Slide 1
Slide 1 text
Text
Shiny,
Let’s Be Bad Guys!
Exploiting and Mitigating the
Top 1
0 Web App Vulnerabilities
Mike Pirnat - @mpirnat
David Stanek - @dstanek
Slide 2
Slide 2 text
Announcements
Slide 3
Slide 3 text
Schedule & Lunch
• This session will run 9:00 AM - 12:20 PM
• 20-minute break at 10:50 AM
• Lunch 12:20 PM - 1:20 PM
• Lunch moved to Exhibit Hall D
Slide 4
Slide 4 text
Volunteering
Opportunities
• Low-commitment! Fun!
• SWAG bagging: Thursday 4-8 PM
• Just do 10 bags! (~1/2 hr)
• Registration Desk: any time
• 1-2 hours helps
• Friday => meet everyone!
Slide 5
Slide 5 text
Volunteering Info
• Current needs:
http://bit.ly/pycon-volunteering-status
• More information:
http://bit.ly/pycon2013-volunteer
Slide 6
Slide 6 text
Tutorial Feedback
• Go here:
• https://www.surveymonkey.com/s/
pycon2013_tutorials or
• https://goo.gl/PvHDc
• Be honest!
Slide 7
Slide 7 text
http://i.qkme.me/3r16r5.jpg
Slide 8
Slide 8 text
Q
Who here has
vulnerable apps?
Slide 9
Slide 9 text
Why it Matters
• Your users
• Your data
• Your business
Slide 10
Slide 10 text
OWASP
• http://www.owasp.org
• Open Web Application Security Project
• Non-profit focused on improving software
security
• Documentation and tools to help learn
about security and protect your apps
Slide 11
Slide 11 text
OWASP Top Ten
• Based on risk data from 8 firms
• Over 500,000 vulnerabilities, hundreds of
orgs, thousands of apps
• Selected & prioritized by prevalence data
combined with estimates of exploitability,
detectability, and impact
• Recently updated for 2013!
Slide 12
Slide 12 text
Today
• Background on a type of vulnerability
• Exploit it!
• Discuss prevention
• Django-specific advice where possible
Slide 13
Slide 13 text
Disclaimer
Slide 14
Slide 14 text
Setup: 1
Make a virtualenv:
$ virtualenv badguys
$ cd badguys
$ source bin/activate
Slide 15
Slide 15 text
Setup: 2
Clone our repository:
$ git clone https://github.com/
mpirnat/lets-be-bad-guys src
Or pull the latest changes:
$ cd src
$ git pull
Slide 16
Slide 16 text
Setup: 3
Install dependencies:
$ cd src
$ pip install -r requirements.txt
Slide 17
Slide 17 text
Setup: 2 & 3
(Offline/USB)
• Extract the project:
$ mkdir src
$ unzip /Volumes/BADGUYS/project/
badguys.zip -d src/
• Install dependencies:
$ cd src
$ pip install -r requirements.txt
-i file:///Volumes/BADGUYS/software
Slide 18
Slide 18 text
Setup: 4
Start up the app:
$ python manage.py runserver
Slide 19
Slide 19 text
Find a Partner
Slide 20
Slide 20 text
1
Injection
Slide 21
Slide 21 text
Injection Attacks
• When an application sends untrusted data
to an interpreter
• Can result in data loss/corruption, lack of
accountability, denial of access
• Can lead to complete host takeover
Slide 22
Slide 22 text
Trust No One
• External users
• Internal users
• Administrators
Slide 23
Slide 23 text
Attack Vectors
• GET parameters
• POST parameters
• PATH_INFO
• Some HTTP headers: Cookie, Host
• Uploaded Files
Slide 24
Slide 24 text
Possible
Consequences
• Creation of malicious SQL (or other
queries)
• Accessing private files on disk
• Arbitrary code execution
Slide 25
Slide 25 text
Real-World
Examples
• Sony Playstation Network
• Ruby on Rails
• http://es.pn/Z0jnoi
Slide 26
Slide 26 text
SQL Injection
• Unescaped user input causes the premature
end of a SQL query and allows a malicious
query to be executed...
"""
select * from users where
username='%s';
"""
• http://localhost:8000/injection/sql
Slide 27
Slide 27 text
Accessing Private
Files
• File system access + unvalidated user
input allows attackers to navigate the file
system
• http://localhost:8000/injection/file-
access
Slide 28
Slide 28 text
Arbitrary Code
Execution
• Unsafe input is dynamically evaluated or
executed
• http://localhost:8000/injection/code-
execution
Slide 29
Slide 29 text
Prevention
• Validate ALL user input
• Sign cookies, don’t accept if signature is
bogus/missing
• Use ORMs or bind variables when talking
to the database
• Don’t use eval or exec, beware of pickle,
user-supplied YAML, etc.
Slide 30
Slide 30 text
Django Advice
• Make sure data types for your model are tight
• Use Forms instead of ModelForms for
stronger validation
• Make new validators as needed for your
application
• Make sure your URL regexes for dynamic
URLs are tight
Slide 31
Slide 31 text
Django Advice
• Use the ORM when you can
• When you can’t, use extreme caution!
• Bind variables
• No string concatenation/formatting of
anything that came from the client
Slide 32
Slide 32 text
2
Broken
Authentication
& Session
Management
Slide 33
Slide 33 text
Broken Auth &
Session
Management
• Attacker uses leaks or flaws in
authentication or session management to
impersonate users
• Roll-your-own solutions contribute to the
difficulty of finding these flaws
Slide 34
Slide 34 text
Possible
Consequences
• Compromised user accounts
• Compromised administrative accounts
• Unauthorized use of privileged
functionality
Slide 35
Slide 35 text
Prevention
• Hash or encrypt passwords
• Don’t let credentials be easily overwritten
• Don’t put session IDs in URLs
• Allow session IDs to timeout/log out
• Rotate session IDs after successful login
• TLS connections for passwords, session IDs
Slide 36
Slide 36 text
Django Advice
• Use django.contrib.auth
• Consider https://github.com/yourlabs/
django-session-security middleware for
timing out sessions
• We’ll talk about transport layer security
later on...
Slide 37
Slide 37 text
3
Cross-Site
Scripting (XSS)
Slide 38
Slide 38 text
XSS Attacks
• Cross-Site Scripting (XSS)
• The most prevalent web app security flaw
• App includes user-supplied data in content
sent to the browser without properly
validating or sanitizing it
Slide 39
Slide 39 text
XSS Attacks
• Stored: injected code permanently stored in
database, message forum, comment, etc.
• Reflected: injected code in live request to
server, reflected back in error message or
search result
• DOM: injected code in browser DOM
environment that causes scripts to run in
unexpected ways (eg, reading from URL)
Slide 40
Slide 40 text
Possible
Consequences
• Execute scripts in a victim’s browser
• Hijack sessions
• Deface sites
• Insert hostile content
• Redirect users
• Hijack browser (install malware)
Slide 41
Slide 41 text
Most Often Seen...
• Places where user-created text is
displayed to other users (comments,
messages)
• Form inputs where value is populated
with user-supplied data
• Script tags where user-supplied data is
populated into script variables
Slide 42
Slide 42 text
XSS in
Dynamic URLs
• Part of the URL path is variable, isn’t
validated, and gets included into the page
• http://localhost:8000/cross-site-
scripting/path-matching/your-path-
here
Slide 43
Slide 43 text
XSS in Query
String Parameters
• Unvalidated user input from a query string
parameter is included in the page
• http://localhost:8000/cross-site-
scripting/query-params?qs=awesome
Slide 44
Slide 44 text
XSS in
Form Fields
• The value part of an input is prematurely
terminated, allowing Javascript to be
injected into the element (eg, adding an
onclick)
• http://localhost:8000/cross-site-
scripting/form-field
Slide 45
Slide 45 text
Q
Can you trust the
database?
Slide 46
Slide 46 text
Prevention
• Escape all untrusted data based on the
HTML context the data will be placed into
• Whitelist input validation
• Consider auto-sanitization libraries for rich
content (eg, OWASP’s AntiSamy)
• Update your parents’/in-laws’ browsers!
Slide 47
Slide 47 text
Django Advice
• Be careful with the safe filter,
django.utils.safestring, etc.
• Be careful with your own template tags;
django.utils.html.escape is your friend!
• Use form.as_p, form.as_table,
form.as_ul
Slide 48
Slide 48 text
4
Insecure
Direct Object
References
Slide 49
Slide 49 text
Insecure Direct
Object Reference
• Expose a reference to an internal
implementation object without verifying
authorization
• Attacker changes URL or GET/POST
parameters, cookies
Slide 50
Slide 50 text
Possible
Consequences
• Compromise of all data that can be
referenced by the vulnerable parameter
• Unless the namespace is sparse, an
attacker can easily access all available
data of that type
Slide 51
Slide 51 text
Exercises
• Manipulate parameters in the URL to
access data that doesn’t belong to you
• http://localhost:8000/direct-object-
references
Slide 52
Slide 52 text
Prevention
• Implement access controls on any direct
references to restricted resources
• Implement per-user or per-session
indirect object references
Slide 53
Slide 53 text
Django Advice
• Use permissions architecture to lock
down views
• Customize queryset for looking up objects
that involve user ownership
Slide 54
Slide 54 text
5
Security
Misconfiguration
Slide 55
Slide 55 text
Security
Misconfiguration
• Insecure application settings
• Unpatched flaws
• Unused pages
Slide 56
Slide 56 text
Possible
Consequences
• Unauthorized access to some system
data or functionality
• Potential complete system compromise
Slide 57
Slide 57 text
Exercises
• Demos and discussion
• http://localhost:8000/misconfiguration
Slide 58
Slide 58 text
Prevention
• Have a repeatable hardening process
• Have a process for keeping on top of
updates and patches
• Architecture that provides secure
separation between components
• Periodic scans and audits
Slide 59
Slide 59 text
Django Advice
• Don’t run in debug mode in production
• Keep your SECRET_KEY secret!
• Keep Python code out of webserver’s root
• Don’t run admin publicly (if you can help it)
• Don’t use the built-in admin for normal
user admin tasks
Slide 60
Slide 60 text
Q
Gateway to Social
Engineering?
Slide 61
Slide 61 text
6
Sensitive
Data Exposure
Slide 62
Slide 62 text
Sensitive Data
Exposure
• Failure to properly protect credit cards, tax
ids, authentication credentials, etc.
• Sensitive data deserves extra protection
such as encryption at rest or in transit,
special precautions when exchanged with
the browser
Slide 63
Slide 63 text
Insecure
Cryptographic
Storage
• Not encrypting worthy data
• Unsafe key generation & storage, failure to
rotate keys
• Weak algorithms
• Weak or unsalted hashes
Slide 64
Slide 64 text
Insufficient
Transport Layer
Protection
• May not authenticate, encrypt, and protect
the confidentiality and integrity of sensitive
network traffic
• May use weak algorithms
• May use expired or invalid certificates
• May use certificates incorrectly
Slide 65
Slide 65 text
Possible
Consequences
• Compromise of all data that should have
been encrypted
• This can be highly sensitive information:
credentials, credit cards, personal data,
health records, etc.
Slide 66
Slide 66 text
Possible
Consequences
• Expose individual users’ data
• Account theft
• Compromise an admin account?!
• Poor SSL setup can facilitate phishing
and man-in-the-middle attacks
Slide 67
Slide 67 text
Attack Vectors
• Attacker monitors network traffic of your
users
• Maybe in public places (Starbucks,
conference wi-fi, etc.)
• Maybe back end connections
• Maybe inside your network (!!!)
Slide 68
Slide 68 text
Prevention
• Encrypt sensitive data at rest
• Encrypt offsite backups; manage keys
separately
• Use strong standard algorithms, strong keys
• Hash passwords with strong standard algorithm
& use appropriate salt
• Protect passwords & keys from unauthorized
access
Slide 69
Slide 69 text
Prevention
• Require SSL for all sensitive pages; redirect
non-SSL requests to SSL
• Set the “secure” flag on sensitive cookies
• Use only strong SSL algorithms
• Ensure your cert is valid, not expired, not
revoked, and matches your domain
• SSL/encryption on the back end too
Slide 70
Slide 70 text
Django Advice
• Use django.contrib.auth for proper password
salting and hashing
• Require SSL in Apache or Nginx
• Require SSL using middleware:
• http://www.redrobotstudios.com/blog/2010/02/06/
requiring-https-for-certain-paths-in-django/
• http://djangosnippets.org/snippets/2833/
• http://djangosnippets.org/snippets/1467/
Slide 71
Slide 71 text
7
Missing
Function Level
Access Control
Slide 72
Slide 72 text
Missing
Function Level
Access Control
• Application doesn’t protect its functions
properly
• Misconfiguration
• Forgot proper code checks
Slide 73
Slide 73 text
Attack Vectors
• Authorized user changes a URL or
parameter to a privileged function
• Anonymous users could access private
functions that aren’t protected
Slide 74
Slide 74 text
Possible
Consequences
• Compromised user accounts
• Compromised administrative accounts
• Unauthorized use of privileged
functionality
Slide 75
Slide 75 text
Exercises
• Manipulate the URL to access privileged
functionality
• http://localhost:8000/missing-access-
control
Slide 76
Slide 76 text
Prevention
• Consider every page; public or private?
• If authentication is required, make sure
that checks are in place
• If additional authorization is required,
make sure that checks are in place
• Deny all by default; explicitly grant access
to users or roles
Slide 77
Slide 77 text
Django Advice
• Use the permissions architecture to
lock down views
• Don’t use the built-in admin for normal
user admin tasks
Slide 78
Slide 78 text
8
Cross-Site
Request Forgery
Slide 79
Slide 79 text
CSRF Attacks
• Cross-Site Request Forgery (CSRF)
• Attacker tricks victim into submitting
forged HTTP requests
• Attack succeeds if user is authorized/
authenticated
Slide 80
Slide 80 text
Attack Vectors
• Image tags
• Cross-Site Scripting (XSS)
• Fake buttons
• Phishing forms
• Other techniques
Slide 81
Slide 81 text
Possible
Consequences
• Cause victim to change any data the
victim is allowed to change
• Cause victim to perform any function the
victim is authorized to use
• Impact varies based on victim’s role
• Think of some possibilities...
Slide 82
Slide 82 text
Real-World
Examples
• Facebook:
http://amolnaik4.blogspot.com/
2012/08/facebook-csrf-worth-
usd-5000.html
• Google/Gmail:
http://cryptogasm.com/2012/02/does-
google-understand-csrf/
Slide 83
Slide 83 text
CSRF via Image
• Craft an “image” link that triggers some
site functionality
• http://localhost:8000/csrf/image
Slide 84
Slide 84 text
What if...
Slide 85
Slide 85 text
CSRF via
Form Post
• Create an innocuous-looking form that
POSTs to a vulnerable location
• http://localhost:8000/csrf/third-party-
site
Slide 86
Slide 86 text
Prevention
• Don’t “do” things on a GET
• Include a unique token in a hidden field
(often used in concert with a cookie)
• Validate token to make sure the request
is from on-site
• Avoid putting the token into a query string
Slide 87
Slide 87 text
Django Advice
• Don’t change the built-in settings!
• Do use the CSRF middleware and
template tag in forms
• Be VERY CAREFUL about deactivating it
(csrf_exempt decorator)
• Be careful about APIs (Tastypie, oauth)
Slide 88
Slide 88 text
9
Using Known
Vulnerable
Components
Slide 89
Slide 89 text
Components
with Known
Vulnerabilities
• Libraries, frameworks, and other modules
almost always run with full privilege
• Hard to stay up to date on everything
• Do you even know all the components in
use, let alone their versions?
• Components with known problems can be
identified & exploited with automated tools
Slide 90
Slide 90 text
Attack Vectors
• Attacker identifies a weak component
through scanning or manual analysis
• Customize exploit as needed
• More difficult the deeper the component is
in the application
Slide 91
Slide 91 text
Possible
Consequences
• Full range of weaknesses are possible
• Impact could be minimal, or...
• Complete host takeover!
• Data compromise!
Slide 92
Slide 92 text
Prevention
• Don’t use components you don’t write
(unrealistic)
• Keep components up to date
• Identify all components and versions
• Monitor security of these components
Slide 93
Slide 93 text
Django Advice
When @jacobian says there are new
security releases for Django, upgrade!
Slide 94
Slide 94 text
1
0
Unvalidated
Redirects &
Forwards
Slide 95
Slide 95 text
Redirection Abuse
• Attacker tricks user into visiting a URL that
redirects or forwards the request without
validating the redirect location
• Users prone to click because the link is to
a legitimate site
Slide 96
Slide 96 text
Possible
Consequences
• Install malware
• Phishing/information disclosure
• Bypass access controls
Slide 97
Slide 97 text
External
Redirection
• Use a redirection URL to redirect to an
external location
• http://localhost:8000/redirects-and-
forwards/redirects
Slide 98
Slide 98 text
Forwards
• Manipulate a forward parameter to gain
access to privileged functionality
• http://localhost:8000/redirects-and-
forwards/forwards
Slide 99
Slide 99 text
Prevention
• Don’t use redirects or forwards
• Don’t involve user-supplied data to build
the redirect location
• Ensure the supplied value is valid and
authorized for the user
Slide 100
Slide 100 text
Django Advice
• Use django.utils.http.is_safe_url to
check redirect URLs
• Used by django.contrib.auth internally
• Consider wrapping is_safe_url if you have
to allow other off-domain URLs
Slide 101
Slide 101 text
Q
Who here has
vulnerable apps?
Slide 102
Slide 102 text
Parting Thoughts
Slide 103
Slide 103 text
Think Like
a Bad Guy
Slide 104
Slide 104 text
Don’t Stop at Ten
Slide 105
Slide 105 text
Constant Change
Slide 106
Slide 106 text
Think Positive
Slide 107
Slide 107 text
Announcements
• Lunch—moved to Exhibit Hall D
• Feedback—https://goo.gl/PvHDc
• Volunteer:
http://bit.ly/pycon2013-volunteer
http://bit.ly/pycon-volunteering-status
Slide 108
Slide 108 text
Links
• http://www.owasp.org
• https://www.owasp.org/index.php/
Category:OWASP_Top_Ten_Project
• https://docs.djangoproject.com/en/dev/
topics/security/
• https://github.com/mpirnat/lets-be-bad-guys
Slide 109
Slide 109 text
Contact Us
Mike Pirnat
http://mike.pirnat.com
@mpirnat
David Stanek
http://traceback.org
@dstanek