Slide 1

Slide 1 text

Testing python security PyconIE 2018 1 @jmortegac Testing Python Security José Manuel Ortega @jmortegac

Slide 2

Slide 2 text

Testing python security PyconIE 2018 2 @jmortegac ● Develop Python scripts for automating security and pentesting tasks ● Discover the Python standard library's main modules used for performing security-related tasks ● Automate analytical tasks and the extraction of information from servers ● Explore processes for detecting and exploiting vulnerabilities in servers ● Use network software for Python programming ● Perform server scripting and port scanning with Python ● Identify vulnerabilities in web applications with Python ● Use Python to extract metadata and forensics

Slide 3

Slide 3 text

Testing python security PyconIE 2018 3 @jmortegac jmortega.github.io

Slide 4

Slide 4 text

Testing python security PyconIE 2018 4 @jmortegac 1. Secure coding 2. Dangerous functions 3. Common attack vectors 4. Static analisys tools 5. Other security issues

Slide 5

Slide 5 text

Testing python security PyconIE 2018 5 @jmortegac Secure coding 1. Analysis of architectures involved 2. Review of implementation details 3. Verification of code logic and syntax 4. Operational testing (unit testing, white-box) 5. Functional testing (black-box)

Slide 6

Slide 6 text

Testing python security PyconIE 2018 6 @jmortegac Unsafe python components

Slide 7

Slide 7 text

Testing python security PyconIE 2018 7 @jmortegac Dangerous Python Functions

Slide 8

Slide 8 text

Testing python security PyconIE 2018 8 @jmortegac Security issues Here’s a list of handful of other potential issues to watch for: ● Dangerous python functions like eval() ● Serialization and deserialization objects with pickle ● SQL and JavaScript snippets ● API keys included in source code ● HTTP calls to internal or external web services

Slide 9

Slide 9 text

Testing python security PyconIE 2018 9 @jmortegac Improper input/output validation

Slide 10

Slide 10 text

Testing python security PyconIE 2018 10 @jmortegac eval() eval(expression[, globals[, locals]])

Slide 11

Slide 11 text

Testing python security PyconIE 2018 11 @jmortegac eval() No globals

Slide 12

Slide 12 text

Testing python security PyconIE 2018 12 @jmortegac eval() eval("__import__('os').system('clear') ", {}) eval("__import__('os').system('rm -rf')", {})

Slide 13

Slide 13 text

Testing python security PyconIE 2018 13 @jmortegac eval() Refuse access to the builtins

Slide 14

Slide 14 text

Testing python security PyconIE 2018 14 @jmortegac eval()

Slide 15

Slide 15 text

Testing python security PyconIE 2018 15 @jmortegac Serialization and Deserialization with Pickle WARNING: pickle or cPickle are NOT designed as safe/secure solution for serialization

Slide 16

Slide 16 text

Testing python security PyconIE 2018 16 @jmortegac Serialization and Deserialization with Pickle

Slide 17

Slide 17 text

Testing python security PyconIE 2018 17 @jmortegac Serialization and Deserialization with Pickle

Slide 18

Slide 18 text

Testing python security PyconIE 2018 18 @jmortegac Serialization and Deserialization with Pickle

Slide 19

Slide 19 text

Testing python security PyconIE 2018 19 @jmortegac Serialization and Deserialization with Pickle

Slide 20

Slide 20 text

Testing python security PyconIE 2018 20 @jmortegac Security issues Overflow errors ● The buffer overflow ● The integer or arithmetic overflow >> print xrange(2**63) Traceback (most recent call last): File "", line 1, in OverflowError: Python int too large to convert to C long >>> print range(2**63) Traceback (most recent call last): File "", line 1, in OverflowError: range() result has too many items

Slide 21

Slide 21 text

Testing python security PyconIE 2018 21 @jmortegac Input injection attacks

Slide 22

Slide 22 text

Testing python security PyconIE 2018 22 @jmortegac Command Injection @app.route('/menu',methods =['POST']) def menu(): param = request.form [ ' suggestion '] command = ' echo ' + param + ' >> ' + ' menu.txt ' subprocess.call(command,shell = True) with open('menu.txt','r') as f: menu = f.read() return render_template('command_injection.html', menu = menu)

Slide 23

Slide 23 text

Testing python security PyconIE 2018 23 @jmortegac Command Injection @app.route('/menu',methods =['POST']) def menu(): param = request.form [ ' suggestion '] command = ' echo ' + param + ' >> ' + ' menu.txt ' subprocess.call(command,shell = False) with open('menu.txt','r') as f: menu = f.read() return render_template('command_injection.html', menu = menu)

Slide 24

Slide 24 text

Testing python security PyconIE 2018 24 @jmortegac Command Injection

Slide 25

Slide 25 text

Testing python security PyconIE 2018 25 @jmortegac shlex module

Slide 26

Slide 26 text

Testing python security PyconIE 2018 26 @jmortegac PyExecCmd

Slide 27

Slide 27 text

Testing python security PyconIE 2018 27 @jmortegac Common attack vectors on web applications OWASP TOP 10: A1 Injection A2 Broken Authentication and Session Management A3 Cross-Site Scripting (XSS) A4 Insecure Direct Object References A5 Security Misconfiguration A6 Sensitive Data Exposure A7 Missing Function Level Access Control A8 Cross-Site Request Forgery (CSRF) A9 Using Components with Known Vulnerabilities A10 Unvalidated Redirects and Forwards

Slide 28

Slide 28 text

Testing python security PyconIE 2018 28 @jmortegac SQL Injection @app.route('/filtering') def filtering(): param = request.args.get('param', 'not set') Session = sessionmaker(bind = db.engine) session = Session() result = session.query(User).filter(" username ={} ".format(param)) for value in result: print(value.username , value.email) return ' Result is displayed in console.'

Slide 29

Slide 29 text

Testing python security PyconIE 2018 29 @jmortegac Prevent SQL injection attacks Prevent SQL injection attacks ● NEVER concatenate untrusted inputs in SQL code. ● Concatenate constant fragments of SQL (literals) with parameter placeholders. ● cur.execute("SELECT * FROM students WHERE name= '%s';" % name) ● c.execute("SELECT * from students WHERE name=(?)" , name)

Slide 30

Slide 30 text

Testing python security PyconIE 2018 30 @jmortegac Prevent SQL injection attacks

Slide 31

Slide 31 text

Testing python security PyconIE 2018 31 @jmortegac XSS from flask import Flask , request , make_response app = Flask(__name__) @app.route ('/XSS_param',methods =['GET ]) def XSS(): param = request.args.get('param','not set') html = open('templates/XSS_param.html ').read() resp = make_response(html.replace('{{ param}}',param)) return resp if __name__ == ' __main__ ': app.run(debug = True)

Slide 32

Slide 32 text

Testing python security PyconIE 2018 32 @jmortegac XSS Server Side Template Injection (SSTI)

Slide 33

Slide 33 text

Testing python security PyconIE 2018 33 @jmortegac XSS

Slide 34

Slide 34 text

Testing python security PyconIE 2018 34 @jmortegac XSS

Slide 35

Slide 35 text

Testing python security PyconIE 2018 35 @jmortegac Automated security testing Automatic Scanning tools: ● SQLMap: Sql injection ● XSScrapy: Sql injection and XSS Source Code Analysis tools: ● Bandit: Open Source and can be easily integrated with Jenkins CI/CD

Slide 36

Slide 36 text

Testing python security PyconIE 2018 36 @jmortegac XSScrapy https://github.com/DanMcInerney/xsscrapy

Slide 37

Slide 37 text

Testing python security PyconIE 2018 37 @jmortegac SQLMap

Slide 38

Slide 38 text

Testing python security PyconIE 2018 38 @jmortegac SQLMap

Slide 39

Slide 39 text

Testing python security PyconIE 2018 39 @jmortegac Bandit

Slide 40

Slide 40 text

Testing python security PyconIE 2018 40 @jmortegac Bandit

Slide 41

Slide 41 text

Testing python security PyconIE 2018 41 @jmortegac Bandit Test plugins

Slide 42

Slide 42 text

Testing python security PyconIE 2018 42 @jmortegac Bandit Test plugins

Slide 43

Slide 43 text

Testing python security PyconIE 2018 43 @jmortegac Bandit Test plugins

Slide 44

Slide 44 text

Testing python security PyconIE 2018 44 @jmortegac Bandit Test plugins

Slide 45

Slide 45 text

Testing python security PyconIE 2018 45 @jmortegac Bandit Test plugins

Slide 46

Slide 46 text

Testing python security PyconIE 2018 46 @jmortegac Bandit Test plugins

Slide 47

Slide 47 text

Testing python security PyconIE 2018 47 @jmortegac Bandit Test plugins SELECT %s FROM derp;” % var “SELECT thing FROM ” + tab “SELECT ” + val + ” FROM ” + tab + … “SELECT {} FROM derp;”.format(var)

Slide 48

Slide 48 text

Testing python security PyconIE 2018 48 @jmortegac Syntribos Buffer Overflow Command Injection CORS Wildcard Integer Overflow LDAP Injection SQL Injection String Validation XML External Entity Cross Site Scripting (XSS) Regex Denial of Service (ReDoS)

Slide 49

Slide 49 text

Testing python security PyconIE 2018 49 @jmortegac Other security issues CPython vulnerabilities

Slide 50

Slide 50 text

Testing python security PyconIE 2018 50 @jmortegac Other security issues Insecure packages – acqusition (uploaded 2017-06-03 01:58:01, impersonates acquisition) – apidev-coop (uploaded 2017-06-03 05:16:08, impersonates apidev-coop_cms) – bzip (uploaded 2017-06-04 07:08:05, impersonates bz2file) – crypt (uploaded 2017-06-03 08:03:14, impersonates crypto) – django-server (uploaded 2017-06-02 08:22:23, impersonates django-server-guardian-api) – pwd (uploaded 2017-06-02 13:12:33, impersonates pwdhash) – setup-tools (uploaded 2017-06-02 08:54:44, impersonates setuptools) – telnet (uploaded 2017-06-02 15:35:05, impersonates telnetsrvlib) – urlib3 (uploaded 2017-06-02 07:09:29, impersonates urllib3) – urllib (uploaded 2017-06-02 07:03:37, impersonates urllib3)

Slide 51

Slide 51 text

Testing python security PyconIE 2018 51 @jmortegac Other security issues

Slide 52

Slide 52 text

Testing python security PyconIE 2018 52 @jmortegac Interesting links https://github.com/jmortega/testing_python_security

Slide 53

Slide 53 text

Testing python security PyconIE 2018 53 @jmortegac Interesting links https://security.openstack.org/#bandit-static-analysis-for-python https://security.openstack.org/guidelines/dg_use-subprocess-securely.html https://security.openstack.org/guidelines/dg_avoid-shell-true.html https://security.openstack.org/guidelines/dg_parameterize-database-querie s.html https://security.openstack.org/guidelines/dg_cross-site-scripting-xss.html https://security.openstack.org/guidelines/dg_avoid-dangerous-input-parsin g-libraries.html

Slide 54

Slide 54 text

Testing python security PyconIE 2018 54 @jmortegac Q&A Q & A