Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Web Vulnerabilities: A Field Guide

767b6562c7be79f616e12a0abb9320a4?s=47 Ruan Brandão
February 08, 2019
Technology
0
57

Web Vulnerabilities: A Field Guide

Slides for the talk presented at RubyFuza & Friends 2019.

767b6562c7be79f616e12a0abb9320a4?s=128

Ruan Brandão

February 08, 2019
Tweet

More Decks by Ruan Brandão

See All by Ruan Brandão
767b6562c7be79f616e12a0abb9320a4?s=48 ruanbrandao
2
110
767b6562c7be79f616e12a0abb9320a4?s=48 ruanbrandao
0
40
767b6562c7be79f616e12a0abb9320a4?s=48 ruanbrandao
4
520
767b6562c7be79f616e12a0abb9320a4?s=48 ruanbrandao
2
150
767b6562c7be79f616e12a0abb9320a4?s=48 ruanbrandao
0
33

Other Decks in Technology

See All in Technology
E598c2f9a8e5c94eea0e6505b4233d81?s=48 tomohide_tanaka
1
550
6bb0559d2066b868dab09e435f488c6c?s=48 tomoyuki
0
490
Ca6281fff64797dc419b78f51f25c0a5?s=48 fujiwara3
PRO
0
220
275fa343348e7dd4f5f7abfe09bb19d4?s=48 nishiodens
0
270
98a2aff83d5731c9e153a3f221fc08ab?s=48 kazkanda
0
220
97d180294474e9df01503148f3b11f39?s=48 lambda
0
350
7cd783377515bdf8207062840b7b2f4e?s=48 soracom
0
400
Aa2271fde3c839f2ab82d1d27dbbc650?s=48 takayukihayashi
1
270
D8e79ab09f15e69d600c00131bf7d2a9?s=48 yfutamura
0
140
A4d5b3aae2e67f31b513c88c726514c2?s=48 smzksts
0
250
D8e79ab09f15e69d600c00131bf7d2a9?s=48 yfutamura
0
400
2cf373725ded741824c50fd571eda6e1?s=48 udzura
1
290

Featured

See All Featured
E43f8dfd01057f8304f5f8fb9a294d7d?s=48 jeffersonlam
330
16k
245cee81a9c424266e5e401d844ea881?s=48 lara
590
61k
0c6fd6a08d0f898159cda7cafcacf07f?s=48 afnizarnur
178
14k
78b475797a14c84799063c7cd073962f?s=48 holman
462
280k
812e1705ff0f8bc1bcf18587bde687d5?s=48 62gerente
587
200k
D09fad3e36ae6841f54820be0e907f7a?s=48 rocio
154
11k
Ecdea9b9714877b86cee08458f085481?s=48 trallard
16
880
1177e050db6bafe62885362edf6e3537?s=48 lauravandoore
442
29k
1b75d89772b7eea1f6c89fbf362607d9?s=48 moore
125
21k
C0390e8b11079f8761c0cd3274ed61cb?s=48 productmarketing
7
830
E4f5d494ebdc9e7cce1aecf3ce3e8bc1?s=48 shpigford
370
42k
7c8469ee8c9e594c65c59b919626c08d?s=48 scottboms
252
11k

Transcript

  1. GOOD MORNING RUBYFUZA ☕

  2. RUAN BRANDÃO SOFTWARE ENGINEER AT MAGNETIS (WE ARE HIRING) TWITTER

    TIMELINE CURATOR @RUANBRANDAO /RUAN-BRANDAO

  3. Photo by Rafaela Biazi on Unsplash

  4. São Paulo

  5. Paulínia - São Paulo

  6. Pipa - Rio Grande do Norte

  7. Made in "

  8. CYBER ATTACKS

  9. WEB VULNERABILITIES A FIELD GUIDE FOR

  10. THE WEB HTTP HTTPS TLS SSL Databases Servers Credentials TCP/IP

    DNS Clusters Cache Browsers

  11. USING COMPONENTS WITH KNOWN VULNERABILITIES

  12. None

  13. UPDATE YOUR APPLICATION DEPENDENCIES Security tip #1

  14. INJECTION ‣ SQL ‣ NOSQL ‣ CODE ‣ COMMANDS

  15. INJECTION VULNERABILITIES ALLOW ATTACKERS TO RUN CODE ON YOUR APPLICATION

    SERVERS

  16. SQL INJECTION

  17. XKCD, available at https://xkcd.com/327/

  18. None

  19. BE CAREFUL WITH THE ORDER METHOD

  20. CODE INJECTION & COMMAND INJECTION

  21. BE EXTRA CAREFUL WITH EVAL AND BACKTICKS

  22. BE CAREFUL WITH CONSTANTIZE

  23. CROSS SITE SCRIPTING (XSS)

  24. CROSS SITE SCRIPTING ALLOWS ATTACKERS TO RUN CODE ON YOUR

    APPLICATION USERS BROWSERS
  25. None
  26. None
  27. None

  28. RAILS DOES THE HARD WORK

  29. BE CAREFUL WITH THE RAW AND HTML_SAFE

  30. NEVER TRUST USER INPUT Security tip #2

  31. BROKEN ACCESS CONTROL

  32. None
  33. None
  34. None
  35. None

  36. BE CAREFUL WITH ACCESS TO SENSIBLE DATA Security tip #3

  37. BROKEN AUTHENTICATION

  38. DO NOT REINVENT THE WHEEL. UNLESS YOU REALLY, REALLY, KNOW

    WHAT YOU ARE DOING. Security tip #4

  39. AND MUCH MORE… ‣ CROSS-SITE REQUEST FORGERY (CSRF) ‣ REMOTE

    CODE EXECUTION (RCE) ‣ SENSITIVE DATA EXPOSURE ‣ SECURITY MISCONFIGURATION
  40. None

  41. Photo by Patrick Tomasso on Unsplash

  42. https://owasp.org

  43. None

  44. Photo by Barn Images on Unsplash

  45. STATIC CODE ANALYSIS

  46. None

  47. TOOLS STATIC CODE ANALYSIS TOOLS

  48. TOOLS STATIC CODE ANALYSIS TOOLS

  49. TOOLS STATIC CODE ANALYSIS TOOLS GitHub - Available at https://github.blog/2017-10-11-a-more-connected-universe/

  50. SECURITY SCANNERS

  51. TOOLS SECURITY SCANNER TOOLS http://www.arachni-scanner.com/

  52. PENETRATION TESTS (PENTESTS)

  53. SECURITY IS NOT A PRODUCT. SECURITY IS AN ONGOING PROCESS.

    Security tip #0

  54. THANK YOU! ❤ @RUANBRANDAO /RUAN-BRANDAO