Beyond Scanning

Slides from my talk at SeleniumConf UK 2016!

Transcript

1. Let’s talk Security Beyond Scanning Dheeraj Joshi @dheerajhere
2. • Front-End @ • Previously @ • Open Source (medium-cli) • Ambidextrous TT Player About Me
3. More... Uber, CKEditor, Dropbox, MailChimp, Recruiterbox, InVision, DigitalOcean, Intuit, Groupon, etc. What makes me happy?
4. In this talk... • Why ? • Cross-site Scripting (XSS) • Cross-site Request Forgery (CSRF) • Content Security Policy (CSP) • HTTP Security Headers • Best Practices & Demo
5. Why should we Care about Security? Startups & SMEs are known to cut corners. One of the first things they cut is ‘Security'.
9. Password Reuse Attacks
10. HACKER PUTS HOSTING SERVICE “CODE SPACES” OUT OF BUSINESS The Shutdown
11. CROSS SITE SCRIPTING - XSS • XSS attack users • Inject Malicious content • Exploits can be real bad
12. What is XSS? Typical Reflected XSS
13. Stored XSS
14. DOM XSS
15. Hunt... • Data <-> Code • Input Validation • Check HTML Encoding • Sanitizers • Analyze places where DOM elements are created
16. XSS via template injection Using Sandbox Bypasses http://blog.portswigger.net/2016/04/adapting-angularjs -payloads-to-exploit.html
17. • Check for HTTPOnly, Secure flag on Session Cookie
18. CROSS-SITE REQUEST FORGERY (CSRF)
19. Because the attack is carried out by the victim, CSRF can bypass: • HTTP Auth • Session-based auth • Firewalls CSRF Attacks
20. • Only accepting POST requests • Referer Protection • Multi-Step Transactions • URL Rewriting • application/json “CSRF Myths” Preventions that Won’t work
21. XSS + CSRF = ?
22. Content Security Policy (CSP) CSP Evaluator (https://csp-evaluator.withgoogle.com)
23. HTTP Security headers • Strict-Transport-Security: max-age=16070400; includeSubDomains • X-Frame-Options: deny • X-XSS-Protection: 1; mode=block • X-Content-Type-Options: nosniff
24. Defense • Strategy - Integrate into SDLC • Static Code Analysis • Security Audits • CTFs
25. Show Time !
26. Questions ?
27. Thank you @dheerajhere @djadmin