Upgrade to Pro — share decks privately, control downloads, hide ads and more …

OWASP demonstratie met focus op .NET

Sponsored · Ship Features Fearlessly Turn features on and off without deploys. Used by thousands of Ruby developers. →
Avatar for devNetNoord devNetNoord
March 20, 2014
Technology
36
0

OWASP demonstratie met focus op .NET

devNetNoord 6, sessie 2

Avatar for devNetNoord

devNetNoord

March 20, 2014

More Decks by devNetNoord

See All by devNetNoord
Gebruik je broncode als documentatie voor je stakeholders
Avatar for devNetNoord devnetnoord
0
51
Efficient and Secure Software Delivery with Azure Deployment Environments and Dev Box
Avatar for devNetNoord devnetnoord
0
47
Toepassing van AI in de zorg; hype, hoop en haalbaarheid
Avatar for devNetNoord devnetnoord
0
82
What's new with Azure Bicep?
Avatar for devNetNoord devnetnoord
0
53
Copilot Beyond the Basics
Avatar for devNetNoord devnetnoord
0
130
The Blazor Multiverse
Avatar for devNetNoord devnetnoord
0
100
De Architectuur Odyssee
Avatar for devNetNoord devnetnoord
0
59
Azure Kubernetes Service Quickstart
Avatar for devNetNoord devnetnoord
0
67
The Office Copilot
Avatar for devNetNoord devnetnoord
0
50

Other Decks in Technology

See All in Technology
気づかぬうちにセキュリティ負債を生むAPIキー運用
Avatar for Michitaka Sugawara sgwrmctk
0
160
現地で盛り上がった WWDC26 Keynote
Avatar for ZOZO Developers zozotech
PRO
1
250
マルチアカウント環境での コーディングエージェントを使った障害調査が大変なので AIエージェントにReadOnly権限を付与してみた / ReadOnly AI Agents for Multi-Account AWS Incident Response
Avatar for Takashi Yamaguchi yamaguchitk333
2
110
AIのReact習熟度を測る
Avatar for uhyo uhyo
2
620
AWS Security Agent といっしょに脅威モデリングをやってみよう
Avatar for amarelo_n24 amarelo_n24
0
110
AAIFに入ってみた ～内から見えるコミュニティ動向～
Avatar for Satoshi Ito sato4
0
250
自宅LLMの話
Avatar for Kazuto Kusama jacopen
1
600
iAEONの段階的リアーキテクト戦略 / iAEON's_Gradual_Re-architecture_Strategy
Avatar for AEON aeonpeople
0
210
RAG を使わないという選択肢
Avatar for tatsutaka tatsutaka
1
250
【Cyber-sec+】経営層を"動かす"ための考え方
Avatar for Hisashi Hibino hssh2_bin
0
190
AGENTS.mdとSkillsで始めるAIエージェント活用
Avatar for そのだ sonoda_mj
3
220
アジャイルな経理と Claude Code と 経営の未来
Avatar for Yasunobu Kawaguchi kawaguti
PRO
3
150

Featured

See All Featured
Side Projects
Avatar for Sacha Greif sachag
455
43k
The agentic SEO stack - context over prompts
Avatar for schlessera schlessera
0
820
Redefining SEO in the New Era of Traffic Generation
Avatar for Szymon Słowik szymonslowik
1
340
Dominate Local Search Results - an insider guide to GBP, reviews, and Local SEO
Avatar for Greg Gifford greggifford
PRO
0
190
Jess Joyce - The Pitfalls of Following Frameworks
Avatar for Tech SEO Connect techseoconnect
PRO
1
170
We Are The Robots
Avatar for Honza Javorek honzajavorek
0
250
Templates, Plugins, & Blocks: Oh My! Creating the theme that thinks of everything
Avatar for Michelle Schulp Hunt marktimemedia
31
2.8k
AI Search: Implications for SEO and How to Move Forward - #ShenzhenSEOConference
Avatar for Aleyda Solis aleyda
1
1.3k
ピンチをチャンスに：未来をつくるプロダクトロードマップ #pmconf2020
Avatar for Aki / @LoveIdahoBurger aki_iinuma
128
56k
Build your cross-platform service in a week with App Engine
Avatar for Jose L jlugia
234
18k
JavaScript: Past, Present, and Future - NDC Porto 2020
Avatar for David Neal reverentgeek
52
6k
Efficient Content Optimization with Google Search Console & Apps Script
Avatar for Katarina Dahlin katarinadahlin
PRO
1
620

Transcript

  1. OWASP & .NET Arris Huijgen Security Consultant, Deloitte [email protected] www.deloitte.nl

  2. Agenda • OWASP • Injection • Authentication & Session Management

    • Cross-site scripting

  3. Agenda • OWASP • Injection • Authentication & Session Management

    • Cross-site scripting

  4. The Open Web Application Security Project https://www.owasp.org OWASP

  5. OWASP 1. Injection 2. Broken Authentication and Session Management 3.

    Cross Site Scripting (XSS) 4. Insecure Direct Object References 5. Security Misconfiguration 6. Sensitive Data Exposure 7. Missing Function Level Access Control 8. Cross Site Request Forgery (CSRF) 9. Using Known Vulnerable Components 10.Unvalidated Redirects and Forwards

  6. Agenda • OWASP • Injection • Authentication & Session Management

    • Cross-site scripting

  7. Injection

  8. Injection • var results = ExecuteQuery(" SELECT * FROM accounts

    WHERE custID='"+Request.QueryString["id"] +"'"); • http://example.com/AccountView.aspx ?id=' or '1'='1 • var results = ExecuteQuery(" SELECT * FROM accounts WHERE custID='' or '1'='1'");

  9. Injection • Bad conn = pool.getConnection(); string sql = "SELECT

    * FROM user WHERE username='" + username +"'"); stmt = conn.createStatement(); rs = stmt.executeQuery(sql);

  10. Injection • Good conn = pool.getConnection(); string selectStatement = "SELECT

    * FROM user WHERE username = ?"; PreparedStatement prepStmt = conn.prepareStatement(selectStatement); prepStmt.setString(1, username); ResultSet rs = prepStmt.executeQuery();

  11. Injection • Command Injection Process.Start("find", args[0]); • LDAP Injection string

    ldapQuery = "cn=" + getParameter("userName") + ", ou=Users"; • HTTP Response Header Splitting string referrer = Request.QueryString["page"]; Response.Redirect(referrer); GET /redirect?page=%0D%0A%0D%0AHTTP/1.1 200 OK%0D%0AContent-Type: text/html%0D%0A%0D%0%3Chtml%3Ehello%3C/html%3E HTTP/1.1 302 Found  HTTP/1.1 200 OK Server: Apache Content-Type: text/html Location: <html>hello</html>

  12. Injection Demo time!

  13. Agenda • OWASP • Injection • Authentication & Session management

    • Cross-site scripting

  14. Broken Authentication & Session Management

  15. Broken Authentication & Session Management • Implementation; • Authentication credentials

    not encrypted when stored; • Credentials or SessionIDs sent over an unencrypted channel.

  16. Broken Authentication & Session Management • Session ID in Link:

    http://example.com/sale/saleitems.aspx? sessionid=2P0OC2JSNPSKHCJUN2JV • No session time-out; • Session mixing; • Session fixation.

  17. Broken Authentication & Session Management • Regenerate session at login/logout:

    Session.Abandon(); Response.Cookies.Add( new HttpCookie("ASP.NET_SessionId", "")); • Session timeout: <system.web> <sessionState timeout="20"></sessionState> </system.web> • Logout: – Invalidate session; – Destroy cookie.

  18. Broken Authentication & Session Management Example • Customers need to

    authenticate in two steps: – Provide username and Date of Birth; – Provide password.

  19. Broken Authentication & Session Management

  20. Agenda • OWASP • Injection • Authentication & Session Management

    • Cross-site scripting

  21. Cross-site Scripting (XSS)

  22. Cross-site Scripting (XSS) • Reflected: http://website.com/Default.aspx?title= <script>alert('XSS')</script> • Stored:

  23. Cross-site Scripting (XSS) XSS may lead to: • Hijacked Sessions;

    • Insertion of Content; • Defacement; • Redirecting.

  24. Cross-site Scripting (XSS) Prevention: • Properly escape untrusted data: –

    HTML Entities (&lt; &gt; &quot;); • Whitelist Input Validation; • Auto-Sanitization Libraries; • Content Security Policy (CSP); • HTTPOnly flag.

  25. Cross-site Scripting (XSS) • XSS: – Context specific; – Browser

    specific. • Use Anti-XSS library: Microsoft AntiXSS. • Additionally; enable Anti-XSS components.

  26. Cross-site Scripting (XSS) AntiXss • LDAP encoders • CssEncode() •

    HtmlEncode() (shortcut in MVC <%: Model.Value %>) • HtmlAttributeEncode() • UrlEncode() • HtmlFormUrlEncode() • XmlEncode() • XmlAttributeEncode() • JavaScriptEncode() • VisualBasicScriptEncode() • But AntiXss does not offer: – JSON encoding.

  27. Cross-site Scripting (XSS) Notes: • ‘Split’ attacks. add(new Label("lblHello", "hello

    " + user.FirstName + " " + user.LastName)); user.firstName = "Jan<script type=\"javascript\""; user.lastName = ">alert(\"XSS\");</script>Klaassen"; • HttpOnly cookie flag.

  28. Injection Demo time!

  29. Thank you! [email protected] www.deloitte.nl

  30. Trainings Want to know more about security/hacking? Follow one of

    our HackLab trainings: HackLab: Demo editie - 26 & 27 maart - Zwolle HackLab: Hands-on Hacking - 7-11 april - Amsterdam HackLab: Malware Analysis - 14-16 april – Amsterdam www.deloitte.nl/academy [email protected] www.deloitte.nl

  31. [email protected] www.deloitte.nl Bzz. You’ve heard about application security. Now make

    it visible. www.owasp.org

  32. Deloitte refers to one or more of Deloitte Touche Tohmatsu

    Limited, a UK private company limited by guarantee, and its network of member firms, each of which is a legally separate and independent entity. Please see www.deloitte.com/about for a detailed description of the legal structure of Deloitte Touche Tohmatsu Limited and its member firms. Deloitte provides audit, tax, consulting, and financial advisory services to public and private clients spanning multiple industries. With a globally connected network of member firms in more than 150 countries and territories, Deloitte brings world-class capabilities and high-quality service to clients, delivering the insights they need to address their most complex business challenges. Deloitte’s more than 200,000 professionals are committed to becoming the standard of excellence. This communication contains general information only, and none of Deloitte Touche Tohmatsu Limited, its member firms, or their related entities (collectively, the “Deloitte network”) is, by means of this communication, rendering professional advice or services. No entity in the Deloitte network shall be responsible for any loss whatsoever sustained by any person who relies on this communication.