Hello World 2017 - Get the basics right!

Título: Get the basics right!
Autor: Renato Rodrigues
Contacto: https://twitter.com/simps0n

Transcript

1. GET THE BASICS RIGHT! HELLO WORLD 2017 by Renato Rodrigues
2. RENATO RODRIGUES SIMPS0N //PATHONPROJECT.COM
3. WEB APPS ISSUES OUT OF THE BOX OUT THERE
4. WEB APPLICATIONS
5. WHAT IS IT? In computing, a web application or web app is a client–server software application which the client (or user interface) runs in a web browser. https://en.wikipedia.org/wiki/Web_application
6. CONCEPT MODERN APPS Images from Google Images.
7. THE BIG PICTURE MAYBE WE SHOULD KNOW WHERE THEY LIVE! We know that a modern Web App is a pile of technology. How many stacks are being used? The links between them? Possible weaknesses? Can we understand:
8. BROWSERS Images from Alrra Browser-Logos.
9. ISSUES
10. CROSS-SITE SCRIPTING (XSS)
11. CROSS-SITE REQUEST FORGERY (CSRF)
12. SQL INJECTION (SQLI)
13. Remote Code Execution (RCE) XML External Entity (XXE) Session Fixation Dir Traversal Insecure Direct Object References Broken Authentication and Session Management Server Side Request Forgery (SSRF) Unvalidated Redirects and Forwards Insecure Cryptographic Storage Relative Path Overwrite (RPO) ...
14. OUT OF THE BOX
15. X-XSS-PROTECTION Sets the configuration for the cross-site scripting filters built into most browsers. The best configuration is "X- XSS-Protection: 1; mode=block". X-XSS-Protection 1; mode=block Information from SecurityHeaders.io
16. X-FRAME-OPTIONS Tells the browser whether you want to allow your site to be framed or not. By preventing a browser from framing your site you can defend against attacks like clickjacking. X-Frame-Options SAMEORIGIN | DENY Information from SecurityHeaders.io
17. X-CONTENT-TYPE-OPTIONS Stops a browser from trying to MIME-sniff the content type and forces it to stick with the declared content-type. This helps to reduce the danger of drive-by downloads. The only valid value for this header is "X-Content-Type-Options: nosniff". X-Content-Type-Options nosniff Information from SecurityHeaders.io
18. CONTENT-SECURITY-POLICY Is an "effective" measure to protect your site from several attacks. By whitelisting sources of approved content, you can prevent the browser from loading malicious assets. Content-Security-Policy default-src 'self'; script-src 'self' ... Information from SecurityHeaders.io CSP Builder (Helper): https://report-uri.io/home/generate
19. STRICT-TRANSPORT-SECURITY Is an excellent feature to support on your site and strengthens your implementation of TLS by getting the User Agent to enforce the use of HTTPS. Strict-Transport-Security max-age=31536000; includeSubdomains; preload Information from SecurityHeaders.io
20. PUBLIC-KEY-PINS Protects your site from MiTM attacks using rogue X.509 certificates. By whitelisting only the identities that the browser should trust, your users are protected in the event a certificate authority is compromised. Public-Key-Pins pin-sha256="t/OMbK...JM="; max-age=600; report- uri="..." Information from SecurityHeaders.io
21. SUBRESOURCE INTEGRITY Mechanism by which user agents may verify that a fetched resource has been delivered without unexpected manipulation. <script src="https://example.com/example-framework.js" integrity="sha384- Li9vy3DqF8tnTXu...gNR/VqsVpcw+T...Jr7" crossorigin="anonymous"></script> Information from . W3C
22. COOKIES Session, Secure, HTTPOnly and SameSite INPUT VALIDATION Client and Serve Side Always! MORE TO COME: SUBORIGINS, REFERRER POLICY, EXPECT-CT ... Not out of box but...
23. OUT THERE
24. BUG BOUNTIES //cobalt.io - //bugcrowd.com - //hackerone.com - //synack.com Search for a Security Page A bug bounty program is a deal offered by many websites and software developers by which individuals can receive recognition and compensation for reporting bugs , especially those pertaining to exploits and vulnerabilities. https://en.wikipedia.org/wiki/Bug_bounty_program
25. REPORT Discovery Date: dd/MM/YY - HH:mm:ss System/Domain: https://sub.website.com/ Vulnerability Type: XSS / RCE / CSRF / ... Description: Detailed explanation of the vulnerability Impact: In the context of the vulnerable service/app. Proof of Concept Data (PoC) * Works in: Google Chrome, Firefox, IE, Safari, ... * Attack Vector: How to trigger the vulnerability. * Payload: What triggers the vulnerability. PoC Image/Video: Visual proof. Mitigation: If we have an idea how to fix, we should suggest. Notes: If pertinent. Always remember to be polite!
26. IT'S OVER! @ - SIMPS0N //PATHONPROJECT.COM