Sitecore might be secure, but your site isn't

Sitecore might be
secure,
butYOUR site isn’t
Bas Lijten
April 25th, 2016
#sugcon, @baslijten

© 2016 Sitecore User Group Conference Europe and its respective speakers. All rights reserved.
Tracker.Current.Session.Identify
bas
linkedin.com/in/baslijten
blog.baslijten.com
Twitter.com/baslijten
Bas Lijten
The Netherlands
PrincipalArchitect

Meet Evilcore™ and Safecore™
Download it on GitHub/BasLijten!

What can you expect?
• No Sitecore vulnerabilities
• Small tips / tricks (references to my and other blogs)
• Explanation with some mitigations
• 3 demo’s
7

© 2016 Sitecore User Group Conference Europe and its respective speakers. All rights reserved. 8 of 127
Man in the middle attack

11
Pineapple WiFi - Jasager
?? YES

12

13
1: GET 2: GET
3: RESPONSE:
HTML
FORM ACTION=“HTTPS://WWW.SUGCON.EU/LOGIN”
POST
USERNAME
PASSWORD
HTTPS://WWW.SUGCON.EU/LOGIN
Send Username/password via js
4: RESPONSE:
HTML
FORM ACTION=
Inject malicious javascript
POST
USERNAME
PASSWORD

Still think you don’t need HTTPS?
Faster
Free
SEO

• Don’t access publicWiFi
• Transport Layer Security
• HTTP StrictTransport Security
• Certificate Pinning
Mitigations

XSS –CrossSiteScripting
Possibility to inject client-side scripts into webpages
• Reflective
• Persistent
• Leads to other risks, such as Session Hijacking, browser
takeovers
16

XSS – Reflective XSS
$('#searchTerm').val(' searchterm ');
Trusted data Trusted dataUntrusted data

XSS – Reflective XSS
$('#searchTerm').val(' ');alert('pwned');// ');
Trusted data Trusted dataUntrusted data

Bad Session and Authentication management
Sitecore
1. Login &
Identify
xDB
Session
4. Return cookies
2. Get XDB data
3. Put XDB data in
Session
6. Send email with
malicious JavaScript
SessionID: XXX
5. Change Session ID to XXX

Sitecore
xDB
Session
4. Get XDB data
5. Put XDB data in
Session XXX:
- Bas Lijten
- Brabant
- Creditcard details
1. Open email
Session ID: XXXSession ID: XXX
2. Visit Link
Login
Send Session ID
6. Return response
3. Identification on Session ID XXX

Sitecore
xDB
Session2. Get XDB data for
Session XXX:
- Bas Lijten
- Brabant
- Creditcard details
Session ID: XXXSession ID: XXX
3. Identification on Session ID XXX
1. Refresh browser
3. Return victim’s data

XSS
• Output encoding (CSS, Javascript, Xml, HTML)
• Content Security Policy
Bad Session management
• Don’t clear cookies
• Change your Session ID after Login and Logout
XSS – mitigations & Bad Session Management

SQL Injection

Security Misconfiguration
coremasterweb
Sitecore

coremasterwebComments
Sitecore
comments

Sitecore
comments
Same credentials
Same instance

Sitecore
comments
Other credentials

Sitecore
comments
Other credentials
Other instance

• Parameterize your queries
• Use different credentials
• Separate custom databases from Sitecore
SQL Injection & Security Misconfiguration

Insufficient Transport Layer Protection
• Don’t connect to public wifi
• UseTransport Layer Security
• Enforce HTTPS (HSTS header) to
prevent stripping
Broken authentication / session
management
• Session fixation
• XSS needed
• Don’t remove cookies
XSS (Reflective/Persistent)
• Don’t trust data
• Encode your (untrusted) data
• Use frameworks
Summary
SQL Injection
• Parameterize queries
• Use frameworks
• Least possible permissions
• Don’t share credentials

• How to change your authentication provider and use a
modern hashing algorithm
• Why mixing HTTP and HTTPS gives a false sense of
security
• Using HTTPS? Don’t forget to apply these settings!
Upcoming blogposts

Topic Url
Secure connections Still think you don’t need HTTPS?
Secure connections Understanding HTTP Strict Transport Security
Secure connections Wifi Pineapple
Secure connections Certificate Pinning
XSS XSS Prevention Cheat Sheet
XSS Content Security Policy Header
XSS Report-uri.io
XSS Beef
SQL Injection SQL Injection Cheat Sheet
SQL Injection SQL Map
Security Misconfiguration OWASP
Broken Session and Authentication
Management
OWASP
Topic specific information

General sources of Information
Source Description
Bas Lijten My blog ;)
Securitycore My evilcore/safecore Github repository
Pluralsight Ethical hacking courses – 40+ hours on security training
OWASP Open Web Application Security Project
Troy hunt Security blogger
Dale Meredith Security blogger, author of ethical hacking courses
Microsoft SDLC Microsoft Secure Development Lifecycle
Beef Browser Exploitation Framework

Thank you!
linkedin.com/in/baslijten
blog.baslijten.com
Twitter.com/baslijten

Sitecore might be secure, but your site isn't

Empfohlen

Empfohlen

Weitere ähnliche Inhalte

Ähnlich wie Sitecore might be secure, but your site isn't

Ähnlich wie Sitecore might be secure, but your site isn't (20)

Mehr von Bas Lijten

Mehr von Bas Lijten (7)

Kürzlich hochgeladen

Kürzlich hochgeladen (20)

Sitecore might be secure, but your site isn't

Hinweis der Redaktion