Web Browser and the Internet
|
|
|
- Tabitha Briggs
- 8 years ago
- Views:
Transcription
1 CS 203 / NetSys 240 Web Security Web Browser and the Internet Browser OS Hardware request reply Website (server) somewhere on the Internet slide 2 1
2 HTTP: HyperText Transfer Protocol Used to request and return data Methods: GET, POST, HEAD, Stateless request/response protocol Each request is independent of previous requests Statelessness has a significant impact on design and implementation of applications Evolution HTTP 1.0: simple HTTP 1.1: more complex Etc, etc slide 3 HTTP Request Method File HTTP version Headers GET /default.asp HTTP/1.0 Accept: image/gif, image/x-bitmap, image/jpeg, */* Accept-Language: en User-Agent: Mozilla/1.22 (compatible; MSIE 2.0; Windows 95) Connection: Keep-Alive If-Modified-Since: Sunday, 17-Apr-96 04:32:58 GMT Blank line Data none for GET slide 4 2
3 HTTP Response (PUT) HTTP version Status code Reason phrase Headers HTTP/ OK Date: Sun, 21 Apr :20:42 GMT Server: Microsoft-Internet-Information-Server/5.0 Connection: keep-alive Content-Type: text/html Last-Modified: Thu, 18 Apr :39:05 GMT Content-Length: 2543 Data <HTML> Some data... blah, blah, blah </HTML> slide 5 HTTP Digest Authentication client Request URL with GET or POST method server HTTP 401 Unauthorised Authentication realm (description of system being accessed) Fresh random nonce H1=hash(username, realm, password) H2=hash(method, URL) H3=hash(H1, server nonce, H2) Recompute H3 and verify slide 6 3
4 Primitive Browser Session shopping.cfm? pid=269& item1= View catalog Select item Check out shopping.cfm? pid=269 checkout.cfm? pid=269& item1= Store session information in URL; easily read on network slide 7 FatBrain.com circa 1999 [Fu et al.] User logs into website with his password, authenticator is generated, user is given special URL containing the authenticator With special URL, user doesn t need to re-authenticate Reasoning: user could not have not known the special URL without authenticating first. That s true, BUT Authenticators are global sequence numbers It s easy to guess sequence number for another user Fix: use random authenticators SEE: slide 8 4
5 Examples of Weak Authenticators Verizon Wireless: counter User logs in, gets counter, can view sessions of other users Apache Tomcat: generatesessionid() MD5(PRNG) but weak PRNG PRNG = pseudo-random number generator Result: predictable SessionID s slide 9 Bad Idea: Encoding State in URL Unstable, frequently changing URLs Vulnerable to eavesdropping There is no guarantee that URL is private Early versions of Opera used to send entire browsing history, including all visited URLs, to Google Also, consider HTTP proxies slide 10 5
6 Cookies slide 11 Storing Info Across Sessions A cookie is a file created by a website to store information in your browser Browser POST login.cgi username and pwd HTTP Header: Set-cookie: NAME=VALUE ; domain = (who can read) ; expires = (when expires) ; secure = (only over SSL) Server If expires = NULL, this session only Browser GET restricted.html Cookie: NAME=VALUE Server HTTP is a stateless protocol; cookies add state slide 12 6
7 What Are Cookies Used For? Authentication Use the fact that the user authenticated correctly in the past to make future authentication quicker Personalization Recognize the user from a previous visit Tracking Follow the user from site to site; learn his/her browsing behavior, preferences, and so on slide 13 Cookie Management Cookie ownership Once a cookie is saved on your client device, only the website that created the cookie can read it If cookie is secure, browser will only send it over HTTPS but anyone can write a secure cookie! Variations Temporary cookies: stored until you quit your browser Persistent cookies: remain until deleted or expire Third-party cookies: originate on, or sent to, another website slide 14 7
8 Privacy Issues with Cookies Cookie may include any information about you known by the website that created it Browsing activity, account information, etc. Sites can share this information Advertising networks 2o7.net tracking cookie Browser attacks could invade your privacy November 8, 2001: Users of Microsoft's browser and programs could be vulnerable to having their browser cookies stolen or modified due to a new security bug in Internet Explorer (IE), the company warned today slide 15 Austin American-Statesman The website adinterax.com has requested to save a file on your computer called a cookie. This file may be used to track usage information slide 16 8
9 The Weather Channel The website twci.coremetrics.com has requested to save a file on your computer called a cookie. This file may be used to track usage information slide 17 MySpace The website insightexpressai.com has requested to save a file on your computer called a cookie slide 18 9
10 Let s Take a Closer Look slide 19 Storing State in Browser Dansie Shopping Cart (2006) A premium, comprehensive, Perl shopping cart. Increase your web sales by making it easier for your web store customers to order. <FORM METHOD=POST ACTION=" Black Leather purse with leather straps<br>price: $20.00<BR> <INPUT TYPE=HIDDEN NAME=name VALUE="Black leather purse"> <INPUT TYPE=HIDDEN NAME=price VALUE="20.00"> <INPUT TYPE=HIDDEN NAME=sh VALUE="1"> <INPUT TYPE=HIDDEN NAME=img VALUE="purse.jpg"> <INPUT TYPE=HIDDEN NAME=custom1 VALUE="Black leather purse with leather straps"> <INPUT TYPE=SUBMIT NAME="add" VALUE="Put in Shopping Cart"> </FORM> Change this to 2.00 Bargain shopping! slide 20 10
11 Shopping Cart Form Tampering Many Web-based shopping cart applications use hidden fields in HTML forms to hold parameters for items in an online store. These parameters can include the item's name, weight, quantity, product ID, and price. Any application that bases price on a hidden field in an HTML form is vulnerable to price changing by a remote user. A remote user can change the price of a particular item they intend to buy, by changing the value for the hidden HTML tag that specifies the price, to purchase products at any price they choose. Platforms Affected: 3D3.COM Pty Ltd: ShopFactory 5.8 and Any version Adgrafix: Check It Out Any version Baron Consulting Group: WebSite Tool Any version ComCity Corporation: SalesCart Any version Crested Butte Software: EasyCart Any version Dansie.net: Dansie Shopping Cart Any version Intelligent Vending Systems: Intellivend Any version Make-a-Store: Make-a-Store OrderPage Any version McMurtrey/Whitaker & Associates: Cart McMurtrey/Whitaker & Associates: Cart pknutsen@nethut.no: CartMan 1.04 Rich Media Technologies: JustAddCommerce 5.0 SmartCart: SmartCart Any version Web Express: Shoptron 1.2 slide 21 Other Risks of Hidden Forms [From The Art of Intrusion ] Estonian bank s web server HTML source reveals a hidden variable that points to a file name Change file name to password file Webserver displays contents of password file Bank was not using shadow password files! Standard cracking program took 15 minutes to crack root password slide 22 11
12 Storing State in Browser Cookies Set-cookie: price= User edits the cookie cookie: price=29.99 What s the solution? Add a MAC to every cookie, computed with the server s secret key Price=299.99; HMAC(ServerKey, ) But what if the website changes the price? slide 23 Web Authentication via Cookies Need authentication system that works over HTTP and does not require servers to store session data Why is it a bad idea to store session state on server? Servers can use cookies to store state on client After client successfully authenticates, server computes an authenticator and gives it to browser in a cookie Client cannot forge authenticator on his own Example: hash(server s secret key, session id, other stuff) With each request, browser presents the cookie Server recomputes and verifies the authenticator Server does not need to remember the authenticator slide 24 12
13 Typical Session with Cookies client server POST /login.cgi Set-Cookie:authenticator Verify that this client is authorized GET /restricted.html Cookie:authenticator Restricted content Check validity of authenticator (e.g., recompute hash(key,sessid)) Authenticators must be unforgeable (malicious client shouldn t be able to compute his own or modify an existing authenticator) slide 25 WSJ.com around 1999 [Fu et al.] Idea: use user,hash(user,key) as authenticator Key is secret and known only to the server. Without the key, clients can t forge authenticators. Implementation: user,crypt(user,key) crypt() is UNIX hash function for passwords crypt() truncates its input at 8 characters Usernames matching first 8 characters end up with the same authenticator No expiration or revocation slide 26 13
14 Attack username crypt(username,key, 00 ) authenticator cookie SimpsonH1 SimpsonH2 008H8LRfzUXvk 008H8LRfzUXvk SimpsonH1008H8LRfzUXvk SimpsonH2008H8LRfzUXvk It gets worse The WSJ scheme can be exploited to extract the server s secret key. Read the paper! Dos and Don ts of Client Authentication on the Web Kevin Fu, Emil Sit, Kendra Smith, Nick Feamster Better Cookie Authenticator Capability Expiration Hash(server secret, capability, expiration) Describes what user is authorized to do on the site that issued the cookie Cannot be forged by malicious user; does not leak server secret Main lesson: don t bake your own! Homebrewed authentication schemes are often flawed There are standard cookie-based schemes slide 28 14
15 Kerberos slide 29 Many-to-Many Authentication? Users Servers How do users prove their identities when requesting services from machines on the network? Naïve solution: every server knows every user s password Insecure: break into one server compromise all users Inefficient: to change password, user must contact every server slide 30 15
16 Requirements Security Must be secure against attacks by passive eavesdroppers and actively malicious attackers (including rogue users) Reliability Must be always available Transparency Users should not notice authentication taking place Entering password is OK, if done rarely enough Scalability Must handle large numbers of users and servers slide 31 Threats User impersonation Malicious user with access to a workstation pretends to be another user from the same workstation Can t trust workstations to verify users identities Network address impersonation Malicious user changes network address of his workstation to impersonate another workstation Can t trust network addresses Eavesdropping, tampering and replay Malicious user eavesdrops on, tampers with, or replays, other users conversations to gain unauthorized access slide 32 16
17 Solution: Trusted Third Party User proves its identity; requests ticket for some service Knows all users and servers passwords User receives ticket User Ticket is used to access desired network service Servers Trusted authentication service Knows all passwords, can grant access to any server Convenient, but also single point of failure Requires high level of physical security slide 33 What Should a Ticket Look Like? User Ticket gives holder access to a network service Server Ticket cannot include server plaintext password Otherwise, next time user will access server directly without proving its identity to authentication service Solution: encrypt some information with a key known to the server, but not to the user! Server can decrypt ticket and verify information User does not learn server key slide 34 17
18 What Should a Ticket Include? User Encrypted ticket Knows passwords of all users and servers Encrypted ticket Server User name Server name Address of user s workstation Otherwise, a user on another workstation can steal the ticket and use it to gain access to the server Ticket lifetime A few other things (e.g., session key) slide 35 How to authenticate initially? User Password Encrypted ticket Authentication server Insecure: passwords are sent in plaintext Eavesdropper can steal password and impersonate user Inconvenient: need to send the password each time to obtain the ticket for any network service Separate authentication for , printing, etc. slide 36 18
19 Two-Step Authentication Prove identity once to obtain special TGS ticket Use TGS to get tickets for any network service Joe the User USER=Joe; service=tgs Encrypted TGS ticket TGS ticket Encrypted service ticket Encrypted service ticket Key distribution center (KDC) Ticket granting service (TGS) File server, printer, other network services slide 37 Still Not Good Enough Ticket hijacking Malicious user may steal the service ticket of another user on the same workstation and use it IP address verification does not help Servers must verify that the user who is presenting the ticket is the same user to whom the ticket was issued No server authentication Attacker may mis-configure the network so that it receives messages addressed to a legitimate server Capture private information from users and/or deny service Servers must prove their identity to users slide 38 19
20 Symmetric Keys in Kerberos K c is long-term key of client C Derived from user s password Known to client and key distribution center (KDC) K TGS is long-term key of TGS Known to KDC and ticket granting service (TGS) K v is long-term key of network service V Known to V and TGS; separate key for each service K c,tgs is short-term key between C and TGS Created by KDC, known to C and TGS K c,v is short-term key betwen C and V Created by TGS, known to C and V slide 39 Single Logon Authentication User password Convert into client master key kinit program (client) K c Decrypts with K c and obtains K c,tgs and ID c, ID TGS, time c Encrypt K c (K c,tgs, ID TGS, time KDC, lifetime, ticket TGS ) Fresh key to be used between client and TGS ticket TGS Encrypt KTGS (K c,tgs, ID c, Addr c, ID TGS, time KDC, lifetime) Client will use this unforgeable ticket to get other tickets without re-authenticating Key Distribution Center (KDC) TGS Key = K TGS Key = K c All users must pre-register their passwords with KDC Client only needs to obtain TGS ticket once (say, every morning) Ticket is encrypted; client cannot forge it or tamper with it slide 40 20
21 Obtaining a Service Ticket Client Knows K c,tgs and ticket TGS System command, e.g. lpr Pprint Encrypt Kc,TGS (ID c, Addr c, time c ) Proves that client knows key K c,tgs contained in encrypted TGS ticket ID v, ticket TGS, auth C Ticket Granting Service (TGS) usually lives inside KDC User Encrypt K c,tgs (K c,v, ID v, time TGS, ticket v ) Fresh key to be used between client and service Knows key K v for each service Encrypt Kv (K c,v, ID c, Addr c, ID v, time TGS, lifetime) Client will use this unforgeable ticket to get access to service V Client uses TGS ticket to obtain a service ticket and a short-term key for each network service One encrypted, unforgeable ticket per service (printer, , etc.) slide 41 Obtaining Service Client Knows K c,v and ticket v System command, e.g. lpr Pprint Encrypt Kc,v (ID c, Addr c, time c ) Proves that client knows key K c,v contained in encrypted ticket ticket v, auth C Server V User Encrypt K c,v (time c+1) Authenticates server to client Reasoning: Server can produce this message only if he knows key K c,v. Server can learn key K c,v only if he can decrypt service ticket. Server can decrypt service ticket only if he knows correct key K v. If server knows correct key K v, then he is the right server. For each service request, client uses the short-term key for that service and the ticket he received from TGS slide 42 21
22 Kerberos in Large Networks One KDC isn t enough for large networks (why?) Network is divided into realms KDCs in different realms have different key databases To access a service in another realm, users must Get ticket for home-realm TGS from home-realm KDC Get ticket for remote-realm TGS from home-realm TGS As if remote-realm TGS were just another network service Get ticket for remote service from that realm s TGS Use remote-realm ticket to access service N(N-1)/2 key exchanges for full N-realm interoperation slide 43 Summary of Kerberos slide 44 22
23 Important Ideas in Kerberos Short-term session keys Long-term secrets used only to derive short-term keys Separate session key for each user-server pair but multiple user-server sessions re-use the same key Proofs of identity are based on authenticators Client encrypts his identity, address and current time using a short-term session key Also prevents replays (if clocks are globally synchronized) Server learns this key separately (via encrypted ticket that client can t decrypt) and verifies user s identity Symmetric cryptography only slide 45 Problematic Issues Dictionary attacks on client master keys Replay of authenticators 5-minute lifetimes long enough for replay Timestamps assume global, secure synchronized clocks Challenge-response would have been better Same user-server key used for all sessions Homebrewed PCBC mode of encryption Superfluous double encryption of tickets No ticket delegation Printer can t fetch from server on your behalf slide 46 23
24 Kerberos Version 5 Better user-server authentication Separate subkey for each user-server session instead of re-using the session key contained in the ticket Authentication via subkeys, not timestamp increments Authentication forwarding Servers can access other servers on user s behalf Realm hierarchies for inter-realm authentication Richer ticket functionality Explicit integrity checking + standard CBC mode Multiple encryption schemes, not just DES slide 47 Practical Uses of Kerberos , FTP, network file systems and many other applications have been kerberized Use of Kerberos is transparent for the end user Transparency is important for usability! Local authentication login and su in OpenBSD Authentication for network protocols rlogin, rsh, telnet Secure windowing systems xdm, kx slide 48 24
CS 4803 Computer and Network Security
Many-to-Many Authentication CS 4803 Computer and Network Security s? Servers Alexandra (Sasha) Boldyreva Kerberos How do users prove their identities when requesting services from machines on the network?
Web Authentication and Session Management
CS 361S Web Authentication and Session Management Vitaly Shmatikov Reading Assignment Read Kaufman, Chapter 25 Read Dos and Don ts of Client Authentication on the Web slide 2 HTTP Digest Authentication
Network Security Standards. Key distribution Kerberos SSL/TLS
Network Security Standards Key distribution Kerberos SSL/TLS 1 Many-to-Many Authentication? Users Servers How do users prove their identities when requesting services from machines on the network? Naïve
Web Security: SSL/TLS
CSE 484 / CSE M 584: Computer Security and Privacy Web Security: SSL/TLS Spring 2015 Franziska (Franzi) Roesner franzi@cs.washington.edu Thanks to Dan Boneh, Dieter Gollmann, Dan Halperin, Yoshi Kohno,
Authentication Application
Authentication Application KERBEROS In an open distributed environment servers to be able to restrict access to authorized users to be able to authenticate requests for service a workstation cannot be
How To Use Kerberos
KERBEROS 1 Kerberos Authentication Service Developed at MIT under Project Athena in mid 1980s Versions 1-3 were for internal use; versions 4 and 5 are being used externally Version 4 has a larger installed
Dawn Song dawnsong@cs.berkeley.edu
1 Web Security Dawn Song dawnsong@cs.berkeley.edu Common Vulnerabilities Input validation SQL Injection XSS: cross-site scripting HTTP response splitting Cookie management Cookie forgery CSRF: cross-site
Web Application Firewalls. Our focus: web app code. Web app code. Secure Web Site Design. Common vulnerabilities (OWASP) Dan Boneh
CS 155 Spring 2006 Schematic web site architecture Secure Web Site Design Firewall Application Firewall (WAF) Load Balancer WS 1 WS 2 Firewall App Servers DB Dan Boneh IDS WS 3 Authorization Netegrity
TOPIC HIERARCHY. Distributed Environment. Security. Kerberos
KERBEROS TOPIC HIERARCHY Distributed Environment Security Privacy Authentication Authorization Non Repudiation Kerberos ORIGIN MIT developed Kerberos to protect network services. Developed under the Project
CIS 551 / TCOM 401 Computer and Network Security. Spring 2007 Lecture 20
CIS 551 / TCOM 401 Computer and Network Security Spring 2007 Lecture 20 Announcements Reminder: Project 3 is available on the web pages Due: April 3rd Midterm II has been graded Today: Web Security [Some
Cookie Same Origin Policy
CS 142 Winter 2009 Cookie Same Origin Policy Dan Boneh Monday: session management using cookies Same origin policy: high level Review: Same Origin Policy (SOP) for DOM: Origin A can access origin B s DOM
Chapter 4. Authentication Applications. COSC 490 Network Security Annie Lu 1
Chapter 4 Authentication Applications COSC 490 Network Security Annie Lu 1 OUTLINE Kerberos X.509 Authentication Service COSC 490 Network Security Annie Lu 2 Authentication Applications authentication
Authentication Types. Password-based Authentication. Off-Line Password Guessing
Authentication Types Chapter 2: Security Techniques Background Secret Key Cryptography Public Key Cryptography Hash Functions Authentication Chapter 3: Security on Network and Transport Layer Chapter 4:
SYSTEM MODEL KERBEROS OBJECTIVES PHYSICAL SECURITY TRUST: CONSOLIDATED KERBEROS MODEL TRUST: BILATERAL RHOSTS MODEL
INFS 766 Internet Security Protocols Lecture 9 WORK- STATIONS SYSTEM MODEL NETWORK SERVERS NFS GOPHER Prof. Ravi Sandhu LIBRARY KERBEROS 2 PHYSICAL SECURITY KERBEROS OBJECTIVES CLIENT WORKSTATIONS None,
2.4: Authentication Authentication types Authentication schemes: RSA, Lamport s Hash Mutual Authentication Session Keys Trusted Intermediaries
Chapter 2: Security Techniques Background Secret Key Cryptography Public Key Cryptography Hash Functions Authentication Chapter 3: Security on Network and Transport Layer Chapter 4: Security on the Application
Kerberos. Public domain image of Heracles and Cerberus. From an Attic bilingual amphora, 530 520 BC. From Italy (?).
Kerberos Public domain image of Heracles and Cerberus. From an Attic bilingual amphora, 530 520 BC. From Italy (?). 1 Kerberos Kerberos is an authentication protocol and a software suite implementing this
CIS 551 / TCOM 401 Computer and Network Security. Spring 2008 Lecture 25
CIS 551 / TCOM 401 Computer and Network Security Spring 2008 Lecture 25 Announcements Project 4 is Due Friday May 2nd at 11:59 PM Final exam: Friday, May 12th. Noon - 2:00pm DRLB A6 Today: Cookies & State
HTTP. Internet Engineering. Fall 2015. Bahador Bakhshi CE & IT Department, Amirkabir University of Technology
HTTP Internet Engineering Fall 2015 Bahador Bakhshi CE & IT Department, Amirkabir University of Technology Questions Q1) How do web server and client browser talk to each other? Q1.1) What is the common
What is Web Security? Motivation
brucker@inf.ethz.ch http://www.brucker.ch/ Information Security ETH Zürich Zürich, Switzerland Information Security Fundamentals March 23, 2004 The End Users View The Server Providers View What is Web
4.2: Kerberos Kerberos V4 Kerberos V5. Chapter 5: Security Concepts for Networks. Lehrstuhl für Informatik 4 Kommunikation und verteilte Systeme
Chapter 2: Security Techniques Background Chapter 3: Security on Network and Transport Layer Chapter 4: Security on the Application Layer Secure Applications Network Authentication Service: Kerberos 4.2:
Chapter 15 User Authentication
Chapter 15 User Authentication 2015. 04. 06 Jae Woong Joo SeoulTech (woong07@seoultech.ac.kr) Table of Contents 15.1 Remote User-Authentication Principles 15.2 Remote User-Authentication Using Symmetric
Authentication. Agenda. IT Security course Lecture April 14 th 2003. Niels Christian Juul 2. April 14th, 2003
Authentication IT Security course Lecture April 14 th 2003 Niels Christian Juul Computer Science, building 42.1 Roskilde University Universitetsvej 1 P.O. Box 260 DK-4000 Roskilde Denmark Phone: +45 4674
CS 356 Lecture 28 Internet Authentication. Spring 2013
CS 356 Lecture 28 Internet Authentication Spring 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access Control Lists
Client Server Registration Protocol
Client Server Registration Protocol The Client-Server protocol involves these following steps: 1. Login 2. Discovery phase User (Alice or Bob) has K s Server (S) has hash[pw A ].The passwords hashes are
Kerberos. Login via Password. Keys in Kerberos
Kerberos Chapter 2: Security Techniques Background Chapter 3: Security on Network and Transport Layer Chapter 4: Security on the Application Layer Secure Applications Network Authentication Service: Kerberos
Authentication Applications
Authentication Applications will consider authentication functions developed to support application-level authentication & digital signatures will consider Kerberos a private-key authentication service
Session Management in Web Applications
Session Management in Web Applications Author: EUROSEC GmbH Chiffriertechnik & Sicherheit Tel: 06173 / 60850, www.eurosec.com EUROSEC GmbH Chiffriertechnik & Sicherheit, 2005 What is Web-based Session
Protocolo HTTP. Web and HTTP. HTTP overview. HTTP overview
Web and HTTP Protocolo HTTP Web page consists of objects Object can be HTML file, JPEG image, Java applet, audio file, Web page consists of base HTML-file which includes several referenced objects Each
Kerberos. Guilin Wang. School of Computer Science, University of Birmingham G.Wang@cs.bham.ac.uk
Kerberos Guilin Wang School of Computer Science, University of Birmingham G.Wang@cs.bham.ac.uk 1 Entity Authentication and Key Exchange In the last talk, we discussed key exchange and reviewed some concrete
Basic network security threats
Basic network security threats Packet sniffing Packet forgery (spoofed from address) DNS spoofing wrong IP address for hostname Assume bad guy controls network - Can read all your packets - Can tamper
Kerberos: An Authentication Service for Computer Networks by Clifford Neuman and Theodore Ts o. Presented by: Smitha Sundareswaran Chi Tsong Su
Kerberos: An Authentication Service for Computer Networks by Clifford Neuman and Theodore Ts o Presented by: Smitha Sundareswaran Chi Tsong Su Introduction Kerberos: An authentication protocol based on
Network Technologies
Network Technologies Glenn Strong Department of Computer Science School of Computer Science and Statistics Trinity College, Dublin January 28, 2014 What Happens When Browser Contacts Server I Top view:
: Network Security. Name of Staff: Anusha Linda Kostka Department : MSc SE/CT/IT
Subject Code Department Semester : Network Security : XCS593 : MSc SE : Nineth Name of Staff: Anusha Linda Kostka Department : MSc SE/CT/IT Part A (2 marks) 1. What are the various layers of an OSI reference
reference: HTTP: The Definitive Guide by David Gourley and Brian Totty (O Reilly, 2002)
1 cse879-03 2010-03-29 17:23 Kyung-Goo Doh Chapter 3. Web Application Technologies reference: HTTP: The Definitive Guide by David Gourley and Brian Totty (O Reilly, 2002) 1. The HTTP Protocol. HTTP = HyperText
Chapter 17. Transport-Level Security
Chapter 17 Transport-Level Security Web Security Considerations The World Wide Web is fundamentally a client/server application running over the Internet and TCP/IP intranets The following characteristics
Authentication. Computer Security. Authentication of People. High Quality Key. process of reliably verifying identity verification techniques
Computer Security process of reliably verifying identity verification techniques what you know (eg., passwords, crypto key) what you have (eg., keycards, embedded crypto) what you are (eg., biometric information)
The Web: some jargon. User agent for Web is called a browser: Web page: Most Web pages consist of: Server for Web is called Web server:
The Web: some jargon Web page: consists of objects addressed by a URL Most Web pages consist of: base HTML page, and several referenced objects. URL has two components: host name and path name: User agent
Module 8. Network Security. Version 2 CSE IIT, Kharagpur
Module 8 Network Security Lesson 2 Secured Communication Specific Instructional Objectives On completion of this lesson, the student will be able to: State various services needed for secured communication
Web application security
Web application security Sebastian Lopienski CERN Computer Security Team openlab and summer lectures 2010 (non-web question) Is this OK? int set_non_root_uid(int uid) { // making sure that uid is not 0
Chapter 16: Authentication in Distributed System
Chapter 16: Authentication in Distributed System Ajay Kshemkalyani and Mukesh Singhal Distributed Computing: Principles, Algorithms, and Systems Cambridge University Press A. Kshemkalyani and M. Singhal
Cryptography and Network Security
Cryptography and Network Security Spring 2012 http://users.abo.fi/ipetre/crypto/ Lecture 9: Authentication protocols, digital signatures Ion Petre Department of IT, Åbo Akademi University 1 Overview of
Cyber Security Workshop Ethical Web Hacking
Cyber Security Workshop Ethical Web Hacking May 2015 Setting up WebGoat and Burp Suite Hacking Challenges in WebGoat Concepts in Web Technologies and Ethical Hacking 1 P a g e Downloading WebGoat and Burp
Web and Email Security 1 / 40
Web and 1 / 40 Untrusted Clients Repeat: Untrusted Clients Server-Side Storage Cryptographic Sealing Hidden Values Cookies Protecting Data Sidebar: Cookies and JavaScript Cross-Site Scripting (XSS) Why
CS 161 Computer Security Spring 2010 Paxson/Wagner MT2
CS 161 Computer Security Spring 2010 Paxson/Wagner MT2 PRINT your name:, (last) SIGN your name: (first) PRINT your class account login: cs161- Your T s name: Your section time: Name of the person sitting
Midterm 2 exam solutions. Please do not read or discuss these solutions in the exam room while others are still taking the exam.
CS 161 Computer Security Spring 2010 Paxson/Wagner MT2 Solns Midterm 2 exam solutions Please do not read or discuss these solutions in the exam room while others are still taking the exam. CS 161, Spring
CONTENT of this CHAPTER
CONTENT of this CHAPTER v DNS v HTTP and WWW v EMAIL v SNMP 3.2.1 WWW and HTTP: Basic Concepts With a browser you can request for remote resource (e.g. an HTML file) Web server replies to queries (e.g.
10.2 World Wide Web Security S-HTTP (secure hypertext transfer protocol) SEA (security extension architecture)
Contents 1 / 55 10.1 Kerberos Kerberos V4 Kerberos V5 10.2 World Wide Web Security S-HTTP (secure hypertext transfer protocol) SEA (security extension architecture) Kerberos V4 / Contents 2 / 55 Kerberos
Using Foundstone CookieDigger to Analyze Web Session Management
Using Foundstone CookieDigger to Analyze Web Session Management Foundstone Professional Services May 2005 Web Session Management Managing web sessions has become a critical component of secure coding techniques.
Introduction to Computer Security
Introduction to Computer Security Identification and Authentication Pavel Laskov Wilhelm Schickard Institute for Computer Science Resource access: a big picture 1. Identification Which object O requests
Authentication Applications
Authentication Applications CSCI 454/554 Authentication Applications will consider authentication functions developed to support application-level authentication & digital signatures Kerberos a symmetric-key
Kerberos and Single Sign-On with HTTP
Kerberos and Single Sign-On with HTTP Joe Orton Red Hat Introduction The Problem Current Solutions Future Solutions Conclusion Overview Introduction WebDAV: common complaint of poor support for authentication
TELE 301 Network Management. Lecture 18: Network Security
TELE 301 Network Management Lecture 18: Network Security Haibo Zhang Computer Science, University of Otago TELE301 Lecture 18: Network Security 1 Security of Networks Security is something that is not
A Secure Authenticate Framework for Cloud Computing Environment
A Secure Authenticate Framework for Cloud Computing Environment Nitin Nagar 1, Pradeep k. Jatav 2 Abstract Cloud computing has an important aspect for the companies to build and deploy their infrastructure
HTTP Authentication. RFC 2617 obsoletes RFC 2069
HTTP Authentication RFC 2617 obsoletes RFC 2069 Agenda Positioning Basic Access Authentication Digest Access Authentication Proxy-Authentication and Proxy- Authorization Security Considerations Internet
Introduction to Computer Security
Introduction to Computer Security Web Application Security Pavel Laskov Wilhelm Schickard Institute for Computer Science Modern threat landscape The majority of modern vulnerabilities are found in web
Web Payment Security. A discussion of methods providing secure communication on the Internet. Zhao Huang Shahid Kahn
Web Payment Security A discussion of methods providing secure communication on the Internet Group Members: Peter Heighton Zhao Huang Shahid Kahn 1. Introduction Within this report the methods taken to
Basic network security threats
Basic network security threats Packet sniffing Packet forgery (spoofed from address) DNS spoofing wrong IP address for hostname Assume bad guy controls network - Can read all your packets - Can tamper
Chapter 7 Transport-Level Security
Cryptography and Network Security Chapter 7 Transport-Level Security Lectured by Nguyễn Đức Thái Outline Web Security Issues Security Socket Layer (SSL) Transport Layer Security (TLS) HTTPS Secure Shell
Last update: February 23, 2004
Last update: February 23, 2004 Web Security Glossary The Web Security Glossary is an alphabetical index of terms and terminology relating to web application security. The purpose of the Glossary is to
Architecture of Enterprise Applications III Single Sign-On
Architecture of Enterprise Applications III Single Sign-On Haopeng Chen REliable, INtelligent and Scalable Systems Group (REINS) Shanghai Jiao Tong University Shanghai, China e-mail: chen-hp@sjtu.edu.cn
Web applications. Web security: web basics. HTTP requests. URLs. GET request. Myrto Arapinis School of Informatics University of Edinburgh
Web applications Web security: web basics Myrto Arapinis School of Informatics University of Edinburgh HTTP March 19, 2015 Client Server Database (HTML, JavaScript) (PHP) (SQL) 1 / 24 2 / 24 URLs HTTP
Transport Layer Security Protocols
SSL/TLS 1 Transport Layer Security Protocols Secure Socket Layer (SSL) Originally designed to by Netscape to secure HTTP Version 2 is being replaced by version 3 Subsequently became Internet Standard known
An Insight into Cookie Security
An Insight into Cookie Security Today most websites and web based applications use cookies. Cookies are primarily used by the web server to track an authenticated user or other user specific details. This
1 Introduction: Network Applications
1 Introduction: Network Applications Some Network Apps E-mail Web Instant messaging Remote login P2P file sharing Multi-user network games Streaming stored video clips Internet telephone Real-time video
1. When will an IP process drop a datagram? 2. When will an IP process fragment a datagram? 3. When will a TCP process drop a segment?
Questions 1. When will an IP process drop a datagram? 2. When will an IP process fragment a datagram? 3. When will a TCP process drop a segment? 4. When will a TCP process resend a segment? CP476 Internet
SY0-201. system so that an unauthorized individual can take over an authorized session, or to disrupt service to authorized users.
system so that an unauthorized individual can take over an authorized session, or to disrupt service to authorized users. From a high-level standpoint, attacks on computer systems and networks can be grouped
E-commerce. Security. Learning objectives. Internet Security Issues: Overview. Managing Risk-1. Managing Risk-2. Computer Security Classifications
Learning objectives E-commerce Security Threats and Protection Mechanisms. This lecture covers internet security issues and discusses their impact on an e-commerce. Nov 19, 2004 www.dcs.bbk.ac.uk/~gmagoulas/teaching.html
Leverage Active Directory with Kerberos to Eliminate HTTP Password
Leverage Active Directory with Kerberos to Eliminate HTTP Password PistolStar, Inc. PO Box 1226 Amherst, NH 03031 USA Phone: 603.547.1200 Fax: 603.546.2309 E-mail: salesteam@pistolstar.com Website: www.pistolstar.com
CS5008: Internet Computing
CS5008: Internet Computing Lecture 22: Internet Security A. O Riordan, 2009, latest revision 2015 Internet Security When a computer connects to the Internet and begins communicating with others, it is
Key Management and Distribution
Key Management and Distribution Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 Jain@cse.wustl.edu Audio/Video recordings of this lecture are available at: http://www.cse.wustl.edu/~jain/cse571-11/
Web Security. Crypto (SSL) Client security Server security 2 / 40. Web Security. SSL Recent Changes in TLS. Protecting the Client.
1 / 40 Crypto () Client security Server security 2 / 40 Trusting The Server s Client SET The Failure of SET Aside: The SET Root Certificate The Client s Server Who Issues Web Certificates? Mountain America
E- Encryption in Unix
UNIVERSITY of WISCONSIN-MADISON Computer Sciences Department CS 537 A. Arpaci-Dusseau Intro to Operating Systems Spring 2000 Security Solutions and Encryption Questions answered in these notes: How does
Hack Yourself First. Troy Hunt @troyhunt troyhunt.com troyhunt@hotmail.com
Hack Yourself First Troy Hunt @troyhunt troyhunt.com troyhunt@hotmail.com We re gonna turn you into lean, mean hacking machines! Because if we don t, these kids are going to hack you Jake Davies, 19 (and
Network Security [2] Plain text Encryption algorithm Public and private key pair Cipher text Decryption algorithm. See next slide
![Network Security [2] Plain text Encryption algorithm Public and private key pair Cipher text Decryption algorithm. See next slide](/thumbs/24/4351346.jpg "Network Security [2] Plain text Encryption algorithm Public and private key pair Cipher text Decryption algorithm. See next slide")
Network Security [2] Public Key Encryption Also used in message authentication & key distribution Based on mathematical algorithms, not only on operations over bit patterns (as conventional) => much overhead
Introduction to Computer Security
Introduction to Computer Security Authentication and Access Control Pavel Laskov Wilhelm Schickard Institute for Computer Science Resource access: a big picture 1. Identification Which object O requests
TELE 301 Network Management. Lecture 16: Remote Terminal Services
TELE 301 Network Management Lecture 16: Remote Terminal Services Haibo Zhang Computer Science, University of Otago TELE301 Lecture 16: Remote Terminal Services 1 Today s Focus Remote Terminal Services
CS 361S - Network Security and Privacy Spring 2014. Homework #1
CS 361S - Network Security and Privacy Spring 2014 Homework #1 Due: 11am CST (in class), February 11, 2014 YOUR NAME: Collaboration policy No collaboration is permitted on this assignment. Any cheating
CSE331: Introduction to Networks and Security. Lecture 29 Fall 2006
CSE331: Introduction to Networks and Security Lecture 29 Fall 2006 Announcements Project 3 is due Today Can submit electronically (mail savi@seas) By midnight Project 4 will be on the web this afternoon
HTTP Protocol. Bartosz Walter <Bartek.Walter@man.poznan.pl>
HTTP Protocol Bartosz Walter Agenda Basics Methods Headers Response Codes Cookies Authentication Advanced Features of HTTP 1.1 Internationalization HTTP Basics defined in
CSC 474 -- Network Security. User Authentication Basics. Authentication and Identity. What is identity? Authentication: verify a user s identity
CSC 474 -- Network Security Topic 6.2 User Authentication CSC 474 Dr. Peng Ning 1 User Authentication Basics CSC 474 Dr. Peng Ning 2 Authentication and Identity What is identity? which characteristics
Cookies Overview and HTTP Proxies
Cookies Overview and HTTP Proxies What is a Cookie? Small piece of data generated by a web server, stored on the client s hard drive. Serves as an add-on to the HTTP specification (remember, HTTP by itself
Using etoken for SSL Web Authentication. SSL V3.0 Overview
Using etoken for SSL Web Authentication Lesson 12 April 2004 etoken Certification Course SSL V3.0 Overview Secure Sockets Layer protocol, version 3.0 Provides communication privacy over the internet. Prevents
Secure Sockets Layer (SSL) / Transport Layer Security (TLS)
Secure Sockets Layer (SSL) / Transport Layer Security (TLS) Brad Karp UCL Computer Science CS GZ03 / M030 19 th November 2014 What Problems Do SSL/TLS Solve? Two parties, client and server, not previously
Internet Technologies 4-http. F. Ricci 2010/2011
Internet Technologies 4-http F. Ricci 2010/2011 Content Hypertext Transfer Protocol Structure of a message Methods Headers Parameters and character encoding Proxy Caching HTTP 1.1: chunked transfer and
The Hyper-Text Transfer Protocol (HTTP)
The Hyper-Text Transfer Protocol (HTTP) Antonio Carzaniga Faculty of Informatics University of Lugano October 4, 2011 2005 2007 Antonio Carzaniga 1 HTTP message formats Outline HTTP methods Status codes
Ethical Hacking as a Professional Penetration Testing Technique
Ethical Hacking as a Professional Penetration Testing Technique Rochester ISSA Chapter Rochester OWASP Chapter - Durkee Consulting, Inc. info@rd1.net 2 Background Founder of Durkee Consulting since 1996
Digital Certificates (Public Key Infrastructure) Reshma Afshar Indiana State University
Digital Certificates (Public Key Infrastructure) Reshma Afshar Indiana State University October 2015 1 List of Figures Contents 1 Introduction 1 2 History 2 3 Public Key Infrastructure (PKI) 3 3.1 Certificate
Table of Contents. Open-Xchange Authentication & Session Handling. 1.Introduction...3
Open-Xchange Authentication & Session Handling Table of Contents 1.Introduction...3 2.System overview/implementation...4 2.1.Overview... 4 2.1.1.Access to IMAP back end services...4 2.1.2.Basic Implementation
7 Network Security. 7.1 Introduction 7.2 Improving the Security 7.3 Internet Security Framework. 7.5 Absolute Security?
7 Network Security 7.1 Introduction 7.2 Improving the Security 7.3 Internet Security Framework 7.4 Firewalls 7.5 Absolute Security? 7.1 Introduction Security of Communications data transport e.g. risk
FINAL DoIT 04.01.2013- v.8 APPLICATION SECURITY PROCEDURE
Purpose: This procedure identifies what is required to ensure the development of a secure application. Procedure: The five basic areas covered by this document include: Standards for Privacy and Security
Transport Level Security
Transport Level Security Overview Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 Jain@cse.wustl.edu Audio/Video recordings of this lecture are available at: http://www.cse.wustl.edu/~jain/cse571-14/
THE PROXY SERVER 1 1 PURPOSE 3 2 USAGE EXAMPLES 4 3 STARTING THE PROXY SERVER 5 4 READING THE LOG 6
The Proxy Server THE PROXY SERVER 1 1 PURPOSE 3 2 USAGE EXAMPLES 4 3 STARTING THE PROXY SERVER 5 4 READING THE LOG 6 2 1 Purpose The proxy server acts as an intermediate server that relays requests between
Contents. Identity Assurance (Scott Rea Dartmouth College) IdM Workshop, Brisbane Australia, August 19, 2008
Identity Assurance (Scott Rea Dartmouth College) IdM Workshop, Brisbane Australia, August 19, 2008 Contents Authentication and Identity Assurance The Identity Assurance continuum Plain Password Authentication
Key Management and Distribution
Key Management and Distribution Overview Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 Jain@cse.wustl.edu udio/video recordings of this lecture are available at: http://www.cse.wustl.edu/~jain/cse571-14/
Chapter 9 Key Management 9.1 Distribution of Public Keys 9.1.1 Public Announcement of Public Keys 9.1.2 Publicly Available Directory
There are actually two distinct aspects to the use of public-key encryption in this regard: The distribution of public keys. The use of public-key encryption to distribute secret keys. 9.1 Distribution
Federated Identity and Single-Sign On
CS 6393 Lecture 5 Federated Identity and Single-Sign On Prof. Ravi Sandhu Executive Director and Endowed Chair February 15, 2013 ravi.sandhu@utsa.edu www.profsandhu.com Ravi Sandhu 1 The Web Today User
Session Hijacking Exploiting TCP, UDP and HTTP Sessions
Session Hijacking Exploiting TCP, UDP and HTTP Sessions Shray Kapoor shray.kapoor@gmail.com Preface With the emerging fields in e-commerce, financial and identity information are at a higher risk of being
Security-Assessment.com White Paper Leveraging XSRF with Apache Web Server Compatibility with older browser feature and Java Applet
Security-Assessment.com White Paper Leveraging XSRF with Apache Web Server Compatibility with older browser feature and Java Applet Prepared by: Roberto Suggi Liverani Senior Security Consultant Security-Assessment.com
Security vulnerabilities in the Internet and possible solutions
Security vulnerabilities in the Internet and possible solutions 1. Introduction The foundation of today's Internet is the TCP/IP protocol suite. Since the time when these specifications were finished in
Internet Key Exchange (IKE) EJ Jung
Internet Key Exchange (IKE) EJ Jung Secure Key Establishment Goal: generate and agree on a session key using some public initial information What properties are needed? Authentication (know identity of