topic Re: deactivate encoding for analysis purposes? in Application Development and Automation Discussions

deactivate encoding for analysis purposes?

Former Member — Wed, 19 Jul 2006 16:12:56 GMT

Hi security folks,

We have a scanning tool which we successfully use to anaylze development work on web applications. The main purpose is security analysis such as parameter validations etc etc.

The SAP WAS is causing problems for such analysis as the parameters / values are base64 encoded into the path, so the scanner cannot know or test it.

Does anybody know whether and where it is possible (or legal?) to deactivate this encoding, or should we just accept it as a security feature which makes our system safer?

Kind regards,

Julius

Re: deactivate encoding for analysis purposes?

christian_wippermann — Thu, 20 Jul 2006 09:03:07 GMT

The base64 encoding is not a security mechanism. It is used to transport special characters in URLs without using URL encoding. I do not know if there is a way to deactivate the b64 encoding but strongly doubt it.

I suppose you are refering to a web application firewall in front of your SAP WAS. Wouldn't it be possible to identify those parameters that are b64 encoded, decode them in the WAF and check the decoded values? As far as I know most of the params are not encoded and can be checked right away.

Cheers,

Christian

Re: deactivate encoding for analysis purposes?

Former Member — Thu, 20 Jul 2006 09:40:39 GMT

Thanks Christian,

I also have my doubts as OSS returns a note indicating that the government has middled with the topic. (631826 category "legal change")

The scanner is located on the front end and the user navigates around a bit so the scanner can inform itself. The encoding of parameters and values for the same directory makes it think that all URLs are unique paths - > so it cannot go prowling beyond the encoded value.

The idea of the tool is not rocket science, it is used to automate some of the testing / QA (with a bit of help from human intuition) to do a high level check for known errors (scripting, injection, missing input validation etc). Never the less, is there a source on identifying a b64 encoded value and decoding it?

Many thanks for the idea,

Julius

Re: deactivate encoding for analysis purposes?

christian_wippermann — Thu, 20 Jul 2006 11:03:29 GMT

Hi Julius,

If you do semi-automated checks, you should find them. Strings like "Y2t3Lg==" especially if they have one or two equal signs at the end are most probably Base64 (<a href="http://en.wikipedia.org/wiki/Base64">see wikipedia for some detailed explaination</a>).

Be careful that besides alphanumeric characters also "+" and "/" are allowed in b64 encoded values. They will additionally be URL encoded to %2B and %2F. Before you decode b64 you need to URLdecode these values.

For occasional decoding / encoding of base64, you could use the various online tools. Just google for "<a href="http://www.google.de/search?hl=de&q=base64encodedecode&meta=">base64 encode decode</a>".

Hope that helped,

Christian

Re: deactivate encoding for analysis purposes?

Wolfgang_Janzen — Thu, 20 Jul 2006 12:54:58 GMT

Hi Julius,

I'm sorry, but most likely you are on the wrong track.

Regards, Wolfgang

Re: deactivate encoding for analysis purposes?

Former Member — Thu, 20 Jul 2006 13:16:28 GMT

Thank you Wolfgang,

Are mangled URL's a proprietary thing?

Julius

Re: deactivate encoding for analysis purposes?

Wolfgang_Janzen — Mon, 24 Jul 2006 06:48:18 GMT

Definetly - it is even BSP-specific.

Brian McKellar has posted some documents on that topic in SDN. I just do not have the URL at hand ...

Re: deactivate encoding for analysis purposes?

Former Member — Mon, 24 Jul 2006 07:46:53 GMT

Thank you Wolfgang.

We will try to find the decode_url and figure it out how to use it.

If the effort is worth it I will update the post.

Many thanks,

Julius

Re: deactivate encoding for analysis purposes?

Wolfgang_Janzen — Fri, 25 Aug 2006 08:20:15 GMT

> Are mangled URL's a proprietary thing?

Here's the <a href="/people/brian.mckellar/blog/2003/09/30/bsp-in-depth-url-mangling to Brian's Blog on "Mangled URLs"</a>

Re: deactivate encoding for analysis purposes?

Former Member — Fri, 25 Aug 2006 08:38:29 GMT

Thank you Wolfgang!

From the blog: <i>"anyone in our group who even thinks about using frames is banished from the office for the day :-).</i>"

Well, it is Friday and the sun is shining...