Women of Silicon Roundabout security workshop

A short introductory workshop about web security run by Rosa Fox and Jenny Duckett at Women of Silicon Roundabout 2017

Exercise 1: https://www.codebashing.com/sql_demo
Exercise 2: https://cxa.codebashing.com/courses/nodejs/lessons/persistent_stored_xss

Transcript

1. Rosa Fox and Jenny Duckett Government Digital Service @rosaemerald, @jenny_duckett
2. Welcome!
3. GDS What do we mean by security on the web?
4. GDS We aren’t security experts
5. GDS Web security is a huge topic
6. GDS ...but understanding some general principles really helps
7. GDS Don’t trust user input
8. GDS Tools can help, but understand how to use them properly and their limitations
9. GDS There is one thing you need to know before we begin: Computer Misuse Act 1990 Unauthorised access to computer material can be punishable by imprisonment
10. Code injection
11. GDS Getting your code onto someone else’s server and making it run The code can come from any user input It can damage anything on the server
12. GDS Practical exercise! First link at https://speakerdeck.com/jennyd https://www.codebashing.com/sql_demo Step 8 email address = alice@bank.com
13. GDS SQL injection 'SELECT * FROM data WHERE name=' + 'bobby' + ';'
14. GDS SQL injection 'SELECT * FROM data WHERE name=' + '1; DROP TABLE users' + ';'
15. GDS https://xkcd.com/327/
16. GDS Remote code execution using ImageMagick... ImageTragick!
17. GDS “We had thousands of hits in the first 15 minutes. We were at the top of hacker news, which a lot of people see. We were getting the word out on something tragickally simple to exploit. We'd do it again.” https://imagetragick.com/
18. Code also runs in browsers
19. GDS Cookies and Authentication (logging in!)
20. Cross-site scripting (XSS)
21. It’s useful to think of this as JavaScript injection GDS
22. GDS Practical exercise! Second link at https://speakerdeck.com/jennyd https://cxa.codebashing.com/courses/nodejs /lessons/persistent_stored_xss
23. What else can you do with XSS? GDS
24. Two types of XSS: • persistent (stored) • reflected GDS
25. http://example.com/search?query=<script>alert('xss')</script> GDS
26. Social engineering
27. GDS People are fallible
28. GDS Make security that works for people https://www.ncsc.gov.uk/information/people-strongest-link
29. GDS https://www.youtube.com/watch?v=bjYhmX_OUQQ
30. Learn more about web security
31. GDS OWASP Top 10 Falsehoods developers believe about security Ruby on Rails security guide www.hacksplaining.com Google Gruyere
32. GDS https://speakerdeck.com/jennyd https://gdstechnology.blog.gov.uk/
33. Thanks!