Web Vulnerabilities: A Field Guide

Transcript

1. 1.

   GOOD MORNING RUBYFUZA ☕

2. 2.

   RUAN BRANDÃO SOFTWARE ENGINEER AT MAGNETIS (WE ARE HIRING) TWITTER

   TIMELINE CURATOR @RUANBRANDAO /RUAN-BRANDAO
3. 3.

   Photo by Rafaela Biazi on Unsplash

4. 4.

   São Paulo

5. 5.

   Paulínia - São Paulo

6. 6.

   Pipa - Rio Grande do Norte

7. 7.

   Made in "

8. 8.

   CYBER ATTACKS

9. 9.

   WEB VULNERABILITIES A FIELD GUIDE FOR

10. 10.

    THE WEB HTTP HTTPS TLS SSL Databases Servers Credentials TCP/IP

    DNS Clusters Cache Browsers
11. 11.

    USING COMPONENTS WITH KNOWN VULNERABILITIES

12. 12.

    None
13. 13.

    UPDATE YOUR APPLICATION DEPENDENCIES Security tip #1

14. 14.

    INJECTION ‣ SQL ‣ NOSQL ‣ CODE ‣ COMMANDS

15. 15.

    INJECTION VULNERABILITIES ALLOW ATTACKERS TO RUN CODE ON YOUR APPLICATION

    SERVERS
16. 16.

    SQL INJECTION

17. 17.

    XKCD, available at https://xkcd.com/327/

18. 18.

    None
19. 19.

    BE CAREFUL WITH THE ORDER METHOD

20. 20.

    CODE INJECTION & COMMAND INJECTION

21. 21.

    BE EXTRA CAREFUL WITH EVAL AND BACKTICKS

22. 22.

    BE CAREFUL WITH CONSTANTIZE

23. 23.

    CROSS SITE SCRIPTING (XSS)

24. 24.

    CROSS SITE SCRIPTING ALLOWS ATTACKERS TO RUN CODE ON YOUR

    APPLICATION USERS BROWSERS
25. 25.

    None
26. 26.

    None
27. 27.

    None
28. 28.

    RAILS DOES THE HARD WORK

29. 29.

    BE CAREFUL WITH THE RAW AND HTML_SAFE

30. 30.

    NEVER TRUST USER INPUT Security tip #2

31. 31.

    BROKEN ACCESS CONTROL

32. 32.

    None
33. 33.

    None
34. 34.

    None
35. 35.

    None
36. 36.

    BE CAREFUL WITH ACCESS TO SENSIBLE DATA Security tip #3

37. 37.

    BROKEN AUTHENTICATION

38. 38.

    DO NOT REINVENT THE WHEEL. UNLESS YOU REALLY, REALLY, KNOW

    WHAT YOU ARE DOING. Security tip #4
39. 39.

    AND MUCH MORE… ‣ CROSS-SITE REQUEST FORGERY (CSRF) ‣ REMOTE

    CODE EXECUTION (RCE) ‣ SENSITIVE DATA EXPOSURE ‣ SECURITY MISCONFIGURATION
40. 40.

    None
41. 41.

    Photo by Patrick Tomasso on Unsplash

42. 42.

    https://owasp.org

43. 43.

    None
44. 44.

    Photo by Barn Images on Unsplash

45. 45.

    STATIC CODE ANALYSIS

46. 46.

    None
47. 47.

    TOOLS STATIC CODE ANALYSIS TOOLS

48. 48.

    TOOLS STATIC CODE ANALYSIS TOOLS

49. 49.

    TOOLS STATIC CODE ANALYSIS TOOLS GitHub - Available at https://github.blog/2017-10-11-a-more-connected-universe/

50. 50.

    SECURITY SCANNERS

51. 51.

    TOOLS SECURITY SCANNER TOOLS http://www.arachni-scanner.com/

52. 52.

    PENETRATION TESTS (PENTESTS)

53. 53.

    SECURITY IS NOT A PRODUCT. SECURITY IS AN ONGOING PROCESS.

    Security tip #0
54. 54.

    THANK YOU! ❤ @RUANBRANDAO /RUAN-BRANDAO