BlackHat资料us-14-Bongard-Fingerprinting-Web-Application-Platforms-By-Variations-In-PNG-Implementations.pdfVIP

Fingerprinting web application platforms by variations in PNG implementations Dominique Bongard @ reversity Who am I ? • From Switzerland • Founder of 0xcite LLC • Reverse engineer • Focusing on embedded devices • Mobile application developer Agenda • Schizophrenic files • Motivation for fingerprinting image libraries • PNG file format 101 • MNG and JNG files • Various PNG libraries put under stress • Fingerprinting web applications with PNG • Practical results on major websites • Introducing the fingerping tool Schizophrenic files • Files that render differently depending on the viewer that is used • Takes advantage of bugs or ambiguities in the file format spec. • Popularized by Ange Albertini in the PoC ||GTFO security e-zine Schizophrenic PNG Schizophrenic PNG Schizophrenic PNG Motivation for fingerprinting image libraries Web server fingerprinting is a critical task for the Penetration tester. Knowing the version and type of a running web server allows testers to determine known vulnerabilities and the appropriate exploits to use during testing. (OWASP) Motivation for fingerprinting image libraries • Gives information about the application framework and language • Can give information about system libraries • May uncover an attack vector through native libraries • Usually hard to hide the fingerprints Motivation for fingerprinting image libraries PNG file format 101 • Signature: 137 80 78 71 13 10 26 10 PNG file format 101 • Chunks: LENGTH CHUNK TYPE CHUNK DATA CRC