OWASP 201: Request-Based Security Eric Mann 

ASR 1 - Injection 

The attacker's hostile data can trick the interpreter into executing unintended commands or accessing data without proper authorization. 

xkcd: Exploits of a Mom - https://xkcd.com/327/ 

$db = new \PDO(...); $name = $_POST['name']; $sql = "SELECT * FROM users WHERE email='$name'"; foreach($db->query($sql) as $user) { // ... } curl -X POST -d "[email protected]' OR 1=1;--" http://yoursite.com SELECT * FROM users WHERE email='[email protected]' OR 1=1;--' 

$db = new \PDO(...); $name = $_POST['name']; $sql = "SELECT * FROM users WHERE email=:email"; $statement = $db->prepare($sql); $params = [':email' => $name]; foreach($db->execute($statement, $params) as $user) { // ... } curl -X POST -d "[email protected]' OR 1=1;--" http://yoursite.com SELECT * FROM users WHERE email='[email protected]\' OR 1=1;--' 

function serve_file($filename) { header("Content-Type: application/octet-stream"); header("Content-Disposition: attachment; filename=\"{$filename}\""); header("Content-Length: 11111"); passthru("cat /home/uploads/" . $filename); exit(); } curl -X GET -d "filename=;cat+/etc/letsencrypt/site.com/privkey.pem" http://site.com cat /home/uploads/;cat /etc/letsencrypt/site.com/privkey.pem 

function serve_file($filename) { // Sanitize the filename before it's used $sanitized = basename($filename); header("Content-Type: application/octet-stream"); header("Content-Disposition: attachment; filename=\"{$sanitized}\""); header("Content-Length: 11111"); $path = "/home/uploads/{$sanitized}"; passthru('cat ' . escapeshellarg($path)); exit(); } curl -X GET -d "filename=;cat+/etc/letsencrypt/site.com/privkey.pem" http://site.com cat /home/uploads/privkey.pem 

ASR 2 - Broken Authentication 

Application functions related to authentication and session management are often not implemented correctly... 

Client-side Sessions Don’t trust the user to store sensitive information Don’t trust information provided by the user Don’t store sensitive information with an untrusted party Don’t use cookies to store sensitive data (If you are using cookies, use secure cookies - but only store identifiers) 

Password Management Passwords should NEVER be stored in plaintext. Passwords should NEVER be stored with encryption. Passwords should ONLY be stored using one-way hashes. Try to avoid passwords in the first place... 

No content

(Full image slide. No text) 

Problems with JWT Leaking sensitive information The `none` algorithm is required by the spec Algorithm confusion - RSA vs HMAC Weak algorithms are allowed 

What you should do Only store session data on the server Ensure strong authentication protects user identities Lock down insecure algorithms and primitives Only use trusted third-party library implementations 

ASR 4 - XML External Entities 

Untrusted XML input containing a reference to an external entity is processed by a weakly configured XML parser ... 

]> Friend of &name; &name; &name; - 2019 ]> &info; 

]> &bomb; 

$default = libxml_disable_entity_loader(true); $dom = new DOMDocument(); $dom->loadXML($xml); // Do things with XML // Restore the previous value libxml_disable_entity_loader($default); What you should do 

ASR 7 - Cross-Site Scripting (XSS) 

An application takes untrusted data and sends it to a web browser without proper validation or escaping. 





ASR 8 - Insecure Deserialization 

Languages’ native deserialization mechanisms can be repurposed for malicious effect when operating on untrusted data. 

class CartCache { $cache_file; $data = []; // ... /** * Automatically purge the cache file from disk to clean up */ public function __destruct() { $file = "/var/www/cache/tmp/carts/{$this->cache_file}"; if ($this->cleanup && file_exists($file)) { @unlink($file); } } } $data = unserialize($_GET['data']); https://yoursite.com/endpoint.php?data=O:9:"CartCache":2:{s:10:"cache_file";s:18:"../../../i ndex.php";s:4:"data";a:0:{}} 

Do not pass untrusted user input to unserialize() regardless of the options value of allowed_classes. 

Questions? 

Thank you [email protected] | 503.925.6266