Web Application Security

This talk covers how we can get started on Web Application Security.

Presented at OWASP SRM Student Chapter.

Follow and Share!

Reach me at:
Facebook
Instagram
Twitter
Linkedin

Transcript

1. Sudhakar Muthumani Web application Security
2. Table of contents 01 Introduction Introduction to Web Application Security 02 OWASP TOP 10 Describing OWASP Top 10 bugs 03 Hands on Hands on Intro to the labs 04 VAPT Introduction about VAPT
3. 01 iNTRODUCTION Introduction to Web Application Security
4. • Securing the custom code that drives a web application. • Securing libraries • Securing backend systems • Securing the web application and servers. What is web application Security?
5. Owasp top 10 2003 First release 2021 Latest Release
6. 02 OWASP TOP 10 Introduction to OWASP Top 10
7. WHY OWASP TOP 10 Strengthen the encryption of the software. Reduce security bugs in the code. Safeguarding the code against vulnerabilities.
8. Apps Failed In Top 10
9. oWASP TOP 10 • Broken Access Control • Cryptographic Failures • Injection • Insecure Design • Security Misconfiguration • Vulnerable and Outdated Components • Identification and Authentication Failures • Software and Data Integrity Failures • Security Logging and Monitoring Failures • Server-Side Request Forgery (SSRF)
10. Broken Access Control • Bypassing access control checks. • Permitting viewing or editing someone else's account, by providing its unique identifier. • Accessing API with missing access controls for POST, PUT and DELETE. • Elevation of privilege.
11. Cryptographic Failures • Data transmitted in clear text. Using old or weak cryptographic algorithms or protocols. • Using default crypto keys, weak crypto keys, etc. • Using deprecated hash functions such as MD5 or SHA1.
12. Injection • Cross-site Scripting is now part of this category in this edition. • User-supplied data is not validated, filtered, or sanitized by the application. • The SQL or command contains the structure and malicious data in dynamic queries, commands, or stored procedures.
13. Insecure Design • Focus on risks related to design flaws. • Must know what and where the control works?
14. Security Misconfiguration • Unnecessary features are enabled or installed Default accounts and their passwords are still enabled and unchanged. • Error handling reveals stack traces or other overly informative messages.
15. Vulnerable and Outdated Components • Not regularly scanning for vulnerabilities. • Software is vulnerable, unsupported, or out of date. • Not securing the components’ configurations.
16. Identification and Authentication Failures • Permits brute force or other automated attacks. • Permits default, weak, or well-known passwords, such as "Password1" or "admin/admin". • Has missing or ineffective multi-factor authentication. • Exposes session identifier in the URL. • Reuse session identifier after successful login.
17. Software and Data Integrity Failures • Use digital signatures or similar mechanisms to verify the software or data. • Ensure libraries and dependencies, such as npm or Maven, are consuming trusted repositories. • Ensure that there is a review process for code and configuration changes. • Ensure that unsigned or unencrypted serialized data is not sent to untrusted clients.
18. Security Logging and Monitoring Failures • Logs are only stored locally. • Warnings and errors generate no, inadequate, or unclear log messages. • Logs of applications and APIs are not monitored for suspicious activity. • Auditable events, such as logins, failed logins, and high-value transactions, are not logged.
19. Server-Side Request Forgery (SSRF) • SSRF flaws occur whenever a web application is fetching a remote resource without validating the user-supplied URL. • Disable HTTP redirection.
20. 03 LABS Hands on labs to practice
21. labs OWASP JUICE SHOP TRY HACKME BWAPP PORTSWIGGER HACK THE BOX VULNHUB hACKER 101 CTF
22. 04 VAPT Introduction to Vulnerability Assessment and Penetration Testing
23. SCANNING TARGET Penetration testing Vulnerability assessment REPORT WRITING VAPT
24. Thanks Should you have any questions? Ping me @ sudhakar@primefort.net @sudhakar_._m sudhakarmuthumani @sudhakarmuthu04 sudhakarmuthumani00