Upgrade to Pro — share decks privately, control downloads, hide ads and more …

CSCD27 Web Security

ThierrySans
November 24, 2016
410

CSCD27 Web Security

ThierrySans

November 24, 2016
Tweet

Transcript

  1. 2014 Collaboration Customer Resources Managemen Accounting and Billing Content Management

    E-Learning E-Health Publishing Web Portals Social Networks
  2. Securing the web architecture means securing ... • The network

    • The DNS (Domain Name System) • The web server operating system • The web server application (Apache for instance) • The database application (Oracle for instance) • The web application Our focus here!
  3. What is a web application? program running 
 on the

    browser + program running 
 on the server
  4. How big is the threat? Statistics based on data collected

    by the Whitehat security tool that monitors15,000 websites source “WhiteHat Website Security Statistics report 2013” from WhiteHat Security
  5. Average Number of Vulnerabilities (based on 7000 websites) source “WhiteHat

    Website Security Statistics report 2012” from WhiteHat Security Who is vulnerable?
  6. The HTTP protocol Network protocol for requesting/receiving data on the

    Web • Standard TCP protocol on port 80 (by default) • URI/URL specifies what resource is being accessed • Different request methods
  7. Let’s look at what a web server does > telnet

    whitehat.local 80 GET / telnet to a web server enter HTTP requests
  8. Authentication and Authorization ✓ Authentication • Who are the authorized

    users?
 ✓ Authorization • Who can access what and how?
  9. The simple recipe for user authentication 1. Ask the user

    for a login and password and send it to the server (HTTP/POST request) 2. Verify the login/password based on information stored on the server (usually in the database) 3. Start a session once the user has been authenticated 4. Grant access to resources according to the session
  10. The concept of session There is a session id (aka

    token) 
 between the browser and the web application This session id should be unique and unforgeable 
 (usually a long random number or a hash) ➡ Stored in the cookie The session id is bind to key/value pairs data ➡ Stored on the server
  11. The big picture Web Server Web Browser HTTP request HTTP

    response HTTP request HTTP response Cookie : key/value pairs stored in the requests The user can create, modify, delete the session ID in the cookie Session : key/value pairs stored on the server But cannot access the key/value pairs stored on the server
  12. How to steal user’s credentials • Brute force the password

    • Brute force the session ID • Steal the user’s password • Steal the user’s session ID
  13. Do you trust the network? interesting! id=scACRSm... <html><... ๏ An

    attacker can eavesdrop messages sent back and forth
  14. Do you really trust the network? I am id=scACRSm... <html><...

    ๏ An attacker can tamper with messages sent back and forth
  15. Confidentiality and Integrity Confidentiality: how do exchange information secretly? ✓

    Encryption Integrity: How do we exchange information reliably? ✓ Digital Signature
  16. Generic solution - HTTPS ➡ SSL provides • end-to-end secure

    channel (confidentially) • authentication handshake (integrity) ✓ HTTPS = HTTP + SSL

  17. When to use HTTPS? We need to protect • Login

    and password • Session ID ✓ HTTPS must be used during the entire session
  18. Stealing passwords from the client • Social engineering - Phishing

    • Keyloggers (keystroke logging) • Data mining (emails, logs) • Hack the client’s code
  19. Client side’s attacks Incomplete Mediation ➡ hijacking the interactions between

    the client and the server Content Spoofing ➡ inject arbitrary HTML content into a webpage CSRF ➡ inject arbitrary urls into a webpage XSS ➡ inject arbitrary Javascript code into a webpage
  20. Incomplete Mediation
 The shopping cart attack order=(#2956,10,9,90) Server Trusted Domain

    Client Trusted Domain * Notice that Amazon is not vulnerable to this attack * Thank you for your order! The total is calculated by a script on the client The order is generated based on the request 10
  21. comment = “<a href=”myad.com”>Fun stuff ... * Notice that Youtube

    is not vulnerable to this attack GET /?videoid=527 <html ... GET /?videoid=527 <html ... Content Spoofing
 injecting arbitrary HTML content into a webpage The page contains the attacker’s code.
  22. GET View/?profileid=53 GET Delete/?profileid=53 ??? ...... GET setProfile/?url=Delete/?profileid=53 GET View/?profileid=86

    <img src=”Delete/?profileid=53 GET Delete/?profileid=53 Hey Alice, check my profile id url name 53 www.alice.com/ profilepic Alice 86 www.badwebsite.com/ Delete/?imageid=53 Charlie www.badwebsite.com <img src=”www.alice.com/profilepic Done! profileid=86 GET profilepic www.alice.com CSRF attack
 injecting arbitrary urls into a webpage
  23. comment = “<script> ... * Notice that Youtube is not

    vulnerable to this attack login=Alice&password=123456 GET /?videoid=527 <html ... GET /?videoid=527 <html ... The script contained in the comments modifies the page to look like the login page! XSS attack
 injecting arbitrary javascript into a webpage
  24. Scope of XSS attacks ๏ Inject illegitimate content in the

    page
 (same as content spoofing) ๏ Perform illegitimate HTTP requests through Ajax 
 (same as a CSRF attack) ๏ Steal Session ID from the cookie ๏ Steal user’s login/password by modifying the page to forge a perfect scam
  25. It gets worst - XSS Worms Spread on social networks

    • Samy targeting MySpace (2005) • JTV.worm targeting Justin.tv (2008) • Twitter worm targeting Twitter (2010)
  26. Server’s side attacks SQL injection ➡ inject arbitrary SQL code

    executed on the server’s database File inclusion ➡ inject arbitrary code executed on the server
  27. SQL Injection Attack inject arbitrary SQL code executed on the

    server’s database Access Deny! name=Alice&pwd=123456 checkPassword.php loginPage.html 123456’ OR ‘1’=‘1 Access Granted! <?php $uid = SQLQuery("SELECT uid FROM LoginTable WHERE login=" . $_POST['name'] . "AND password =" . $POST['pwd ']); if ($uid) echo "Access Granted"; else echo "Access Denied"; ?>
  28. Scope of SQL injection attacks ๏ retrieves, adds, modifies, deletes

    arbitrary information ๏ bypasses authentication ๏ installs a reverse shell
  29. Web application security tools • Proxy mapper • Vulnerability scanner

    • Replay HTTP requests • (Exploit tool) Nikto Burp Suite W3af Acunetix AppScan Vega Commercial Open Source … among others
  30. Conclusion Server Side Client Side Web Server Database Web Browser

    You have absolutely no control on the client
  31. References • Mozilla Secure Coding Guideline
 https://wiki.mozilla.org/WebAppSec/Secure_Coding_Guidelines • Ruby on

    Rails Security Page
 http://guides.rubyonrails.org/security.html • Django Security Page
 https://docs.djangoproject.com/en/dev/topics/security/ • PHP Security Pages
 http://php.net/manual/en/security.php
 http://phpsec.org/projects/guide/