Client Side Cross Site Scripting

Save this PDF as:
 WORD  PNG  TXT  JPG

Size: px
Start display at page:

Download "Client Side Cross Site Scripting"

Transcription

1 Client Side Cross Site Scripting 1

2 Client Side Cross Site Scripting CLIENT SIDE XSS - DI PAOLA 2

3 Soluzioni e sicurezza per applicazioni mobile e payments Consorzio Triveneto, azienda leader nei sistemi di pagamento a livello italiano da sempre all avanguardia nello studio e nella sperimentazione di nuove tecnologie nell ambito dei pagamenti, è una realtà del Gruppo Bassilichi che opera prevalentemente nei campi della Monetica con la gestione dei servizi POS e di Commercio Elettronico e del Corporate Banking a supporto delle imprese. SPONSOR DELL EVENTO Sponsor e sostenitori di ISACA VENICE Chapter Con il patrocinio di CLIENT SIDE XSS - DI PAOLA 3

4 Who Am I Stefano Di Research OWASP-Italy Senior Member Testing Guide Contributor OWASP SWFIntruder Bug Hunter & Sec Research (Pdf Uxss, Flash Security, HPP) Security Since '99 Work Minded Security Application Security Consulting Director of Minded Security Research Labs Lead of WAPT & Code Review Activities Blog: 2

5 Agenda XSS Client Side XSS (aka DOM Based XSS) Examples Tools and Expertise Some Stats Conclusions 3

6 XSS... The Flaw that Keeps Being Hacked 4

7 Three kinds: Reflected Stored <html>.. <script>eviljs</sc ript>..</html> <html>..+ taintedinput +..</html> DOM Based User-Victim taintedinput=<script>eviljs</script> Image Courtesy of John Wilander 5

8 <html>.. <script>eviljs</sc ript>..</html> <html>..+ taintedinput +..</html> User-Victim taintedinput=<script>eviljs</script> Image Courtesy of John Wilander 6

9 User-Victim taintedinput=<script>eviljs</script> Image Courtesy of John Wilander 7

10 <html>.. <script>eviljs</sc ript>..</html> <html>..+ taintedinput +..</html> User-Victim Image Courtesy of John Wilander 8

11 <html>.. <script>eviljs</sc ript>..</html> <html>..+ taintedinput +..</html> User-Victim taintedinput=<script>eviljs</script> Image Courtesy of John Wilander 9

12 User-Victim Injection Happens at Client Side Level! + Sometimes no server roundtrip Eg. location.hash Courtesy of John Wilander 10

13 DOM Based XSS... The Elephant in the XSS Room 11

14 DOM XSS Page Application Perspective 3rd Party JS (?) Courtesy of Dave Wichers 12

15 Traditional XSS Vs DOM Based Impacts/Risks are identical Detectability is lower for DOM-Based XSS as its harder for defenders to find XSS Risk from OWASP Top 10 13

16 From Server to Client 14

17 3rd Party JS Experiment take the first top 100 Sites from Alexa: Extract all script sources and count how many external scripts are used. Result: ~70% contained 3rd Party Js. Do you trust 3rd Party Code in your site? Let me rephrase it: Have you ever tested your 3rd Party JS? Script used to extract: 15

18 Client Side Vulnerabilities Vulnerability JS Execution HTML Injection/ Content Spoofing Impact Complete Control Over User's Page. (CI) Arbitrary HTML Insertion. Attacker can completely spoof the content. Cannot Access Cookies and other JS Data. (CI) Client Side SQL Injection URL Redirect CSS Injection Resource Manipulation Data exfiltration (CI) URL Spoofing (C) Extract Sensitive Information (C) Change the location of a resource requested by a page. (CI)

19 Client Side HTML Injection...<script> var nextlink=getparameterfromlocation('nextid'); document.write('<a href="page'+nextlink+'.html">next Step</a>'); </script>... ><img src='a' onerror=alert(1)> 17

20 A Client Side XSS Example Twitter 2010 ( function(g){ var a=location.href.split("#!")[1]; if(a){ g.location=g.hbr=a; } } )(window); 18

21 A Client Side XSS Example Twitter 2010 ( function(g){ 'http://twitter.com#!/wisecwisec'.split('#!')[1] var a=location.href.split("#!")[1]; if(a){ Returns g.location=g.hbr=a; /WisecWisec } g.location= /WisecWisec } )(window); 19

22 A Client Side XSS Example Twitter 2010 'http://twitter.com#!javascript:icanhascookies()'.split('#!')[1] Returns javascript:icanhascookies() window.location= 'javascript:icanhascookies()' Pseudo-Protocol 20

23 A Client Side XSS Example Twitter 2010 Pseudo-Protocol 21

24 Client Side Issues - Examples DEMO 22

25 Code Analysis - Manual Minimized Client Side JavaScript Server Side Java/C#/Whatever Spot the Difference! But Automated Static Analysis can do it.. doesn't it? 23

26 Code Analysis Automated static analysis Problems with Minimizers Obfuscators AND JavaScript Rigid langs Ie. Java: request.getquerystring() ; Ok.. some coverage can be performed (according to Static Analysis limits) Flexible/Dynamic langs - JavaScript: location.search window.location.search document.location.search window[ location ]['search'] window[ l + o + \x63 + ation ][atob('c2vhcmno')] window[arr[43]][obj['thesearch']] Very poor coverage. OK so What About Runtime? 24

27 Runtime Analysis Runtime Fuzzing: BlackBox Scanning, fault injection with patterns, hoping to reach the sink (dangerous function). Poor coverage, Lot of False Negatives Real Time Taint Propagation with Instrumentation: While executing it propagates the "taint" flag. In the JavaScript case if the Browser is "instrumented" there are other Pros, like Real Client State emulation. (Use Selenium, JSUnits...) OWASP Project: DOMinator by Minded Security 25

28 Some Stats from Took first 100 from Top 1 Million Alexa list. Found several others in top 1 Million most of them advertising hosted as 3rd party scripts. For example Omniture, Google AdWords, or widgets, buttons etc. Using DOMinator + my brain I found that 56 out of 100 top Alexa sites where vulnerable to directly exploitable DOM Based Xss. Means, remote attacker with a reliable scenario. 26

29 Conclusions Client Side Issues are very hard to find. JavaScript is a language for tough people :) Strongly depends on both Client AND Server States. It's a quite untested topic. Even Google Microsoft and big companies have difficulties in identification. Only now, after 8 years scanners are starting to add some kind of identification technique in order to give. some coverage. We need more tools but, more important, we need more brains! 27

30 Tnx! ^_^ Q&A Mail: Twitter: wisecwisec 28

Software Security: Services and Products

Software Security: Services and Products Software Security: Services and Products Minded Security Management & Business Profile Senior Management Business Profile Matteo Meucci CEO and Minded Security SRL co-founder Founded in 2007 in Italy Marco

More information

(WAPT) Web Application Penetration Testing

(WAPT) Web Application Penetration Testing (WAPT) Web Application Penetration Testing Module 0: Introduction 1. Introduction to the course. 2. How to get most out of the course 3. Resources you will need for the course 4. What is WAPT? Module 1:

More information

Finding DOMXSS With DOMinator

Finding DOMXSS With DOMinator Finding DOMXSS With DOMinator OWASP Goteborg Nov. 2011 Stefano di Paola CTO @ Minded Security stefano.dipaola@mindedsecurity.com Copyright The OWASP Foundation Permission is granted to copy, distribute

More information

25 Million Flows Later Large-scale Detection of DOM-based XSS. CCS 2013, Berlin Sebastian Lekies, Ben Stock, Martin Johns

25 Million Flows Later Large-scale Detection of DOM-based XSS. CCS 2013, Berlin Sebastian Lekies, Ben Stock, Martin Johns 25 Million Flows Later Large-scale Detection of DOM-based XSS CCS 2013, Berlin Sebastian Lekies, Ben Stock, Martin Johns Agenda XSS & Attacker Scenario WebSec guys: wake up once you see a cat Motivation

More information

SESSION IDENTIFIER ARE FOR NOW, PASSWORDS ARE FOREVER

SESSION IDENTIFIER ARE FOR NOW, PASSWORDS ARE FOREVER SESSION IDENTIFIER ARE FOR NOW, PASSWORDS ARE FOREVER XSS-BASED ABUSE OF BROWSER PASSWORD MANAGERS Ben Stock, Martin Johns, Sebastian Lekies Browser choices Full disclosure: Ben was an intern with Microsoft

More information

Web application testing

Web application testing CL-WTS Web application testing Classroom 2 days Testing plays a very important role in ensuring security and robustness of web applications. Various approaches from high level auditing through penetration

More information

EVALUATING COMMERCIAL WEB APPLICATION SECURITY. By Aaron Parke

EVALUATING COMMERCIAL WEB APPLICATION SECURITY. By Aaron Parke EVALUATING COMMERCIAL WEB APPLICATION SECURITY By Aaron Parke Outline Project background What and why? Targeted sites Testing process Burp s findings Technical talk My findings and thoughts Questions Project

More information

Crosscheck Web Services Patent Pending Automated SOA Compliance and Security Assessment

Crosscheck Web Services Patent Pending Automated SOA Compliance and Security Assessment Pagina 1 di 5 Hacking News Malwares Cyber Attack Vulnerabilities Hacking Groups Spying e.g. Hacking Facebook +1,310,745 163,900 392,600 +10m Follow Firing Range Open Source Web App Vulnerability Scanning

More information

Product Roadmap. Sushant Rao Principal Product Manager Fortify Software, a HP company

Product Roadmap. Sushant Rao Principal Product Manager Fortify Software, a HP company Product Roadmap Sushant Rao Principal Product Manager Fortify Software, a HP company Agenda Next Generation of Security Analysis Future Directions 2 Currently under investigation and not guaranteed to

More information

Intrusion detection for web applications

Intrusion detection for web applications Intrusion detection for web applications Intrusion detection for web applications Łukasz Pilorz Application Security Team, Allegro.pl Reasons for using IDS solutions known weaknesses and vulnerabilities

More information

The Top Web Application Attacks: Are you vulnerable?

The Top Web Application Attacks: Are you vulnerable? QM07 The Top Web Application Attacks: Are you vulnerable? John Burroughs, CISSP Sr Security Architect, Watchfire Solutions jburroughs@uk.ibm.com Agenda Current State of Web Application Security Understanding

More information

Web-Application Security

Web-Application Security Web-Application Security Kristian Beilke Arbeitsgruppe Sichere Identität Fachbereich Mathematik und Informatik Freie Universität Berlin 29. Juni 2011 Overview Web Applications SQL Injection XSS Bad Practice

More information

Acunetix Website Audit. 5 November, 2014. Developer Report. Generated by Acunetix WVS Reporter (v8.0 Build 20120808)

Acunetix Website Audit. 5 November, 2014. Developer Report. Generated by Acunetix WVS Reporter (v8.0 Build 20120808) Acunetix Website Audit 5 November, 2014 Developer Report Generated by Acunetix WVS Reporter (v8.0 Build 20120808) Scan of http://filesbi.go.id:80/ Scan details Scan information Starttime 05/11/2014 14:44:06

More information

Adobe Systems Incorporated

Adobe Systems Incorporated Adobe Connect 9.2 Page 1 of 8 Adobe Systems Incorporated Adobe Connect 9.2 Hosted Solution June 20 th 2014 Adobe Connect 9.2 Page 2 of 8 Table of Contents Engagement Overview... 3 About Connect 9.2...

More information

Source code security testing

Source code security testing Source code security testing Simone Riccetti EMEA PSS Security Services All information represents IBM's current intent, is subject to change or withdrawal without notice, and represents only IBM ISS goals

More information

Creating Stronger, Safer, Web Facing Code. JPL IT Security Mary Rivera June 17, 2011

Creating Stronger, Safer, Web Facing Code. JPL IT Security Mary Rivera June 17, 2011 Creating Stronger, Safer, Web Facing Code JPL IT Security Mary Rivera June 17, 2011 Agenda Evolving Threats Operating System Application User Generated Content JPL s Application Security Program Securing

More information

Security Testing with Selenium

Security Testing with Selenium with Selenium Vidar Kongsli Montréal, October 25th, 2007 Versjon 1.0 Page 1 whois 127.0.0.1? Vidar Kongsli System architect & developer Head of security group Bekk Consulting Technology and Management

More information

Web Application Security

Web Application Security Web Application Security Ng Wee Kai Senior Security Consultant PulseSecure Pte Ltd About PulseSecure IT Security Consulting Company Part of Consortium in IDA (T) 606 Term Tender Cover most of the IT Security

More information

Comparing Application Security Tools

Comparing Application Security Tools Comparing Application Security Tools Defcon 15-8/3/2007 Eddie Lee Fortify Software Agenda Intro to experiment Methodology to reproduce experiment on your own Results from my experiment Conclusions Introduction

More information

The New OWASP Testing Guide v4

The New OWASP Testing Guide v4 The New OWASP Testing Guide v4 Matteo Meucci OWASP Testing Guide Co-lead 17 th March 2015 Security Summit - OWASP-Italy Matteo Meucci OWASP: OWASP-Italy Founder and Chair from 2005 OWASP Testing Guide

More information

Bank Hacking Live! Ofer Maor CTO, Hacktics Ltd. ATC-4, 12 Jun 2006, 4:30PM

Bank Hacking Live! Ofer Maor CTO, Hacktics Ltd. ATC-4, 12 Jun 2006, 4:30PM Bank Hacking Live! Ofer Maor CTO, Hacktics Ltd. ATC-4, 12 Jun 2006, 4:30PM Agenda Introduction to Application Hacking Demonstration of Attack Tool Common Web Application Attacks Live Bank Hacking Demonstration

More information

Web Application Security

Web Application Security White Paper Web Application Security Managing Cross-Site Scripting, The Number One Item on OWASP s Top Ten List Introduction: What is OWASP? The Open Web Application Security Project (OWASP) is, by its

More information

SecuBat: An Automated Web Vulnerability Detection Framework

SecuBat: An Automated Web Vulnerability Detection Framework SecuBat: An Automated Web Vulnerability Detection Framework Stefan Kals, Engin Kirda Christopher Kruegel and Nenad Jovanovic Secure Systems Lab Vienna University of Technology Austria Outline Motivation

More information

CROSS-SITE SCRIPTING (XSS) ATTACKS

CROSS-SITE SCRIPTING (XSS) ATTACKS CROSS-SITE SCRIPTING (XSS) ATTACKS Abu Khleif & Haitham Topics In security, Nov 28, 2016 CONTENTS Overview Types of XSS Vulnerabilities How to Determine If You Are Vulnerable? How to Protect Your Website?

More information

We protect you applications! No, you don t. Digicomp Hacking Day 2013 May 16 th 2013

We protect you applications! No, you don t. Digicomp Hacking Day 2013 May 16 th 2013 We protect you applications! No, you don t Digicomp Hacking Day 2013 May 16 th 2013 Sven Vetsch Partner & CTO at Redguard AG www.redguard.ch Specialized in Application Security (Web, Web-Services, Mobile,

More information

What about MongoDB? can req.body.input 0; var date = new Date(); do {curdate = new Date();} while(curdate-date<10000)

What about MongoDB? can req.body.input 0; var date = new Date(); do {curdate = new Date();} while(curdate-date<10000) Security What about MongoDB? Even though MongoDB doesn t use SQL, it can be vulnerable to injection attacks db.collection.find( {active: true, $where: function() { return obj.credits - obj.debits < req.body.input;

More information

Adding Value to Automated Web Scans. Burp Suite and Beyond

Adding Value to Automated Web Scans. Burp Suite and Beyond Adding Value to Automated Web Scans Burp Suite and Beyond Automated Scanning vs Manual Tes;ng Manual Tes;ng Tools/Suites At MSU - QualysGuard WAS & Burp Suite Automated Scanning - iden;fy acack surface

More information

Bridging the Gap - Security and Software Testing. Roberto Suggi Liverani ANZTB Test Conference - March 2011

Bridging the Gap - Security and Software Testing. Roberto Suggi Liverani ANZTB Test Conference - March 2011 Bridging the Gap - Security and Software Testing Roberto Suggi Liverani ANZTB Test Conference - March 2011 1 Agenda Roberto, what test are you doing? Is this a defect, vulnerability or both? What can we

More information

Application Security Testing. Erez Metula (CISSP), Founder Application Security Expert ErezMetula@AppSec.co.il

Application Security Testing. Erez Metula (CISSP), Founder Application Security Expert ErezMetula@AppSec.co.il Application Security Testing Erez Metula (CISSP), Founder Application Security Expert ErezMetula@AppSec.co.il Agenda The most common security vulnerabilities you should test for Understanding the problems

More information

Application Code Development Standards

Application Code Development Standards Application Code Development Standards Overview This document is intended to provide guidance to campus system owners and software developers regarding secure software engineering practices. These standards

More information

Detecting and Exploiting XSS with Xenotix XSS Exploit Framework

Detecting and Exploiting XSS with Xenotix XSS Exploit Framework Detecting and Exploiting XSS with Xenotix XSS Exploit Framework ajin25@gmail.com keralacyberforce.in Introduction Cross Site Scripting or XSS vulnerabilities have been reported and exploited since 1990s.

More information

Using Sprajax to Test AJAX. OWASP AppSec Seattle Oct 2006. The OWASP Foundation http://www.owasp.org/

Using Sprajax to Test AJAX. OWASP AppSec Seattle Oct 2006. The OWASP Foundation http://www.owasp.org/ Using Sprajax to Test AJAX Security OWASP AppSec Seattle Oct 2006 Dan Cornell, OWASP San Antonio Leader Principal, Denim Group, Ltd. dan@denimgroup.com (210) 572-4400 Copyright 2006 - The OWASP Foundation

More information

Project OWASP and two most frequent vulnerabilities in web applications

Project OWASP and two most frequent vulnerabilities in web applications Project OWASP and two most frequent vulnerabilities in web applications Filip Šebesta, Wilson Tuladhar 2010 Abstract With the rapid use of the Internet, there has been a rapid growth in websites and web

More information

Security Products Development. Leon Juranic leon@defensecode.com

Security Products Development. Leon Juranic leon@defensecode.com Security Products Development Leon Juranic leon@defensecode.com Security Products Development Q: Why I picked this boring topic at all? A: Avoidance of any hackingrelated topics for fsec (khm.) :) Security

More information

Web Maniac Hacking Trust. Aditya K Sood [adi_ks [at] secniche.org] SecNiche Security

Web Maniac Hacking Trust. Aditya K Sood [adi_ks [at] secniche.org] SecNiche Security Web Maniac Hacking Trust Aditya K Sood [adi_ks [at] secniche.org] SecNiche Security Disclaimer Web Maniac - Hacking Trust Pentesting web applications in a hacker s way. Attack surface varies from application

More information

The purpose of this report is to educate our prospective clients about capabilities of Hackers Locked.

The purpose of this report is to educate our prospective clients about capabilities of Hackers Locked. This sample report is published with prior consent of our client in view of the fact that the current release of this web application is three major releases ahead in its life cycle. Issues pointed out

More information

NoSQL, But Even Less Security Bryan Sullivan, Senior Security Researcher, Adobe Secure Software Engineering Team

NoSQL, But Even Less Security Bryan Sullivan, Senior Security Researcher, Adobe Secure Software Engineering Team NoSQL, But Even Less Security Bryan Sullivan, Senior Security Researcher, Adobe Secure Software Engineering Team Agenda Eventual Consistency REST APIs and CSRF NoSQL Injection SSJS Injection NoSQL databases

More information

HTTPParameter Pollution. ChrysostomosDaniel

HTTPParameter Pollution. ChrysostomosDaniel HTTPParameter Pollution ChrysostomosDaniel Introduction Nowadays, many components from web applications are commonly run on the user s computer (such as Javascript), and not just on the application s provider

More information

Reliable Mitigation of DOM-based XSS

Reliable Mitigation of DOM-based XSS Intro XSS Implementation Evaluation Q&A Reliable Mitigation of DOM-based XSS Tobias Mueller 2014-09-07 1 / 39 Intro XSS Implementation Evaluation Q&A About me The results Motivation about:me MSc. cand.

More information

Performing a Web Application Security Assessment

Performing a Web Application Security Assessment IBM Software Group Performing a Web Application Security Assessment 2007 IBM Corporation Coordinate the Time of the Audit Set up a time window with the application owner Inform your security team Inform

More information

A Network Administrator s Guide to Web App Security

A Network Administrator s Guide to Web App Security A Network Administrator s Guide to Web App Security Speaker: Orion Cassetto, Product Marketing Manager, Incapsula Moderator: Rich Nass, OpenSystems Media Agenda Housekeeping Presentation Questions and

More information

A Tale of the Weaknesses of Current Client-Side XSS Filtering

A Tale of the Weaknesses of Current Client-Side XSS Filtering Call To Arms: A Tale of the Weaknesses of Current Client-Side XSS Filtering Martin Johns, Ben Stock, Sebastian Lekies About us Martin Johns, Ben Stock, Sebastian Lekies Security Researchers at SAP, Uni

More information

How to break in. Tecniche avanzate di pen testing in ambito Web Application, Internal Network and Social Engineering

How to break in. Tecniche avanzate di pen testing in ambito Web Application, Internal Network and Social Engineering How to break in Tecniche avanzate di pen testing in ambito Web Application, Internal Network and Social Engineering Time Agenda Agenda Item 9:30 10:00 Introduction 10:00 10:45 Web Application Penetration

More information

WTH is XSS. What is Cross-site Scripting and How Bad is it Really?

WTH is XSS. What is Cross-site Scripting and How Bad is it Really? WTH is XSS What is Cross-site Scripting and How Bad is it Really? This Guy Joshua Barone Senior Information Security Engineer with Geocent Master of Science (Computer Science) from UNO Certifications:

More information

Application Security Testing. Indian Computer Emergency Response Team (CERT-In)

Application Security Testing. Indian Computer Emergency Response Team (CERT-In) Application Security Testing Indian Computer Emergency Response Team (CERT-In) OWASP Top 10 Place to start for learning about application security risks. Periodically updated What is OWASP? Open Web Application

More information

Client vs. Server Implementations of Mitigating XSS Security Threats on Web Applications

Client vs. Server Implementations of Mitigating XSS Security Threats on Web Applications Journal of Basic and Applied Engineering Research pp. 50-54 Krishi Sanskriti Publications http://www.krishisanskriti.org/jbaer.html Client vs. Server Implementations of Mitigating XSS Security Threats

More information

Introduction. Secure Software Development 9/03/2015. Matias starts. Daan takes over. Matias takes over. Who are we? Round of introductions

Introduction. Secure Software Development 9/03/2015. Matias starts. Daan takes over. Matias takes over. Who are we? Round of introductions Matias starts Who are we? Applying Static Analysis Matias Madou and Daan Raman, Leuven, Feb 27, 2015 1 At NVISO, I m responsible for the software security practice. Next to the client work, I also leads

More information

CNIT 129S: Securing Web Applications. Ch 12: Attacking Users: Cross-Site Scripting (XSS) Part 1

CNIT 129S: Securing Web Applications. Ch 12: Attacking Users: Cross-Site Scripting (XSS) Part 1 CNIT 129S: Securing Web Applications Ch 12: Attacking Users: Cross-Site Scripting (XSS) Part 1 Attacking Clients Vulnerabilities in browsers May result in session hijacking, unauthorized actions, and disclosure

More information

Web Applications Testing

Web Applications Testing Web Applications Testing Automated testing and verification JP Galeotti, Alessandra Gorla Why are Web applications different Web 1.0: Static content Client and Server side execution Different components

More information

Application Security Testing

Application Security Testing Tstsec - Version: 1 09 July 2016 Application Security Testing Application Security Testing Tstsec - Version: 1 4 days Course Description: We are living in a world of data and communication, in which the

More information

Detecting and Defending Against Security Vulnerabilities for Web 2.0 Applications

Detecting and Defending Against Security Vulnerabilities for Web 2.0 Applications Detecting and Defending Against Security Vulnerabilities for Web 2.0 Applications Ray Lai, Intuit TS-5358 Share experience how to detect and defend security vulnerabilities in Web 2.0 applications using

More information

Web application security: Testing for vulnerabilities

Web application security: Testing for vulnerabilities Web application security: Testing for vulnerabilities Using open source tools to test your site Jeff Orloff Technology Coordinator/Consultant Sequoia Media Services Inc. Skill Level: Intermediate Date:

More information

Cross-Site Scripting

Cross-Site Scripting Cross-Site Scripting (XSS) Computer and Network Security Seminar Fabrice Bodmer (fabrice.bodmer@unifr.ch) UNIFR - Winter Semester 2006-2007 XSS: Table of contents What is Cross-Site Scripting (XSS)? Some

More information

Web Application Worms & Browser Insecurity

Web Application Worms & Browser Insecurity Web Application Worms & Browser Insecurity Mike Shema Welcome Background Hacking Exposed: Web Applications The Anti-Hacker Toolkit Hack Notes: Web Security Currently working at Qualys

More information

Integrating Security into the Application Development Process. Jerod Brennen, CISSP CTO & Principal Security Consultant, Jacadis

Integrating Security into the Application Development Process. Jerod Brennen, CISSP CTO & Principal Security Consultant, Jacadis Integrating Security into the Application Development Process Jerod Brennen, CISSP CTO & Principal Security Consultant, Jacadis Agenda Seek First to Understand Source Code Security AppSec and SQA Analyzing

More information

Preparing for the Cross Site Request Forgery Defense

Preparing for the Cross Site Request Forgery Defense Preparing for the Cross Site Request Forgery Defense Chuck Willis chuck.willis@mandiant.com Black Hat DC 2008 February 20, 2008 About Me Principal Consultant with MANDIANT in Alexandria, VA Full spectrum

More information

Application security testing: Protecting your application and data

Application security testing: Protecting your application and data E-Book Application security testing: Protecting your application and data Application security testing is critical in ensuring your data and application is safe from security attack. This ebook offers

More information

Cracking the Perimeter via Web Application Hacking. Zach Grace, CISSP, CEH zgrace@403labs.com January 17, 2014 2014 Mega Conference

Cracking the Perimeter via Web Application Hacking. Zach Grace, CISSP, CEH zgrace@403labs.com January 17, 2014 2014 Mega Conference Cracking the Perimeter via Web Application Hacking Zach Grace, CISSP, CEH zgrace@403labs.com January 17, 2014 2014 Mega Conference About 403 Labs 403 Labs is a full-service information security and compliance

More information

Complete Cross-site Scripting Walkthrough

Complete Cross-site Scripting Walkthrough Complete Cross-site Scripting Walkthrough Author : Ahmed Elhady Mohamed Email : ahmed.elhady.mohamed@gmail.com website: www.infosec4all.tk blog : www.1nfosec4all.blogspot.com/ [+] Introduction wikipedia

More information

Webapps Vulnerability Report

Webapps Vulnerability Report Tuesday, May 1, 2012 Webapps Vulnerability Report Introduction This report provides detailed information of every vulnerability that was found and successfully exploited by CORE Impact Professional during

More information

Sidste chance for Early Bird! Tilmeld dig før d. 30. juni og spar 4.000 DKK. Læs mere og tilmeld dig på www.gotocon.

Sidste chance for Early Bird! Tilmeld dig før d. 30. juni og spar 4.000 DKK. Læs mere og tilmeld dig på www.gotocon. Sidste chance for Early Bird! Tilmeld dig før d. 30. juni og spar 4.000 DKK. Læs mere og tilmeld dig på www.gotocon.com/aarhus-2012 SIKKERHED I WEBAPPLIKATIONER Anders Skovsgaard Hackavoid anders@hackavoid.dk

More information

ASL IT SECURITY BEGINNERS WEB HACKING AND EXPLOITATION

ASL IT SECURITY BEGINNERS WEB HACKING AND EXPLOITATION ASL IT SECURITY BEGINNERS WEB HACKING AND EXPLOITATION V 2.0 A S L I T S e c u r i t y P v t L t d. Page 1 Overview: Learn the various attacks like sql injections, cross site scripting, command execution

More information

Attacks on Clients: Dynamic Content & XSS

Attacks on Clients: Dynamic Content & XSS Software and Web Security 2 Attacks on Clients: Dynamic Content & XSS (Section 7.1.3 on JavaScript; 7.2.4 on Media content; 7.2.6 on XSS) sws2 1 Recap from last lecture Attacks on web server: attacker/client

More information

Web Application Security. Vulnerabilities, Weakness and Countermeasures. Massimo Cotelli CISSP. Secure

Web Application Security. Vulnerabilities, Weakness and Countermeasures. Massimo Cotelli CISSP. Secure Vulnerabilities, Weakness and Countermeasures Massimo Cotelli CISSP Secure : Goal of This Talk Security awareness purpose Know the Web Application vulnerabilities Understand the impacts and consequences

More information

Øredev 2006. Web application testing using a proxy. Lucas Nelson, Symantec Inc.

Øredev 2006. Web application testing using a proxy. Lucas Nelson, Symantec Inc. Øredev 2006 Web application testing using a proxy Lucas Nelson, Symantec Inc. Agenda What is a proxy? Setting up your environment Pre-login tests Post-login tests Conclusion A man in the middle proxy The

More information

Smashing Web Apps Applying Fuzzing to Web Applications and Web Services. Michael Sutton, Security Evangelist

Smashing Web Apps Applying Fuzzing to Web Applications and Web Services. Michael Sutton, Security Evangelist Smashing Web Apps Applying Fuzzing to Web Applications and Web Services Michael Sutton, Security Evangelist Overview Background Vulnerability discovery methodologies What is fuzzing? Web application fuzzing

More information

Detecting Web Application Vulnerabilities Using Open Source Means. OWASP 3rd Free / Libre / Open Source Software (FLOSS) Conference 27/5/2008

Detecting Web Application Vulnerabilities Using Open Source Means. OWASP 3rd Free / Libre / Open Source Software (FLOSS) Conference 27/5/2008 Detecting Web Application Vulnerabilities Using Open Source Means OWASP 3rd Free / Libre / Open Source Software (FLOSS) Conference 27/5/2008 Kostas Papapanagiotou Committee Member OWASP Greek Chapter conpap@owasp.gr

More information

Web Application Security Payloads. Andrés Riancho Director of Web Security OWASP AppSec USA 2011 - Minneapolis

Web Application Security Payloads. Andrés Riancho Director of Web Security OWASP AppSec USA 2011 - Minneapolis Web Application Security Payloads Andrés Riancho Director of Web Security OWASP AppSec USA 2011 - Minneapolis Topics Short w3af introduction Automating Web application exploitation The problem and how

More information

Security Tools - Hands On

Security Tools - Hands On Security Tools - Hands On SecAppDev 2014 Ken van Wyk, @KRvW! Leuven, Belgium 10-14 February 2014 Caveats and Warnings This is not a sales pitch for any product(s) If you want to talk to a sales person,

More information

Institutionen för datavetenskap

Institutionen för datavetenskap Institutionen för datavetenskap Department of Computer and Information Science Final thesis Generating web applications containing XSS and CSRF vulnerabilities by Gustav Ahlberg LIU-IDA/LITH-EX-A--14/054--SE

More information

Adobe ColdFusion. Secure Profile Web Application Penetration Test. July 31, 2014. Neohapsis 217 North Jefferson Street, Suite 200 Chicago, IL 60661

Adobe ColdFusion. Secure Profile Web Application Penetration Test. July 31, 2014. Neohapsis 217 North Jefferson Street, Suite 200 Chicago, IL 60661 Adobe ColdFusion Secure Profile Web Application Penetration Test July 31, 2014 Neohapsis 217 North Jefferson Street, Suite 200 Chicago, IL 60661 Chicago Dallas This document contains and constitutes the

More information

Agenda. SQL injection review XSS attacks 1/21

Agenda. SQL injection review XSS attacks 1/21 Agenda SQL injection review XSS attacks 1/21 Excerpt from the Debate - Closely relevant to this class "Mine were words, and his was action." "You would be in jail." "When they go low, we go high." "She

More information

Blackbox Reversing of XSS Filters

Blackbox Reversing of XSS Filters Blackbox Reversing of XSS Filters Alexander Sotirov alex@sotirov.net Introduction Web applications are the future Reversing web apps blackbox reversing very different environment and tools Cross-site scripting

More information

Web Security Everything we know is wrong

Web Security Everything we know is wrong Web Security Everything we know is wrong Eoin Keary CTO BCCRISKADVISORY.COM OWASP GLOBAL BOARD MEMBER Architect of edgescan.com ACKED 3 Target's December 19 disclosure 100+ million payment cards Snapchat:

More information

Client-Side Protection Against DOM-based XSS Done Right (TM) Ben Stock, Sebastian Lekies, Martin Johns

Client-Side Protection Against DOM-based XSS Done Right (TM) Ben Stock, Sebastian Lekies, Martin Johns Client-Side Protection Against DOM-based XSS Done Right (TM) Ben Stock, Sebastian Lekies, Martin Johns About us Ben Stock, Sebastian Lekies, Martin Johns Security Researcher at Uni Erlangen, Uni Bochum

More information

Are AJAX Applications Vulnerable to Hack Attacks?

Are AJAX Applications Vulnerable to Hack Attacks? Are AJAX Applications Vulnerable to Hack Attacks? The importance of Securing AJAX Web Applications This paper reviews AJAX technologies with specific reference to JavaScript and briefly documents the kinds

More information

CS 558 Internet Systems and Technologies

CS 558 Internet Systems and Technologies CS 558 Internet Systems and Technologies Dimitris Deyannis deyannis@csd.uoc.gr 881 Heat seeking Honeypots: Design and Experience Abstract Compromised Web servers are used to perform many malicious activities.

More information

Web Application Vulnerability Scanning. VITA Commonwealth Security & Risk Management. April 8, 2016

Web Application Vulnerability Scanning. VITA Commonwealth Security & Risk Management. April 8, 2016 Web Application Vulnerability Scanning VITA Commonwealth Security & Risk Management April 8, 2016 1 Terms Threat A thing that can cause harm Vulnerability A flaw that can be exploited to cause bad things

More information

Web Application Hacking (Penetration Testing) 5-day Hands-On Course

Web Application Hacking (Penetration Testing) 5-day Hands-On Course Web Application Hacking (Penetration Testing) 5-day Hands-On Course Web Application Hacking (Penetration Testing) 5-day Hands-On Course Course Description Our web sites are under attack on a daily basis

More information

WebGoat for testing your Application Security tools

WebGoat for testing your Application Security tools WebGoat for testing your Application Security tools NAISG-DFW February 28 th, 2012 Michael A Ortega, CISSP CEH CISM GCFA Sr Application Security Professional IBM Security Systems 312.523.1538 maortega@us.ibm.com

More information

ASL IT Security Advanced Web Exploitation Kung Fu V2.0

ASL IT Security Advanced Web Exploitation Kung Fu V2.0 ASL IT Security Advanced Web Exploitation Kung Fu V2.0 A S L I T S e c u r i t y P v t L t d. Page 1 Overview: There is a lot more in modern day web exploitation than the good old alert( xss ) and union

More information

Aiming at Higher Network Security Levels Through Extensive PENETRATION TESTING. Anestis Bechtsoudis. http://bechtsoudis.com abechtsoudis (at) ieee.

Aiming at Higher Network Security Levels Through Extensive PENETRATION TESTING. Anestis Bechtsoudis. http://bechtsoudis.com abechtsoudis (at) ieee. Aiming at Higher Network Security Levels Through Extensive PENETRATION TESTING Anestis Bechtsoudis http://bechtsoudis.com abechtsoudis (at) ieee.org Athena Summer School 2011 Course Goals Highlight modern

More information

Criteria for web application security check. Version 2015.1

Criteria for web application security check. Version 2015.1 Criteria for web application security check Version 2015.1 i Content Introduction... iii ISC- P- 001 ISC- P- 001.1 ISC- P- 001.2 ISC- P- 001.3 ISC- P- 001.4 ISC- P- 001.5 ISC- P- 001.6 ISC- P- 001.7 ISC-

More information

Chapter 1 Web Application (In)security 1

Chapter 1 Web Application (In)security 1 Introduction xxiii Chapter 1 Web Application (In)security 1 The Evolution of Web Applications 2 Common Web Application Functions 4 Benefits of Web Applications 5 Web Application Security 6 "This Site Is

More information

Cross Site Scripting in Joomla Acajoom Component

Cross Site Scripting in Joomla Acajoom Component Whitepaper Cross Site Scripting in Joomla Acajoom Component Vandan Joshi December 2011 TABLE OF CONTENTS Abstract... 3 Introduction... 3 A Likely Scenario... 5 The Exploit... 9 The Impact... 12 Recommended

More information

A Tale of the Weaknesses of Current Client-side XSS Filtering

A Tale of the Weaknesses of Current Client-side XSS Filtering A Tale of the Weaknesses of Current Client-side XSS Filtering Sebastian Lekies (@sebastianlekies), Ben Stock (@kcotsneb) and Martin Johns (@datenkeller) Attention hackers! These slides are preliminary!

More information

Introduction to Web Application Security. Microsoft CSO Roundtable Houston, TX. September 13 th, 2006

Introduction to Web Application Security. Microsoft CSO Roundtable Houston, TX. September 13 th, 2006 Introduction to Web Application Security Microsoft CSO Roundtable Houston, TX September 13 th, 2006 Overview Background What is Application Security and Why Is It Important? Examples Where Do We Go From

More information

JavaScript static security analysis made easy with JSPrime

JavaScript static security analysis made easy with JSPrime JavaScript static security analysis made easy with JSPrime Nishant Das Patnaik & Sarathi Sabyasachi Sahoo nishant.dp@gmail.com & sarathisahoo@gmail.com JavaScript is the lingua-franca of Web 2.0 and, recently,

More information

1000 Projects later. Security Code Scans at SAP

1000 Projects later. Security Code Scans at SAP 1000 Projects later Security Code Scans at SAP About Us Ruediger Bachmann is a Development Architect at SAP AG working, as member of the central code analyses team, in the areas application security and

More information

Out of the Fire - Adding Layers of Protection When Deploying Oracle EBS to the Internet

Out of the Fire - Adding Layers of Protection When Deploying Oracle EBS to the Internet Out of the Fire - Adding Layers of Protection When Deploying Oracle EBS to the Internet March 8, 2012 Stephen Kost Chief Technology Officer Integrigy Corporation Phil Reimann Director of Business Development

More information

Security Research Advisory IBM inotes 9 Active Content Filtering Bypass

Security Research Advisory IBM inotes 9 Active Content Filtering Bypass Security Research Advisory IBM inotes 9 Active Content Filtering Bypass Table of Contents SUMMARY 3 VULNERABILITY DETAILS 3 TECHNICAL DETAILS 4 LEGAL NOTICES 7 Active Content Filtering Bypass Advisory

More information

Detection of DOM-based Cross-Site Scripting by Analyzing Dynamically Extracted Scripts

Detection of DOM-based Cross-Site Scripting by Analyzing Dynamically Extracted Scripts Detection of DOM-based Cross-Site Scripting by Analyzing Dynamically Extracted Scripts Suman Saha 1, Shizhen Jin 2,3 and Kyung-Goo Doh 3 1 LIP6-Regal, France Suman.Saha@lip6.fr 2 GTOne, Seoul, Korea jinshzh@gmail.com

More information

Next Generation Clickjacking

Next Generation Clickjacking Next Generation Clickjacking New attacks against framed web pages Black Hat Europe, 14 th April 2010 Paul Stone paul.stone@contextis.co.uk Coming Up Quick Introduction to Clickjacking Four New Cross-Browser

More information

HTTP Parameter Pollution. OWASP EU09 Poland. The OWASP Foundation. Luca Carettoni Independent Researcher luca.carettoni@ikkisoft.

HTTP Parameter Pollution. OWASP EU09 Poland. The OWASP Foundation. Luca Carettoni Independent Researcher luca.carettoni@ikkisoft. HTTP Parameter Pollution Luca Carettoni Independent Researcher luca.carettoni@ikkisoft.com OWASP EU09 Poland Stefano di Paola CTO @ Minded Security stefano.dipaola@mindedsecurity.com Copyright The OWASP

More information

A Multi agent Scanner to Detect Stored XSS Vulnerabilities

A Multi agent Scanner to Detect Stored XSS Vulnerabilities A Multi agent Scanner to Detect Stored XSS Vulnerabilities E. Galán, A. Alcaide, A. Orfila, J. Blasco University Carlos III of Madrid, UC3M Leganés, Spain {edgalan,aalcaide,adiaz,jbalis}@inf.uc3m.es Abstract

More information

Secure Web Application Coding Team Introductory Meeting December 1, 2005 1:00 2:00PM Bits & Pieces Room, Sansom West Room 306 Agenda

Secure Web Application Coding Team Introductory Meeting December 1, 2005 1:00 2:00PM Bits & Pieces Room, Sansom West Room 306 Agenda Secure Web Application Coding Team Introductory Meeting December 1, 2005 1:00 2:00PM Bits & Pieces Room, Sansom West Room 306 Agenda 1. Introductions for new members (5 minutes) 2. Name of group 3. Current

More information

Penetration Testing Lessons Learned. Security Research

Penetration Testing Lessons Learned. Security Research 1 Penetration Testing Lessons Learned Security Research 2 Who am I? CTO at Immunity, Inc. Privately held information security company Consulting Training Specialized Security Products CANVAS SILICA Based

More information

OWASP Top Ten Tools and Tactics

OWASP Top Ten Tools and Tactics OWASP Top Ten Tools and Tactics Russ McRee Copyright 2012 HolisticInfoSec.org SANSFIRE 2012 10 JULY Welcome Manager, Security Analytics for Microsoft Online Services Security & Compliance Writer (toolsmith),

More information

HOD of Dept. of CSE & IT. Asst. Prof., Dept. Of CSE AIET, Lko, India. AIET, Lko, India

HOD of Dept. of CSE & IT. Asst. Prof., Dept. Of CSE AIET, Lko, India. AIET, Lko, India Volume 5, Issue 12, December 2015 ISSN: 2277 128X International Journal of Advanced Research in Computer Science and Software Engineering Research Paper Available online at: www.ijarcsse.com Investigation

More information

Universal XSS via IE8s XSS Filters

Universal XSS via IE8s XSS Filters Universal XSS via IE8s XSS Filters the sordid tale of a wayward hash sign slides: http://p42.us/ie8xss/ About Us Eduardo Vela Nava aka sirdarckcat http://sirdarckcat.net http://twitter.com/sirdarckcat

More information