dmayer
Attack tab proposal
User story
As a user I want to be able to exploit timing vulnerabilities using time-trial
Limitations
- The algorithm I'll implement requires the attacker to have a valid token/password.
- The algorithm I'll implement does timing attack for the first N chars and then performs a brute-force attack for the last M bytes (N, M are TBD)
- The algorithm will find only one extra valid token, not all the existing ones
Conditions of satisfaction
- [ ] User can easily configure the attack
- [ ] The attack is automated
User input
The user needs to be able to configure the following settings (which are duplicates from the creation of a new trial):
- [ ] Trial type
- [ ] Name
- [ ] Repetitions
- [ ] Description
- [ ] Request URL
- [ ] HTTP request
- [ ] Racer
- [ ] CPU core
- [ ] Real-time scheduling
These extra settings are required:
- [ ] Bruteforce charset, for example "abcdef..." or "0123456789"
- [ ] Valid token/password
- [ ] First token characters to keep unmodified during bruteforce phase (>0)
- [ ] Analysis lower quantile (for box test during attack)
- [ ] Analysis upper quantile (for box test during attack)
When specifying the HTTP request the user needs to use $TIME_TRIAL$ in the part of the request where time trial will perform the brute force.
Algorithm
- User inputs valid token
ab123, valid charset0123456789abcdefand token chars to keep untouched - Algorithm asserts that token length is at least 5 characters
- Algorithm asserts that token chars to keep untouched is >0
- Time trial gathers timing information for
ab100andab200. These tokens are created using the valid token + number of characters to keep untouched; and finally padding with the first valid charset char to the right. - Time trial asserts that it is able to differentiate between these two data sets. If this is True then time trial knows it is able to bruteforce the token byte per byte
- Time attack process is performed for all bytes after the "untouched" ones
- Time trial sends the following tests
abc100(a),ab110(b) - Compares A and B using the box test. If A takes less time than B it means that
0is a valid character afterabc1. - Test continues with
abc10as the beginning of the valid token and time-attacks the next character (unless brute-force takes less HTTP requests) - In the case where the algorithm detects no time difference between all the tested characters in the defined charset the algorithm stops with an error
Last M characters brute-force
The algorithm will brute-force the last M characters. M is calculated using:
- Attack repetitions
- User defined charset
The goal is to brute-force only when the number of HTTP requests used for brute-force is less than the used for timing attack.
Ideas and potential improvements
- The algorithm has no backtracking, so if it makes a mistake
Initial implementation and unittests at https://github.com/andresriancho/time_trial/tree/develop/time_trial_gui/lib/attack