Hacking Web Apps. Detecting and Preventing Web Application Security Problems. Jorge Blanco Alcover. Mike Shema. Technical Editor SYNGRESS

Transcription

1 Hacking Web Apps Detecting and Preventing Web Application Security Problems Mike Shema Technical Editor Jorge Blanco Alcover AMSTERDAM BOSTON HEIDELBERG LONDON NEW YORK OXFORD PARIS SAN DIEGO SAN FRANCISCO SINGAPORE SYDNEY TOKYO Syngress is an Imprint of Elsevier SYNGRESS

2 Contents About the Author v Acknowledgements v i i Introduction xiu CHAPTER 1 HTML5 1 The New Document Object Model (DOM) 2 Cross-Origin Resource Sharing (CORS) 3 WebSockets 6 Transferring Data 10 Data Frames 11 Security Considerations 13 Web Storage 14 IndexedDB 16 Web Workers 16 Flotsam & Jetsam 19 History API 19 Draft APIs 20 Summary 20 CHAPTER 2 HTML Injection & Cross-Site Scripting (XSS) 23 Understanding HTML Injection 24 Identifying Points of Injection 30 Identifying the Type of Reflection 37 Identifying the Injection's Rendered Context 42 Putting the Hack Together 45 Abusing Character Sets 48 Exploiting Failure Modes 56 Bypassing Weak Exclusion Lists 59 Leveraging Browser Quirks 60 The Unusual Suspects 63 The Impact of XSS 66 Employing Countermeasures 67 Fixing a Static Character Set 68 Normalizing Character Sets and Encoding 69 Encoding the Output 70 Beware of Exclusion Lists and Regexes 71 Reuse, Don't Reimplement, Code 73 ix

3 x Contents JavaScript Sandboxes 73 Browsers' Built-in XSS Defenses 76 Summary 78 CHAPTER 3 Cross-Site Request Forgery (CSRF) 79 Understanding Cross-Site Request Forgery 80 The Mechanics of CSRF 83 Request Forgery via Forced Browsing 85 Attacking Authenticated Actions without Passwords 89 Dangerous Liaison: CSRF and HTML Injection 89 Be Wary of the Tangled Web 90 Variation on a Theme: Clickjacking 91 Employing Countermeasures 93 Heading in the Right Direction 94 Defending the Web Browser 103 Vulnerability & Verisimilitude 104 Summary 104 CHAPTER 4 SQL Injection & Data Store Manipulation 107 Understanding SQL Injection 109 Hacking Tangents: Mathematical and Grammatical 112 Breaking SQL Statements 113 Vivisecting the Database 122 Alternate Attack Vectors 125 Real-World SQL Injection 126 HTML5's Web Storage API 127 SQL Injection Without SQL 128 Employing Countermeasures 130 Validating Input 131 Securing the Statement 131 Protecting Information 137 Stay Current with Database Patches 139 Summary 140 CHAPTER 5 Breaking Authentication Schemes 141 Understanding Authentication Attacks 142 Replaying the Session Token 142 Brute Force 145 Sniffing 146 Resetting Passwords 149 Cross-Site Scripting (XSS) 149

4 Contents xi SQL Injection 150 Gulls & Gullibility 151 Employing Countermeasures 152 Protect Session Cookies 153 Use Secure Authentication Schemes 155 Engage the User 163 Annoy the User 164 Request Throttling 165 Logging and Triangulation 166 Defeating Phishing 166 Protecting Passwords 168 Summary 168 CHAPTER 6 Abusing Design Deficiencies 11 i Understanding Logic & Design Attacks 174 Abusing Workflows 175 Exploiting Policies & Practices 175 Induction 180 Denial of Service 183 Insecure Design Patterns 183 Implementation Errors in Cryptography 188 Information Sieves 201 Employing Countermeasures 202 Documenting Requirements 202 Creating Robust Test Cases 203 Mapping Policies to Controls 204 Defensive Programming 205 Verifying the Client 205 Encryption Guidelines 205 Summary 206 CHAPTER 7 Leveraging Platform Weaknesses 209 Understanding the Attacks 210 Recognizing Patterns, Structures, & Developer Quirks 210 Targeting the Operating System 225 Attacking the Server 230 Denial of Service 230 Employing Countermeasures 235 Restricting file Access 235 Using Object References 236

5 xii Contents Blacklisting Insecure Functions 236 Enforcing Authorization 237 Restricting Network Connections 237 Summary 238 CHAPTER 8 Browser & Privacy Attacks 239 Understanding Malware and Browser Attacks 240 Malware 241 Plugging in to Browser Plugins 244 DNS and Origins 246 HTML5 247 Privacy 249 Employing Countermeasures 258 Configure SSL/TLS Securely 258 Safer Browsing 259 Isolating the Browser 260 Tor 260 DNSSEC 261 Summary 261 Index 263