Save 37% off PRO during our Black Friday Sale! »

Web Vulnerabilities: A Field Guide

767b6562c7be79f616e12a0abb9320a4?s=47 Ruan Brandão
February 08, 2019
Technology
0
60

Web Vulnerabilities: A Field Guide

Slides for the talk presented at RubyFuza & Friends 2019.

767b6562c7be79f616e12a0abb9320a4?s=128

Ruan Brandão

February 08, 2019
Tweet

More Decks by Ruan Brandão

See All by Ruan Brandão
767b6562c7be79f616e12a0abb9320a4?s=48 ruanbrandao
2
150
767b6562c7be79f616e12a0abb9320a4?s=48 ruanbrandao
0
50
767b6562c7be79f616e12a0abb9320a4?s=48 ruanbrandao
4
570
767b6562c7be79f616e12a0abb9320a4?s=48 ruanbrandao
2
170
767b6562c7be79f616e12a0abb9320a4?s=48 ruanbrandao
0
35

Other Decks in Technology

See All in Technology
67683b0a8d24009c731787b49881a9de?s=48 tomuro
1
170
D8d463da5ab4a99265ffc1d12e76cbc9?s=48 sagara
0
210
61748c5d26ae54a57b478f9c792bc2f7?s=48 mochizuki875
1
110
91f6ef52b846ca5f00325b05f3e3547d?s=48 cola119
3
1.1k
Ca6281fff64797dc419b78f51f25c0a5?s=48 fujiwara3
4
930
140494d272a4d89883a94fdfdb29dea2?s=48 oracle4engineer
PRO
2
3.5k
140494d272a4d89883a94fdfdb29dea2?s=48 oracle4engineer
PRO
5
580
Cdf97a1b1b132c56582773c3ba09a3a6?s=48 rakus_dev
0
480
140494d272a4d89883a94fdfdb29dea2?s=48 oracle4engineer
PRO
0
120
Ef3b48913ea26665c25b2ad78e449d16?s=48 larchanjo
0
140
Ad22fcf5773b906c08330f4d57242212?s=48 inductor
1
140
C422cc033079e005fd1aa1b845b099da?s=48 meow_noisy
0
440

Featured

See All Featured
B47b288784fda77a94aeb234ca743c24?s=48 keavy
111
15k
0438ae60cde4c7add6f9da48f28c15cc?s=48 chrisshort
6
28k
1f74b13f1e5c6c69cb5d7fbaabb1e2cb?s=48 sferik
612
56k
C7393b7ba7ec9c8890dd77d209fbb3c9?s=48 maltzj
504
37k
5b9fe87ec1faa67a4599782930f45ec9?s=48 sstephenson
149
12k
C86443373fbfe92996aa882d0d7a59f8?s=48 imathis
484
150k
9cde37f47e4a800ea081ea42de8d749a?s=48 dougneiner
56
5.7k
Fe6b81005d1553accd6b2a28f6a2bef1?s=48 phodgson
92
4.3k
Ded01cdab114abe4ec13511e4c25b9bb?s=48 andyhume
67
4.6k
E837d2996f52008ace055a08fbfff992?s=48 frogandcode
130
20k
1519587b1a0febb658c36c94f6272b0d?s=48 roundedbygravity
249
21k
433acaea1012b25d97ae66da9b998dad?s=48 malarkey
396
61k

Transcript

  1. GOOD MORNING RUBYFUZA ☕

  2. RUAN BRANDÃO SOFTWARE ENGINEER AT MAGNETIS (WE ARE HIRING) TWITTER

    TIMELINE CURATOR @RUANBRANDAO /RUAN-BRANDAO

  3. Photo by Rafaela Biazi on Unsplash

  4. São Paulo

  5. Paulínia - São Paulo

  6. Pipa - Rio Grande do Norte

  7. Made in "

  8. CYBER ATTACKS

  9. WEB VULNERABILITIES A FIELD GUIDE FOR

  10. THE WEB HTTP HTTPS TLS SSL Databases Servers Credentials TCP/IP

    DNS Clusters Cache Browsers

  11. USING COMPONENTS WITH KNOWN VULNERABILITIES

  12. None

  13. UPDATE YOUR APPLICATION DEPENDENCIES Security tip #1

  14. INJECTION ‣ SQL ‣ NOSQL ‣ CODE ‣ COMMANDS

  15. INJECTION VULNERABILITIES ALLOW ATTACKERS TO RUN CODE ON YOUR APPLICATION

    SERVERS

  16. SQL INJECTION

  17. XKCD, available at https://xkcd.com/327/

  18. None

  19. BE CAREFUL WITH THE ORDER METHOD

  20. CODE INJECTION & COMMAND INJECTION

  21. BE EXTRA CAREFUL WITH EVAL AND BACKTICKS

  22. BE CAREFUL WITH CONSTANTIZE

  23. CROSS SITE SCRIPTING (XSS)

  24. CROSS SITE SCRIPTING ALLOWS ATTACKERS TO RUN CODE ON YOUR

    APPLICATION USERS BROWSERS
  25. None
  26. None
  27. None

  28. RAILS DOES THE HARD WORK

  29. BE CAREFUL WITH THE RAW AND HTML_SAFE

  30. NEVER TRUST USER INPUT Security tip #2

  31. BROKEN ACCESS CONTROL

  32. None
  33. None
  34. None
  35. None

  36. BE CAREFUL WITH ACCESS TO SENSIBLE DATA Security tip #3

  37. BROKEN AUTHENTICATION

  38. DO NOT REINVENT THE WHEEL. UNLESS YOU REALLY, REALLY, KNOW

    WHAT YOU ARE DOING. Security tip #4

  39. AND MUCH MORE… ‣ CROSS-SITE REQUEST FORGERY (CSRF) ‣ REMOTE

    CODE EXECUTION (RCE) ‣ SENSITIVE DATA EXPOSURE ‣ SECURITY MISCONFIGURATION
  40. None

  41. Photo by Patrick Tomasso on Unsplash

  42. https://owasp.org

  43. None

  44. Photo by Barn Images on Unsplash

  45. STATIC CODE ANALYSIS

  46. None

  47. TOOLS STATIC CODE ANALYSIS TOOLS

  48. TOOLS STATIC CODE ANALYSIS TOOLS

  49. TOOLS STATIC CODE ANALYSIS TOOLS GitHub - Available at https://github.blog/2017-10-11-a-more-connected-universe/

  50. SECURITY SCANNERS

  51. TOOLS SECURITY SCANNER TOOLS http://www.arachni-scanner.com/

  52. PENETRATION TESTS (PENTESTS)

  53. SECURITY IS NOT A PRODUCT. SECURITY IS AN ONGOING PROCESS.

    Security tip #0

  54. THANK YOU! ❤ @RUANBRANDAO /RUAN-BRANDAO