Dissecting CSRF Attacks & Defenses. Mike Shema October 16, 2013
|
|
|
- Marianna Harris
- 8 years ago
- Views:
Transcription
1 Dissecting CSRF Attacks & Defenses Mike Shema October 16, 2013
2 Cross Site Request Forgery Identifying the confused, session-riding deputy. WHAT Putting the attack in context. WHY Analyzing & implementing countermeasures. HOW Defending the browser. WHEN 2
3 User Agent Double Agent Secret Agent <!DOCTYPE html> <html> <head> <meta http-equiv="refresh" content="0;url= <link ref="prefetch" href=" </head> <body> <img src=" alt=""> <iframe sandbox src=" <a href=" here<a> </body> </html> Cross-origin requests are an integral design and expected behavior of HTML. 3
4 CSRF Mechanism vs. Exploit Force a victim s browser to request a resource of the attacker s choosing. <img src=" alt=""> <img src=" alt=""> <iframe src=" The request affects the victim s context with the web app in a way that either benefits the attacker or is detrimental to the victim. 4
5 Request Context The attacker chooses an action to be performed. The browser includes cookies to perform that action against the target app under the victim s session context. 5
6 Two Senses of Forgery Creation SOP restricts reading the response from a crossorigin request, not making the request. Many elements automatically initiate a request. XHR object can compose complex requests. Counterfeit Compose request with attacker s choice of values. The request triggers a behavior of the attacker s choice made under the victim s context. 6
7 Request Creation <form method="post" action="changepassword"> <input type="password" name="newpass" value=""> <input type="password" name="confirmpass" value=""> <input type="submit"> </form> POST /changepassword HTTP/1.1 Host: web.site User-Agent: Mozilla/ Cookie: sessid=12345 Connection: keep-alive newpass=kar120c&confirmpass=kar120c GET /changepassword?newpass=kar120c&confirmpass=kar120c HTTP/1.1 Host: web.site User-Agent: Mozilla/ Cookie: sessid=12345 Connection: keep-alive 7
8 Request Subterfuge <img style="visibility:hidden"... <iframe frameborder="0" height="0" width="0"... <iframe seamless height="0" width="0"... <iframe style="position:absolute; left:-1000px; top:-1000px"... 8
9 Risk Considerations current_page=main_analysis_content.asp& next_page=cmdret_check.htm&next_host= & group_id=&modified=0&action_mode=+refresh+& action_script=&action_wait=&first_time=&preferred_lang=en& SystemCmd=nvram%20%show& firmver= &cmdmethod=ping&destip=localhost&pingcnt=5 h*p:// db.com/exploits/28652/ 9
10 Authorized Are You Experienced? Fundamentally, we want to distinguish between a user-intended action and a browser-initiated one. Cross-origin requests that assume the victim s authorization are the problem (i.e. session riding). Hence, a countermeasure might try to...prevent the initiation of the request...make it difficult to correctly compose the request...separate the user s context from the request 10
11 Castles Made of Sand Make requests harder to create. CORS isolation Make requests harder to counterfeit by including entropy or secrets. Double submit cookie Anti-CSRF token (nonce) Tie the request to the user s session. Separate authorization & authentication tokens 11
12 Secrets & Entropy PRNG sizeof(prng) hash(hash(hash(...(prng)...))) sizeof(prng) hash(prng, salt) sizeof(prng + salt) HMAC-SHA256(PRNG, secret) sizeof(prng + secret) HMAC-MD5 HMAC-SHA512 12
13 PRNG & Entropy Deterministic Poor seeding Poor algorithm Exposed state srand(1); $x = rand(); $x = sha256(rand()); Cryptographically secure algorithms designed to...self-measure entropy to improve seeding...resist prediction, bias...resist compromise in case of state exposure 13
14 Heuristics θ=2πxn φ=πxn+1 ρ= Xn+2 h*p://mathworld.wolfram.com/noisesphere.html 14
15 Entropic Horror BH PRNG: Pwning Random Number Generators sjcl.random openssl rand 32 -hex 15
16 HMAC & Secrets Something other than the default value keyboard cat Something outside a dictionary secret Shad0wfax $./john --format=hmac-sha256 --wordlist=words.txt sids.john $./hashcat-cli64.app -a 0 -m 1450 sids.hashcat words.txt 16
17 explore.gitignore OAUTH_CONSUMER_SECRET session_secret secret_token.rb mongodb://admin hmac- sha
18 CSRF Exposes Weak Design Password change mechanisms that don t require current password. Missing authentication barriers for sensitive actions. e.g. check-out and shipping to known vs. new address Loose coupling of authentication, authorization, and session. 18
19 Dangerous Design GET/POST negligence and mismatch form method modification PHP $_GET vs. $_POST vs. $_REQUEST Unrestricted redirection e.g. Link-based links e.g. 19
20 Attack Payloads Griefing Actions detrimental to user Manipulation Upvotes/downvotes POST HTTP/1.1 Host: stackoverflow.com Spamming fkey=d2aad1a4a5e8326b26eb82307f25a072 Messages from the user without authorization of user 20
21 (press control+c to stop) 21
22 Detection Methodologies Pattern-based detection of token names Security by regexity Checks for presence, not effectiveness or implementation Active test Cookie Swap between user session contexts Determine enforcement, not predictability 22
23 Mobile Apps Recreating vulns from first principles Using HTTP instead of HTTPS Not verifying HTTPS certs But at least the apps are signed... More areas to explore Not a browser, but making HTTP requests CSRF potential of malevolent ad banners 23
24 Wherever Browsers Roam Does it speak HTTP(S)? Gaming systems Televisions Embedded devices Does it have a user context?...or integration with social media?...or control a security barrier? 24
25 Cross Origin Resource Sharing Control the forgery (i.e. creation) of nonsimple, cross-origin requests X-CSRF: 1 XCSRF /foo HTTP/1.1 25
26 CORS Isolation Guarantees same Origin (or allowed cross- Origin) But only for non-simple XHR requests Must start inspecting the Origin header Limitations Must be part of app s design and implementation Breaks simple cross-origin requests 26
27 <form id= dragon > (function(){ "use strict"; $(document).ready(function() { $("#dragon").submit(function(event) { $.ajax({ url: "dragon.php", data: "foo", error: function(jqxhr, textstatus, errorthrown) { $("#results").html(textstatus + ", " + errorthrown); }, headers: { "X-CSRF" : "1" }, success: function(data) { $("#results").html(data); } }); return false; }); }); })(); 27
28 Pre-Flight OPTIONS HTTP/1.1 Host: web.site User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:24.0) Gecko/ Firefox/24.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-us,en;q=0.5 Origin: Access-Control-Request-Method: GET Access-Control-Request-Headers: x-csrf Connection: keep-alive HTTP/ OK Date: Wed, 16 Oct :13:31 GMT Server: Apache/ (Unix) X-Powered-By: PHP/ Set-Cookie: PHPSESSID=mkpb5bn4cbp86orsjekmp6asb7; path=/ Expires: Thu, 19 Nov :52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Access-Control-Allow-Origin: Access-Control-Allow-Headers: X-CSRF Access-Control-Max-Age: 10 Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=utf-8 28
29 Content Security Policy CSP: default-src 'self' <input type="text" name="q" value="foo" autofocus/onfocus=alert(9)//""> CSP: default-src 'self' 'unsafe-inline' <input type="text" name="q" value="foo" autofocus/onfocus=alert(9)//""> 29
30 Speaking of CSP <!doctype html> <html> <head> <meta http-equiv="x-webkit-csp" content="img-src 'none'; report-uri ' </head> <body> <img alt="" src="whatever"> </body> </html> 30
31 Partial POST Forgery POST /page?a=1&b=2&c=3 HTTP/1.1 Host: csrf.target User-Agent: Mozilla/ Content-Length: 116 Accept: */* Origin: null Content-Type: application/x-www-form-urlencoded Referer: Cookie: sessid=12345 Connection: keep-alive document-url=http%3a%2f%2fcsrf.target%2fhwa %2Fch3%2Fcsrf.html&violated-directive=defaultsrc+%27none%27 31
32 ONE ATTACK AMONG MANY 32
33 Crosstown Traffic HTML injection, cross-site scripting It s executing in Same Origin CSRF countermeasures are intended to prevent cross-origin attacks Start using Content Security Policy DNS, cache poisoning, sniffing,... Start using HSTS Where did DNSSEC go? 33
34 Vuln Background Radiation 1/5 th!? 30% 23% 15% 8% Total Scans 0% Insecure Flash/Scan Insecure Java/Scan Insecure Silverlight/Scan 20 months starrng November
35 Plugins Outside of SOP Outside of privacy settings Compose requests Unrestricted header creation Raw packets Eternally insecure To be replaced by HTML5, <canvas>, <audio>, <video> 35
36 AND THEY HAVE A PLAN. 36
37 Security of Sessions Focus on the abuse of session context Session-riding, confused deputy Control when cookies accompany requests initiated from a cross-origin resource Similar to CORS enforcement of non-simple requests Isolate the user s session context 37
38 Simplicity of Settings Syntax like CSP, behavior like CORS Simple behavior with fewer chances of mistakes Leverage pre-flight as a permission check for context Don t require changes to application code Add headers via WAF Provide more flexibility by opt-in to exceptions 38
39 Should Often Succeed Don t break the web, ease adoption Ad banners first visit, blank browsing context Deal with domains & subdomains vs. Origins Browsers have to support it Old, unpatched browsers forsaken to the demons of insecurity anyway 39
40 Some Ordinary Syntax On the web application, define a policy: Set-Cookie: cookiename=... Content-Security-Policy: sos-apply=cookiename self sos-apply=cookiename any sos-apply=cookiename isolate sos-apply=* self 40
41 Policies self -- trigger pre-flight, cookie included only from same origin unless given exception any -- trigger pre-flight, cookie included unless given exception isolate -- no pre-flight, no exceptions. Cookie only included from same Origin. (?) sos-remove=cookiename to remove policy 41
42 Some Ordinary Syntax If a cookie has a policy (or no policy), and a request is generated by a resource from the same Origin....work like the web works today. If a cookie has a policy of isolate, and a request is generated by a cross-origin resource....never include the cookie. If a cookie has a policy of any or self, and a request is generated by a cross-origin resource....make a pre-flight check 42
43 Why Pre-Flight? Cookies apply site-wide (including subdomains!), without granularity of resources. The /path attribute is not a security boundary An SOS policy instructs the browser for default handling of a cookie. A particular resource can declare an exception by responding to the pre-flight. 43
44 Pre-Flight Request [prereq] A policy of any or self [prereq] Cross-origin resource initiates request Browser makes CORS-like request: OPTIONS HTTP/1.1 Host: web.site User-Agent:... Origin: Access-Control-SOS: cookiename cookiename2 Connection: keep-alive Content-Length: 0 44
45 Pre-Flight Response Web app receives a pre-flight request. Supply an expires value so the browser can cache the response....if a policy should be enforced for the specific resource: HTTP 200 OK Access-Control-SOS-reply: allow deny ; expires=seconds 45
46 Pre-Flight Response...if the resource is not exceptional, browser follows established policy any would include the cookie for cross-origin self would exclude the cookie for cross-origin Benefits Web app can enforce per resource, per cookie Sees the Origin header Expiration eases performance with caching 46
47 Two Sets Policy applies to cookies for all resources (entire Origin) Policy can be adjusted by a resource Pre-flight response shouldn t leak information about cookies for which it has a policy If the client can t ask for the right cookie, then no response. Respond with deny if the cookie doesn t exist 47
48 Remember Browser tracks... Cookies for which a policy has been applied. Resources that respond to cross-origin requests with exceptions to the policy. Cookies and destination origin, source origin doesn t matter Web App Applies a policy at each Set-Cookie Applies a policy at a bottleneck 48
49 Goals Ease adoption Familiar syntax Small command set Acknowledge performance Cache pre-flight responses Only track all other origins to origin, not pairs of origins 49
50 The WordPress Problem Strong anti-csrf token is present in WordPress trunk WP plugins keep forgetting to use it../wp-admin/admin.php?page=... Must continually protect every new action...or protect the /wp-admin/ directory sos-apply=cookiename; self 50
51 Mitigate Social Engineering Should prevent situations where user is tricked onto clicking a link/submitting a form on attacker s page (i.e. different origin) that submits to targeted origin Use X-Frame-Options to deal with clickjacking 51
52 If 6 Was 9 No secrets, no entropy Easier on embedded devices, fewer mistakes Enforcement by origin Exception-based for flexibility Shift state tracking from server to browser Pre-flight can be handled by WAF isolate and expire deal with overhead of preflight (Which is only for cross-origin anyway) 52
53 Imperfect Much easier to isolate an origin than work with cross-origin requests. Decorates resources instead of decorating the cookie. 53
54 When Old Becomes New Update browsers Still have to support legacy, although the window to the past is shrinking People still use old browsers for good reasons, TorBrowser using FireFox ESR Fix frameworks Use cryptographically secure PRNG Don t reuse example passphrases Use XHR brokering with custom headers Separate authentication and authorization 54
55 Strong Foundations Use HSTS Use CORS isolation (i.e. non-simple requests) Send an SOS SIX: ALL OF THIS HAS HAPPENED BEFORE. BALTAR: BUT THE QUESTION REMAINS, DOES ALL OF THIS HAVE TO HAPPEN AGAIN? 55
56 Thank You! Content 56
57 References beefproject.com crypto.stanford.edu/sjcl/ github.com/mutantzombie/sessionoriginsecurity hashcat.net media.blackhat.com/bh-us-12/briefings/argyros/bh_us_12_argyros_prng_wp.pdf research.microsoft.com/en-us/um/people/helenw/papers/racl.pdf
A Server and Browser-Transparent CSRF Defense for Web 2.0 Applications. Slides by Connor Schnaith
A Server and Browser-Transparent CSRF Defense for Web 2.0 Applications Slides by Connor Schnaith Cross-Site Request Forgery One-click attack, session riding Recorded since 2001 Fourth out of top 25 most
Web applications. Web security: web basics. HTTP requests. URLs. GET request. Myrto Arapinis School of Informatics University of Edinburgh
Web applications Web security: web basics Myrto Arapinis School of Informatics University of Edinburgh HTTP March 19, 2015 Client Server Database (HTML, JavaScript) (PHP) (SQL) 1 / 24 2 / 24 URLs HTTP
Table of Contents. Open-Xchange Authentication & Session Handling. 1.Introduction...3
Open-Xchange Authentication & Session Handling Table of Contents 1.Introduction...3 2.System overview/implementation...4 2.1.Overview... 4 2.1.1.Access to IMAP back end services...4 2.1.2.Basic Implementation
Web Application Security
Web Application Security The OWASP Foundation Securing the application Input validation Authorization Session mgmt Config mgmt Authenticatio n Error handling Web server App server DB server Secure storage
Security starts in the head(er)
Security starts in the head(er) JavaOne 2014 Dominik Schadow bridgingit Policies are independent of framework and language response.addheader(! "Policy name",! "Policy value"! ); User agent must understand
Where every interaction matters.
Where every interaction matters. Peer 1 Vigilant Web Application Firewall Powered by Alert Logic The Open Web Application Security Project (OWASP) Top Ten Web Security Risks and Countermeasures White Paper
Hacking Web Apps. Detecting and Preventing Web Application Security Problems. Jorge Blanco Alcover. Mike Shema. Technical Editor SYNGRESS
Hacking Web Apps Detecting and Preventing Web Application Security Problems Mike Shema Technical Editor Jorge Blanco Alcover AMSTERDAM BOSTON HEIDELBERG LONDON NEW YORK OXFORD PARIS SAN DIEGO SAN FRANCISCO
HTTP Response Splitting
The Attack HTTP Response Splitting is a protocol manipulation attack, similar to Parameter Tampering The attack is valid only for applications that use HTTP to exchange data Works just as well with HTTPS
Playing with Web Application Firewalls
Playing with Web Application Firewalls Who is Wendel? Independent penetration test analyst. Affiliated to Hackaholic team. Over 7 years in the security industry. Discovered vulnerabilities in Webmails,
Security-Assessment.com White Paper Leveraging XSRF with Apache Web Server Compatibility with older browser feature and Java Applet
Security-Assessment.com White Paper Leveraging XSRF with Apache Web Server Compatibility with older browser feature and Java Applet Prepared by: Roberto Suggi Liverani Senior Security Consultant Security-Assessment.com
AppSec USA 2014 Denver, Colorado Security Header Injection Module (SHIM)
AppSec USA 2014 Denver, Colorado Security Header Injection Module (SHIM) Inspired By: The OWASP Secure Headers Project Introduction Eric Johnson (@emjohn20) Cypress Data Defense Security Consultant SANS
Hypertext for Hyper Techs
Hypertext for Hyper Techs An Introduction to HTTP for SecPros Bio Josh Little, GSEC ~14 years in IT. Support, Server/Storage Admin, Webmaster, Web App Dev, Networking, VoIP, Projects, Security. Currently
Criteria for web application security check. Version 2015.1
Criteria for web application security check Version 2015.1 i Content Introduction... iii ISC- P- 001 ISC- P- 001.1 ISC- P- 001.2 ISC- P- 001.3 ISC- P- 001.4 ISC- P- 001.5 ISC- P- 001.6 ISC- P- 001.7 ISC-
Recent Advances in Web Application Security
Recent Advances in Web Application Security Author: Neelay S Shah Principal Security Consultant Foundstone Professional Services Table of Contents Introduction 3 Content Security Policy 3 Best Practices
Ethical Hacking as a Professional Penetration Testing Technique
Ethical Hacking as a Professional Penetration Testing Technique Rochester ISSA Chapter Rochester OWASP Chapter - Durkee Consulting, Inc. info@rd1.net 2 Background Founder of Durkee Consulting since 1996
reference: HTTP: The Definitive Guide by David Gourley and Brian Totty (O Reilly, 2002)
1 cse879-03 2010-03-29 17:23 Kyung-Goo Doh Chapter 3. Web Application Technologies reference: HTTP: The Definitive Guide by David Gourley and Brian Totty (O Reilly, 2002) 1. The HTTP Protocol. HTTP = HyperText
Secure development and the SDLC. Presented By Jerry Hoff @jerryhoff
Secure development and the SDLC Presented By Jerry Hoff @jerryhoff Agenda Part 1: The Big Picture Part 2: Web Attacks Part 3: Secure Development Part 4: Organizational Defense Part 1: The Big Picture Non
Secure Coding in Node.js
Secure Coding in Node.js Advanced Edition Copyright 2015 nvisium LLC 590 Herndon Parkway Suite 120, Herndon VA 20170 571.353.7551 www.nvisium.com 1 Introduction Seth Law VP of Research & Development @
APPLICATION SECURITY AND ITS IMPORTANCE
Table of Contents APPLICATION SECURITY AND ITS IMPORTANCE 1 ISSUES AND FIXES: 2 ISSUE: XSS VULNERABILITIES 2 ISSUE: CSRF VULNERABILITY 2 ISSUE: CROSS FRAME SCRIPTING (XSF)/CLICK JACKING 2 ISSUE: WEAK CACHE
Web Security Threat Report: January April 2007. Ryan C. Barnett WASC Member Project Lead: Distributed Open Proxy Honeypots
Web Security Threat Report: January April 2007 Ryan C. Barnett WASC Member Project Lead: Distributed Open Proxy Honeypots What are we reporting? We are presenting real, live web attack data captured in-the-wild.
Protecting Web Applications and Users
Protecting Web Applications and Users Technical guidance for improving web application security through implementing web browser based mitigations. Defence Signals Directorate February 2012 Contents 1
Sichere Webanwendungen mit Java
Sichere Webanwendungen mit Java Karlsruher IT- Sicherheitsinitiative 16.07.2015 Dominik Schadow bridgingit Patch fast Unsafe platform unsafe web application Now lets have a look at the developers OWASP
Hack Yourself First. Troy Hunt @troyhunt troyhunt.com troyhunt@hotmail.com
Hack Yourself First Troy Hunt @troyhunt troyhunt.com troyhunt@hotmail.com We re gonna turn you into lean, mean hacking machines! Because if we don t, these kids are going to hack you Jake Davies, 19 (and
Abusing the Internet of Things. BLACKOUTS. FREAKOUTS. AND STAKEOUTS. @nitesh_dhanjani
2014 Abusing the Internet of Things. BLACKOUTS. FREAKOUTS. AND STAKEOUTS. @nitesh_dhanjani We are going to depend on IoT devices for our privacy and physical security at work and at home. Vulnerabilities
Real World Java Web Security
Real World Java Web Security Java User Group Karlsruhe Dominik Schadow bridgingit Who thinks about architecture while coding? architecture before coding? Who thinks about security while coding? security
PHP code audits. OSCON 2009 San José, CA, USA July 21th 2009
PHP code audits OSCON 2009 San José, CA, USA July 21th 2009 1 Agenda Workshop presentation Black box audit Source code audit 2 Who speaks? Philippe Gamache Parler Haut, Interagir Librement : Web development,
ivoyeur: permission to parse
D A V I D J O S E P H S E N ivoyeur: permission to parse David Josephsen is the author of Building a Monitoring Infrastructure with Nagios (Prentice Hall PTR, 2007) and Senior Systems Engineer at DBG,
An Insight into Cookie Security
An Insight into Cookie Security Today most websites and web based applications use cookies. Cookies are primarily used by the web server to track an authenticated user or other user specific details. This
Magento Security and Vulnerabilities. Roman Stepanov
Magento Security and Vulnerabilities Roman Stepanov http://ice.eltrino.com/ Table of contents Introduction Open Web Application Security Project OWASP TOP 10 List Common issues in Magento A1 Injection
Web application security
Web application security Sebastian Lopienski CERN Computer Security Team openlab and summer lectures 2010 (non-web question) Is this OK? int set_non_root_uid(int uid) { // making sure that uid is not 0
HTTP. Internet Engineering. Fall 2015. Bahador Bakhshi CE & IT Department, Amirkabir University of Technology
HTTP Internet Engineering Fall 2015 Bahador Bakhshi CE & IT Department, Amirkabir University of Technology Questions Q1) How do web server and client browser talk to each other? Q1.1) What is the common
Web-Application Security
Web-Application Security Kristian Beilke Arbeitsgruppe Sichere Identität Fachbereich Mathematik und Informatik Freie Universität Berlin 29. Juni 2011 Overview Web Applications SQL Injection XSS Bad Practice
Web Security: SSL/TLS
CSE 484 / CSE M 584: Computer Security and Privacy Web Security: SSL/TLS Spring 2015 Franziska (Franzi) Roesner franzi@cs.washington.edu Thanks to Dan Boneh, Dieter Gollmann, Dan Halperin, Yoshi Kohno,
PHP Magic Tricks: Type Juggling. PHP Magic Tricks: Type Juggling
Who Am I Chris Smith (@chrismsnz) Previously: Polyglot Developer - Python, PHP, Go + more Linux Sysadmin Currently: Pentester, Consultant at Insomnia Security Little bit of research Insomnia Security Group
Cyber Security Workshop Ethical Web Hacking
Cyber Security Workshop Ethical Web Hacking May 2015 Setting up WebGoat and Burp Suite Hacking Challenges in WebGoat Concepts in Web Technologies and Ethical Hacking 1 P a g e Downloading WebGoat and Burp
ArcGIS Server Security Threats & Best Practices 2014. David Cordes Michael Young
ArcGIS Server Security Threats & Best Practices 2014 David Cordes Michael Young Agenda Introduction Threats Best practice - ArcGIS Server settings - Infrastructure settings - Processes Summary Introduction
Anatomy of a Pass-Back-Attack: Intercepting Authentication Credentials Stored in Multifunction Printers
Anatomy of a Pass-Back-Attack: Intercepting Authentication Credentials Stored in Multifunction Printers By Deral (PercX) Heiland and Michael (omi) Belton Over the past year, one focus of the Foofus.NET
elearning for Secure Application Development
elearning for Secure Application Development Curriculum Application Security Awareness Series 1-2 Secure Software Development Series 2-8 Secure Architectures and Threat Modeling Series 9 Application Security
WHITE PAPER. FortiWeb and the OWASP Top 10 Mitigating the most dangerous application security threats
WHITE PAPER FortiWeb and the OWASP Top 10 PAGE 2 Introduction The Open Web Application Security project (OWASP) Top Ten provides a powerful awareness document for web application security. The OWASP Top
Web Same-Origin-Policy Exploration Lab
Laboratory for Computer Security Education 1 Web Same-Origin-Policy Exploration Lab (Web Application: Collabtive) Copyright c 2006-2011 Wenliang Du, Syracuse University. The development of this document
What is Web Security? Motivation
brucker@inf.ethz.ch http://www.brucker.ch/ Information Security ETH Zürich Zürich, Switzerland Information Security Fundamentals March 23, 2004 The End Users View The Server Providers View What is Web
Is Drupal secure? A high-level perspective on web vulnerabilities, Drupal s solutions, and how to maintain site security
Is Drupal secure? A high-level perspective on web vulnerabilities, Drupal s solutions, and how to maintain site security Presented 2009-05-29 by David Strauss Thinking Securely Security is a process, not
Essential IT Security Testing
Essential IT Security Testing Application Security Testing for System Testers By Andrew Muller Director of Ionize Who is this guy? IT Security consultant to the stars Member of OWASP Member of IT-012-04
OWASP and OWASP Top 10 (2007 Update) OWASP. The OWASP Foundation. Dave Wichers. The OWASP Foundation. OWASP Conferences Chair dave.wichers@owasp.
and Top 10 (2007 Update) Dave Wichers The Foundation Conferences Chair dave.wichers@owasp.org COO, Aspect Security dave.wichers@aspectsecurity.com Copyright 2007 - The Foundation This work is available
Information Extraction Art of Testing Network Peripheral Devices
OWASP AppSec Brazil 2010, Campinas, SP The OWASP Foundation http://www.owasp.org Information Extraction Art of Testing Network Peripheral Devices Aditya K Sood, SecNiche Security (adi_ks@secniche.org)
HTTP Protocol. Bartosz Walter <Bartek.Walter@man.poznan.pl>
HTTP Protocol Bartosz Walter Agenda Basics Methods Headers Response Codes Cookies Authentication Advanced Features of HTTP 1.1 Internationalization HTTP Basics defined in
Web Application Penetration Testing
Web Application Penetration Testing 2010 2010 AT&T Intellectual Property. All rights reserved. AT&T and the AT&T logo are trademarks of AT&T Intellectual Property. Will Bechtel William.Bechtel@att.com
Relax Everybody: HTML5 Is Securer Than You Think
Relax Everybody: HTML5 Is Securer Than You Think Martin Johns (@datenkeller) SAP AG Session ID: ADS-W08 Session Classification: Advanced Motivation For some reason, there is a preconception that HTML5
MANAGED SECURITY TESTING
MANAGED SECURITY TESTING SERVICE LEVEL COMPARISON External Network Testing (EVS) Scanning Basic Threats Penetration Testing Network Vulnerability Scan Unauthenticated Web App Scanning Validation Of Scan
Web Application Scan. Document Revision Initial Report Prepared By: AppCheck-NG Version: 1.0
Web Application Scan Document Revision Initial Report Prepared By: AppCheck-NG Version: 1.0 Assessment Schedule Assessment Performed on Tuesday 10 June 2014 Report Prepared on Tuesday 10 June 2014 1. CONTENTS
Web Application Firewall on SonicWALL SSL VPN
Web Application Firewall on SonicWALL SSL VPN Document Scope This document describes how to configure and use the Web Application Firewall feature in SonicWALL SSL VPN 5.0. This document contains the following
DEPLOYMENT GUIDE DEPLOYING THE BIG-IP LTM SYSTEM WITH CITRIX PRESENTATION SERVER 3.0 AND 4.5
DEPLOYMENT GUIDE DEPLOYING THE BIG-IP LTM SYSTEM WITH CITRIX PRESENTATION SERVER 3.0 AND 4.5 Deploying F5 BIG-IP Local Traffic Manager with Citrix Presentation Server Welcome to the F5 BIG-IP Deployment
FINAL DoIT 11.03.2015 - v.4 PAYMENT CARD INDUSTRY DATA SECURITY STANDARDS APPLICATION DEVELOPMENT AND MAINTENANCE PROCEDURES
Purpose: The Department of Information Technology (DoIT) is committed to developing secure applications. DoIT s System Development Methodology (SDM) and Application Development requirements ensure that
Acunetix Website Audit. 5 November, 2014. Developer Report. Generated by Acunetix WVS Reporter (v8.0 Build 20120808)
Acunetix Website Audit 5 November, 2014 Developer Report Generated by Acunetix WVS Reporter (v8.0 Build 20120808) Scan of http://filesbi.go.id:80/ Scan details Scan information Starttime 05/11/2014 14:44:06
Internet Technologies Internet Protocols and Services
QAFQAZ UNIVERSITY Computer Engineering Department Internet Technologies Internet Protocols and Services Dr. Abzetdin ADAMOV Chair of Computer Engineering Department aadamov@qu.edu.az http://ce.qu.edu.az/~aadamov
Finding and Preventing Cross- Site Request Forgery. Tom Gallagher Security Test Lead, Microsoft
Finding and Preventing Cross- Site Request Forgery Tom Gallagher Security Test Lead, Microsoft Agenda Quick reminder of how HTML forms work How cross-site request forgery (CSRF) attack works Obstacles
External Network & Web Application Assessment. For The XXX Group LLC October 2012
External Network & Web Application Assessment For The XXX Group LLC October 2012 This report is solely for the use of client personal. No part of it may be circulated, quoted, or reproduced for distribution
Login with Amazon. Developer Guide for Websites
Login with Amazon Developer Guide for Websites Copyright 2014 Amazon Services, LLC or its affiliates. All rights reserved. Amazon and the Amazon logo are trademarks of Amazon.com, Inc. or its affiliates.
Security for mobile apps
November 2014 Security for mobile apps This white paper provides education on security considerations and requirements for mobile apps. 1 Contents Authentication & security for mobile apps 3 Securing mobile
Internet Technologies. World Wide Web (WWW) Proxy Server Network Address Translator (NAT)
Internet Technologies World Wide Web (WWW) Proxy Server Network Address Translator (NAT) What is WWW? System of interlinked Hypertext documents Text, Images, Videos, and other multimedia documents navigate
OWASP TOP 10 ILIA ALSHANETSKY @ILIAA HTTPS://JOIND.IN/15741
OWASP TOP 10 ILIA ALSHANETSKY @ILIAA HTTPS://JOIND.IN/15741 ME, MYSELF & I PHP Core Developer Author of Guide to PHP Security Security Aficionado THE CONUNDRUM USABILITY SECURITY YOU CAN HAVE ONE ;-) OPEN
WEB SECURITY CONCERNS THAT WEB VULNERABILITY SCANNING CAN IDENTIFY
WEB SECURITY CONCERNS THAT WEB VULNERABILITY SCANNING CAN IDENTIFY www.alliancetechpartners.com WEB SECURITY CONCERNS THAT WEB VULNERABILITY SCANNING CAN IDENTIFY More than 70% of all websites have vulnerabilities
Web Application Guidelines
Web Application Guidelines Web applications have become one of the most important topics in the security field. This is for several reasons: It can be simple for anyone to create working code without security
SESSION IDENTIFIER ARE FOR NOW, PASSWORDS ARE FOREVER
SESSION IDENTIFIER ARE FOR NOW, PASSWORDS ARE FOREVER XSS-BASED ABUSE OF BROWSER PASSWORD MANAGERS Ben Stock, Martin Johns, Sebastian Lekies Browser choices Full disclosure: Ben was an intern with Microsoft
Recent Web Security Technology. Lieven Desmet iminds-distrinet-ku Leuven 3th February 2015 B-CCENTRE closing workshop Lieven.Desmet@cs.kuleuven.
Recent Web Security Technology Lieven Desmet iminds-distrinet-ku Leuven 3th February 2015 B-CCENTRE closing workshop Lieven.Desmet@cs.kuleuven.be About myself: Lieven Desmet Research manager at KU Leuven
Network Technologies
Network Technologies Glenn Strong Department of Computer Science School of Computer Science and Statistics Trinity College, Dublin January 28, 2014 What Happens When Browser Contacts Server I Top view:
How to break in. Tecniche avanzate di pen testing in ambito Web Application, Internal Network and Social Engineering
How to break in Tecniche avanzate di pen testing in ambito Web Application, Internal Network and Social Engineering Time Agenda Agenda Item 9:30 10:00 Introduction 10:00 10:45 Web Application Penetration
Department of Computing Imperial College London. BrowserAudit. A web application that tests the security of browser implementations
Department of Computing Imperial College London BrowserAudit A web application that tests the security of browser implementations Charlie Hothersall-Thomas Supervisor: Dr. Sergio Maffeis June 2014 Submitted
Ruby on Rails Security. Jonathan Weiss, 30.12.2007 Peritor Wissensmanagement GmbH
Ruby on Rails Security Jonathan Weiss, 30.12.2007 Peritor Wissensmanagement GmbH Who am I? Jonathan Weiss Consultant for Peritor Wissensmanagement GmbH Specialized in Rails, Scaling, and Code Review Active
Sitefinity Security and Best Practices
Sitefinity Security and Best Practices Table of Contents Overview The Ten Most Critical Web Application Security Risks Injection Cross-Site-Scripting (XSS) Broken Authentication and Session Management
(WAPT) Web Application Penetration Testing
(WAPT) Web Application Penetration Testing Module 0: Introduction 1. Introduction to the course. 2. How to get most out of the course 3. Resources you will need for the course 4. What is WAPT? Module 1:
Network Security Exercise #8
Computer and Communication Systems Lehrstuhl für Technische Informatik Network Security Exercise #8 Falko Dressler and Christoph Sommer Computer and Communication Systems Institute of Computer Science,
ECE458 Winter 2013. Web Security. Slides from John Mitchell and Vitaly Shmatikov (Modified by Vijay Ganesh)
ECE458 Winter 2013 Web Security Slides from John Mitchell and Vitaly Shmatikov (Modified by Vijay Ganesh) Reported Web Vulnerabilities "In the Wild" Data from aggregator and validator of NVD-reported vulnerabilities
Introduction Les failles les plus courantes Les injections SQL. Failles Web. Maxime Arthaud. net7. Jeudi 03 avril 2014.
Maxime Arthaud net7 Jeudi 03 avril 2014 Syllabus Introduction Exemple de Requête Transmission de données 1 Introduction Exemple de Requête Transmission de données 2 3 Exemple de Requête Transmission de
Hack Proof Your Webapps
Hack Proof Your Webapps About ERM About the speaker Web Application Security Expert Enterprise Risk Management, Inc. Background Web Development and System Administration Florida International University
Method of control. Lots of ways to architect C&C: Star topology; hierarchical; peer-to-peer Encrypted/stealthy communication.
Botnets Botnets Collection of compromised machines (bots) under (unified) control of an attacker (botmaster) Upon infection, new bot phones home to rendezvous w/ botnet command-and-control (C&C) Botmaster
Investigation Report Regarding Security Issues of Web Applications Using HTML5
Investigation Report Regarding Security Issues of Web Applications Using HTML5 JPCERT Coordination Center October 30, 2013 Contents 1. Introduction... 2 2. Purpose and Method of This Investigation... 4
CloudOYE CDN USER MANUAL
CloudOYE CDN USER MANUAL Password - Based Access Logon to http://mycloud.cloudoye.com. Enter your Username & Password In case, you have forgotten your password, click Forgot your password to request a
Detecting and Exploiting XSS with Xenotix XSS Exploit Framework
Detecting and Exploiting XSS with Xenotix XSS Exploit Framework ajin25@gmail.com keralacyberforce.in Introduction Cross Site Scripting or XSS vulnerabilities have been reported and exploited since 1990s.
Protocolo HTTP. Web and HTTP. HTTP overview. HTTP overview
Web and HTTP Protocolo HTTP Web page consists of objects Object can be HTML file, JPEG image, Java applet, audio file, Web page consists of base HTML-file which includes several referenced objects Each
Weird New Tricks for Browser Fingerprinting. yan (@bcrypt) ToorCon 2015
Weird New Tricks for Browser Fingerprinting yan (@bcrypt) ToorCon 2015 real pic of me also work on these things EFF staff photo, 2015 BETTER TRACKING METHODS Tracking web users is all the rage Show ads!
The Web: some jargon. User agent for Web is called a browser: Web page: Most Web pages consist of: Server for Web is called Web server:
The Web: some jargon Web page: consists of objects addressed by a URL Most Web pages consist of: base HTML page, and several referenced objects. URL has two components: host name and path name: User agent
Playing with Web Application Firewalls
Playing with Web Application Firewalls DEFCON 16, August 8-10, 2008, Las Vegas, NV, USA Who is Wendel Guglielmetti Henrique? Penetration Test analyst at SecurityLabs - Intruders Tiger Team Security division
Next Generation Clickjacking
Next Generation Clickjacking New attacks against framed web pages Black Hat Europe, 14 th April 2010 Paul Stone paul.stone@contextis.co.uk Coming Up Quick Introduction to Clickjacking Four New Cross-Browser
HTTP Caching & Cache-Busting for Content Publishers
HTTP Caching & Cache-Busting for Content Publishers Michael J. Radwin http://public.yahoo.com/~radwin/ OSCON 2005 Thursday, August 4th, 2005 1 1 Agenda HTTP in 3 minutes Caching concepts Hit, Miss, Revalidation
Enterprise Application Security Workshop Series
Enterprise Application Security Workshop Series Phone 877-697-2434 fax 877-697-2434 www.thesagegrp.com Defending JAVA Applications (3 Days) In The Sage Group s Defending JAVA Applications workshop, participants
Data Breaches and Web Servers: The Giant Sucking Sound
Data Breaches and Web Servers: The Giant Sucking Sound Guy Helmer CTO, Palisade Systems, Inc. Lecturer, Iowa State University @ghelmer Session ID: DAS-204 Session Classification: Intermediate The Giant
Cyber Security Scan Report
Scan Customer Information Scan Company Information Company: Example Name Company: SRC Security Research & Consulting GmbH Contact: Mr. Example Contact: Holger von Rhein : : Senior Consultant Telephone:
OWASP Top Ten Tools and Tactics
OWASP Top Ten Tools and Tactics Russ McRee Copyright 2012 HolisticInfoSec.org SANSFIRE 2012 10 JULY Welcome Manager, Security Analytics for Microsoft Online Services Security & Compliance Writer (toolsmith),
BASELINE SECURITY TEST PLAN FOR EDUCATIONAL WEB AND MOBILE APPLICATIONS
BASELINE SECURITY TEST PLAN FOR EDUCATIONAL WEB AND MOBILE APPLICATIONS Published by Tony Porterfield Feb 1, 2015. Overview The intent of this test plan is to evaluate a baseline set of data security practices
CIS 551 / TCOM 401 Computer and Network Security. Spring 2007 Lecture 20
CIS 551 / TCOM 401 Computer and Network Security Spring 2007 Lecture 20 Announcements Reminder: Project 3 is available on the web pages Due: April 3rd Midterm II has been graded Today: Web Security [Some
Web Application Vulnerability Testing with Nessus
The OWASP Foundation http://www.owasp.org Web Application Vulnerability Testing with Nessus Rïk A. Jones, CISSP rikjones@computer.org Rïk A. Jones Web developer since 1995 (16+ years) Involved with information
LBL Application Availability Infrastructure Unified Secure Reverse Proxy
LBL Application Availability Infrastructure Unified Secure Reverse Proxy Valerio Mezzalira TCOGROUP Company Outline Mission: Development of Software Tools Aimed at Enhancing High Availability (HA) of IT
Intrusion detection for web applications
Intrusion detection for web applications Intrusion detection for web applications Łukasz Pilorz Application Security Team, Allegro.pl Reasons for using IDS solutions known weaknesses and vulnerabilities
Web Application Security Guidelines for Hosting Dynamic Websites on NIC Servers
Web Application Security Guidelines for Hosting Dynamic Websites on NIC Servers The Website can be developed under Windows or Linux Platform. Windows Development should be use: ASP, ASP.NET 1.1/ 2.0, and
Lecture Notes for Advanced Web Security 2015
Lecture Notes for Advanced Web Security 2015 Part 6 Web Based Single Sign-On and Access Control Martin Hell 1 Introduction Letting users use information from one website on another website can in many
1. Introduction. 2. Web Application. 3. Components. 4. Common Vulnerabilities. 5. Improving security in Web applications
1. Introduction 2. Web Application 3. Components 4. Common Vulnerabilities 5. Improving security in Web applications 2 What does World Wide Web security mean? Webmasters=> confidence that their site won
WWPass External Authentication Solution for IBM Security Access Manager 8.0
WWPass External Authentication Solution for IBM Security Access Manager 8.0 Setup guide Enhance your IBM Security Access Manager for Web with the WWPass hardware authentication IBM Security Access Manager
Web Application Firewall on SonicWALL SRA
Web Application Firewall on SonicWALL SRA Document Scope This document describes how to configure and use the Web Application Firewall feature in SonicWALL SRA 6.0. This document contains the following
Using Foundstone CookieDigger to Analyze Web Session Management
Using Foundstone CookieDigger to Analyze Web Session Management Foundstone Professional Services May 2005 Web Session Management Managing web sessions has become a critical component of secure coding techniques.