Web Vulnerabilities: A Field Guide

Slides for the talk presented at RubyFuza & Friends 2019.

Transcript

1. GOOD MORNING RUBYFUZA ☕
2. RUAN BRANDÃO SOFTWARE ENGINEER AT MAGNETIS (WE ARE HIRING) TWITTER TIMELINE CURATOR @RUANBRANDAO /RUAN-BRANDAO
3. Photo by Rafaela Biazi on Unsplash
4. São Paulo
5. Paulínia - São Paulo
6. Pipa - Rio Grande do Norte
7. Made in "
8. CYBER ATTACKS
9. WEB VULNERABILITIES A FIELD GUIDE FOR
10. THE WEB HTTP HTTPS TLS SSL Databases Servers Credentials TCP/IP DNS Clusters Cache Browsers
11. USING COMPONENTS WITH KNOWN VULNERABILITIES
13. UPDATE YOUR APPLICATION DEPENDENCIES Security tip #1
14. INJECTION ‣ SQL ‣ NOSQL ‣ CODE ‣ COMMANDS
15. INJECTION VULNERABILITIES ALLOW ATTACKERS TO RUN CODE ON YOUR APPLICATION SERVERS
16. SQL INJECTION
17. XKCD, available at https://xkcd.com/327/
19. BE CAREFUL WITH THE ORDER METHOD
20. CODE INJECTION & COMMAND INJECTION
21. BE EXTRA CAREFUL WITH EVAL AND BACKTICKS
22. BE CAREFUL WITH CONSTANTIZE
23. CROSS SITE SCRIPTING (XSS)
24. CROSS SITE SCRIPTING ALLOWS ATTACKERS TO RUN CODE ON YOUR APPLICATION USERS BROWSERS
28. RAILS DOES THE HARD WORK
29. BE CAREFUL WITH THE RAW AND HTML_SAFE
30. NEVER TRUST USER INPUT Security tip #2
31. BROKEN ACCESS CONTROL
36. BE CAREFUL WITH ACCESS TO SENSIBLE DATA Security tip #3
37. BROKEN AUTHENTICATION
38. DO NOT REINVENT THE WHEEL. UNLESS YOU REALLY, REALLY, KNOW WHAT YOU ARE DOING. Security tip #4
39. AND MUCH MORE… ‣ CROSS-SITE REQUEST FORGERY (CSRF) ‣ REMOTE CODE EXECUTION (RCE) ‣ SENSITIVE DATA EXPOSURE ‣ SECURITY MISCONFIGURATION
41. Photo by Patrick Tomasso on Unsplash
42. https://owasp.org
44. Photo by Barn Images on Unsplash
45. STATIC CODE ANALYSIS
47. TOOLS STATIC CODE ANALYSIS TOOLS
48. TOOLS STATIC CODE ANALYSIS TOOLS
49. TOOLS STATIC CODE ANALYSIS TOOLS GitHub - Available at https://github.blog/2017-10-11-a-more-connected-universe/
50. SECURITY SCANNERS
51. TOOLS SECURITY SCANNER TOOLS http://www.arachni-scanner.com/
52. PENETRATION TESTS (PENTESTS)
53. SECURITY IS NOT A PRODUCT. SECURITY IS AN ONGOING PROCESS. Security tip #0
54. THANK YOU! ❤ @RUANBRANDAO /RUAN-BRANDAO