PST_WEBZINE_0X04. How to solve XSS and mix user's HTML/JavaScript code with your content with just one script
|
|
|
- Timothy Carson
- 8 years ago
- Views:
Transcription
1 ACS - Active Content Signatures By Eduardo Vela Nava ACS - Active Content Signatures How to solve XSS and mix user's HTML/JavaScript code with your content with just one script Eduardo Vela Nava (sirdarckcat@gmail.com) Contents: Introduction Signatures APIs Sandboxes Acknowledgements == Introduction == One of the main challenges in secure web application development is how to mix user supplied content and the server content. This, in its most basic form has created one of the most common vulnerabilities now a days that affect most if not all websites in the web, the so called Cross Site Scripting (XSS). A good solution would be a technology capable of limiting the scope of XSS attacks, by a way to tell the browser what trusted code is, and what is not. This idea has been out for ages, but it has always required some sort of browser native support. ACS (Active Content Signature) comes to solve this problem, by creating a JavaScript code that will work in all browsers, without the need to install anything, and that will completely remove from the DOM any type of dangerous code. I will start by demonstrating how ACS solves XSS issues, without the need of the server to do any type of parsing or filtering, and without endangering the user. Ph4nt0m Security Team[ 1
2 ACS will be appended at the beginning of the webpage's HTML code. As a simple external JavaScript code, something like: <html> <head> <script type="text/javascript" src="/acs.js">/*signature here*/<plaintext/></script> When this script is loaded, it will automatically stop the parsing of the rest of the HTML page. It will, then recreate the DOM itself, taking out dangerous snippets of code (like event handlers, or scripts), making the browser display it's content's without any danger. Now, if the user wants to make exceptions so their own scripts are loaded, they can do so, in a very simple way... adding a signature. A signature is a simple definition of the active content in the page. It will instruct ACS, which scripts are safe to run, and that any other scripts should be blocked (and optionally notified). This has a big similarity with Mozilla's Content Security Policy ( proposal, that will be implemented on a near future version of Firefox and Chrome (possibly IE), but with a couple of differences. In the first place, ACS allows you to sandbox untrusted scripts; this gives you the ability to mix your content with user's javascript code, and still be safe. It's important to note that this is cross browser, giving you the possibility to provide your users (as of right now) the ability to add arbitrary HTML and javascript code to your website, and still keep it safe. Besides this protection against XSS attacks, developers can benefit from ACS's functionality Ph4nt0m Security Team[ 2
3 that is provided via an API. This API, allows developers to parse HTML safely, sandbox javascript, and provides a safe environment where user's supplied code can interact with the original content of the page in safe way. This program's sandbox functionality overlaps with some already existent tools that require server side interaction, or the user to install add-ons like Silverlight or java. ACS main advantage is that it works completely on javascript, and requires nothing in the user's client, allowing developers to automatically support their entire previous user base instantly. ACS will include in itself a system that will automatically create a signature for a webpage, to help the developer on the creation of the signature. == Signatures == Originally, ACS was conceived to be a new idea, however later on, it was obvious that there are a lot of similarities with Mozilla's Content Security Policy rules, syntax and objectives. Either way, ACS has some different and extra signatures lacking on CSP, specifically, making it easier to migrate to it. In general, CSP forbids the webpage to display any type of inline javascript code, forcing all the code to be loaded as an external resource. As well, it forbids the creation of code via javascript strings (e.g. the use of javascript: URIs, eval, Function, settimeout, and setinterval with string arguments), giving you the option to either change all your code to external resources, or opt out of it, and so, be vulnerable to XSS. ACS, besides the fact of allowing a page to select which external resources to load, it also Ph4nt0m Security Team[ 3
4 provides an extra set of signatures that allow web owners to keep those scripts without enabling XSS, by specifying a hash of the code inside it. Another difference is that ACS provides the web owner to limit the amount of javascript code/forms/frames/etc... that are loaded in the page. This is a very important feature, since it allows web owners that if they put all user content after their active content, without the need of making any type hashing, the user code will be blocked (or sandboxed), and still keep the original scripts and styles, frames, and forms allowed. Yet another difference is the fact that ACS provides sandboxing functionality that can be enabled from the filter itself. It allows the user to sandbox CSS (removing dangerous properties), linearise CSS (removing the danger of ui redressing attacks), a frame breaker (allowing the page to avoid being framed), a XSS filter (that protects the application from XSS attacks being, reflected [also DOM level]), it allows to sandbox calls to eval() or disable it as a whole, it allows to disable javascript: URIs (as opt in feature), enforce SSL (avoid the page to load via HTTP), and enforce SSL cookies (delete cookies if they were leaked, and force them to be "secure" if they aren't). It also provides more actions to happen when an error occurs, being to warn the user, to stop the execution of the page, to sandbox the whole page, to disable the offending element, and/or to notify the web owner of the error. You can specify more than one action, and select which error will trigger which action(s). Now follows a description of the rules and events for ACS: Occurrence Counter: Ph4nt0m Security Team[ 4
5 * script-count - Would specify the number of acceptable scripts inside the page * embed-count - Would specify the number of acceptable embeds inside the page * event-count - Would specify the number of acceptable html attribute events inside the page * jsuri-count - Would specify the number of acceptable JS URIs (or vbscript) in href/src/etc.. arguments inside the page. * datauri-count - Would specify the number of acceptable data URIs in href/src/etc.. arguments inside the page. * frame-count - Would specify the number of acceptable frames inside the page * form-count - Would specify the number of acceptable forms inside the page * css-count - Would specify the number of acceptable CSS styles (<link> or <style>) inside the page * style-count - Would specify the number of acceptable styles (as attributes) inside the page * breaker-count - Would specify the number of acceptable HTML breakers inside the document (such as other <plaintext>, <xmp>, <xml>, open arguments, etc.. with more HTML content inside, this is to avoid the corruption of the other counters, this defaults to 0 if not explicitly set). * default-count Would specify the default value for counters (except breaker count). Can be either 0 or *, the declaration of this element is mandatory. * dyn-occurrence Replace occurrence with any of the previous defined occurrence definitions, including dyn-breaker-count and dyn-default-count, if no value is specified for dyn-breaker-count it s going to default to the remain of breaker-count, and dyn-default-count will default to default-count value. * all-count - Would specify the total amount of active content elements in the DOM to be allowed. Occurrence Counter Values: * A number. Ph4nt0m Security Team[ 5
6 * An *, specifying any amount of values are accepted. Occurrences: NOTE: The hashes should be put in the format algorithm:hash, for example: sha1:f71bc019a37e4651f471f1c13d74c means the hash is using SHA-1. * script-hash - A hash or list of hashes allowed as source code. * jsuri-hash - A hash or list of hashes allowed as JS URI (or vbscript). * datauri-hash - A hash or list of hashes allowed as data URI. * css-hash A hash or list of hashes allowed as css. * style-hash - A hash or list of hashes allowed as a style. * event-hash - A hash or list of hashes allowed as inline events in the form: hash(tagname::event::sourcecode) * script-src - A source to match (as a global expression, regex or exact match)[15]. * embed-src - A source to match (as a global expression, regex or exact match).[16] * frame-src - A source to match (as a global expression, regex or exact match).[17] * css-src - A source to match (as a global expression, regex or exact match). * form-src - A source to match (as a global expression, regex or exact match). * default-src A default source to match for all elements. Filter: * sandbox-css: Disables all active CSS properties (expression,binding). * linearise -css: Disables absolute and relative styles (as well as opacity and filters). * frame-breaker: Sets whether to be allowed to be framed (accepts an optional argument: same-origin, specifying that only can be framed if parent is same origin). * xss-filter: Enables the XSS filter for DOM based threads. * sandbox-eval: Sandboxes calls to eval/settimeout/setinterval/function with a string argument (sandboxed code has no access to the DOM). * disable-eval: Disables normal calls to eval/settimeout/setinterval/function with a string argument. Ph4nt0m Security Team[ 6
7 * disable-jslocation: Disables the page to set the location to javascript/vbscript: URIs via javascript. * enforce-ssl: Forces the use of SSL. * enforce-ssl-cookies: Changes all current cookies to cookies with secure flag.[18] Events: * on-error - Specifies what to do in case of any error by default, the declaration of this element is mandatory. * on-error[#,##,-###...] - Specifies what to do in case of an error on the #'th, or ##'th, (or ###'th starting from the last). Event Actions: * warn - Just warn the user * stop Don t load the page (at all) * sandbox - Load the whole page sandboxed (no scripting) * disable - Disable (or delete, depending) the matched element/s (on style/events/jsuri/datauri its disable and on everything else delete). * notify The event is going to be notified to the web owners. Notifications: * notify-url Will receive one single XHR-POST request (must be same origin) with an array (called acs-notification[]): o acs-notification[][request-uri]=request_uri o acs-notification[][referrer]=referrer o acs-notification[][cookies]=cookies_before_html_was_loaded o acs-notification[][signature]=page_signature o acs-notification[][errors][]=array_of_errors_generated + [signature]=signature_broken + [element]=offending_element_base64_encoded == API == Now a days, rich content (being not only images and colored text, but also videos, audio, javascript Ph4nt0m Security Team[ 7
8 code and add-ons) have enabled users to enhance their user experience in many websites. Social Networking Sites have been trying to find a way to balance between user's experience and safety, so several solutions have been created. These are OpenSocial (Google Gadgets) that has inherent security problems by allowing any code at all to be executed, and limit its safety on the idea of putting the code in a frame. The other one is Google CAJA, which includes an HTML, CSS and JavaScript sandbox, works on every browser, but requires either java, or server interaction. Another one is Facebook FBJS, requiring also server side parsing and prone to several vulnerabilities. ACS wants to enable developers to use the same features ACS uses to protect the webpage, and it's done extending its own functions to the global scope. ACS will leak one global object, _acs that will have the following elements: * _acs.browser - Returns a 2 bytes string with the browser name (Opera->OP,Chrome->CH,Safari->SF,Firefox->FF,Internet Explorer->IE, KQ->Konqueror, UK->Unknown) followed by a dot, and the approximate browser version. This detection is done using native JavaScript features that allow us to do fingerprinting disregarding the version reported by window.navigator. * _acs.isie,_acs.isie6,_acs.isie7,_acs.isie8,_acs.isff,_acs.isff2,_acs.isff3,_ acs.isff35, _acs.issa3,_acs.issa4,_acs.isch3,_acs.isch4,_acs.isop9,_acs.isop10,_ac s.iskq,_acs.iswk(webkit), _acs.isgk(gecko), with an assertion of the browser. * _acs.jssandbox - an instance of the default javascript Sandbox. * _acs.csssandbox - an instance of the default CSS Sandbox. * _acs.htmlsandbox - an instance of the default HTML Sandbox. * _acs.signature - the signature with which this page was evaluated. == Sandboxes == Ph4nt0m Security Team[ 8
9 ACS supports by default 3 sandboxes, one HTML sandbox created specifically for ACS, one CSS sandbox that uses the native browser engine, and JSReg ( as a javascript sandbox. All sandboxes (HTML/CSS/JS) have the same interface, and are used in a similar way. When you create a new object of a Sandbox, you create a new default sandbox, which can also be called using: _acs.jssandbox.default(),_acs.csssandbox.default() or _acs.htmlsandbox.default(). All sandboxes have the following methods: * Sandbox::parse(code) -> will instruct the sandbox to parse the code given, the return value is the same sandbox object. In case of an error, the function will throw an error. * Sandbox::exec(element) -> will instruct the sandbox to execute the code given (in the context of the optional argument 'element', being, a Node object for the CSS/HTML sandbox specifying the rules and nodes should be applied under that object, and a Object for the JS sandbox specifying the global context of the function), and return its value.. This will return a StyleSheet object for the CSS parser, a Node object for the HTML parser, and an Object for the JS sandbox. * Sandbox::toString() -> will return the code safe to eval() or document.write() that was sent by Sandox::parse(). == Acknowledgements == The author (Eduardo {sirdarckcat} Vela Nava) wants to acknowledge Alibaba Group for providing Ph4nt0m Security Team[ 9
10 an oportunity to develop this project, as well as the support and help on the testing of the prototypes, comments, guidance and suggestions to Giorgio Maone creator of NoScript, and Gareth Heyes creator of JSReg as well as WHK from elhacker.net, Luoluo, Axis, and Yunshu from ph4nt0m, Daniel Veditz, and Sid Stamm from Mozilla, David Ross, Billy Rios, and Eric Lawrence from Microsoft, Adam Barth, Christoph, and Chris Evans from Google, and kuza55, David Lindsay, and Mario Heiderich from slackers. Ph4nt0m Security Team[ 10
Universal XSS via IE8s XSS Filters
Universal XSS via IE8s XSS Filters the sordid tale of a wayward hash sign slides: http://p42.us/ie8xss/ About Us Eduardo Vela Nava aka sirdarckcat http://sirdarckcat.net http://twitter.com/sirdarckcat
A Tale of the Weaknesses of Current Client-Side XSS Filtering
Call To Arms: A Tale of the Weaknesses of Current Client-Side XSS Filtering Martin Johns, Ben Stock, Sebastian Lekies About us Martin Johns, Ben Stock, Sebastian Lekies Security Researchers at SAP, Uni
Relax Everybody: HTML5 Is Securer Than You Think
Relax Everybody: HTML5 Is Securer Than You Think Martin Johns (@datenkeller) SAP AG Session ID: ADS-W08 Session Classification: Advanced Motivation For some reason, there is a preconception that HTML5
Security starts in the head(er)
Security starts in the head(er) JavaOne 2014 Dominik Schadow bridgingit Policies are independent of framework and language response.addheader(! "Policy name",! "Policy value"! ); User agent must understand
XSS Lightsabre techniques. using Hackvertor
XSS Lightsabre techniques using Hackvertor What is Hackvertor? Tag based conversion tool Javascript property checker Javascript/HTML execution DOM browser Saves you writing code Free and no ads! Whoo hoo!
Recent Advances in Web Application Security
Recent Advances in Web Application Security Author: Neelay S Shah Principal Security Consultant Foundstone Professional Services Table of Contents Introduction 3 Content Security Policy 3 Best Practices
HTML5. Eoin Keary CTO BCC Risk Advisory. www.bccriskadvisory.com www.edgescan.com
HTML5 Eoin Keary CTO BCC Risk Advisory www.bccriskadvisory.com www.edgescan.com Where are we going? WebSockets HTML5 AngularJS HTML5 Sinks WebSockets: Full duplex communications between client or server
The Past, Present and Future of XSS Defense Jim Manico. HITB 2011 Amsterdam
The Past, Present and Future of XSS Defense Jim Manico HITB 2011 Amsterdam 0 Jim Manico Managing Partner, Infrared Security Web Developer, 15+ Years OWASP Connections Committee Chair OWASP ESAPI Project
10CS73:Web Programming
10CS73:Web Programming Question Bank Fundamentals of Web: 1.What is WWW? 2. What are domain names? Explain domain name conversion with diagram 3.What are the difference between web browser and web server
Abusing Internet Explorer 8's XSS Filters
Abusing Internet Explorer 8's XSS Filters by Eduardo Vela Nava (http://twitter.com/sirdarckcat, sird@rckc.at) David Lindsay (http://twitter.com/thornmaker, http://www.cigital.com) Summary Internet Explorer
jfingerprint Datasheet
jfingerprint Datasheet jfingerprint An introduction to jfingerprint, the browser fingerprinting and identification solution. W o l f S o f t w a r e L i m i t e d Contents 1 Background... 3 2 How does
Recent Web Security Technology. Lieven Desmet iminds-distrinet-ku Leuven 3th February 2015 B-CCENTRE closing workshop Lieven.Desmet@cs.kuleuven.
Recent Web Security Technology Lieven Desmet iminds-distrinet-ku Leuven 3th February 2015 B-CCENTRE closing workshop Lieven.Desmet@cs.kuleuven.be About myself: Lieven Desmet Research manager at KU Leuven
Detecting and Exploiting XSS with Xenotix XSS Exploit Framework
Detecting and Exploiting XSS with Xenotix XSS Exploit Framework ajin25@gmail.com keralacyberforce.in Introduction Cross Site Scripting or XSS vulnerabilities have been reported and exploited since 1990s.
Blackbox Reversing of XSS Filters
Blackbox Reversing of XSS Filters Alexander Sotirov alex@sotirov.net Introduction Web applications are the future Reversing web apps blackbox reversing very different environment and tools Cross-site scripting
JavaScript By: A. Mousavi & P. Broomhead SERG, School of Engineering Design, Brunel University, UK
Programming for Digital Media EE1707 JavaScript By: A. Mousavi & P. Broomhead SERG, School of Engineering Design, Brunel University, UK 1 References and Sources 1. DOM Scripting, Web Design with JavaScript
Abusing HTML5. DEF CON 19 Ming Chow Lecturer, Department of Computer Science TuCs University Medford, MA 02155 mchow@cs.tucs.edu
Abusing HTML5 DEF CON 19 Ming Chow Lecturer, Department of Computer Science TuCs University Medford, MA 02155 mchow@cs.tucs.edu What is HTML5? The next major revision of HTML. To replace XHTML? Yes Close
Protection, Usability and Improvements in Reflected XSS Filters
Protection, Usability and Improvements in Reflected XSS Filters Riccardo Pelizzi System Security Lab Department of Computer Science Stony Brook University May 2, 2012 1 / 19 Riccardo Pelizzi Improvements
Protecting Web Applications and Users
Protecting Web Applications and Users Technical guidance for improving web application security through implementing web browser based mitigations. Defence Signals Directorate February 2012 Contents 1
1 Web Application Firewalls implementations, common problems and vulnerabilities
Bypassing Web Application Firewalls Pavol Lupták Pavol.Luptak@nethemba.com CEO, Nethemba s.r.o Abstract The goal of the presentation is to describe typical obfuscation attacks that allow an attacker to
A Tale of the Weaknesses of Current Client-side XSS Filtering
A Tale of the Weaknesses of Current Client-side XSS Filtering Sebastian Lekies (@sebastianlekies), Ben Stock (@kcotsneb) and Martin Johns (@datenkeller) Attention hackers! These slides are preliminary!
WompMobile Technical FAQ
WompMobile Technical FAQ What are the technical benefits of WompMobile? The mobile site has the same exact URL as the desktop website. The mobile site automatically and instantly syncs with the desktop
Cross Site Scripting (XSS) and PHP Security. Anthony Ferrara NYPHP and OWASP Security Series June 30, 2011
Cross Site Scripting (XSS) and PHP Security Anthony Ferrara NYPHP and OWASP Security Series June 30, 2011 What Is Cross Site Scripting? Injecting Scripts Into Otherwise Benign and Trusted Browser Rendered
AJAX and JSON Lessons Learned. Jim Riecken, Senior Software Engineer, Blackboard Inc.
AJAX and JSON Lessons Learned Jim Riecken, Senior Software Engineer, Blackboard Inc. About Me Jim Riecken Senior Software Engineer At Blackboard for 4 years. Work out of the Vancouver office. Working a
MASTERTAG DEVELOPER GUIDE
MASTERTAG DEVELOPER GUIDE TABLE OF CONTENTS 1 Introduction... 4 1.1 What is the zanox MasterTag?... 4 1.2 What is the zanox page type?... 4 2 Create a MasterTag application in the zanox Application Store...
XSS PROTECTION CHEATSHEET FOR DEVELOPERS V1.0. Author of OWASP Xenotix XSS Exploit Framework opensecurity.in
THE ULTIMATE XSS PROTECTION CHEATSHEET FOR DEVELOPERS V1.0 Ajin Abraham Author of OWASP Xenotix XSS Exploit Framework opensecurity.in The quick guide for developers to protect their web applications from
Network Security Web Security
Network Security Web Security Anna Sperotto, Ramin Sadre Design and Analysis of Communication Systems Group University of Twente, 2012 Cross Site Scripting Cross Side Scripting (XSS) XSS is a case of (HTML)
Cross-site site Scripting Attacks on Android WebView
IJCSN International Journal of Computer Science and Network, Vol 2, Issue 2, April 2013 1 Cross-site site Scripting Attacks on Android WebView 1 Bhavani A B 1 Hyderabad, Andhra Pradesh-500050, India Abstract
Project 2: Web Security Pitfalls
EECS 388 September 19, 2014 Intro to Computer Security Project 2: Web Security Pitfalls Project 2: Web Security Pitfalls This project is due on Thursday, October 9 at 6 p.m. and counts for 8% of your course
Acunetix Website Audit. 5 November, 2014. Developer Report. Generated by Acunetix WVS Reporter (v8.0 Build 20120808)
Acunetix Website Audit 5 November, 2014 Developer Report Generated by Acunetix WVS Reporter (v8.0 Build 20120808) Scan of http://filesbi.go.id:80/ Scan details Scan information Starttime 05/11/2014 14:44:06
Client-side Web Engineering From HTML to AJAX
Client-side Web Engineering From HTML to AJAX SWE 642, Spring 2008 Nick Duan 1 What is Client-side Engineering? The concepts, tools and techniques for creating standard web browser and browser extensions
Bypassing Web Application Firewalls (WAFs) Ing. Pavol Lupták, CISSP, CEH Lead Security Consultant
Bypassing Web Application Firewalls (WAFs) Ing. Pavol Lupták, CISSP, CEH Lead Security Consultant Nethemba All About Security Highly experienced certified IT security experts (CISSP, C EH, SCSecA) Core
Webapps Vulnerability Report
Tuesday, May 1, 2012 Webapps Vulnerability Report Introduction This report provides detailed information of every vulnerability that was found and successfully exploited by CORE Impact Professional during
Bypassing NoScript Security Suite Using Cross-Site Scripting and MITM Attacks
Bypassing NoScript Security Suite March 2016 Mazin Ahmed mazin@mazinahmed.net @mazen160 Table of Contents Abstract... 3 Introduction... 3 Research... 4 Solution... 7 Recommendations... 7 Notes... 7 Disclosure
AppSec USA 2014 Denver, Colorado Security Header Injection Module (SHIM)
AppSec USA 2014 Denver, Colorado Security Header Injection Module (SHIM) Inspired By: The OWASP Secure Headers Project Introduction Eric Johnson (@emjohn20) Cypress Data Defense Security Consultant SANS
Team Members: Christopher Copper Philip Eittreim Jeremiah Jekich Andrew Reisdorph. Client: Brian Krzys
Team Members: Christopher Copper Philip Eittreim Jeremiah Jekich Andrew Reisdorph Client: Brian Krzys June 17, 2014 Introduction Newmont Mining is a resource extraction company with a research and development
How to start with 3DHOP
How to start with 3DHOP Package content, local setup, online deployment http://3dhop.net 30/6/2015 The 3DHOP distribution Where to find it, what s inside The 3DHOP distribution package From the page http://3dhop.net/download.php
Cross Site Scripting Prevention
Project Report CS 649 : Network Security Cross Site Scripting Prevention Under Guidance of Prof. Bernard Menezes Submitted By Neelamadhav (09305045) Raju Chinthala (09305056) Kiran Akipogu (09305074) Vijaya
PLAYER DEVELOPER GUIDE
PLAYER DEVELOPER GUIDE CONTENTS CREATING AND BRANDING A PLAYER IN BACKLOT 5 Player Platform and Browser Support 5 How Player Works 6 Setting up Players Using the Backlot API 6 Creating a Player Using the
Phishing by data URI
Phishing by data URI Henning Klevjer henning@klevjers.com October 22, 2012 1 Abstract Historically, phishing web pages have been hosted by web servers that are either compromised or owned by the attacker.
MO 25. Aug. 2008, 17:00 UHR RICH INTERNET APPLICATIONS MEHR BISS FÜR WEBANWENDUNGEN
082 MO 25. Aug. 2008, 17:00 UHR 0 RICH INTERNET APPLICATIONS MEHR BISS FÜR WEBANWENDUNGEN 1 Rich Internet Applications - Definition «Rich Internet Applications (RIAs) are web applications that have the
Client vs. Server Implementations of Mitigating XSS Security Threats on Web Applications
Journal of Basic and Applied Engineering Research pp. 50-54 Krishi Sanskriti Publications http://www.krishisanskriti.org/jbaer.html Client vs. Server Implementations of Mitigating XSS Security Threats
Advanced XSS. Nicolas Golubovic
Advanced XSS Nicolas Golubovic Image courtesy of chanpipat / FreeDigitalPhotos.net Today's menu 1. Starter: reboiled XSS 2. Course: spicy blacklists & filters 3. Course: sweet content sniffing 4. Course:
Pwning Intranets with HTML5
Javier Marcos de Prado Juan Galiana Lara Pwning Intranets with HTML5 2009 IBM Corporation Agenda How our attack works? How we discover what is in your network? What does your infrastructure tell us for
Sichere Webanwendungen mit Java
Sichere Webanwendungen mit Java Karlsruher IT- Sicherheitsinitiative 16.07.2015 Dominik Schadow bridgingit Patch fast Unsafe platform unsafe web application Now lets have a look at the developers OWASP
Example. Represent this as XML
Example INF 221 program class INF 133 quiz Assignment Represent this as XML JSON There is not an absolutely correct answer to how to interpret this tree in the respective languages. There are multiple
RTC-Web Security Considerations
RTC-Web Security Considerations IETF 80 Eric Rescorla ekr@rtfm.com IETF 80 RTC-Web Security Issues 1 The Browser Threat Model Core Web Security Guarantee: users can safely visit arbitrary web sites and
Lecture 9 Chrome Extensions
Lecture 9 Chrome Extensions 1 / 22 Agenda 1. Chrome Extensions 1. Manifest files 2. Content Scripts 3. Background Pages 4. Page Actions 5. Browser Actions 2 / 22 Chrome Extensions 3 / 22 What are browser
Cryptography for Software and Web Developers
Cryptography for Software and Web Developers Part 1: Web and Crypto Hanno Böck 2014-05-28 1 / 14 HTTP and HTTPS SSL Stripping Cookies Mixed content HTTPS content, HTTP images Many webpages use some kind
Web Application Security
Web Application Security The OWASP Foundation Securing the application Input validation Authorization Session mgmt Config mgmt Authenticatio n Error handling Web server App server DB server Secure storage
1. Introduction. 2. Web Application. 3. Components. 4. Common Vulnerabilities. 5. Improving security in Web applications
1. Introduction 2. Web Application 3. Components 4. Common Vulnerabilities 5. Improving security in Web applications 2 What does World Wide Web security mean? Webmasters=> confidence that their site won
Is preventing browser fingerprinting a lost cause?
Is preventing browser fingerprinting a lost cause? Obligations of W3C specification authors and reviewers to preserve passive privacy properties of the user agent. What are we talking about? You call it
Adobe Flash Player and Adobe AIR security
Adobe Flash Player and Adobe AIR security Both Adobe Flash Platform runtimes Flash Player and AIR include built-in security and privacy features to provide strong protection for your data and privacy,
Document Structure Integrity: A Robust Basis for Cross-Site Scripting Defense
Document Structure Integrity: A Robust Basis for Cross-Site Scripting Defense Yacin Nadji Illinois Institute Of Technology Prateek Saxena UC Berkeley Dawn Song UC Berkeley 1 A Cross-Site Scripting Attack
Gateway Apps - Security Summary SECURITY SUMMARY
Gateway Apps - Security Summary SECURITY SUMMARY 27/02/2015 Document Status Title Harmony Security summary Author(s) Yabing Li Version V1.0 Status draft Change Record Date Author Version Change reference
Web Application Exploits
Monday, November 10, 2014 Resources: see final slide CS342 Computer Security Department of Computer Science Wellesley College Web Evolution o Static content: Server serves web pages created by people.
An Evaluation of the Google Chrome Extension Security Architecture
An Evaluation of the Google Chrome Extension Security Architecture Nicholas Carlini, Adrienne Porter Felt, and David Wagner University of California, Berkeley nicholas.carlini@berkeley.edu, apf@cs.berkeley.edu,
Finding XSS in Real World
Finding XSS in Real World by Alexander Korznikov nopernik@gmail.com 1 April 2015 Hi there, in this tutorial, I will try to explain how to find XSS in real world, using some interesting techniques. All
What about MongoDB? can req.body.input 0; var date = new Date(); do {curdate = new Date();} while(curdate-date<10000)
Security What about MongoDB? Even though MongoDB doesn t use SQL, it can be vulnerable to injection attacks db.collection.find( {active: true, $where: function() { return obj.credits - obj.debits < req.body.input;
Reliable Mitigation of DOM-based XSS
Intro XSS Implementation Evaluation Q&A Reliable Mitigation of DOM-based XSS Tobias Mueller 2014-09-07 1 / 39 Intro XSS Implementation Evaluation Q&A About me The results Motivation about:me MSc. cand.
Portals and Hosted Files
12 Portals and Hosted Files This chapter introduces Progress Rollbase Portals, portal pages, portal visitors setup and management, portal access control and login/authentication and recommended guidelines
Tizen Web Runtime Update. Ming Jin Samsung Electronics
Tizen Web Runtime Update Ming Jin Samsung Electronics Table of Contents Quick Overview of This Talk Background, Major Updates, Upcoming Features What Have Been Updated Installation/Update Flow, WebKit2,
SUBJECT CODE : 4074 PERIODS/WEEK : 4 PERIODS/ SEMESTER : 72 CREDIT : 4 TIME SCHEDULE UNIT TOPIC PERIODS 1. INTERNET FUNDAMENTALS & HTML Test 1
SUBJECT TITLE : WEB TECHNOLOGY SUBJECT CODE : 4074 PERIODS/WEEK : 4 PERIODS/ SEMESTER : 72 CREDIT : 4 TIME SCHEDULE UNIT TOPIC PERIODS 1. INTERNET FUNDAMENTALS & HTML Test 1 16 02 2. CSS & JAVASCRIPT Test
Trends in HTML5. Matt Spencer UI & Browser Marketing Manager
Trends in HTML5 Matt Spencer UI & Browser Marketing Manager 6 Where to focus? Chrome is the worlds leading browser - by a large margin 7 Chrome or Chromium, what s the difference Chromium is an open source
Chatbots 3.3. Chatbots in Web Applications with RiveScript. Presented by Noah Petherbridge
Chatbots 3.3 Chatbots in Web Applications with RiveScript Presented by Noah Petherbridge Agenda What's new since last year? The Pandorabots of RiveScript RiveScript::HTTPd Aires Bot Let's talk Android
Web Application Guidelines
Web Application Guidelines Web applications have become one of the most important topics in the security field. This is for several reasons: It can be simple for anyone to create working code without security
Regular Expressions Considered Harmful in Client-Side XSS Filters
Regular Expressions Considered Harmful in Client-Side XSS Filters Daniel Bates UC Berkeley dbates@berkeley.edu Adam Barth UC Berkeley abarth@eecs.berkeley.edu Collin Jackson Carnegie Mellon University
Debugging JavaScript and CSS Using Firebug. Harman Goei CSCI 571 1/27/13
Debugging JavaScript and CSS Using Firebug Harman Goei CSCI 571 1/27/13 Notice for Copying JavaScript Code from these Slides When copying any JavaScript code from these slides, the console might return
Detect and Sanitise Encoded Cross-Site Scripting and SQL Injection Attack Strings Using a Hash Map
Detect and Sanitise Encoded Cross-Site Scripting and SQL Injection Attack Strings Using a Hash Map Erwin Adi and Irene Salomo School of Computer Science BINUS International BINUS University, Indonesia
Why Real Browsers Matter
White Paper Why Real Browsers Matter Why real browser measurement technologies matter to IT operations and business managers that are measuring their Web applications and properties for both operational
A Server and Browser-Transparent CSRF Defense for Web 2.0 Applications. Slides by Connor Schnaith
A Server and Browser-Transparent CSRF Defense for Web 2.0 Applications Slides by Connor Schnaith Cross-Site Request Forgery One-click attack, session riding Recorded since 2001 Fourth out of top 25 most
The Image that called me
The Image that called me Active Content Injection with SVG Files A presentation by Mario Heiderich, 2011 Introduction Mario Heiderich Researcher and PhD student at the Ruhr- University, Bochum Security
Client Side Filter Enhancement using Web Proxy
Client Side Filter Enhancement using Web Proxy Santosh Kumar Singh 1, Rahul Shrivastava 2 1 M Tech Scholar, Computer Technology (CSE) RCET, Bhilai (CG) India, 2 Assistant Professor, CSE Department, RCET
CommonSpot Content Server Version 6.2 Release Notes
CommonSpot Content Server Version 6.2 Release Notes Copyright 1998-2011 PaperThin, Inc. All rights reserved. About this Document CommonSpot version 6.2 updates the recent 6.1 release with: Enhancements
A Measurement Study of the Content Security Policy on Real-World Applications
International Journal of Network Security, Vol.18, No.2, PP.383-392, Mar. 2016 383 A Measurement Study of the Content Security Policy on Real-World Applications Kailas Patil 1 and Braun Frederik 2 (Corresponding
KUB Website Troubleshooting
KUB Website Troubleshooting Are you having problems getting to the KUB website at http://www.kub.org/? If you type in your user ID and password and press the login button, are you routed right back to
Web Design Technology
Web Design Technology Terms Found in web design front end Found in web development back end Browsers Uses HTTP to communicate with Web Server Browser requests a html document Web Server sends a html document
Reining in the Web with Content Security Policy
Reining in the Web with Content Security Policy Sid Stamm Mozilla sid@mozilla.com Brandon Sterne Mozilla bsterne@mozilla.com Gervase Markham Mozilla gerv@mozilla.org ABSTRACT The last three years have
Website Performance: Kyle Simpson
Website Performance: Kyle Simpson (Video: 0_Introduction.mp4): Introduction 00:00:0000:07:50: An introduction and a discussion about how developers need to change their mindset to think about web performance
Usable Crypto: Introducing minilock. Nadim Kobeissi HOPE X, NYC, 2014
Usable Crypto: Introducing minilock Nadim Kobeissi HOPE X, NYC, 2014 2012 Browsers are an environment that is hostile to cryptography Malleability of the JavaScript runtime. The lack of low-level (system-level)
Cross-Site Scripting
Cross-Site Scripting (XSS) Computer and Network Security Seminar Fabrice Bodmer (fabrice.bodmer@unifr.ch) UNIFR - Winter Semester 2006-2007 XSS: Table of contents What is Cross-Site Scripting (XSS)? Some
Responsive Web Design Creative License
Responsive Web Design Creative License Level: Introduction - Advanced Duration: 16 Days Time: 9:30 AM - 4:30 PM Cost: 2197 Overview Web design today is no longer just about cross-browser compatibility.
COMP 112 Assignment 1: HTTP Servers
COMP 112 Assignment 1: HTTP Servers Lead TA: Jim Mao Based on an assignment from Alva Couch Tufts University Due 11:59 PM September 24, 2015 Introduction In this assignment, you will write a web server
Sandy. The Malicious Exploit Analysis. http://exploit-analysis.com/ Static Analysis and Dynamic exploit analysis. Garage4Hackers
Sandy The Malicious Exploit Analysis. http://exploit-analysis.com/ Static Analysis and Dynamic exploit analysis About Me! I work as a Researcher for a Global Threat Research firm.! Spoke at the few security
Understanding Cross Site Scripting
Understanding Cross Site Scripting Hardik Shah Understanding cross site scripting attacks Introduction: there are many techniques which a intruder can use to compromise the webapplications. one such techniques
Next Generation Clickjacking
Next Generation Clickjacking New attacks against framed web pages Black Hat Europe, 14 th April 2010 Paul Stone paul.stone@contextis.co.uk Coming Up Quick Introduction to Clickjacking Four New Cross-Browser
Update logo and logo link on A Master. Update Date and Product on B Master
Cover Be sure to: Update META data Update logo and logo link on A Master Update Date and Product on B Master Web Performance Metrics 101 Contents Preface...3 Response Time...4 DNS Resolution Time... 4
RELEASE NOTES API Healthcare Time and Attendance Solution. Version 2014.3
RELEASE NOTES API Healthcare Time and Attendance Solution Version 2014.3 Applied May 28, 2015 TimeNetAPI Healthcare Time and Attendance Solution Release Notes Table of Contents 2014.3 Release Notes 4 LaborViews...
Attacks on Clients: Dynamic Content & XSS
Software and Web Security 2 Attacks on Clients: Dynamic Content & XSS (Section 7.1.3 on JavaScript; 7.2.4 on Media content; 7.2.6 on XSS) sws2 1 Recap from last lecture Attacks on web server: attacker/client
Binonymizer A Two-Way Web-Browsing Anonymizer
Binonymizer A Two-Way Web-Browsing Anonymizer Tim Wellhausen Gerrit Imsieke (Tim.Wellhausen, Gerrit.Imsieke)@GfM-AG.de 12 August 1999 Abstract This paper presents a method that enables Web users to surf
HTML5 the new. standard for Interactive Web
WHITE PAPER HTML the new standard for Interactive Web by Gokul Seenivasan, Aspire Systems HTML is everywhere these days. Whether desktop or mobile, windows or Mac, or just about any other modern form factor
Check list for web developers
Check list for web developers Requirement Yes No Remarks 1. Input Validation 1.1) Have you done input validation for all the user inputs using white listing and/or sanitization? 1.2) Does the input validation
Building A Self-Hosted WebRTC Project
Building A Self-Hosted WebRTC Project Rod Apeldoorn EasyRTC Server Lead Priologic Software Inc. rod.apeldoorn@priologic.com Slides will be available at: http://easyrtc.com/cloudexpo/ A Little About Priologic
Performance Testing for Ajax Applications
Radview Software How to Performance Testing for Ajax Applications Rich internet applications are growing rapidly and AJAX technologies serve as the building blocks for such applications. These new technologies
Project Plan Log Monitoring Compliance
Project Plan Log Monitoring Compliance The Capstone Experience Team Spectrum Health Kathryn Bonnen Collin Lotus Will Seeger Wayne Stiles Department of Computer Science and Engineering Michigan State University
How To Understand The History Of The Web (Web)
(World Wide) Web WWW A way to connect computers that provide information (servers) with computers that ask for it (clients like you and me) uses the Internet, but it's not the same as the Internet URL
Chapter 1 Programming Languages for Web Applications
Chapter 1 Programming Languages for Web Applications Introduction Web-related programming tasks include HTML page authoring, CGI programming, generating and parsing HTML/XHTML and XML (extensible Markup
Bypassing Browser Memory Protections in Windows Vista
Bypassing Browser Memory Protections in Windows Vista Mark Dowd & Alexander Sotirov markdowd@au1.ibm.com alex@sotirov.net Setting back browser security by 10 years Part I: Introduction Thesis Introduction
CSE598i - Web 2.0 Security OWASP Top 10: The Ten Most Critical Web Application Security Vulnerabilities
CSE598i - Web 2.0 Security OWASP Top 10: The Ten Most Critical Web Application Security Vulnerabilities Thomas Moyer Spring 2010 1 Web Applications What has changed with web applications? Traditional applications
Robust Defence against XSS through Context Free Grammar
Robust Defence against XSS through Context Free Grammar 1 Divya Rishi Sahu, 2 Deepak Singh Tomar 1,2 Dept. of CSE, MANIT, Bhopal, MP, India Abstract JavaScript is one of the world s most widely adopted
Bug Report. Date: March 19, 2011 Reporter: Chris Jarabek (cjjarabe@ucalgary.ca)
Bug Report Date: March 19, 2011 Reporter: Chris Jarabek (cjjarabe@ucalgary.ca) Software: Kimai Version: 0.9.1.1205 Website: http://www.kimai.org Description: Kimai is a web based time-tracking application.