Beyond Scanning

Transcript

1. Let’s talk Security Beyond Scanning Dheeraj Joshi @dheerajhere

2. • Front-End @ • Previously @ • Open Source (medium-cli)

   • Ambidextrous TT Player About Me

3. More... Uber, CKEditor, Dropbox, MailChimp, Recruiterbox, InVision, DigitalOcean, Intuit, Groupon,

   etc. What makes me happy?

4. In this talk... • Why ? • Cross-site Scripting (XSS)

   • Cross-site Request Forgery (CSRF) • Content Security Policy (CSP) • HTTP Security Headers • Best Practices & Demo

5. Why should we Care about Security? Startups & SMEs are

   known to cut corners. One of the first things they cut is ‘Security'.
6. None
7. None
8. None

9. Password Reuse Attacks

10. HACKER PUTS HOSTING SERVICE “CODE SPACES” OUT OF BUSINESS The

    Shutdown

11. CROSS SITE SCRIPTING - XSS • XSS attack users •

    Inject Malicious content • Exploits can be real bad

12. What is XSS? Typical Reflected XSS

13. Stored XSS

14. DOM XSS

15. Hunt... • Data <-> Code • Input Validation • Check

    HTML Encoding • Sanitizers • Analyze places where DOM elements are created

16. XSS via template injection Using Sandbox Bypasses http://blog.portswigger.net/2016/04/adapting-angularjs -payloads-to-exploit.html

17. • Check for HTTPOnly, Secure flag on Session Cookie

18. CROSS-SITE REQUEST FORGERY (CSRF)

19. Because the attack is carried out by the victim, CSRF

    can bypass: • HTTP Auth • Session-based auth • Firewalls CSRF Attacks

20. • Only accepting POST requests • Referer Protection • Multi-Step

    Transactions • URL Rewriting • application/json “CSRF Myths” Preventions that Won’t work

21. XSS + CSRF = ?

22. Content Security Policy (CSP) CSP Evaluator (https://csp-evaluator.withgoogle.com)

23. HTTP Security headers • Strict-Transport-Security: max-age=16070400; includeSubDomains • X-Frame-Options: deny

    • X-XSS-Protection: 1; mode=block • X-Content-Type-Options: nosniff

24. Defense • Strategy - Integrate into SDLC • Static Code

    Analysis • Security Audits • CTFs

25. Show Time !

26. Questions ?

27. Thank you @dheerajhere @djadmin