XSS-GUARD : Precise Dynamic Prevention of Cross Site Scripting (XSS) Attacks
|
|
|
- Noreen Wilkerson
- 8 years ago
- Views:
Transcription
1 XSS-GUARD : Precise Dynamic Prevention of Cross Site Scripting (XSS) Attacks Prithvi Bisht ( Joint work with : V.N. Venkatakrishnan Systems and Internet Security Laboratory Department of Computer Science University of Illinois, Chicago USA
2 XSS attacks : number one threat CVE Vulnerabilities 2004 CVE Vulnerabilities 2006 XSS 10.9% XSS 21.5% Others 89.1% Others 78.5% and the trend continues... Second half of 2007 : 80% of all attacks were XSS January 2007 : 70% web applications are vulnerable [source : Simple attacks lucrative targets <script> alert( xss );</script>
3 A typical XSS attack <html>... [evilcode]... </html> Vulnerable bank web application name=[evilcode] Claim prize Response... evilcode executed!... Client browser Attacker controlled code can steal sensitive information or perform malicious operations.
4 Objective Vulnerable web application Automated Transformation Safe web application Automated prevention of XSS attacks : server side Robust against subtle attacks Efficient
5 Outline of this talk Introduction Web application transformation technique Robust script identification at server side XSS-GUARD Examples Evaluation results Related work and summary
6 HTML : A web application s view User Input name= xyz write( hi ) write( name ) write( ) Web application hi xyz HTML Output statements not influenced by user inputs produce programmer intended script code/data Others may produce unintended script code Page generated by output statements in a control path. Web application s view : intended regions & others Other regions could lead to unintended script code.
7 HTML : A browser s view name= [evilcode] write( hi ) write( name ) write( ) Web application hi [evilcode] HTML data code code Browser Browser does not differentiate between injected and programmer intended scripts. Browser s view : a collection of script code & data.
8 A complete view intended hi data Web application other intended [evilcode] code code Browser Web application view Knows intentions HTML Browser view Knows scripts An effective defense would require both these views!
9 Idea If a web application knows intended scripts and all the scripts (including injected) for a generated HTML, it can remove unintended scripts. Question : How to compute intended scripts?
10 Computing intended code write( hi realpage, ) hi ) write( shadowpage, hi ) write( realpage, name ) name ) write( shadowpage, name_c ) write( realpage, ) ) write( shadowpage, ) Web application name= xyz name_c = aaa hi xyz hi aaa data data code data data code Replicate output statements uninfluenced by user inputs to create shadow. Other output statements replicated but act on benign inputs (as intended). Real HTML Shadow HTML
11 Computing intended code cont. name = [xsscode] name_c = aaaaaaaa write( realpage, hi ) write( shadowpage, hi ) write( realpage, name ) write( shadowpage, name_c ) write( realpage, ) write( shadowpage, ) hi [xsscode] hi aaaaaaa data code code data data code Real HTML Shadow HTML Web application Real contains injected script, but shadow retains only intended script. For a real, its shadow has intended scripts.
12 Shadow captures intended code Real HTML = output statements with user inputs Shadow HTML = mirror above output statements with benign user inputs Transform web application to create shadow (intended) for each real Define benign input for each real input. Mirror the actual input processing on benign input. Replicate output statements with above processed inputs. For details on transformation, please refer to CANDID: Preventing SQL Injection Attacks using Dynamic Candidate Evaluations, S. Bandhakavi, P. Bisht, P. Madhusudan, V.N. Venkatakrishnan, ACM CCS 2007, submitted to ACM TISSEC 2008
13 Idea Revisited If a web application knows intended scripts and all scripts (including injected) for a generated HTML, it can remove unintended scripts. Question : How to compute intended scripts? - By computing shadow s. Question : How can application identify all scripts? What about filters?
14 Filters effective first layer...but lack context Ineffective against subtle cases MySpace Samy worm used eval( inner + HTML ) to evade innerhtml filter. Large attack surface tags and URI schemes, attributes, event handlers, alternate encoding... Filters analyze inputs without their context of use. <scri pt> OK OK <script> filter write( <scri ) write( pt> ) Alternate scheme: find scripts in output (HTML ) Inputs embedded in context of use in HTML <script> HTML Not OK
15 How Firefox identifies scripts? hi xyz Lexical Analysis HTML Tag based processing HTML Code identification scheme Browser Lexical analysis component identifies tokens. Code Execution Module HTML tag based processing identifies scripts in: External resource download e.g., <script src=...> Inlined scripts/event handlers e.g., <body onload=...> URI schemes that can have scripts e.g., javascript/data
16 Leveraging browser s code identification mechanism A browser performs precise identification of scripts. Robust alternate encodings large attack surface Our approach leverages this at the server side. hi xyz Modified Lexical Analysis Modified HTML Tag based processing Real HTML contains all scripts identifies all scripts Modifications record all scripts in real HTML.
17 XSS-GUARD : End to - End Transformed web application HTTP request... real... aaaaaa shadow... real... aaaaaa shadow... Verified real Removal of injected code Safe web application
18 XSS-GUARD : intended scripts name = xyz name_c = aaa write( realpage, hi ) write( shadowpage, hi ) write( realpage, name ) write( shadowpage, name_c ) write( realpage, ) write( shadowpage, ) Web application hi xyz hi aaa code code Real Shadow All intended scripts in real have equivalent scripts in shadow.
19 XSS-GUARD : Attack prevention Web application name = <script>...</script> name_c = aaaaaaaaaaaaaaaaa write( realpage, hi ) write( shadowpage, hi ) write( realpage, name ) write( shadowpage, name_c ) write( realpage, ) write( shadowpage, ) Real hi <script> </script> hi aaaaaaaaaaaaaaaa Shadow Injected script in real does not have equivalent script in shadow, and is removed. code data
20 XSS-GUARD : Subtle attack case web application name = aa;evil( ); name_c = aaaaaaaaaa write( realpage, <script>x = ) write( shadowpage, <script>x= ) write( realpage, name ) write( shadowpage, name_c ) write( realpage, </script> ) write( shadowpage, </script> ) Real <script> x = aa; evil(...);</script> <script> x = aaaaaaaa</script> Any unintended addition to existing scripts is successfully prevented. Shadow code code
21 Effectiveness Evaluation Against real world exploits CVE /5121 JSPWiki defended CVE Tomcat HTML Manager defended CVE Tomcat Host Manager defended CVE /3384/2449 CVE Tomcat Example Web Applications defended Defended 32 applicable exploits out of 92 : R. Hansen XSS cheatsheet. False negatives : non-firefox attacks Current implementation can be extended initial experiments : Defended 35 / 56 non-firefox attacks
22 Performance Evaluation Performance overhead (response time) Exploits from CVE 5 24 % Varied response sizes (1KB 75KB) Parse tree comparison of scripts (1 5) 3 14 % % Parse tree comparison is rarely done : in presence of attacks, or scripts embedding user inputs. These numbers indicate worst case performance Negligible network latency in experiments (LAN setup) Can be further improved by limiting the transformation to only relevant statements.
23 Some Related Work Vulnerability analysis: find vulnerable source-sink pairs e.g., saner: Livshits et al. Usenix 2005, Pixy N. Jovanovic et al. S&P2006, Y. Xie et al. Usenix 2006, D. Balzarotti et al. CCS Useful but limited to detection Server side solutions: filter based or track taint & disallow at sink : W. Xu et al. Usenix 2006, Centralized defense but do not know all scripts Client side solutions: Firewall like mechanisms to prevent malicious actions at client Noxes E. Kirda, et al. SAC 2006, P. Vogt et al. NDSS 2007 User controlled protection but do not know intended scripts Client-Server collaborative solutions: Clients enforce application specified policies BEEP T. Jim, et al. WWW 2007, Tahoma R. Cox et al. S&P 2006, Browsershield C. Reis et al. OSDI 2006 Can determine intended and all scripts but deployment issues
24 Contributions and future work A robust server side solution to prevent XSS attacks. A mechanism to compute programmer intended code, useful in defending other code injection attacks. Leveraged browser s mechanisms at server side. Thanks for your attention! Questions?
25 Backup Slides
26 Taint vs Candidate evaluations Taint tracking captures trust notion. Candidate computation captures intended structure. We found taint tracking and limiting tainted constructs in parse trees, a very powerful idea. There are no differences in effectiveness but there are subtle differences X = taintedx taintedx ; X will be treated as tainted : false positive? X_c = taintedx_c taintedx_c ; X_c will contain equivalent structure to X.
27 Miscellaneous examples Non-Firefox construct based false negative <IMG SRC='vbscript:msgbox("XSS")'> Firefox does not understand vbscript URIs. Firefox quirk based exploit <script/xss src= > </script>
28 Changes done to handle non-firefox quirks Others (3) Attacks based on src attributes (2) <XML SRC="xsstest.xml" ID=I></XML> <SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN> <SCRIPT a=`>` SRC=" Javascript / data URI scheme based exploits (30) <img src= javascript:alert( XSS ) >Is ignored in Firefox, but valid in other browsers. We forced all the attributes to be parsed irrespective of Firefox applicability.
29 Candidate Transformation
30 Performance numbers (detailed)
31 Related work Filters : don t have adequate context Output encoding : may forbid all HTML Taint : Effective, focuses on taintedness, rather than semantics Server side solutions : Client side solutions : Firewall like behavior, may disallow legitimate scripts, or allow attacks on trusted servers. Server-client side solutions
32 Real and shadow comparison with offsets
33 False positive in subtle case
34 Example with existing filters prevent attack
XSS-GUARD: Precise Dynamic Prevention of Cross-Site Scripting Attacks
XSS-GUARD: Precise Dynamic Prevention of Cross-Site Scripting Attacks Prithvi Bisht and V.N. Venkatakrishnan Systems and Internet Security Lab, Department of Computer Science, University of Illinois, Chicago
Document Structure Integrity: A Robust Basis for Cross-Site Scripting Defense
Document Structure Integrity: A Robust Basis for Cross-Site Scripting Defense Yacin Nadji Illinois Institute Of Technology Prateek Saxena UC Berkeley Dawn Song UC Berkeley 1 A Cross-Site Scripting Attack
Cross Site Scripting Prevention
Project Report CS 649 : Network Security Cross Site Scripting Prevention Under Guidance of Prof. Bernard Menezes Submitted By Neelamadhav (09305045) Raju Chinthala (09305056) Kiran Akipogu (09305074) Vijaya
Protection, Usability and Improvements in Reflected XSS Filters
Protection, Usability and Improvements in Reflected XSS Filters Riccardo Pelizzi System Security Lab Department of Computer Science Stony Brook University May 2, 2012 1 / 19 Riccardo Pelizzi Improvements
A Tale of the Weaknesses of Current Client-Side XSS Filtering
Call To Arms: A Tale of the Weaknesses of Current Client-Side XSS Filtering Martin Johns, Ben Stock, Sebastian Lekies About us Martin Johns, Ben Stock, Sebastian Lekies Security Researchers at SAP, Uni
Towards Client-side HTML Security Policies
Towards Client-side HTML Security Policies Joel Weinberger University of California, Berkeley Adam Barth Google Dawn Song University of California, Berkeley Abstract With the proliferation of content rich
Acunetix Website Audit. 5 November, 2014. Developer Report. Generated by Acunetix WVS Reporter (v8.0 Build 20120808)
Acunetix Website Audit 5 November, 2014 Developer Report Generated by Acunetix WVS Reporter (v8.0 Build 20120808) Scan of http://filesbi.go.id:80/ Scan details Scan information Starttime 05/11/2014 14:44:06
HOD of Dept. of CSE & IT. Asst. Prof., Dept. Of CSE AIET, Lko, India. AIET, Lko, India
Volume 5, Issue 12, December 2015 ISSN: 2277 128X International Journal of Advanced Research in Computer Science and Software Engineering Research Paper Available online at: www.ijarcsse.com Investigation
A Tale of the Weaknesses of Current Client-side XSS Filtering
A Tale of the Weaknesses of Current Client-side XSS Filtering Sebastian Lekies (@sebastianlekies), Ben Stock (@kcotsneb) and Martin Johns (@datenkeller) Attention hackers! These slides are preliminary!
A Server and Browser-Transparent CSRF Defense for Web 2.0 Applications. Slides by Connor Schnaith
A Server and Browser-Transparent CSRF Defense for Web 2.0 Applications Slides by Connor Schnaith Cross-Site Request Forgery One-click attack, session riding Recorded since 2001 Fourth out of top 25 most
Recommended Practice Case Study: Cross-Site Scripting. February 2007
Recommended Practice Case Study: Cross-Site Scripting February 2007 iii ACKNOWLEDGEMENT This document was developed for the U.S. Department of Homeland Security to provide guidance for control system cyber
Web Application Security
Web Application Security John Zaharopoulos ITS - Security 10/9/2012 1 Web App Security Trends Web 2.0 Dynamic Webpages Growth of Ajax / Client side Javascript Hardening of OSes Secure by default Auto-patching
End-to-end Web Application Security
End-to-end Web Application Security Úlfar Erlingsson Benjamin Livshits Microsoft Research Yinglian Xie Abstract Web applications are important, ubiquitous distributed systems whose current security relies
Prevent Cross-site Request Forgery: PCRF
Prevent Cross-site Request Forgery: PCRF Sooel Son University of Texas, Austin samuel@cs.utexas.edu Abstract CSRF attacks are one of the most prevalent and dangerous web threats at the level of XSS, SQL
A Multi agent Scanner to Detect Stored XSS Vulnerabilities
A Multi agent Scanner to Detect Stored XSS Vulnerabilities E. Galán, A. Alcaide, A. Orfila, J. Blasco University Carlos III of Madrid, UC3M Leganés, Spain {edgalan,aalcaide,adiaz,jbalis}@inf.uc3m.es Abstract
AMIT KLEIN, FORMER DIRECTOR OF SECURITY AND RESEARCH, SANCTUM
AMIT KLEIN, FORMER DIRECTOR OF SECURITY AND RESEARCH, SANCTUM A whitepaper from Watchfire TABLE OF CONTENTS Introduction 1 Full Explanation The XSS Technique. 1 Scope and Feasibility.. 3 Variations on
Saner: Composing Static and Dynamic Analysis to Validate Sanitization in Web Applications
Saner: Composing Static and Dynamic Analysis to Validate Sanitization in Web Applications Davide Balzarotti, Marco Cova, Vika Felmetsger, Nenad Jovanovic, Engin Kirda, Christopher Kruegel, and Giovanni
Understanding Cross Site Scripting
Understanding Cross Site Scripting Hardik Shah Understanding cross site scripting attacks Introduction: there are many techniques which a intruder can use to compromise the webapplications. one such techniques
Robust Defence against XSS through Context Free Grammar
Robust Defence against XSS through Context Free Grammar 1 Divya Rishi Sahu, 2 Deepak Singh Tomar 1,2 Dept. of CSE, MANIT, Bhopal, MP, India Abstract JavaScript is one of the world s most widely adopted
Adobe Systems Incorporated
Adobe Connect 9.2 Page 1 of 8 Adobe Systems Incorporated Adobe Connect 9.2 Hosted Solution June 20 th 2014 Adobe Connect 9.2 Page 2 of 8 Table of Contents Engagement Overview... 3 About Connect 9.2...
Exploitation of Cross-Site Scripting (XSS) Vulnerability on Real World Web Applications and its Defense
Exploitation of Cross-Site Scripting (XSS) Vulnerability on Real World Web Applications and its Defense Shashank Gupta Lecturer in Department of Information Technology, Model Institute of Engineering and
Cross-Site Scripting
Cross-Site Scripting (XSS) Computer and Network Security Seminar Fabrice Bodmer (fabrice.bodmer@unifr.ch) UNIFR - Winter Semester 2006-2007 XSS: Table of contents What is Cross-Site Scripting (XSS)? Some
Project 2: Web Security Pitfalls
EECS 388 September 19, 2014 Intro to Computer Security Project 2: Web Security Pitfalls Project 2: Web Security Pitfalls This project is due on Thursday, October 9 at 6 p.m. and counts for 8% of your course
CSE598i - Web 2.0 Security OWASP Top 10: The Ten Most Critical Web Application Security Vulnerabilities
CSE598i - Web 2.0 Security OWASP Top 10: The Ten Most Critical Web Application Security Vulnerabilities Thomas Moyer Spring 2010 1 Web Applications What has changed with web applications? Traditional applications
Watch What You Write: Preventing Cross-Site Scripting by Observing Program Output
Watch What You Write: Preventing Cross-Site Scripting by Observing Program Output Matias Madou, Edward Lee, Jacob West and Brian Chess Fortify Software 2215 Bridgepointe Pkwy, Suite 400 San Mateo, CA,
Reliable Mitigation of DOM-based XSS
Intro XSS Implementation Evaluation Q&A Reliable Mitigation of DOM-based XSS Tobias Mueller 2014-09-07 1 / 39 Intro XSS Implementation Evaluation Q&A About me The results Motivation about:me MSc. cand.
A Novel Frame Work to Detect Malicious Attacks in Web Applications
Technology, Volume-2, Issue-1, January-March, 2014, pp. 23-28, IASTER 2014, www.iaster.com, Online:2347-5099, Print:2348-0009 A Novel Frame Work to Detect Malicious Attacks in Web Applications N. Jayakanthan
Defending against XSS,CSRF, and Clickjacking David Bishop
Defending against XSS,CSRF, and Clickjacking David Bishop University of Tennessee Chattanooga ABSTRACT Whenever a person visits a website, they are running the risk of falling prey to multiple types of
Detection of DOM-based Cross-Site Scripting by Analyzing Dynamically Extracted Scripts
Detection of DOM-based Cross-Site Scripting by Analyzing Dynamically Extracted Scripts Suman Saha 1, Shizhen Jin 2,3 and Kyung-Goo Doh 3 1 LIP6-Regal, France Suman.Saha@lip6.fr 2 GTOne, Seoul, Korea jinshzh@gmail.com
Hunting Cross-Site Scripting Attacks in the Network
Hunting Cross-Site Scripting Attacks in the Network Elias Athanasopoulos, Antonis Krithinakis, and Evangelos P. Markatos Institute of Computer Science Foundation for Research and Technology - Hellas N.
Check list for web developers
Check list for web developers Requirement Yes No Remarks 1. Input Validation 1.1) Have you done input validation for all the user inputs using white listing and/or sanitization? 1.2) Does the input validation
Document Structure Integrity: A Robust Basis for Cross-site Scripting Defense
Document Structure Integrity: A Robust Basis for Cross-site Scripting Defense Yacin Nadji Illinois Institute of Technology Chicago, IL, USA yacin@ir.iit.edu Prateek Saxena University of California Berkeley,
Attacks on Clients: Dynamic Content & XSS
Software and Web Security 2 Attacks on Clients: Dynamic Content & XSS (Section 7.1.3 on JavaScript; 7.2.4 on Media content; 7.2.6 on XSS) sws2 1 Recap from last lecture Attacks on web server: attacker/client
Bayesian Classification for SQL Injection Detection
Bayesian Classification for SQL Injection Detection Brandon Skari College of Engineering and Applied Science University of Wyoming Laramie, Wyoming 82070 brandon.skari@gmail.com April 6, 2011 Overview
Where every interaction matters.
Where every interaction matters. Peer 1 Vigilant Web Application Firewall Powered by Alert Logic The Open Web Application Security Project (OWASP) Top Ten Web Security Risks and Countermeasures White Paper
Defeating Script Injection Attacks with Browser-Enforced Embedded Policies
Defeating Script Injection Attacks with Browser-Enforced Embedded Policies Trevor Jim AT&T Labs Research Nikhil Swamy University of Maryland, College Park Michael Hicks University of Maryland, College
L-WMxD: Lexical based Webmail XSS Discoverer
The First International Workshop on Security in Computers, Networking and Communications LWMxD: Lexical based Webmail XSS Discoverer Zhushou Tang, Haojin Zhu, Zhenfu Cao, Shuai Zhao Department of Computer
Client vs. Server Implementations of Mitigating XSS Security Threats on Web Applications
Journal of Basic and Applied Engineering Research pp. 50-54 Krishi Sanskriti Publications http://www.krishisanskriti.org/jbaer.html Client vs. Server Implementations of Mitigating XSS Security Threats
Introduction to Computer Security
Introduction to Computer Security Web Application Security Pavel Laskov Wilhelm Schickard Institute for Computer Science Modern threat landscape The majority of modern vulnerabilities are found in web
Bank Hacking Live! Ofer Maor CTO, Hacktics Ltd. ATC-4, 12 Jun 2006, 4:30PM
Bank Hacking Live! Ofer Maor CTO, Hacktics Ltd. ATC-4, 12 Jun 2006, 4:30PM Agenda Introduction to Application Hacking Demonstration of Attack Tool Common Web Application Attacks Live Bank Hacking Demonstration
Blackbox Reversing of XSS Filters
Blackbox Reversing of XSS Filters Alexander Sotirov alex@sotirov.net Introduction Web applications are the future Reversing web apps blackbox reversing very different environment and tools Cross-site scripting
A DYNAMIC TOOL FOR DETECTION OF XSS ATTACKS IN A REAL-TIME ENVIRONMENT
A DYNAMIC TOOL FOR DETECTION OF XSS ATTACKS IN A REAL-TIME ENVIRONMENT K. G. Maheswari 1 and R. Anita 2 1 Department of MCA, Institute of Road and Transport Technology, Anna University, Erode, Tamil Nadu,
CHAPTER 5 INTELLIGENT TECHNIQUES TO PREVENT SQL INJECTION ATTACKS
66 CHAPTER 5 INTELLIGENT TECHNIQUES TO PREVENT SQL INJECTION ATTACKS 5.1 INTRODUCTION In this research work, two new techniques have been proposed for addressing the problem of SQL injection attacks, one
RIPS - A static source code analyser for vulnerabilities in PHP scripts
RIPS - A static source code analyser for vulnerabilities in PHP scripts Johannes Dahse 1 Introduction The amount of websites have increased rapidly during the last years. While websites consisted mostly
Stopping SQL Injection and. Manoranjan (Mano) Paul. Track: Operating Systems Security - Are we there yet?
Stopping SQL Injection and Crossing Over Cross-site Scripting Track: Operating Systems Security - Are we there yet? Manoranjan (Mano) Paul CISSP, MCSD, MCAD, CompTIA Network+, ECSA/LPT Catalyst(s) SQL
Is Drupal secure? A high-level perspective on web vulnerabilities, Drupal s solutions, and how to maintain site security
Is Drupal secure? A high-level perspective on web vulnerabilities, Drupal s solutions, and how to maintain site security Presented 2009-05-29 by David Strauss Thinking Securely Security is a process, not
Secure Coding. External App Integrations. Tim Bach Product Security Engineer salesforce.com. Astha Singhal Product Security Engineer salesforce.
Secure Coding External App Integrations Astha Singhal Product Security Engineer salesforce.com Tim Bach Product Security Engineer salesforce.com Safe Harbor Safe harbor statement under the Private Securities
Cross Site Scripting (XSS) and PHP Security. Anthony Ferrara NYPHP and OWASP Security Series June 30, 2011
Cross Site Scripting (XSS) and PHP Security Anthony Ferrara NYPHP and OWASP Security Series June 30, 2011 What Is Cross Site Scripting? Injecting Scripts Into Otherwise Benign and Trusted Browser Rendered
A Survey on Detection Techniques to Prevent Cross-Site Scripting Attacks on Current Web Applications
A Survey on Detection Techniques to Prevent Cross-Site Scripting Attacks on Current Web Applications Joaquin Garcia-Alfaro 1 and Guillermo Navarro-Arribas 2 1 Universitat Oberta de Catalunya, Rambla Poble
Automatic vs. Manual Code Analysis
Automatic vs. Manual Code Analysis 2009-11-17 Ari Kesäniemi Senior Security Architect Nixu Oy ari.kesaniemi@nixu.com Copyright The Foundation Permission is granted to copy, distribute and/or modify this
Application Security Testing. Erez Metula (CISSP), Founder Application Security Expert ErezMetula@AppSec.co.il
Application Security Testing Erez Metula (CISSP), Founder Application Security Expert ErezMetula@AppSec.co.il Agenda The most common security vulnerabilities you should test for Understanding the problems
What about MongoDB? can req.body.input 0; var date = new Date(); do {curdate = new Date();} while(curdate-date<10000)
Security What about MongoDB? Even though MongoDB doesn t use SQL, it can be vulnerable to injection attacks db.collection.find( {active: true, $where: function() { return obj.credits - obj.debits < req.body.input;
Detect and Sanitise Encoded Cross-Site Scripting and SQL Injection Attack Strings Using a Hash Map
Detect and Sanitise Encoded Cross-Site Scripting and SQL Injection Attack Strings Using a Hash Map Erwin Adi and Irene Salomo School of Computer Science BINUS International BINUS University, Indonesia
Towards More Security in Data Exchange
Towards More Security in Data Exchange Defining Unparsers with Context-Sensitive Encoders for Context-Free Grammars Lars Hermerschmidt, Stephan Kugelmann, Bernhard Rumpe Software http://www.se-rwth.de/
RIA SECURITY TECHNOLOGY
RIA SECURITY TECHNOLOGY Ulysses Wang Security Researcher, Websense Hermes Li Security Researcher, Websense 2009 Websense, Inc. All rights reserved. Agenda RIA Introduction Flash Security Attack Vectors
Web Application Firewall Profiling and Evasion. Michael Ritter Cyber Risk Services Deloitte
Web Application Firewall Profiling and Evasion Michael Ritter Cyber Risk Services Deloitte Content 1. Introduction 2. WAF Basics 3. Identifying a WAF 4. WAF detection tools 5. WAF bypassing methods 6.
External Network & Web Application Assessment. For The XXX Group LLC October 2012
External Network & Web Application Assessment For The XXX Group LLC October 2012 This report is solely for the use of client personal. No part of it may be circulated, quoted, or reproduced for distribution
Bug Report. Date: March 19, 2011 Reporter: Chris Jarabek (cjjarabe@ucalgary.ca)
Bug Report Date: March 19, 2011 Reporter: Chris Jarabek (cjjarabe@ucalgary.ca) Software: Kimai Version: 0.9.1.1205 Website: http://www.kimai.org Description: Kimai is a web based time-tracking application.
Advanced Web Technology 10) XSS, CSRF and SQL Injection 2
Berner Fachhochschule, Technik und Informatik Advanced Web Technology 10) XSS, CSRF and SQL Injection Dr. E. Benoist Fall Semester 2010/2011 Table of Contents Cross Site Request Forgery - CSRF Presentation
Adobe ColdFusion. Secure Profile Web Application Penetration Test. July 31, 2014. Neohapsis 217 North Jefferson Street, Suite 200 Chicago, IL 60661
Adobe ColdFusion Secure Profile Web Application Penetration Test July 31, 2014 Neohapsis 217 North Jefferson Street, Suite 200 Chicago, IL 60661 Chicago Dallas This document contains and constitutes the
Prevention of Cross-Site Scripting Attacks on Current Web Applications
Prevention of Cross-Site Scripting Attacks on Current Web Applications Joaquin Garcia-Alfaro 1 and Guillermo Navarro-Arribas 2 1 Universitat Oberta de Catalunya, Rambla Poble Nou 156, 08018 Barcelona -
Security Model for the Client-Side Web Application Environments
Security Model for the Client-Side Web Application Environments May 24, 2007 Sachiko Yoshihama, Naohiko Uramoto, Satoshi Makino, Ai Ishida, Shinya Kawanaka, and Frederik De Keukelaere IBM Tokyo Research
WEB SECURITY CONCERNS THAT WEB VULNERABILITY SCANNING CAN IDENTIFY
WEB SECURITY CONCERNS THAT WEB VULNERABILITY SCANNING CAN IDENTIFY www.alliancetechpartners.com WEB SECURITY CONCERNS THAT WEB VULNERABILITY SCANNING CAN IDENTIFY More than 70% of all websites have vulnerabilities
Finding Your Way in Testing Jungle. A Learning Approach to Web Security Testing.
Finding Your Way in Testing Jungle A Learning Approach to Web Security Testing. Research Questions Why is it important to improve website security? What techniques are already in place to test security?
Are AJAX Applications Vulnerable to Hack Attacks?
Are AJAX Applications Vulnerable to Hack Attacks? The importance of Securing AJAX Web Applications This paper reviews AJAX technologies with specific reference to JavaScript and briefly documents the kinds
A Survey on Threats and Vulnerabilities of Web Services
A Survey on Threats and Vulnerabilities of Web Services A Thesis submitted in partial fulfillment of the requirements for the degree of Master of Computer Science and Engineering of Jadavpur University
Øredev 2006. Web application testing using a proxy. Lucas Nelson, Symantec Inc.
Øredev 2006 Web application testing using a proxy Lucas Nelson, Symantec Inc. Agenda What is a proxy? Setting up your environment Pre-login tests Post-login tests Conclusion A man in the middle proxy The
DNS Pinning and Web Proxies
DNS Pinning and Web Proxies An NGSSoftware Insight Security Research (NISR) Publication 2007 Next Generation Security Software Ltd Abstract DNS-based attacks can be used to perform a partial breach of
ArcGIS Server Security Threats & Best Practices 2014. David Cordes Michael Young
ArcGIS Server Security Threats & Best Practices 2014 David Cordes Michael Young Agenda Introduction Threats Best practice - ArcGIS Server settings - Infrastructure settings - Processes Summary Introduction
Threat Modeling. Categorizing the nature and severity of system vulnerabilities. John B. Dickson, CISSP
Threat Modeling Categorizing the nature and severity of system vulnerabilities John B. Dickson, CISSP What is Threat Modeling? Structured approach to identifying, quantifying, and addressing threats. Threat
KEYWORDS: Internet Applications, Security, Languages, Review and evaluation.
[Madhusudhanan, 4(3): March, 2015] ISSN: 2277-9655 IJESRT INTERNATIONAL JOURNAL OF ENGINEERING SCIENCES & RESEARCH TECHNOLOGY WEB SECURITY VULNERABILITY ASSESSMENT AND RECOVERY MACHANISAM M.Madhusudhanan*,
An Efficient Black-box Technique for Defeating Web Application Attacks
2/9/2009 An Efficient Black-box Technique for Defeating Web Application Attacks R. Sekar Stony Brook University (Research supported by DARPA, NSF and ONR) Example: SquirrelMail Command Injection Attack:
Sidste chance for Early Bird! Tilmeld dig før d. 30. juni og spar 4.000 DKK. Læs mere og tilmeld dig på www.gotocon.
Sidste chance for Early Bird! Tilmeld dig før d. 30. juni og spar 4.000 DKK. Læs mere og tilmeld dig på www.gotocon.com/aarhus-2012 SIKKERHED I WEBAPPLIKATIONER Anders Skovsgaard Hackavoid anders@hackavoid.dk
SECURE APPLICATION DEVELOPMENT CODING POLICY OCIO-6013-09 TABLE OF CONTENTS
OFFICE OF THE CHIEF INFORMATION OFFICER OCIO-6013-09 Date of Issuance: May 22, 2009 Effective Date: May 22, 2009 Review Date: TABLE OF CONTENTS Section I. PURPOSE II. AUTHORITY III. SCOPE IV. DEFINITIONS
Web application security: Testing for vulnerabilities
Web application security: Testing for vulnerabilities Using open source tools to test your site Jeff Orloff Technology Coordinator/Consultant Sequoia Media Services Inc. Skill Level: Intermediate Date:
Advanced XSS. Nicolas Golubovic
Advanced XSS Nicolas Golubovic Image courtesy of chanpipat / FreeDigitalPhotos.net Today's menu 1. Starter: reboiled XSS 2. Course: spicy blacklists & filters 3. Course: sweet content sniffing 4. Course:
Web Application Security. Vulnerabilities, Weakness and Countermeasures. Massimo Cotelli CISSP. Secure
Vulnerabilities, Weakness and Countermeasures Massimo Cotelli CISSP Secure : Goal of This Talk Security awareness purpose Know the Web Application vulnerabilities Understand the impacts and consequences
HTTPParameter Pollution. ChrysostomosDaniel
HTTPParameter Pollution ChrysostomosDaniel Introduction Nowadays, many components from web applications are commonly run on the user s computer (such as Javascript), and not just on the application s provider
Phishing by data URI
Phishing by data URI Henning Klevjer henning@klevjers.com October 22, 2012 1 Abstract Historically, phishing web pages have been hosted by web servers that are either compromised or owned by the attacker.
Bypassing Web Application Firewalls (WAFs) Ing. Pavol Lupták, CISSP, CEH Lead Security Consultant
Bypassing Web Application Firewalls (WAFs) Ing. Pavol Lupták, CISSP, CEH Lead Security Consultant Nethemba All About Security Highly experienced certified IT security experts (CISSP, C EH, SCSecA) Core
Creating Stronger, Safer, Web Facing Code. JPL IT Security Mary Rivera June 17, 2011
Creating Stronger, Safer, Web Facing Code JPL IT Security Mary Rivera June 17, 2011 Agenda Evolving Threats Operating System Application User Generated Content JPL s Application Security Program Securing
WEB ATTACKS AND COUNTERMEASURES
WEB ATTACKS AND COUNTERMEASURES February 2008 The Government of the Hong Kong Special Administrative Region The contents of this document remain the property of, and may not be reproduced in whole or in
HTML5. Eoin Keary CTO BCC Risk Advisory. www.bccriskadvisory.com www.edgescan.com
HTML5 Eoin Keary CTO BCC Risk Advisory www.bccriskadvisory.com www.edgescan.com Where are we going? WebSockets HTML5 AngularJS HTML5 Sinks WebSockets: Full duplex communications between client or server
Master of Technology, CS Indian Institute of Technology, Kanpur CPA: 7.71/10.0
1/5 Prithvi Bisht 1500 Harbour Dr, Unit 4D, Wheeling, Illinois, 60090 T 3 1 2-8 1 0-1 8 1 2 B p b i s h t @ c s. u i c. e d u, b i s h t s p p @ y a h o o. c o m WWW: www.cs.uic.edu/ pbisht Overview Extensive
Uploaded images filter evasion for carrying out XSS attacks
February 25, 2007 Uploaded images filter evasion for carrying out XSS attacks Digitаl Security Research Group (DSecRG) Alexander Polyakov a.polyakov@dsec.ru http://dsecrg.ru Table of contents Introduction...3
LASTLINE WHITEPAPER. Large-Scale Detection of Malicious Web Pages
LASTLINE WHITEPAPER Large-Scale Detection of Malicious Web Pages Abstract Malicious web pages that host drive-by-download exploits have become a popular means for compromising hosts on the Internet and,
Revisiting SQL Injection Will we ever get it right? Michael Sutton, Security Evangelist
Revisiting SQL Injection Will we ever get it right? Michael Sutton, Security Evangelist Overview Background What it is? How are we doing? Web 2.0 SQL injection meets AJAX Fuggle SQL Injection meets Google
Web Application Exploits
Monday, November 10, 2014 Resources: see final slide CS342 Computer Security Department of Computer Science Wellesley College Web Evolution o Static content: Server serves web pages created by people.
Web application security
Web application security Sebastian Lopienski CERN Computer Security Team openlab and summer lectures 2010 (non-web question) Is this OK? int set_non_root_uid(int uid) { // making sure that uid is not 0
Java Program Vulnerabilities
Java Program Vulnerabilities Sheetal Thakare, Dr.B.B.Meshram Abstract The Java programming language provides a lot of security features, build directly into the language and also supplied by security relevant
Hacking Web Apps. Detecting and Preventing Web Application Security Problems. Jorge Blanco Alcover. Mike Shema. Technical Editor SYNGRESS
Hacking Web Apps Detecting and Preventing Web Application Security Problems Mike Shema Technical Editor Jorge Blanco Alcover AMSTERDAM BOSTON HEIDELBERG LONDON NEW YORK OXFORD PARIS SAN DIEGO SAN FRANCISCO
Magento Security and Vulnerabilities. Roman Stepanov
Magento Security and Vulnerabilities Roman Stepanov http://ice.eltrino.com/ Table of contents Introduction Open Web Application Security Project OWASP TOP 10 List Common issues in Magento A1 Injection
A Survey on Detection and Prevention of Cross-Site Scripting Attack
, pp. 139-152 http://dx.doi.org/10.14257/ijsia.2015.9.3.14 A Survey on Detection and Prevention of Cross-Site Scripting Attack V. Nithya 1, S. Lakshmana Pandian 2 and C. Malarvizhi 3 1,3 University College
Webapps Vulnerability Report
Tuesday, May 1, 2012 Webapps Vulnerability Report Introduction This report provides detailed information of every vulnerability that was found and successfully exploited by CORE Impact Professional during
Network Security Web Security
Network Security Web Security Anna Sperotto, Ramin Sadre Design and Analysis of Communication Systems Group University of Twente, 2012 Cross Site Scripting Cross Side Scripting (XSS) XSS is a case of (HTML)
CANDID: Preventing SQL Injection Attacks using Dynamic Candidate Evaluations
CANDID: Preventing SQL Injection Attacks using Dynamic Candidate Evaluations Sruthi Bandhakavi University of Illinois Urbana-Champaign, USA sbandha2@uiuc.edu Prithvi Bisht University of Illinois Chicago,
What is Web Security? Motivation
brucker@inf.ethz.ch http://www.brucker.ch/ Information Security ETH Zürich Zürich, Switzerland Information Security Fundamentals March 23, 2004 The End Users View The Server Providers View What is Web
Finding XSS in Real World
Finding XSS in Real World by Alexander Korznikov nopernik@gmail.com 1 April 2015 Hi there, in this tutorial, I will try to explain how to find XSS in real world, using some interesting techniques. All
SECURITY ADVISORY. December 2008 Barracuda Load Balancer admin login Cross-site Scripting
SECURITY ADVISORY December 2008 Barracuda Load Balancer admin login Cross-site Scripting Discovered in December 2008 by FortConsult s Security Research Team/Jan Skovgren WARNING NOT FOR DISCLOSURE BEFORE
CS 558 Internet Systems and Technologies
CS 558 Internet Systems and Technologies Dimitris Deyannis deyannis@csd.uoc.gr 881 Heat seeking Honeypots: Design and Experience Abstract Compromised Web servers are used to perform many malicious activities.