We got everybody? All right, let's do this. OK, guys, I'm Joe McCray. If you've never heard of me, you're like the rest of the conference. I'm a network pentester guy. Anybody has ever heard one of those guys? You know, I'm AKA the black guy at security conferences. Yeah, it's me. It's me. There's like three of us. You know, if you're one of them, see, I got them. Yes! See? OK, that's us. That's us. I'm a network pentester.  Yes! That was me for years and years and years and years. I was like cross-site scripting?  I get pop-ups when I surf the web all the time. Just one that says XSS. Kind of wasn't scaring me. So I realized that I have been here, God, since like DEF CON 8.  Who's with me? Old? Yes. OK, I remember. Let's take me back.  Let's go back. Who remembers back in the good old days when you would tell the customer all you need to do is apply a patch? Who remembers that?  People didn't apply patches.  That's what I remember. I remember we would use ISS because Nessus was like some rogue open source thing. Does anybody remember that? Back when Nessus was free, who remembers? Nessus used to be free. Yes. So I remember back in the days, we'd break out our Uber tools. We did it something like this. Go with me, guys. Go with me. So you'd port scan the network. You'd run in-map, find a bunch of open ports. You'd banner grab. You'd go, OK, this is what you're running. You'd go out to websites like Rootshell. Does anybody remember Rootshell? Yes. So we'd go out. We'd grab our exploit code. We'd own half the freaking planet. Nobody applied patches back then. So we would go. We would own the whole freaking planet.  That was it. That was it.     And that was it.  This guy is bad. Well, now, pen testing is different. I mean, you can't even walk into Barnes & Noble without tripping over a security book. So everybody's a CISSP. Every customer is a security consultant, trying to tell you how to do the assessment. Come on. Yeah. So we would get paid for telling people that they were dumbasses. Now they think that because they read hacking exposed, they're the pen tester now, but they're still hiring us. So now they've got 50 million other security things for us to go against. Firewalls, antivirus, intrusion detection, intrusion prevention, they've got everything. There's so much stuff for us to go against. The game has changed. It's not port scan. Who doesn't port scan anymore? Who's like, why? Who's with me? OK, I got one man back there. I don't port scan anymore. It's pointless. Why? I go through the web app.  It's dumb. And then I saw SQL Ninja uploading that cat via SQL injection. And bro, it changed my life like Jesus. I was like, that's it. That's what I want to do. So I switched to the web app. I completely changed.   So let's walk you through the agenda. Hopefully my laptop will stay on. I always submit a talk called SQL Injection for Mere Mortals where I cover the basics of SQL injection. It never gets accepted. This is like the 15th time I've given this talk. No one ever wants to learn the basics. So I'm not teaching the basics.   I'm not teaching it.  So get me some rum and coke.  By the way, if you guys haven't noticed, I curse. Just I'm black. I'm not here to clean. I'm a security guy. I do curse. Stay with me. All right, guys, we've got three classes of SQL Injection, in-band, out-of-band, inferential. So I'm sure everybody can read the slides. Let's get through this because I'm going to try and move on to the SQL Injection in the real world. So in-band SQL Injection is when you're attacking the site and then you see the error message. So like here, it says, syntax error converting the VARCHAR value of Joe to a column of data type int. So in this case, the error message is right on the screen. You did your attack. It's in-band. You see it right where you did it. Out-of-band is different, different. You maybe get the response back over email, over HTTP, or over DNS. So you do the attack, and then the results of the attack come back over at different means. Please kind of bear with me. I'm kind of moving quickly. All right, inferential. Inferential is when you don't get error messages. You always get developers who tell me stuff like, well, what if I just turn off verbose error messages? What if I redirect everybody to a custom 404 page? Won't that stop you? I mean, you kind of look at them like, no. So with inferential SQL Injection, you're asking the database a question.  So you ask the database the question, and he waits a couple of seconds, and then he gives you the valid page. And you're like, oh, cool. So you are running as DBO or whatever the case may be. All right, so what about tools? Everybody loves tools. So let's go over some simple concepts with the tools. One, I don't use closed source tools. Sorry. So with the first tool, I can't even say it. Sorry, a little bit too much alcohol. WPoison, SQL Map, WAPiti, W3AF, Paros, SQL ID. These tools identify SQL injection. But the thing that I run into is they only identify one, or in some cases, two. So this is that little hint to people. There's three types of SQL injection, error-based, union-based, and blind. So if your tool only identifies one, or two types of SQL injection, is anybody kind of picking up on what I'm inferring here? Come on, come on. Yes, you will miss something. You will miss something. Okay, so again, error-based is asking the database a question, and then gleaming the answer to your question in an error. Union is joining your own SQL query to the query that's already there. And then lastly, blind, that's asking it like, okay, well, does one equal one? Database is like, yeah, it does. Does one equal two? Database is like, no, it doesn't. That's inferential-based. All right, so here's my methodology. Key things that are important for me. Everybody knows that when you're testing for SQL injection, you need to use a tick, okay, the single quote. So I always say, identify the injection point. You see in the query string that you can insert your tick. You go, all right, cool. Identify my injection. And then determine the type. Is the point that I'm injecting into, is it an integer, or is it a string? And if I can figure that out, which shouldn't be too hard, because can we differentiate between numbers and letters? Okay, so if you can do that, you can figure out that if it's a number, it's an integer. If it's got letters, it's a string. So that's determined the injection type. Is it integer-based or is it stream-based? Now I know that sounds stupid, but the reason that that's important is because if you can figure that out, that's how you know whether you need your tick or not, your single quote for all of the rest of your attacks. And as corny as it sounds, that's extremely important for IDS evasion and web application firewall evasion. So now we start going down into it. How do we attack it? Well, the first thing is to just go for error-based. That's the easiest. If it throws an error, we can look at it and go, ah, SQL error. Pretty easy, okay? Sometimes we don't have errors. We have to move on to a union-based where we try to append our own query to it. Union joins two queries. And if none of it works, we go for blind. All right, so I have to focus on manual testing. If none of your tools identify all three types of SQL injection, you're really gonna have to be forced to learn how to test for this stuff manually. Now who uses WebGoat? Anybody? WebGoat? Okay, so when I first started using WebGoat and Web Maven and HackMe Bank and HackMe Books and all these applications that are designed to teach you WebApp Sack, I was like, wow, this is cool. Then I actually tried to pen test the real WebApp. See anybody go through that one? It's kind of a little different, right? Okay, SQL injection in the real world is difficult. Okay, so that's really kind of why I started putting this together because it was all the headaches I went through. Okay, so integer-based injection, so you see page.asp, question mark, that's the parameter, ID equals one, cool. So it's a one, so now we know it's, this isn't working very well. So it's a one, so we know that that's an integer, we don't need our tick. We look down here at string-based SQL injection, ID equals X, so now we know we need to use our tick. Very important to remember. So I'm gonna move through this kind of quickly because it's a breakout talk. I don't even have a QA period, I'm supposed to just go 50 minutes, so we're gonna move quickly, okay? All right, so let's talk with MSSQL syntax. So you're attacking a website and it's page.asp ID equals one, one of the most common things that people will say is, or one equals convert int user. Now the database comes back and he's like, dude, you can't convert the value of user into an integer.  So in that, we get the actual database user, so see syntax error converting and varchar value of DB user into a column of data type int. So the database responds by actually answering your question, who is the user in the error message? So some other things that I've learned is to grab some other things. Grab the database user, grab the database name, grab the server name, grab the OS version, just replace this user DB name, server name, just replace that in your injection point.  Union-based looks like this. So here you see that ID equals one, so you add a union select all one. Then it comes back and it tells you, whoa, all queries in an SQL statement contained in a union operator must have an equal number of expressions in the target list. You have to have the correct number of columns. So now what do you do? You go, okay, well let's try union one, two, and you keep getting the error message. So you keep adding numbers until you finally get no error message. So here you see it's union select all one, two, three, four, no error message. So we go, okay, now I know there's four columns. So now I can replace one of those columns with the word user or DB name, and now we can start extracting data out of it. Okay, and this is those cases when you don't have error messages. All right, lastly, blind SQL injection. This is where you start asking really weird questions. If the database user name is one character, wait 10 seconds. Okay, if the page comes back immediately, okay, well I know it's not one character. If the database user is two characters, wait 10 seconds, it comes back immediately. Okay, so I know it's more than two characters. If the database user name is three characters, wait 10 seconds, then you see that it waits 10 seconds, and then the valid page displays. Even if it's just a home page, you go, wow. Okay, so the database user name is three characters. So we break out our handy-dandy conversion chart, ASCII decks, ASCII decimal hex. We say, okay. A 97 is the letter A. So is the database first letter of the database name in A, if it is, wait 10 seconds. So now you'll see that it's not, and you keep iterating through it. Is it a 98, a letter B? No, it's not. Is it a 99, a letter C? No, it's not. It's a letter 100, the letter D, and then it waits 10 seconds. Is anyone picking up on the fact that this is gonna take a while? I'm just hoping, I know it's early. I know it's early. Does anyone realize this is gonna take a while? This is blind SQL injection. Who's with me?   You wanna do error-based first. You wanna read the errors. Well, okay, if that doesn't work, then we go for a union. And if that doesn't work, then we go for blind. So I don't like when guys say, oh, I just use SQL map. Do you realize SQL map uses blind SQL injection? I had a buddy of mine tell me he's on a pen test. So he asked me to help him with this injection. So we're talking and I'm helping him. So he's like, oh, I wanna dump the whole database. And I'm like, okay, I'll help you out. What are you gonna use? He goes, SQL map.  This is one of those lessons that it's better you learn on your own. Two days later, he dumped the entire database.  Hello. So that was a good lesson. He doesn't do that anymore. So here we finally guess the second character is a B. Here we guess the third character is a B. Oh, database owner. Okay, I'm gonna skip my SQL syntax.  All right, but real quick on the union. How do I figure out where to throw in the word user and all that kind of stuff? What's happening is if the website is saying ID equals one, union all select one, two, three, four, five. Now I get a valid page. So I know there's five columns. I'll change the value one to a negative number. Doing that will make numbers display on your screen.  So you change the value to a negative number. And now what happens, or the word no. And then you'll get the column numbers that echo back data right to the center of the screen. So it looks like this.  But I just changed the word to ID equals no. There's seven columns in the table. But can you see now that the number six and the number three display right in the middle of the screen? So now I replace column six and column three with my queries. So now you can see that column three is user. You guys see the lower case three of the small three? That's WS user at local host. You see the at version. Now it comes back saying, hey, I'm my SQL version 5.045. So now we're extracting all this data straight to the website. Okay, and then the same thing like I showed you with Microsoft SQL injection. You know, you can just replace them with user, database, version, data directory. There's a whole bunch more. All right, now we already know about the blind SQL injection. So let's move on through that. SQL injection in the real world.     Weird error messages, okay? So I watch TV while I hack. You know, so I watch a lot of videos and stuff like that. So is it just me or is little John a millionaire with only a two word vocabulary?  I think this is deep thought for me, you know. So it bothers me, you know, like I'm hacking into banks. I'm breaking into like multi-million dollar systems and all that kind of stuff. And I don't make seven figures.  I can put some long words together. I'm telling you. And how the hell, okay, well, let me move on to the next slide. I'm not bitter. We're just gonna own littlejohn.com. So we're going to littlejohn.com. It's littlejohn.asp and it's Lil, right? So Lil is the parameter. It's a string, so we need the tick, right? Yes, yes we do. So we need the tick and here we get this funny error. Microsoft OLEDB, provider for SQL server, incorrect syntax near your right parenthesis. So about two freaking days goes by of me Googling everything on these types of errors. So I get a wild idea.  Now, who's with me?   It's not like that in the real world, people. Not anymore. That stuff's gone. So now that I realize that I still need my tick and I need my right parenthesis for every injection, I'm cool. So if you're using an open source tool just open up your Perl or Python based tool and change that for all the rest of your injections. Okay, so now here we can see or convert int, debby name and we see that the database name is yeah. Yeah? Now here we go int version and it comes back and tells us hey, we're running Microsoft SQL Server 2005 on Windows NT 5.2, which is Server 2003, Service Pack 2, okay?  Just bothered me.  This one took me a little while. So I'm working on this website and it's PHP. So I do a union all select one, union all select two. This is usually where I ask my girlfriend, I'm like okay, so what do you think?  Right, so I'm like union all one, two, then I get this error, whoa. The text, in text or image cannot be displayed as distinct. Who's a programmer? You guys are way better than me because I'm not.  I Googled and Googled and Googled, called my friends, Googled some more, called my friends, drank some more rum. None of it was working, those are my usual things by the way. And I'm working at it, working at it, working at it and I'm like God, so finally one day I'm using that whole Google translate thing and I find this Chinese website where the guy's like dude, if you just do a convert text hello, it'll allow you to keep enumerating past this point. I'm like you've got to be kidding me. And he's like yeah, so I tried it, freaking works. Okay, the issue is people put things in their database like favocons, like thumbnails. So it doesn't come up, it's just a regular string or a regular integer. Couldn't somebody have just put that in the first five results of Google? I mean damn, can you help a brother out? So now we go back to iterating four, five, six, seven, eight, nine, then we come up with whoa, operin clash, text is incompatible with type int. Another weird freaking database. The database developer decided to do something cool. You know how these guys go, right?  The smelly one that you don't let talk to the customer? Come on, right? So he's back in the server room going oh, this is gonna be so cool, if I just write these queries this way, it's that guy. So you're like okay, man. So this one I found that if you actually just substitute the word no, I can get by that one. So some quick tips I came up with. Always use the union with all because of similar or non-distinct field types. By default, union tries to get records with type distinct. Okay, use null in union as much as you can. It's just a much easier way when you don't know what the data type is. Really big help. Okay, I'm gonna skip privilege escalation to save time. But essentially what's happening is you're allowed to make an SQL OLEDB connection to the database and pass a username and password to it. Well, because of that, you can actually brute force the database. You just keep iterating through usernames until the connection is authorized. Okay, and I'm gonna skip this stuff. If you wanna ask me about it outside, I'll help you out, because we're kinda pressed for time and battery life. Okay, so essentially you just create, you'll add the current user to the SQL server admins group. Okay, filter evasion. Let's talk about the real stuff. The first thing is client-side filtering.  Okay, so we don't need to explain on that one too much. People who do client-side filtering, it's easy to bypass by just using something like tamper data or peros or saving the page locally and changing all that because they're trying to stop you with JavaScript. So I talk to developers and I say, hey bro, does this pass the common sense test? All of your security mechanisms you're putting in the browser and the hacker has control of his browser. Does that pass the common sense test? And then they kinda look at me like, wow Joe, I guess that doesn't. No, it doesn't. Okay, restrictive blacklist. Sometimes you run into websites that use filtering and they'll say, okay, well, we're gonna use alphanumeric filtering. So you can't use things like a greater than, a less than and equal than sign. So maybe I can't say or one equals one, but you can do some cool things like, well, is one like one? Yes it is. Okay. Whoa, that didn't work. Okay, so signature-based IDS. This is the one that everyone always wants to talk about. How do you bypass the IDS? So break out your handy dandy chart because this is what you're gonna need to bypass the intrusion detection system. So can everyone read Snort? Who speaks Snort? Everyone speaky Snort? Cool. Okay, so alert TCP, any IP address, any port going to our web servers on our web server ports. The message we're gonna send to the analyst is SQL injection attempt. Now, what are we looking for? The content is tick or one equals one. So that's what we're looking for. Guys, how do we bypass this one? How about tick or two equals two? Huh, huh?  And I was an IDS analyst. I know what I'm talking about. I wrote a lot of simple IDS signatures. So why do we have signatures like this? You can say two equals two. You can say one is less than two. You can say one is like one. You can intersperse comments or two slash astros, astros slash or two. The whole bit, okay? We have these kind of signatures to catch automated tools. These are good signatures, believe it or not.  When I was an IDS analyst, I always used to say things to my boss, like we catch idiots. We catch people who deserve to be caught. We catch people who don't know how to delete logs. We catch people who don't know where IIS actually stores logs.  Great signature for idiots. So my opinion of IDS is, okay? I love this. I was an IDS analyst and we would get an alert and it'd be like, I got one. It's a real hack. Like, I got one. 50 million false positives all day long. I got a real hacker today. Got one. Got one. Okay, let's move on to a little bit more complex of a signature. So in this case, any IP address, any port, going to our web servers, and we've got PCRE, Pearl Compatible Regular Expressions. We're looking for the word and, we're looking for the word or, but we're still looking for one equals one. We're also looking for the comments that people add to the end of their injection. So in this case, we bypass that very simply. So we'll do a two equals two. And then instead of the dash dash, percent sign 2D, percent sign 2D is that comments. It's that hyphen hyphen. So again, we've bypassed the signature. Okay, so again, this is another example of a signature that we have for automated tools, but they're really not good because you can just open up your open source tools, SQL map, SQL ID, WAPIDI, or any of these tools and change your injections to look like this. That's what I do. Okay, so now we've got some more complex ones. So here we're looking for a select statement. So select all records from, and then here we're looking for a union with the dash dash. So can you guys see that I just did a or to in, and then it's just a whole bunch of hex. Well, that hex translates to select user. So the entire signature is bypassed because we've encoded it completely in hex. Same thing with the union. Now there are some IDSs that can do normalization. So we'll talk about that. If you guys have questions, you can just kind of grab me outside. We'll talk about bypassing hosts that, I mean intrusion detection systems that do normalization because that's possible as well. So here, in some cases, maybe they've got a signature that looks for hex, but they're not looking for the uppercase and lowercase versions of each letter. So a percent sign 73 and a percent sign 53, that's the capital and the lowercase x. Well, how do we bypass that? Use another encoding type, utf7, utf8, utf16, okay? The attacker has the advantage, guys. Okay, anyone ever heard of PHP IDS? PHP IDS rocks, okay? So the best thing about the PHP IDS site is not deploying PHP IDS, it's what they call the smoke test. So what happens is you can try all of your attacks on the smoke test site and it tells you what regular expressions for rules that it triggers. So what I do is I just keep going on this site and trying all of my different injections and different encodings until it finally tells me, just like football, right? It's good! So that's what I know. That's what I know. That's the type of injection that I'm gonna use against this host, okay? All right, so signature-based IDS, it's actually pretty easy to bypass. Okay, web application firewalls. I'm gonna kind of skip through some of this kind of quickly, okay? So, key things that I look for, mod security, anybody deploy mod security, okay? All right, mod security is awesome because if you actually do something scary, like read the documentation, it'll tell you put slash cmd.exe at the end of the URL. And if you do that, you'll get this 501 method not implemented error. So great, how do you think I fingerprint mod security now? That helps. So, other things like WebNite, which is another open source web application firewall, you'll see in the response, HTTP 1.1.999, no hacking. See, it's like, don't do that. Okay, well, Gary O'Leary Steel, he has this awesome unicoding coding tool. It's Ruby-based, so you can just put in your cross-site scripting or SQL injection and it codes it all in Unicode. So this is great. So in this case, this is another web application firewall. So it gives me a 200 okay message, which is great for tricking vulnerability scanners into thinking that the host is okay and not vulnerable. It just flat out gives another 200 okay, the scanner just moves on. But if you actually look in the response, you'll see it says condition intercepted. So now you know you're dealing with some sort of filtering device. So I was on a bank pen test recently and I ran into this little bugger called .NET Defender. So I'm like, wow, .NET Defender has blocked your request.  So I was like, damn, now what? So I break out my smoke test and lo and behold, conversion error failed when converting in Varchar value DBO to data type int. This thing is running as administrator, $16 billion bank running as administrator, but they've got a web application firewall. So they're PCI compliant. So wow, the web application firewall is stopping the bulk of my attacks. So I went for the encoding thing. So I used the Gary O'Leary tool and now you see that it says, hey, I'm running SQL Server 2005 on server 2003 service pack two. So I said, you know what? That's cool, but I want something good. Why don't you just give me the admin password hash for the database? It's the end of my talk, fellas. Okay, so if you wanna learn SQL, some great references, go learn SQL, great tutorials, cheat sheets. This guy, pen test monkey. I don't know if he's here today, but if any of you know him, I've never met him, but he helped me out when I was trying to learn SQL injection, gave me some good pointers and all that kind of stuff. If he's here and you know him, pointed my direction, I'm buying that guy a drink. Thanks. He's got the best cheat sheets on the internet for doing SQL injection and he's got them for every backend database. Okay, so MS SQL, MySQL, Oracle, Postgres. He's even got a fricking access SQL injection tutorial.  Okay, all right, references from me. Paul Batista's Tourcon nine presentation was really good, helped me out a lot. Brad Warnack, he works at SecureWorks. He's got a great GAC paper that's really good. That was helpful and lots and lots of rum and coke. That's how I do my thing. Okay, if you wanna catch up with me, work at Learn Security online. You know, hey, I'll try my best to help you out. If you want my slides, it should be on the Defcon CD or you can email me for them. I'm on Twitter, I just don't use it here because it's all on the wall of shame. You know, but if you wanna holler at me on Twitter, I got your back, okay? I'm on LinkedIn, say what's up. Cool? All right, what do you call it? How much time I got? You got 10 minutes. I got 10 minutes? Who's got questions? Okay, well, I can't tell you about that bank, but we did a really cool bank where we were actually able to move money between accounts and all that. Who's ever wanted to do that, like change your grades in school and all that kind of stuff? So that was cool, we could move money between accounts and it was an investment bank so we could do some cool things. SQL injection is great for that kind of stuff. We're able to dump the whole tables, we could see this particular bank. I remember the guy who was telling me the director of information security said, well, if you can get to the SWIF network or if you can get to these three accounts and they're individuals whose account assets were over $200 million each, it's like if you can get to their social security numbers, pen test is over, good job. So miraculously, via SQL injection, life is good. Okay, any more of this? What's up, man? Not really. Okay, so the question was, have you ever found a way to get around prepared statements? So generally what people are gonna tell you is, if you use parameterized queries or prepared statements, it's really just a matter of input filtering and saying that this is what I'm passing to my database. I really have not run into that where we were intentionally bypassing or injecting into prepared statements. What I have run into is injecting and distort procedures. So people who say that stored procedures is a valid means of preventing SQL injection, they are wrong, right? You know, talk to the left because you ain't right type thing, it wrong, does not work. Okay, so if they scrub the input, great, great. But again, how well are they filtering? Are they filtering for encoded type data? Correct, correct, correct. That would be the smart thing to do. And if I had customers like that, I wouldn't have a job. I mean, it's really that simple. Data input validation is always gonna be huge, right? So if you're gonna say, I'm only going to accept from zero to nine in this field, I'm not going to accept anything else, no ASCII, anything, that's exactly what it would have to be. But in those cases where you don't know what it is, like I've been tested a car website. So they had the car model numbers. So if it's like a 325 IBMW, it's got strings and characters into it. So some of that kind of stuff is where it gets hairy. Okay, you have a question? Sure. Well, you're gonna hire me so we can try it out. So he's basically telling me, can you say that one more time? Okay. Okay, so essentially what you're dealing with is you're not saying that you're doing good input validation, you're ensuring that the attacker doesn't see database errors. Okay, so in that case, that's when we use union-based SQL injection and true false or time-based blind SQL injection. So you're asking the database, hey, does one equal one? If the database gives you a valid webpage, then yes, he's processing that request. If you say, hey, does one equal two? And then it gives you an error page or a custom 404 page. Again, it processed your request. Now you know SQL injection is possible. Another one that's really, really good, Paul Batista shows this technique. So let's say it says ID equals five. If you can take that number five encapsulated in parentheses and say four plus one and then you get this correct page, you now know that it's processing your database queries. It's doing arithmetic operators. So now we know that SQL injection is possible without error messages. So it is possible. The best thing to do is prepared statements, parameterized queries, use things like ASP.net. If you're using classic ASP, do your upgrades to ASP.net. That's the kind of stuff that's gonna help. Okay, any other questions? Yes? I have not run into anomaly-based detection while I was pen testing. I have not. So I really can't speak on that. If somebody has something like that that they wanna give me, I've got like probably 30 or 40 vulnerable applications I can put it in front of, I would love to see what it's like. But I just can't see behavior-based SQL, behavior-based anomaly-based detection catching things like all of these different encoding types. I think it would be really, really difficult. I'm partnering with a couple of web application, firewall companies, and encoding is where it's at. That is just where it's at. Okay, did you just add a question, sir? Sure. Sure, sure, sure, sure. They are, they are. What I've seen that's the best in this kind of thing, and to be honest, I really haven't seen it deployed as PHP IDS. ASP.net has what's called Request Validate. And that's been very, very good. But does anybody know Portswigger? You know, they make Burp Suite? Okay, great, great, great tool. He has a blog post on parameter name SQL injection as a means of bypassing Request Validate. So if it's ID equals five, instead of actually injecting into the five, you're injecting into ID, the parameter name itself. So that's a very, very good way for that kind of stuff. You'll get a, you're not injecting into the where clause, which is the norm. You know, you've got a completely broken query. You have to manufacture the query out of it. But it's definitely possible. You know, so again, you're going to do that. Put your injection in and then just comment out the rest of it. Okay, yes, sir? Sure, sure. Dynamic pre-processors and snort and normalization of traffic are what we're going to have to talk about outside. But yes, that's a very good solution, but extremely resource intensive. And, you know, again, someone with just got like a whole server farm and all that kind of stuff, I just haven't seen it be effective. You know, and I'm not down in snort or any of those guys. And all those guys are here. I'm not hating on it. I'm just saying, you know, really, I don't see customers who deploy it that way. And then when they do, they're dropping packets all the time because it's just so much stuff to load all these dynamic pre-processors. Yes, sir? I personally haven't. I think the hottest thing right now for... Okay, so he was talking about ORMS. I haven't tested it. So I can't really speak on that one. Can't really speak on that. I run into a lot of ASP, a lot of PHP, a lot of ASP.net. The thing that's starting to be new for my business is Ajax and web services. That's really kind of what I'm running into a lot of this new stuff. Yes, sir? Yeah.  Email me. Definitely work with you on that. I've got a list of stuff that I've been giving to developers. That's actually something I should put in the slides. That would like make sense, huh? I guess that passes the common sense test. Yes, sir? Yes, there is. He's asking you, are there any tools for showing you what is in the way? There's a guy's name is Sandro Gachi and another guy named Wendel. Wendel works for Trustwave. Sandro works for what he owns, Enable Security. And I've been helping with that and they've got a project called WafWoof and WafFun. And it's on Google code. I should throw that up there. And basically what we're doing with that is we are fingerprinting web application firewalls. And now with WafFun, we're brute forcing web application firewall rule sets. So we'll just keep sending all the different types of requests and see what types of filtering that we get back to determine what the web application firewall rule set is. So that's definitely on the way. We need code monkeys who can help us with that.  So if you're like, hey, we're running in perva, let us give it the beat down and we'll happily add that to the tool. Yes? Sure. Okay, that's a pain in the butt. He's talking about escaping.  It'll, you'll say, or one in select user and then right at your or, you'll see in the error message that it's added an extra tick and broken your query. Right?   You can use slashes to negate your tick and you can use encoding or what's even better is what if you're injecting into an integer and in that case, you don't need your tick at all. Okay, so that's really the two things that I'm using that helped me in those cases. Do we have any other questions? Yes, sir. Yeah, yeah. Biggest things that I'm finding, he's talking about injecting into Ajax, JSON, biggest things that I'm finding is you need something that's going to allow you to mess with that request in and of itself. So things like soap UI, great tool for that because you can actually generate, you know, the, the, uh, Wistful and connect to this web service. You need things like that. You need to be able to break the entire request apart. And worst case scenario, you'll just track the request itself manually with something like wire shark and then submit the request on its own. You know, it's really just a manual tedious process to be honest. Okay. All right. We got five minutes, a couple more questions. All right. Hey guys, my first time speaking at DEF CON, I've been here like so many years. I really appreciate you guys hanging out with me. Thanks a lot.


Surface Plasmon Resonance, SPR, sensors have been around since the early 1900s, but it wasn't until the 1980s when they were used for gas and biochemical sensing. Since then, there has been significant progress in the development of these sensors, driven largely by advances in light source technology. Light sources such as LEDs, OLEDs, and laser diodes have enabled the development of low cost, portable, and disposable SPR sensors. This review discusses the current state of SPR sensor development, focusing on light source technology trends. It also highlights the potential for further miniaturization, portability, and disposability of SPR sensors through the use of low cost light sources. This article was authored by Brilliant Addie Prabowo, Agnes Purwadiantri, and Kochen Lu.


Well, ladies and gentlemen, thank you for coming to this session on the Belt and Road Initiative. The Belt and Road Initiative was mentioned by President Xi Jinping of China in 2013 while he was visiting Kazakhstan. He was talking about the terrestrial belt, and then the next year in Indonesia I believe it was he mentioned the sea route or the sea road. It used to be called the Belt and Road Initiative or BRI. A lot of people are not so clear about the terms, especially in English, because I believe that was a mistake made by the Chinese in translation, and that is the belt is a terrestrial belt that spans all the way from East Asia, from Japan, Korea, China, all the way to the eastern part of Europe. The road in the Chinese language can be sea road, but of course in the English language you don't have a road in the sea. So perhaps we should call it the sea route, but it doesn't matter. The road is a sea link, and this is my first point. The second point is that this is nothing new. 2,000 years ago, mankind already had the silk rope. What we are talking about today, basically geographically, is exactly the same area that was there 2,000 years ago, and President Xi Jinping mentioned in 2013 that this is a silk rope. So I suppose it's nothing new under the sun, and this is just another effort of mankind over a long period of time. This thing was brought up by China, but from day one President Xi Jinping mentioned that this is not something for China alone. This is way too big for any one country. This is something that is indeed for the international community. China, as wealthy as it may be, does not have all the necessary funding for such a huge endeavor. It is really an endeavor that crosses 50, 60 countries, indeed not just the countries that is touched along the silk road today, given transportation and technology and communication, anyone can participate in this effort. And hence, for example, the AIIB, the Asia Investment Infrastructure Investment Bank. Yes, it started by China, but do you know that today some of the top executives are American, European, the rest of Asians? And this is something that is truly an effort that needs the international community to participate. Where I think that it has went wrong, if it did go wrong, was that I believe that the populace in particular on the internet had just blown this thing way out of proportion. And then of course, foreign countries, some of them who don't like either China or Xi Jinping, want to make it into a grand strategy. Well if it is a grand strategy, as far as I can tell as an economic strategy, as we will show later, geopolitically it really does not make sense, but economically it makes all the sense. Let's confront this head on. That is, why is China bringing this up? What is there for China? Well, as I said, it is for everybody who wants to participate. And by the way, everybody sign up on AIIB, all the major nations except two. That is United States and Japan, I hope they will join very soon. Obviously, there is something for China. Nobody in the international arena does things because of altruism. It must be for its own good. In the short run, this is very good for China because China is over inventory and China has over capacity. United States sells steel, cement, many things elsewhere. Number one. Number two, in the medium term, I think China needs energy security. That is very critical to China and indeed food security as well, but energy security is number one. And then in the long term, all those countries along the belt, the terrestrial belt, are basically Muslim countries. And China does have some internal issues with the Muslim community. For the most part, in all the provinces, there is no problem except one. And some people have mentioned that and that is a bigger situation in Xinjiang province. So China needs to make friends with all the Muslim countries west of China all the way to eastern part of East Europe. Number two. Only when the terrestrial belt of Central Asia, Kazakhstan, Kyrgyzstan, Uzbekistan all the way up to Georgia, Azerbaijan, Armenia, and so forth, unless there is economic development, they will not be able to trade with China. China need to help them first together with any other country who want to participate in building the infrastructure that is necessary for those countries to economically develop. And finally, I suppose it's also good to make friends. After all, the United States every year in the United Nations, in Geneva, pick on China on its human rights record. I don't know why they don't pick on the Saudi Arabian, but anyway, they pick on China and it's very useful to have more friends. My last comment is this and I will open it and I will turn to my three speaker and that is, I believe that 100 years later, 200 years later, 500 years later, all the geopolitical, all the geopolitical interactions may be accepted as is or may be forgotten. But whatever it is, there is one thing I believe that is underlying the whole thing that will not be forgiven and that is the cultural exchange. Just like Silk Road of the old days, of course it accomplished something geopolitically, a little bit geopolitically. But mainly, the cultural exchange has perhaps affected the world more than anybody else. So I'm very, very honored to be here with the three very distinguished speakers. Immediately to my left, my good friend, Mr. C. Y. Leung, he was the third chief executive of Hong Kong. Under the British, it's called Governor, they're governors. Now that after 1997, the top leader of Hong Kong is called the chief executive. I suppose his business is very important to us. So Mr. Leung is the first chief executive, the third chief executive of Hong Kong after 1997. And after his term was up, he is now a vice chairman of CPPCC or China Political, People's Political Consultative Conference, which ranks him as one of the leaders of China. So next to him is my other good friend, Chef Kamka. Chef's family is truly amazing. They hail from India. However, his parents are mostly in London, although every time I'm in London, his parents are traveling, can't see me. But anyway, Chef has lived, what, 20 years, 25 years in Russia. He speaks Russian fluently, many other languages as well. And then he is doing business all along the terrestrial belt, of course, in India, which straddles both the belt and the sea road, but also Russia. And then he's, I understand, recently doing some business in China as well. So he's truly very qualified to speak on this subject. Last but not least, Dr. Bayu, Christina Muti, the former Minister of Trade from Indonesia, as we all know, Indonesia is really the big country in Southeast Asia. They account for 40% of the population and 40% of the GDP of the entire Indonesia, of the entire ASEAN countries. And Dr. Bayu is a leader in many, many fields, including agriculture, trade, and so forth. And so we are very, very happy, Dr. Bayu, that you can be with us. So I will begin by inviting Mr. Lam to perhaps being a Chinese leader now, a national leader, tell us something about the Belt and Road Initiative. What does China have in mind? How can other countries participate? And then I will turn to Chef and Dr. Bayu. Mr. Lam, floor you.


So, let's just formalize a little bit what we have seen for these elementary examples into some definitions of passivity that you find in the literature and that are useful in passivity-based control. So, if we consider a generic system, again, just a black box with inputs and outputs and we denote E as its energy, we are going to assume that it is bounded. We are going to say that the system is passive if the energy balance equation looks like this. So, available energy equals initial energy plus whatever I supplied into my system. We are going to say that the system is output is strictly passive if the energy balance equation looks like this. So, not only I have the initial energy and the supplied energy, but some energy was dissipated and just went somewhere else, I don't know where, but just into heat or whatever as I explained before. So, there is this component of dissipated energy with a minus sign. That means that I have some damping or friction if you want in my system. So, we will call it output strictly passive. So, notice that we have a coefficient here that is positive and we have the square of the output in this integral. That's what this is. And then we are going to call it input strictly passive if we have a similar balance equation, but instead of this, what we had before with the output square here, we have actually the input. Actually, this is the kind of system that will be very useful later. It's the kind of system that you want to have when you are doing some control because it means that you have dissipation in your system and you are able to stabilize it. A very important statement actually, the fundamental theorem of passivity is that when you take two systems that are passive and you interconnect them in feedback like here. So, let's say it's passive from this input to this output and this one is passive from here to here. And you interconnect them in feedback. You will again recover a system that is passive from the new input which would be the vector of these two guys to a new output that would be the vector of these two guys. And you can keep interconnecting blocks in feedback and you will conserve the passivity property. And as we see, this can be very useful to construct your controllers, always trying to maintain this passivity property or rendering the system passive if it is not in the beginning. So, if the systems Sigma 1 and Sigma 2 are passive, the interconnected system is passive meaning the map from U to Y is passive. So, we write that as using this funny arrow like this, that's in LaTeX, that's maps too. So, we are seeing the system as a map as an operator that maps once again transforms inputs into outputs. So, that's why we write it like that. So, once again the electrical circuit, let's see what happens to this circuit. We already saw that if we have a resistive element, we actually have this integral of I square R, sitting there with a minus sign. So, meaning that system satisfies this balance equation. So, my circuit, my RLC circuit is output of the circuit passive. So, what can I do with a system that is output of the strictly passive? Well, I can for instance, interconnect it with another system that is passive. In this case, if I just use another resistive element, this resistive element you can consider as input is strictly passive because it's just a constant. So, the input here, I mean the output on this side will be of course just RCI. So, you can see that this is of course input strictly passive because the input and the output are basically the same just the scale by some constant. So, it comes to connecting these over here, right? So, I'm adding this resistor into my circuit and now I will have a new input. I will be measuring the voltage from here from this terminal. So, this is what I'm doing from the block diagram perspective. I have this output, I pass it through this new resistor, the current and I inject everything back into my circuit and now I have a new and new input. So, this is how we deal with the passivity and we go constructing passivity blocks, right? So, we start with some passivity block, we make a feedback interconnection with another passivity block and we define a new passive map from a new input to probably a new output. In this case, the same output. All what we did here was adding to add a resistor. So, what will happen with the Kirchhoff's law is that there will be this new term here appearing. So, the voltage in the new resistor that I added and it will just go to the other side and we add up to RP. So, what I did with this is of course I added more dissipation into my system. But I added more with, so I used P for plant, right? There was already some dissipation there but let's suppose that this is a controlled term. So, I added, I chose RC and that's like modifying the circuit with this. So, I'm adding dissipation into my system. That's what I have done with this feedback here of RC, right? So, now my new energy balance equation will look like this. And I will have that the available energy equals the initial energy of course. So, potential energy in the capacitor plus kinetic energy in the inductor that were already in the system. And I just added a resistor to increase the dissipation in my circuit. I could probably also add a capacitor and modify the potential energy, right? I could also modify that. Yeah, yeah, yeah. So, if you connect a system that is just, you will definitely conserve the passivity property that you had initially, right? So, with this feedback, you will probably be adding more passivity or just conserving what you had. So, if you have passive and you interconnect with passive, you will have passive, right? But if you add some, so let's, okay, let's see it this way. Imagine you don't have RP. So, initially you don't have the dissipation. So, you don't have this term here. That system would only be passive, right? But then when you inject this dissipation, you are adding, you are enforcing the passivity and then you will have output-strict passivity, right? This is the output, yeah? So, this energy equation is telling you that the system after the interconnection is output-strictly passive. Yeah, so you can enforce the passivity property with the feedback. So, the energy of the circuit is the same with or without feedback. That's the energy. But by adding a purely resistive element, we just added dissipation. We added friction. Imagine if it were a pendulum, previously I showed you an example. Without friction, then you come and add friction. Now you have output-strict passivity. So, you enforce the passivity. The addition of an inductance would change the kinetic energy. You could also go and do that. And you could also add a capacitor and modify the potential energy. So, you can do a lot of things.  We will see how by manipulating these things, you can control the system very nicely. The resulting system is still passive because once again the fundamental theorem of passivity tells me that the interconnection of passive systems is passive. So, what happens with if I now I interconnect two systems that are different in nature, right? A mechanical and an electrical system. Well, actually the motor, this is supposed to be a motor, it's electromechanical. Well, let's just suppose it's just an electrical system. So, before we said that the input to the pendulum was torque, right? But this torque is actually coming from somewhere, probably from my hand or preferably from some actuator from a motor. So, this motor has an output which is going to be the torque that is going to be injected into the pendulum. But it obviously needs to have an input so that it transforms the energy to move the pendulum. And that input will be typically a voltage, right? You apply a voltage into the motor, you make it spin and generate a torque that moves the pendulum, right? We all know that. If we look at the equations, we will have the following. We have the pendulum equation with a torque that is being injected. And this torque is coming from the motor, right? So, the motor sees this torque. So, this term appears in both equations, here with positive sign, here with negative sign. Because in the equation of the motor, so this is the equation of the motor, this is supposed to be the inertia. And this is the resistance in the friction, sorry, in the rotor. And this is the generated electro, what do you call it, magnetic feedback torque or something. The torque that the motor is generating. And the motor sees the torque tau L as a load, right? Because for the motor, it's a load with the pendulum. It's a load. So, you have this term there and there. So, this is how these two systems get to be interconnected. And we go and look at the energy balance equations for these guys. So, basically, we integrate on both sides of both equations. We will have an energy balance equation for the motor, which will be, of course, the energy available at some moment will be equal to the available energy at the beginning. Whatever was dissipated in, because we have friction in the rotor. And then the supplied energy, so basically the energy that is entering into the motor. Well, there is, of course, what I supply into the motor to make it spin, that comes here. But there is the load. So, I inject some energy into it, but some energy goes into moving the pendulum. So, the supplied energy will look like this. And for the pendulum, the pendulum is all happy because it only sees energy coming in. So, there is supplied energy there and there is some initial energy and there is then available energy. So, basically, the available energy equals whatever is supplied through, I mean, coming from the motor plus the potential energy that was over there already. Now, the nice thing about this is that the whole thing, when I, the system interconnected, will also have some energy, right? And this energy will be basically just the sum of this plus that. So, now we have the sum of the energy in the motor plus the energy in the pendulum, that will be the energy of the whole thing. And what will happen is that if the pendulum didn't have friction, it doesn't matter because this guy will just contribute to there. And the energy balance equation for the closed loop system, for the interconnected system will look like this. Now, we have this term of energy dissipation and we have this term of supplied energy coming from all the way from the input voltage that is here and now my output is still there. Okay, so now I have an interconnected system and I have passivity, actually I will have output-strict passivity due to this from the map V to Q dot. And this is, so once again this is because the motor is output-strictly passive with input being this difference. The pendulum is passive, so I'm interconnected a passive system with an output-strictly passive system. So the resulting interconnection will be output-strictly passive due to this guy, right? So I recover this term in the total energy balance equation. So, again the feedback interconnection of two passive systems yields a passive system. A passive system with input-strict passive feedback yields an output-strictly passive feedback. Yeah, interconnected it will become output-strictly passive. That's the case that they showed you with the electrical circuit with the additional resistor, right? The output is Q dot, yeah. The output is Q dot. The output is Q dot. Yeah, there is no passivity with respect to Q. The output is Q dot. Velocity. And yeah, one thing to remember is that passivity is conserved when you interconnect the systems in feedback. Okay, where is that feedback? Yeah, feedback. If you interconnect them in cascade, so the output of one goes as input into the other and so on. But there is no feedback loop. You don't have passivity necessarily, okay, from here to whatever output you choose there. We are talking about interconnections in feedback form. I will not do input-output stability. Let me just tell you a little bit about this because I want to show you how we can use passivity for control. But for that, I first need to tell you about a couple of things in the steel of passivity theory. So in linear systems, we have this concept of positive realness, which I believe was introduced by Popov, a Romanian mathematician, who studied a lot equations, linear equations, right, and was figuring out properties of these linear equations. And one property that I think he actually came up with this concept of positive realness is the following. We say that the system, a transfer function G of S for a linear system with A, B, C and D matrices is said to be positive real if the real part of the transfer function is larger or equal than zero. The nice thing about this is that a positive real system is passive. And there is another important concept for linear systems, which is called a strict positive realness. So a strict positive realness is the property that the real part of the transfer function with S shifted a little bit, right, so epsilon is a small number but positive. That should be larger equal to zero. So basically you are asking, in this case, you are asking, in the first case, you are asking that the Nyquist plot is somewhere here, right, so in all this zone. And in the other case, it has to be like, sorry, in the other place, right, so the positive real. In the first case, you are asking that the Nyquist be here, right, and in the other case, you are asking that the Nyquist be strictly separated from the vertical axis and we call it strictly positive real. Now strict positive realness is a very strong property for a linear system to have. It basically means that the system is strictly passive in the whole state. I didn't speak about state-strict passivity, but you can just think of this as having the, in the energy balance equation, instead of having a q dot, you will have here the whole state, right, so x, okay. So both, you know, we're both input and output strictly passive. Now the nice thing about strictly positive real systems, we will see that with the up and down functions, it will probably be clearer, is that we have this very nice lemma that is known as Kalman Jacobovich Popov, especially because I think the story goes that Popov proved the one implication, Jacobovich proved both, Kalman proposed different proof. Each of them work separately on this result. I think Kalman published it first, but Jacobovich apparently had it first, but then as many good Russian mathematicians just put it in the drawer and went to solve something else. So anyway, so it is called the KYP lemma, it's a very famous lemma, and it says that a system is a strictly positive real, if and only if, so a linear system like that. If and only if, yeah, there exists a matrix P, matrices L and W such that all these equations hold, all these equalities hold. So in the case when there is no fit through, I mean, directly from the input to the output, which would be this term here, then these equations just boil down to these equations here, okay. So we have that ATP plus PA equals minus Q and this structural condition here. Now this one may be quite familiar to you because it just, you know that if A is Hurwitz for a system, you can always find for any Q positive definite, you can find P also positive definite, so such that you have this equation, it's called the Lyapunov equation, right. But here we have something else, we also have a relation between, so B is the thing that is multiplying the inputs and C is what defines the output, yeah. So this condition gives a structural property between the, about a structural property of the system. And actually this condition means that the relative degree of my system of G is one, at most it can be one. It will be zero if there is this fit through, but if we are in this case down here, then it can only be one, yeah. So this is a relative degree condition and this is basically a condition that says that A should be Hurwitz, right, so it should be stable. Yeah, so that's another thing to know, passive system necessarily is of relative degree either one or zero. It cannot, system of higher relative degree than that cannot be passive. That's me back in the day with Professor Jakubowicz, I'm very proud of this, of this visit, just after my PhD. And this is the piece of paper that he used to announce me as Professor Antonio Lurie, I had just finished my PhD. So yeah, it's sitting there, I will not do these slides, now I will do it in the other set of slides, so I will just pass that. Yeah, one nice thing about passivity is that you can also use it, as I said, you can use it for linear or for nonlinear systems, because again it's a concept of input-output systems, right. So for nonlinear systems, yeah, let me go here, this is like a nonlinear version of the KYP lemma. And basically it says, well this statement I took it from Halil, but the result is by the original papers are, if you are interested, you should look at the Hill and Moylan. I think Hill was a student of Moylan, but I'm not sure. I'm talking about a series of papers in 76 and 80 and there is probably one more intersections. So he essentially introduced passivity for nonlinear systems. And these expressions, as you can see, they are really like a nonlinear version of the previous ones. So essentially you want to have a storage function or call it an energy function such that the inner product of the partial of v times f is less or equal to zero, less or equal to zero and you have this inequality here. So basically the first one is like having ATP plus PA equal to zero or less or equal to zero. And this is, if we had an equality here, this would be the condition that we saw. I think it was, yeah, probably it was like this, right. And in this case, as you can see, we have a quadratic term here. So this is like having ATP plus PA equals minus y square. And here we have again basically the structural condition. You already saw this. So yeah, this is the nonlinear version of this thing here. So this is the inequality of what is below, right? And this formulation here is again, is from Halil, but the original result goes way back to the 70s. As we will see, we can use these to also use passivity for nonlinear systems, not just for linear systems. But it's nice because you can kind of in a way see linear systems as if they were nonlinear, as if they were linear because of these input output properties. And think of energy terms and so on.