework
• WebView uses framework to issue
HTTP(S) requests
• Challenge:
• Our new handlers would have to
support both live and repeated
requests.

CHALLENGE: REPEATER
22
• Background: did not want to reissue
a live request because content may
change.
• Solution: overrode HTTP(s) handlers
and used User4Agent to “tag”
repeated requests.
• If User4Agent contains SHA1 hash,
give URL handler fake output
stream
• Else, continue with live request
• See BurpKit Java package
com.redcanari.net.http for code.

CHALLENGE: JAVASCRIPT BRIDGE
• Background: need to be able to query and
manipulate DOM
• Solution: inject JAVA objects into JS engine!
• Gotchas:
• Funky reflection algorithm in WebEngine prevented
straight-forward JAVA object interaction.
• Lots of deadlock scenarios
• Workarounds:
• Wrapper classes galore!
• Eager instantiation of Swing components.
23

THE FINAL PRODUCT
Google: Before & After
24

WELL?
25

BURPKIT DEMOS
There’s lots to see!

DEMO: GUI WALKTHROUGH
Feature set
27

XSS TRACKER
Tainting applications
28

DEMO: DOM INTERACTION
Analyzing Twitter Followers
29

DEMO: BURP EXTENSIONS
Proxy Listeners, Message Editors, and Context Menus
30

CONCLUSION
• Let’s stop scraping and let’s start
DOMinating the web!
• Our security tools need to evolve
just like the web.
• We have the tools/libraries at our
disposal
• Please contribute your ideas and
code to BurpKit!
• We need to make it the standard!
31

KUDOS
• My Lovely Wife $
• Justin Seitz
• http://automatingosint.com/
• Dirk Lemmermann
• http://dlsc.com/
• Tomas Mikula
• https://github.com/TomasMikula/Ri
chTextFX
• Java/JavaFX team
• The Noun Project
• All the contributors!
32

¿QUESTIONS?
We aim to please…

DEFCON-23-Nadeem-Douba-BurpKit

More Related Content

What's hot (20)

Viewers also liked (13)

Similar to DEFCON-23-Nadeem-Douba-BurpKit (20)

DEFCON-23-Nadeem-Douba-BurpKit