Web Security: Vulnerabilities & Attacks
|
|
|
- Samson Booth
- 8 years ago
- Views:
Transcription
1 Computer Security Course. Web Security: Vulnerabilities & Attacks
2 Cross-site Request Forgery
3 Example Application Consider a social networking site, GraceBook, that allows users to share happenings from around the web. Users can click the Share with GraceBook button which publishes content to GraceBook. When users press the share button, a POST request to is made and gracebook.com makes the necessary updates on the server.
4 Running Example Client Browser Web Server GET form.php URL Request form.php
5 Running Example Client Browser Web Server GET form.php URL Request <html><body> form.php Request Response
6 Running Example <html><body> <div> Update your status: <form action=" method="post"> <input name="text" value="feeling good!"></input> <input type="submit" value="share"></input> </form> </div> </body></html>
7 Running Example Update your status: Share Feeling good! Displays to user Client Browser Web Server
8 Running Example Update your status: Share Feeling good! Displays to user Client Browser Web Server share.php text=feeling Good! On Share click share.php
9 Running Example Update your status: Share Feeling good! Displays to user Client Browser Web Server share.php text=feeling Good! On Share click share.php Session Cookie
10 Running Example Update your status: Share Feeling good! Displays to user Client Browser Web Server share.php text=feeling Good! On Share click share.php valid session cookie? Session Cookie
11 Running Example Update your status: Share Feeling good! Displays to user Client Browser status: Feeling Good! DB Server Web Server share.php text=feeling Good! On Share click share.php Session Cookie update user s status with the text Feeling good!
12 Network Requests The HTTP POST Request looks like this: POST /share.php HTTP/1.1 Host: User-Agent: Mozilla/5.0 Accept: */* Content-Type: application/x-www-form-urlencoded; charset=utf-8 Referer: Cookie: auth=beb18dcd75f2c225a9dcd71c73a8d77b5c304fb8 text=feeling good!
13 CSRF Attack The attacker, on attacker.com, creates a page containing the following HTML: <form action=" method="post" id=" f"> <input type="hidden" name="text" value="spam COMMENT"></input> <script>document.getelementbyid('f').submit();</script> What will happen when the user visits the page? a) The spam comment will be posted to user s share feed on gracebook.com b) The spam comment will be posted to user s share feed if the user is currently logged in on gracebook.com c) The spam comment will not be posted to user s share feed on gracebook.com
14 CSRF Attack The attacker, on attacker.com, creates a page containing the following HTML: <form action=" method="post" id=" f"> <input type="hidden" name="text" value="spam COMMENT"></input> <script>document.getelementbyid('f').submit();</script> What will happen when the user visits the page? a) The spam comment will be posted to user s share feed on gracebook.com b) The spam comment will be posted to user s share feed if the user is currently logged in on gracebook.com c) The spam comment will not be posted to user s share feed on gracebook.com
15 CSRF Attack JavaScript code can automatically submit the form in the background to post spam to the user s GraceBook feed. Similarly, a GET based CSRF is also possible. Making GET requests is easier: just an img tag suffices. <img src=" />
16 Example Attack <input type="hidden" Welcome to my harmless site! Displays to user Client Browser status: SPAM COMMENT! DB Server Web Server share.php text=spam COMMENT! Via JavaScript POST share.php update user s status with a spam comment Session Cookie
17 CSRF Defense Origin headers Introduction of a new header, similar to Referer. Unlike Referer, only shows scheme, host, and port (no path data or query string) Nonce-based Use a nonce to ensure that only form.php can get to share.php.
18 CSRF via POST requests Consider the Referer value from the POST request outlined earlier. In the case of the CSRF attacks, will it be different? a. b. Yes No
19 CSRF via POST requests Consider the Referer value from the POST request outlined earlier. In the case of the CSRF attacks, will it be different? a. b. Yes No
20 Origin Header Instead of sending whole referring URL, which might leak private information, only send the referring scheme, host, and port. POST /share.php HTTP/1.1 Host: User-Agent: Mozilla/5.0 Accept: */* Content-Type: application/x-www-form-urlencoded; charset=utf-8 Origin: Cookie: auth=beb18dcd75f2c225a9dcd71c73a8d77b5c304fb8 text=hi
21 Origin Header Instead of sending whole referring URL, which might leak private information, only send the referring scheme, host, and port. POST /share.php HTTP/1.1 No path string Host: User-Agent: Mozilla/5.0 or query data Accept: */* Content-Type: application/x-www-form-urlencoded; charset=utf-8 Origin: Cookie: auth=beb18dcd75f2c225a9dcd71c73a8d77b5c304fb8 text=hi
22 Nonce based protection Recall the expected flow of the application: The message to be shared is first shown to the user on form.php (the GET request) When user assents, a POST request to share.php makes the actual post The server creates a nonce, includes it in a hidden field in form.php and checks it in share.php.
23 Nonce based protection The form with nonce <form action="share.php" method="post"> <input type="hidden" name="csrfnonce" value="av834favcb623"> <input type="textarea" name="text" value="feeling good!"> POST /share.php HTTP/1.1 Host: User-Agent: Mozilla/5.0 Accept: */* Content-Type: application/x-www-form-urlencoded; charset=utf-8 Origin: Cookie: auth=beb18dcd75f2c225a9dcd71c73a8d77b5c304fb8 Text=Feeling good!&csrfnonce=av834favcb623 Server code compares nonce
24 Legitimate Case Client Browser Web Server GET form.php URL Request form.php
25 Legitimate Case Client Browser Web Server GET form.php URL Request <html><body><input type="hidden" name=" csrfnonce" value="av834favcb623"> form.php Request Response
26 Legitimate Case Update your status: Share Feeling good! <input type="hidden" name="csrfnonce" Displays to user Client Browser Web Server
27 Legitimate Case Update your status: Share Feeling good! status: Feeling Good! DB Server <input type="hidden" name="csrfnonce" Displays to user Client Browser Web Server share.php text=feeling Good! csrfnonce=av834favcb623 share.php update user s status with the text Feeling good! after checking nonce On Share click Session Cookie
28 Attack Case <input type="hidden Welcome to my harmless site! Displays to user Client Browser Web Server share.php text=spam COMMENT! Via JavaScript POST share.php fails to update because nonce value is incorrect Session Cookie
29 Recap CSRF: Cross Site Request Forgery An attack which forces an end user to execute unwanted actions on a web application in which he/she is currently authenticated. Caused because browser automatically includes authorization credentials such as cookies. Fixed using Origin headers and nonces Origin headers not supported in older browsers.
30 Web Session Management Slides credit: Dan Boneh
31 Same origin policy: high level Same Origin Policy (SOP) for DOM: Origin A can access origin B s DOM if match on (scheme, domain, port) Same Original Policy (SOP) for cookies: Based on: ([scheme], domain, path) optional scheme://domain:port/path?params
32 Setting/deleting cookies by server Brows er GET HTTP Header: Server Set-cookie: NAME=VALUE ; domain = (when to send) ; if expires=null: path = (when to send) this session only secure = (only send over SSL); if expires=past date: expires = (when expires) ; browser deletes cookie HttpOnly Default scope is domain and path of setting URL scope
33 Scope setting rules (write SOP) domain: any domain-suffix of URL-hostname, except TLD example: host = login.site.com allowed domains disallowed domains login.site.com other.site.com.site.com othersite.com login.site.com can set cookies for all of.site.com but not for another site or TLD Problematic for sites like.berkeley.edu path: can be set to anything.com
34 Cookies are identified by (name,domain,path) cookie 1 name = userid value = test domain = login.site.com path = / secure cookie 2 name = userid value = test123 domain =.site.com path = / secure distinct cookies Both cookies stored in browser s cookie jar; both are in scope of login.site.com
35 Reading cookies on server Browser GET //URL-domain/URL-path Cookie: NAME = VALUE (read SOP) Server Browser sends all cookies in URL scope: cookie-domain is domain-suffix of URL-domain, and cookie-path is prefix of URL-path, and [protocol=https if cookie is secure ] Goal: server only sees cookies in its scope
36 Examples cookie 1 name = userid value = u1 domain = login.site.com path = / secure both set by login.site.com cookie 2 name = userid value = u2 domain =.site.com path = / non-secure cookie: userid=u2 cookie: userid=u2 (arbitrary cookie: userid=u1; userid=u2 order)
37 Client side read/write: document.cookie Setting a cookie in Javascript: document.cookie = name=value; expires= ; Reading a cookie: alert(document.cookie) prints string containing all cookies available for document (based on [protocol], domain, path) Deleting a cookie: document.cookie = name=; expires= Thu, 01-Jan-70 document.cookie often used to customize page in Javascript
38 Javascript URL javascript: alert(document.cookie) Displays all cookies for current document
39 Viewing/deleting cookies in Browser UI
40 Cookie protocol problems Server is blind: Does not see cookie attributes (e.g. secure, HttpOnly) Does not see which domain set the cookie Server only sees: Cookie: NAME=VALUE
41 Example 1: login server problems 1. Alice logs in at login.site.com login.site.com sets session-id cookie for.site.com 2. Alice visits evil.site.com overwrites.site.com session-id cookie with session-id of user badguy 3. Alice visits course.site.com to submit homework. course.site.com thinks it is talking to badguy Problem: course.site.com expects session-id from login.site.com; cannot tell that session-id cookie was overwritten
42 Example 2: secure cookies are not secure Alice logs in at set-cookie: SSID=A7_ESAgDpKYk5TGnf; Domain=.google.com; Path=/ ; Expires=Wed, 09-Mar :35:11 GMT; Secure; HttpOnly set-cookie: SAPISID=wj1gYKLFy-RmWybP/ANtKMtPIHNambvdI4; Domain=.google.com;Path=/ ; Expires=Wed, 09-Mar :35:11 GMT; Secure Alice visits (cleartext) Network attacker can inject into response Set-Cookie: SSID=badguy; secure and overwrite secure cookie Problem: network attacker can re-write cookies over HTTP
43 Cookies have no integrity User can change and delete cookie values Edit cookie database (cookies.sqlite) Modify Cookie header (TamperData extension) Silly example: shopping cart software Set-cookie: shopping-cart-total = 150 ($) User edits cookie file (cookie poisoning): Cookie: shopping-cart-total = 15 ($) Similar problem with hidden fields <INPUT TYPE= hidden NAME=price VALUE= 150 > 43
44 Sessions A sequence of requests and responses from one browser to one (or more) sites Session can be long (e.g. Gmail) or short without session mgmt: users would have to constantly re-authenticate Session mgmt: authorize user once; All subsequent requests are tied to user
45 Session tokens Browser web site GET /index.html set anonymous session token GET /books.html anonymous session token POST /do-login Username & password check credentials (later) elevate to a logged-in session token POST /checkout logged-in session token Validate token
46 Storing session tokens: Lots of options (but none are perfect) Browser cookie: Set-Cookie: SessionToken=fduhye63sfdb Embed in all URL links: SessionToken=kh7y3b In a hidden form field: <input type= hidden name= sessionid value= kh7y3b > Window.name DOM property
47 Storing session tokens: problems Browser cookie: browser sends cookie with every request, even when it should not (CSRF) Embed in all URL links: token leaks via HTTP Referer header (or if user posts URL in a public blog) In a hidden form field: does not work for long-lived sessions Best answer: a combination of all of the above.
48 The HTTP referer header Referer leaks URL session token to 3rd parties
49 The Logout Process Web sites must provide a logout function: Functionality: let user to login as different user Security: prevent others from abusing account What happens during logout: 1. Delete SessionToken from client 2. Mark session token as expired on server Problem: many web sites do (1) but not (2)!! Especially risky for sites who fall back to HTTP after login
50 Session hijacking Attacker waits for user to login then attacker steals user s Session Token and hijacks session attacker can issue arbitrary requests on behalf of user Example: FireSheep. Firefox extension that hijacks Facebook session tokens over WiFi. Solution: use HTTPS
51 Session token theft Example 1: login over HTTPS, but subsequent HTTP Enables cookie theft at wireless Café (e.g. Firesheep) Other reasons why session token sent in the clear: HTTPS/HTTP mixed content pages at site Example 2: Cross Site Scripting (XSS) exploits Amplified by poor logout procedures: Logout must invalidate token on server
52 Session Fixation Assume the session ID is set by a URL parameter. The attacker can trick the user into acting on behalf of the attacker.
53 Session fixation attacks Suppose attacker can set the user s session token: For URL tokens, trick user into clicking on URL For cookie tokens, set using XSS exploits Attack: (say, using URL tokens) 1. Attacker gets anonymous session token for site.com 2. Sends URL to user with attacker s session token 3. User clicks on URL and logs into site.com this elevates attacker s token to logged-in token 4. Attacker uses elevated token to hijack user s session.
54 Session fixation: lesson When elevating user from anonymous to logged-in: always issue a new session token After login, token changes to value unknown to attacker. Attacker s token is not elevated.
Cookie Same Origin Policy
CS 142 Winter 2009 Cookie Same Origin Policy Dan Boneh Monday: session management using cookies Same origin policy: high level Review: Same Origin Policy (SOP) for DOM: Origin A can access origin B s DOM
Session Management and User Authentication
CS 155 Spring 2011 Session Management and User Authentication Dan Boneh Same origin policy: high level Review: Same Origin Policy (SOP) for DOM: n Origin A can access origin B s DOM if match on (scheme,
A Server and Browser-Transparent CSRF Defense for Web 2.0 Applications. Slides by Connor Schnaith
A Server and Browser-Transparent CSRF Defense for Web 2.0 Applications Slides by Connor Schnaith Cross-Site Request Forgery One-click attack, session riding Recorded since 2001 Fourth out of top 25 most
Web applications. Web security: web basics. HTTP requests. URLs. GET request. Myrto Arapinis School of Informatics University of Edinburgh
Web applications Web security: web basics Myrto Arapinis School of Informatics University of Edinburgh HTTP March 19, 2015 Client Server Database (HTML, JavaScript) (PHP) (SQL) 1 / 24 2 / 24 URLs HTTP
Advanced Web Technology 10) XSS, CSRF and SQL Injection 2
Berner Fachhochschule, Technik und Informatik Advanced Web Technology 10) XSS, CSRF and SQL Injection Dr. E. Benoist Fall Semester 2010/2011 Table of Contents Cross Site Request Forgery - CSRF Presentation
Exploits: XSS, SQLI, Buffer Overflow
Exploits: XSS, SQLI, Buffer Overflow These vulnerabilities continue to result in many active exploits. XSS Cross Site Scripting, comparable to XSRF, Cross Site Request Forgery. These vulnerabilities are
How to break in. Tecniche avanzate di pen testing in ambito Web Application, Internal Network and Social Engineering
How to break in Tecniche avanzate di pen testing in ambito Web Application, Internal Network and Social Engineering Time Agenda Agenda Item 9:30 10:00 Introduction 10:00 10:45 Web Application Penetration
CSE598i - Web 2.0 Security OWASP Top 10: The Ten Most Critical Web Application Security Vulnerabilities
CSE598i - Web 2.0 Security OWASP Top 10: The Ten Most Critical Web Application Security Vulnerabilities Thomas Moyer Spring 2010 1 Web Applications What has changed with web applications? Traditional applications
Web Authentication and Session Management
CS 361S Web Authentication and Session Management Vitaly Shmatikov Reading Assignment Read Kaufman, Chapter 25 Read Dos and Don ts of Client Authentication on the Web slide 2 HTTP Digest Authentication
Web application security
Web application security Sebastian Lopienski CERN Computer Security Team openlab and summer lectures 2010 (non-web question) Is this OK? int set_non_root_uid(int uid) { // making sure that uid is not 0
Cyber Security Workshop Ethical Web Hacking
Cyber Security Workshop Ethical Web Hacking May 2015 Setting up WebGoat and Burp Suite Hacking Challenges in WebGoat Concepts in Web Technologies and Ethical Hacking 1 P a g e Downloading WebGoat and Burp
Criteria for web application security check. Version 2015.1
Criteria for web application security check Version 2015.1 i Content Introduction... iii ISC- P- 001 ISC- P- 001.1 ISC- P- 001.2 ISC- P- 001.3 ISC- P- 001.4 ISC- P- 001.5 ISC- P- 001.6 ISC- P- 001.7 ISC-
Gateway Apps - Security Summary SECURITY SUMMARY
Gateway Apps - Security Summary SECURITY SUMMARY 27/02/2015 Document Status Title Harmony Security summary Author(s) Yabing Li Version V1.0 Status draft Change Record Date Author Version Change reference
Breaking Web Applications in Shared Hosting Environments. Nick Nikiforakis Katholieke Universiteit Leuven
Breaking Web Applications in Shared Hosting Environments Nick Nikiforakis Katholieke Universiteit Leuven Who am I? Nick Nikiforakis PhD student at KULeuven Security Low-level Web applications http://www.securitee.org
The Top Web Application Attacks: Are you vulnerable?
QM07 The Top Web Application Attacks: Are you vulnerable? John Burroughs, CISSP Sr Security Architect, Watchfire Solutions jburroughs@uk.ibm.com Agenda Current State of Web Application Security Understanding
Table of Contents. Open-Xchange Authentication & Session Handling. 1.Introduction...3
Open-Xchange Authentication & Session Handling Table of Contents 1.Introduction...3 2.System overview/implementation...4 2.1.Overview... 4 2.1.1.Access to IMAP back end services...4 2.1.2.Basic Implementation
Where every interaction matters.
Where every interaction matters. Peer 1 Vigilant Web Application Firewall Powered by Alert Logic The Open Web Application Security Project (OWASP) Top Ten Web Security Risks and Countermeasures White Paper
Hack Proof Your Webapps
Hack Proof Your Webapps About ERM About the speaker Web Application Security Expert Enterprise Risk Management, Inc. Background Web Development and System Administration Florida International University
Check list for web developers
Check list for web developers Requirement Yes No Remarks 1. Input Validation 1.1) Have you done input validation for all the user inputs using white listing and/or sanitization? 1.2) Does the input validation
OWASP and OWASP Top 10 (2007 Update) OWASP. The OWASP Foundation. Dave Wichers. The OWASP Foundation. OWASP Conferences Chair dave.wichers@owasp.
and Top 10 (2007 Update) Dave Wichers The Foundation Conferences Chair dave.wichers@owasp.org COO, Aspect Security dave.wichers@aspectsecurity.com Copyright 2007 - The Foundation This work is available
Web Application Security
Web Application Security John Zaharopoulos ITS - Security 10/9/2012 1 Web App Security Trends Web 2.0 Dynamic Webpages Growth of Ajax / Client side Javascript Hardening of OSes Secure by default Auto-patching
Introduction to Computer Security
Introduction to Computer Security Web Application Security Pavel Laskov Wilhelm Schickard Institute for Computer Science Modern threat landscape The majority of modern vulnerabilities are found in web
Web Application Guidelines
Web Application Guidelines Web applications have become one of the most important topics in the security field. This is for several reasons: It can be simple for anyone to create working code without security
WEB SECURITY CONCERNS THAT WEB VULNERABILITY SCANNING CAN IDENTIFY
WEB SECURITY CONCERNS THAT WEB VULNERABILITY SCANNING CAN IDENTIFY www.alliancetechpartners.com WEB SECURITY CONCERNS THAT WEB VULNERABILITY SCANNING CAN IDENTIFY More than 70% of all websites have vulnerabilities
Project 2: Web Security Pitfalls
EECS 388 September 19, 2014 Intro to Computer Security Project 2: Web Security Pitfalls Project 2: Web Security Pitfalls This project is due on Thursday, October 9 at 6 p.m. and counts for 8% of your course
Web Application Security Considerations
Web Application Security Considerations Eric Peele, Kevin Gainey International Field Directors & Technology Conference 2006 May 21 24, 2006 RTI International is a trade name of Research Triangle Institute
Web Security Threat Report: January April 2007. Ryan C. Barnett WASC Member Project Lead: Distributed Open Proxy Honeypots
Web Security Threat Report: January April 2007 Ryan C. Barnett WASC Member Project Lead: Distributed Open Proxy Honeypots What are we reporting? We are presenting real, live web attack data captured in-the-wild.
Next Generation Clickjacking
Next Generation Clickjacking New attacks against framed web pages Black Hat Europe, 14 th April 2010 Paul Stone paul.stone@contextis.co.uk Coming Up Quick Introduction to Clickjacking Four New Cross-Browser
Session Management in Web Applications
Session Management in Web Applications Author: EUROSEC GmbH Chiffriertechnik & Sicherheit Tel: 06173 / 60850, www.eurosec.com EUROSEC GmbH Chiffriertechnik & Sicherheit, 2005 What is Web-based Session
CTF Web Security Training. Engin Kirda ek@ccs.neu.edu
CTF Web Security Training Engin Kirda ek@ccs.neu.edu Web Security Why It is Important Easiest way to compromise hosts, networks and users Widely deployed ( payload No Logs! (POST Request Difficult to defend
ArcGIS Server Security Threats & Best Practices 2014. David Cordes Michael Young
ArcGIS Server Security Threats & Best Practices 2014 David Cordes Michael Young Agenda Introduction Threats Best practice - ArcGIS Server settings - Infrastructure settings - Processes Summary Introduction
Hack Yourself First. Troy Hunt @troyhunt troyhunt.com troyhunt@hotmail.com
Hack Yourself First Troy Hunt @troyhunt troyhunt.com troyhunt@hotmail.com We re gonna turn you into lean, mean hacking machines! Because if we don t, these kids are going to hack you Jake Davies, 19 (and
Security vulnerabilities in new web applications. Ing. Pavol Lupták, CISSP, CEH Lead Security Consultant
Security vulnerabilities in new web applications Ing. Pavol Lupták, CISSP, CEH Lead Security Consultant $whoami Introduction Pavol Lupták 10+ years of practical experience in security and seeking vulnerabilities
Bug Report. Date: March 19, 2011 Reporter: Chris Jarabek (cjjarabe@ucalgary.ca)
Bug Report Date: March 19, 2011 Reporter: Chris Jarabek (cjjarabe@ucalgary.ca) Software: Kimai Version: 0.9.1.1205 Website: http://www.kimai.org Description: Kimai is a web based time-tracking application.
WHITE PAPER. FortiWeb and the OWASP Top 10 Mitigating the most dangerous application security threats
WHITE PAPER FortiWeb and the OWASP Top 10 PAGE 2 Introduction The Open Web Application Security project (OWASP) Top Ten provides a powerful awareness document for web application security. The OWASP Top
Is Drupal secure? A high-level perspective on web vulnerabilities, Drupal s solutions, and how to maintain site security
Is Drupal secure? A high-level perspective on web vulnerabilities, Drupal s solutions, and how to maintain site security Presented 2009-05-29 by David Strauss Thinking Securely Security is a process, not
ECE458 Winter 2013. Web Security. Slides from John Mitchell and Vitaly Shmatikov (Modified by Vijay Ganesh)
ECE458 Winter 2013 Web Security Slides from John Mitchell and Vitaly Shmatikov (Modified by Vijay Ganesh) Reported Web Vulnerabilities "In the Wild" Data from aggregator and validator of NVD-reported vulnerabilities
Certified Secure Web Application Security Test Checklist
www.certifiedsecure.com info@certifiedsecure.com Tel.: +31 (0)70 310 13 40 Loire 128-A 2491 AJ The Hague The Netherlands Certified Secure Checklist About Certified Secure exists to encourage and fulfill
An Insight into Cookie Security
An Insight into Cookie Security Today most websites and web based applications use cookies. Cookies are primarily used by the web server to track an authenticated user or other user specific details. This
Web Security: SSL/TLS
CSE 484 / CSE M 584: Computer Security and Privacy Web Security: SSL/TLS Spring 2015 Franziska (Franzi) Roesner franzi@cs.washington.edu Thanks to Dan Boneh, Dieter Gollmann, Dan Halperin, Yoshi Kohno,
(WAPT) Web Application Penetration Testing
(WAPT) Web Application Penetration Testing Module 0: Introduction 1. Introduction to the course. 2. How to get most out of the course 3. Resources you will need for the course 4. What is WAPT? Module 1:
Security Testing with Selenium
with Selenium Vidar Kongsli Montréal, October 25th, 2007 Versjon 1.0 Page 1 whois 127.0.0.1? Vidar Kongsli System architect & developer Head of security group Bekk Consulting Technology and Management
1. Introduction. 2. Web Application. 3. Components. 4. Common Vulnerabilities. 5. Improving security in Web applications
1. Introduction 2. Web Application 3. Components 4. Common Vulnerabilities 5. Improving security in Web applications 2 What does World Wide Web security mean? Webmasters=> confidence that their site won
Hacking de aplicaciones Web
HACKING SCHOOL Hacking de aplicaciones Web Gabriel Maciá Fernández Fundamentos de la web CLIENTE SERVIDOR BROWSER HTTP WEB SERVER DATOS PRIVADOS BASE DE DATOS 1 Interacción con servidores web URLs http://gmacia:pass@www.ugr.es:80/descarga.php?file=prueba.txt
3. Broken Account and Session Management. 4. Cross-Site Scripting (XSS) Flaws. Web browsers execute code sent from websites. Account Management
What is an? s Ten Most Critical Web Application Security Vulnerabilities Anthony LAI, CISSP, CISA Chapter Leader (Hong Kong) anthonylai@owasp.org Open Web Application Security Project http://www.owasp.org
Lecture 11 Web Application Security (part 1)
Lecture 11 Web Application Security (part 1) Computer and Network Security 4th of January 2016 Computer Science and Engineering Department CSE Dep, ACS, UPB Lecture 11, Web Application Security (part 1)
Sidste chance for Early Bird! Tilmeld dig før d. 30. juni og spar 4.000 DKK. Læs mere og tilmeld dig på www.gotocon.
Sidste chance for Early Bird! Tilmeld dig før d. 30. juni og spar 4.000 DKK. Læs mere og tilmeld dig på www.gotocon.com/aarhus-2012 SIKKERHED I WEBAPPLIKATIONER Anders Skovsgaard Hackavoid anders@hackavoid.dk
Abusing Locality in Shared Web Hosting. Nick Nikiforakis
Abusing Locality in Shared Web Hosting Nick Nikiforakis Nick Nikiforakis Brucon 19 th September 2011 PhD student at KUL About me Applied security research Low-level countermeasures for unsafe languages
Semantic based Web Application Firewall (SWAF V 1.6) Operations and User Manual. Document Version 1.0
Semantic based Web Application Firewall (SWAF V 1.6) Operations and User Manual Document Version 1.0 Table of Contents 1 SWAF... 4 1.1 SWAF Features... 4 2 Operations and User Manual... 7 2.1 SWAF Administrator
Web Application Report
Web Application Report This report includes important security information about your Web Application. Security Report This report was created by IBM Rational AppScan 8.5.0.1 11/14/2012 8:52:13 AM 11/14/2012
EECS 398 Project 2: Classic Web Vulnerabilities
EECS 398 Project 2: Classic Web Vulnerabilities Revision History 3.0 (October 27, 2009) Revise CSRF attacks 1 and 2 to make them possible to complete within the constraints of the project. Clarify that
Web Application Firewall on SonicWALL SSL VPN
Web Application Firewall on SonicWALL SSL VPN Document Scope This document describes how to configure and use the Web Application Firewall feature in SonicWALL SSL VPN 5.0. This document contains the following
Application Security Testing. Generic Test Strategy
Application Security Testing Generic Test Strategy Page 2 of 8 Contents 1 Introduction 3 1.1 Purpose: 3 1.2 Application Security Testing: 3 2 Audience 3 3 Test Strategy guidelines 3 3.1 Authentication
APPLICATION SECURITY AND ITS IMPORTANCE
Table of Contents APPLICATION SECURITY AND ITS IMPORTANCE 1 ISSUES AND FIXES: 2 ISSUE: XSS VULNERABILITIES 2 ISSUE: CSRF VULNERABILITY 2 ISSUE: CROSS FRAME SCRIPTING (XSF)/CLICK JACKING 2 ISSUE: WEAK CACHE
Login with Amazon. Developer Guide for Websites
Login with Amazon Developer Guide for Websites Copyright 2014 Amazon Services, LLC or its affiliates. All rights reserved. Amazon and the Amazon logo are trademarks of Amazon.com, Inc. or its affiliates.
Hacking cookies in modern web applications and browsers
Hacking cookies in modern web applications and browsers Dawid Czagan About me Founder and CEO at Silesia Security Lab Bug hunter: security bugs found in Google, Yahoo, Mozilla, Microsoft, Twitter, Blackberry,...
Web Application Firewall on SonicWALL SRA
Web Application Firewall on SonicWALL SRA Document Scope This document describes how to configure and use the Web Application Firewall feature in SonicWALL SRA 6.0. This document contains the following
BASELINE SECURITY TEST PLAN FOR EDUCATIONAL WEB AND MOBILE APPLICATIONS
BASELINE SECURITY TEST PLAN FOR EDUCATIONAL WEB AND MOBILE APPLICATIONS Published by Tony Porterfield Feb 1, 2015. Overview The intent of this test plan is to evaluate a baseline set of data security practices
State of The Art: Automated Black Box Web Application Vulnerability Testing. Jason Bau, Elie Bursztein, Divij Gupta, John Mitchell
Stanford Computer Security Lab State of The Art: Automated Black Box Web Application Vulnerability Testing, Elie Bursztein, Divij Gupta, John Mitchell Background Web Application Vulnerability Protection
Web Application Security Guidelines for Hosting Dynamic Websites on NIC Servers
Web Application Security Guidelines for Hosting Dynamic Websites on NIC Servers The Website can be developed under Windows or Linux Platform. Windows Development should be use: ASP, ASP.NET 1.1/ 2.0, and
SESSION IDENTIFIER ARE FOR NOW, PASSWORDS ARE FOREVER
SESSION IDENTIFIER ARE FOR NOW, PASSWORDS ARE FOREVER XSS-BASED ABUSE OF BROWSER PASSWORD MANAGERS Ben Stock, Martin Johns, Sebastian Lekies Browser choices Full disclosure: Ben was an intern with Microsoft
Sichere Webanwendungen mit Java
Sichere Webanwendungen mit Java Karlsruher IT- Sicherheitsinitiative 16.07.2015 Dominik Schadow bridgingit Patch fast Unsafe platform unsafe web application Now lets have a look at the developers OWASP
Dawn Song dawnsong@cs.berkeley.edu
1 Web Security Dawn Song dawnsong@cs.berkeley.edu Common Vulnerabilities Input validation SQL Injection XSS: cross-site scripting HTTP response splitting Cookie management Cookie forgery CSRF: cross-site
Acunetix Web Vulnerability Scanner. Getting Started. By Acunetix Ltd.
Acunetix Web Vulnerability Scanner Getting Started V8 By Acunetix Ltd. 1 Starting a Scan The Scan Wizard allows you to quickly set-up an automated scan of your website. An automated scan provides a comprehensive
Secure Coding SSL, SOAP and REST. Astha Singhal Product Security Engineer salesforce.com
Secure Coding SSL, SOAP and REST Astha Singhal Product Security Engineer salesforce.com Safe Harbor Safe harbor statement under the Private Securities Litigation Reform Act of 1995: This presentation may
Using Foundstone CookieDigger to Analyze Web Session Management
Using Foundstone CookieDigger to Analyze Web Session Management Foundstone Professional Services May 2005 Web Session Management Managing web sessions has become a critical component of secure coding techniques.
FINAL DoIT 11.03.2015 - v.4 PAYMENT CARD INDUSTRY DATA SECURITY STANDARDS APPLICATION DEVELOPMENT AND MAINTENANCE PROCEDURES
Purpose: The Department of Information Technology (DoIT) is committed to developing secure applications. DoIT s System Development Methodology (SDM) and Application Development requirements ensure that
SAP: Session (Fixation) Attacks and Protections
www.taddong.com SAP: Session (Fixation) Attacks and Protections (in Web Applications) Raul Siles raul@taddong.com April 15, 2011 VII OWASP Spain Chapter Meeting Copyright 2011 Taddong S.L. Todos los derechos
CIS 551 / TCOM 401 Computer and Network Security. Spring 2008 Lecture 25
CIS 551 / TCOM 401 Computer and Network Security Spring 2008 Lecture 25 Announcements Project 4 is Due Friday May 2nd at 11:59 PM Final exam: Friday, May 12th. Noon - 2:00pm DRLB A6 Today: Cookies & State
What is Web Security? Motivation
brucker@inf.ethz.ch http://www.brucker.ch/ Information Security ETH Zürich Zürich, Switzerland Information Security Fundamentals March 23, 2004 The End Users View The Server Providers View What is Web
SANS Institute 200 5, Author retains full rights.
Secure Session Management Preventing Security Voids in Web Applications Luke Murphey January 10, 2005 Abstract:, option 1 Internet users all over the world are using web-based systems to manage important
Last update: February 23, 2004
Last update: February 23, 2004 Web Security Glossary The Web Security Glossary is an alphabetical index of terms and terminology relating to web application security. The purpose of the Glossary is to
OWASP Application Security Building and Breaking Applications
OWASP Application Security Building and Breaking Applications Rochester OWASP Chapter - Durkee Consulting, Inc. info@rd1.net Who's? Principal Security Consultant Durkee Consulting Inc. Founder of Rochester
Application Layer Encryption: Protecting against Application Logic and Session Theft Attacks. Whitepaper
Application Layer Encryption: Protecting against Application Logic and Session Theft Attacks Whitepaper The security industry has extensively focused on protecting against malicious injection attacks like
Web and Email Security 1 / 40
Web and 1 / 40 Untrusted Clients Repeat: Untrusted Clients Server-Side Storage Cryptographic Sealing Hidden Values Cookies Protecting Data Sidebar: Cookies and JavaScript Cross-Site Scripting (XSS) Why
Defending against XSS,CSRF, and Clickjacking David Bishop
Defending against XSS,CSRF, and Clickjacking David Bishop University of Tennessee Chattanooga ABSTRACT Whenever a person visits a website, they are running the risk of falling prey to multiple types of
CSE 135 Server Side Web Languages Lecture # 7. State and Session Management
State and Session Management Addressing HTTP Statelessness HTTP being stateless, in other words having no memory from page view to page view, can make Web programming a hassle. A variety of techniques
InternetVista Web scenario documentation
InternetVista Web scenario documentation Version 1.2 1 Contents 1. Change History... 3 2. Introduction to Web Scenario... 4 3. XML scenario description... 5 3.1. General scenario structure... 5 3.2. Steps
Web-Application Security
Web-Application Security Kristian Beilke Arbeitsgruppe Sichere Identität Fachbereich Mathematik und Informatik Freie Universität Berlin 29. Juni 2011 Overview Web Applications SQL Injection XSS Bad Practice
PDG Software. Site Design Guide
PDG Software Site Design Guide PDG Software, Inc. 1751 Montreal Circle, Suite B Tucker, Georgia 30084-6802 Copyright 1998-2007 PDG Software, Inc.; All rights reserved. PDG Software, Inc. ("PDG Software")
Ruby on Rails Security. Jonathan Weiss, 30.12.2007 Peritor Wissensmanagement GmbH
Ruby on Rails Security Jonathan Weiss, 30.12.2007 Peritor Wissensmanagement GmbH Who am I? Jonathan Weiss Consultant for Peritor Wissensmanagement GmbH Specialized in Rails, Scaling, and Code Review Active
Web Application Security
E-SPIN PROFESSIONAL BOOK Vulnerability Management Web Application Security ALL THE PRACTICAL KNOW HOW AND HOW TO RELATED TO THE SUBJECT MATTERS. COMBATING THE WEB VULNERABILITY THREAT Editor s Summary
T14 SECURITY TESTING: ARE YOU A DEER IN THE HEADLIGHTS? Ryan English SPI Dynamics Inc BIO PRESENTATION. Thursday, May 18, 2006 1:30PM
BIO PRESENTATION T14 Thursday, May 18, 2006 1:30PM SECURITY TESTING: ARE YOU A DEER IN THE HEADLIGHTS? Ryan English SPI Dynamics Inc International Conference On Software Testing Analysis and Review May
A Tale of the Weaknesses of Current Client-side XSS Filtering
A Tale of the Weaknesses of Current Client-side XSS Filtering Sebastian Lekies (@sebastianlekies), Ben Stock (@kcotsneb) and Martin Johns (@datenkeller) Attention hackers! These slides are preliminary!
Security features of ZK Framework
1 Security features of ZK Framework This document provides a brief overview of security concerns related to JavaScript powered enterprise web application in general and how ZK built-in features secures
Magento Security and Vulnerabilities. Roman Stepanov
Magento Security and Vulnerabilities Roman Stepanov http://ice.eltrino.com/ Table of contents Introduction Open Web Application Security Project OWASP TOP 10 List Common issues in Magento A1 Injection
Web Same-Origin-Policy Exploration Lab
Laboratory for Computer Security Education 1 Web Same-Origin-Policy Exploration Lab (Web Application: Collabtive) Copyright c 2006-2011 Wenliang Du, Syracuse University. The development of this document
What about MongoDB? can req.body.input 0; var date = new Date(); do {curdate = new Date();} while(curdate-date<10000)
Security What about MongoDB? Even though MongoDB doesn t use SQL, it can be vulnerable to injection attacks db.collection.find( {active: true, $where: function() { return obj.credits - obj.debits < req.body.input;
Cross-site site Scripting Attacks on Android WebView
IJCSN International Journal of Computer Science and Network, Vol 2, Issue 2, April 2013 1 Cross-site site Scripting Attacks on Android WebView 1 Bhavani A B 1 Hyderabad, Andhra Pradesh-500050, India Abstract
WHITE PAPER FORTIWEB WEB APPLICATION FIREWALL. Ensuring Compliance for PCI DSS 6.5 and 6.6
WHITE PAPER FORTIWEB WEB APPLICATION FIREWALL Ensuring Compliance for PCI DSS 6.5 and 6.6 CONTENTS 04 04 06 08 11 12 13 Overview Payment Card Industry Data Security Standard PCI Compliance for Web Applications
Detecting and Exploiting XSS with Xenotix XSS Exploit Framework
Detecting and Exploiting XSS with Xenotix XSS Exploit Framework ajin25@gmail.com keralacyberforce.in Introduction Cross Site Scripting or XSS vulnerabilities have been reported and exploited since 1990s.
THE DEPUTIES ARE STILL CONFUSED RICH LUNDEEN
THE DEPUTIES ARE STILL CONFUSED RICH LUNDEEN Hi my name is Rich I have a twi1er @webstersprodigy I have a website h1p://webstersprodigy.net What is the same origin policy? Simple answer: content from one
CGI Programming. Examples
CGI Programming Perl is used as an example throughout. Most of what is said here applies to any common programming language (ie C, C++, python etc.). Perls CGI library provides tools to simplify web page
Workday Mobile Security FAQ
Workday Mobile Security FAQ Workday Mobile Security FAQ Contents The Workday Approach 2 Authentication 3 Session 3 Mobile Device Management (MDM) 3 Workday Applications 4 Web 4 Transport Security 5 Privacy
Preparing for the Cross Site Request Forgery Defense
Preparing for the Cross Site Request Forgery Defense Chuck Willis chuck.willis@mandiant.com Black Hat DC 2008 February 20, 2008 About Me Principal Consultant with MANDIANT in Alexandria, VA Full spectrum
JAVASCRIPT AND COOKIES
JAVASCRIPT AND COOKIES http://www.tutorialspoint.com/javascript/javascript_cookies.htm Copyright tutorialspoint.com What are Cookies? Web Browsers and Servers use HTTP protocol to communicate and HTTP
Web application security
Web application security Sebastian Lopienski CERN Deputy Computer Security Officer Openlab/summer student lectures 2013 Focus on Web applications why? Web applications are: often much more useful than
Full URLs, specified in RFC 3986 have up to eight parts. scheme://login:password@address:port/path/to/resource?query_string#fragment
Outline Recap Secure Programming Lecture 11: Web Application Security II David Aspinall 3rd March 2014 Overview Basics: URLs Output Filtering and XSS Object references Programming web applications securely
National Information Security Group The Top Web Application Hack Attacks. Danny Allan Director, Security Research
National Information Security Group The Top Web Application Hack Attacks Danny Allan Director, Security Research 1 Agenda Web Application Security Background What are the Top 10 Web Application Attacks?
Finding and Preventing Cross- Site Request Forgery. Tom Gallagher Security Test Lead, Microsoft
Finding and Preventing Cross- Site Request Forgery Tom Gallagher Security Test Lead, Microsoft Agenda Quick reminder of how HTML forms work How cross-site request forgery (CSRF) attack works Obstacles