Web Architecture

Web Architecture - Mechanism and Threats
© Copyright 2013 i-secure Co., Ltd. The information contained herein is subject to change without notice.
Sumedt Jitpukdebodin
Senior Security Researcher
CompTIA Security+, LPIC-1 , NCLA, C|EHv6, eCPPT, eWPT, IWSS, CPTE

~# whoami
 Name: Sumedt Jitpukdebodin(สุเมธ จิตภักดีบดินทร์)
 My blog: http://www.r00tsec.com, http://twitter.com/materaj, https://www.facebook.com/hackandsecbook
 Jobs
– I-SECURE Co., Ltd.
– Research And Develop Engineer, Senior Web Application Security Specialist, Senior Security Researcher
– Writer
– English article@ http://packetstormsecurity.com/files/author/9011/ and please google my name.
– Many Thai article, please google my Thai name.
– หนังสือ “Hacking & Security Book "Network Security หนังสือฉบับก้าวสู่นักทดสอบและป้องกันการเจาะระบบ”
 Hobby: Penetration Testing, Hacking, Reading Info Security, Play Games, Traveling around the world, Write
Article, Teaching and more...

Agenda

Agenda
 Web Architecture
 Web Architecture Attack
 Security Controls & Mechanism

Web Architecture

Basic Web Architecture
 Two Tier Architecture
– Web browser display content that return from Web Server
– Web server provide resource for client

HTML
 HTML(Hyper Text Markup Language)
– Document Layout Language
– Viewed by using Web Browser.

URI
 URI(Universal Resource Identifier)

URI(2)
 URL(Universal Resource Locator)
 URN(Universal Resource Name)

HTTP
 HTTP(Hyper Text Transfer Protocol)
 HTTP is an application layer.
 HTTP has 2 way communication: HTTP Request and HTTP Response.

HTTP(2)
 Request Message
– Request Line
– Request Header
– An empty line
– An optional Message Body

HTTP(3)

Request Method
– HEAD
– GET
– POST
– PUT
– DELETE
– TRACE
– OPTIONS
– CONNECT

Safe Method
– HEAD
– GET
– OPTIONS
– TRACE
– POST
– PUT
– DELETE
– CONNECT

Status Code
 Success: 2xx
 Redirection: 3xx
 Client-Side Error: 4xx
 Server-Side Error: 5xx

HTTP Session State
 HTTP is stateless Protocol
 Solutions
– Cookies
– Sessions
– Hidden variable
– URL encode parameter( /index.php?session_id=$session_code)

Web Architecture Extension
 Two tier architecture is not enough
 Common Gateway Interface(CGI)
 Standard protocol for interfacing with external application software with
a web server
 CGI program are executable programs that run on the web server.

Javascript
 Scripting language designed for dynamic, interactive web application
 Run on client side.
 Preprocessing data on the client before submission to a server.
 Changing content type and styles

Three tier web architecture

Make HTTP to stateful(2)
 Cookie
 A text stored on a client’s computer by a web browser.
 Sent as an HTTP Header
 Can used for authenticating, session tracking

Server and Client Processing
 Server-Side Processing
 PHP
 ASP
 ASP.NET
 Perl
 J2EE
 Python, Django
 Ruby On Rail
 Client-Side Processing
 CSS
 HTML
 Javascript
 Adobe Flash
 Microsoft Silverlight

AJAX
 Asynchronous Javascript and XML(AJAX)
 Create by Jesse James Garrett, Febuary 18, 2005
 Ajax Incorporates
 XHTML, CSS, Document Object Model(DOM), XML and XSLT,
XMLHttpRequest, Javascript

AJAX(2)

AJAX(3)

JSON
 Javascript Object Notation(JSON)
 JSON is lightweight computer data interchange format.
 JSON is based on a subset of Javascript programming language.
 Using of XML format.

JSON Request && Response

JSON(2)

XML
 eXtensible Markup Language
 Using for information exchange.
 Two primary building blocks of XML are elements and attributes.
 Elements are tags and have values.
 Elements are structured as a tree.
 Alternatively, elements may have both attributes as well as data.
 Attributes help you to give more meaning and describe your
element more efficiently and clearly.

XML(2)
 Tag
 Element
 Content

XML(3)

XML(4)

XML vs JSON

Web Services
 Web service is a software system designed to support machine-to-machine
intraction over a network.
 Web service are frequently just used to Internet Application
Programming Interfaces(API).
 Web service use HTTP for transmitting messages(RPC,SOAP,REST)

SOAP vs REST
 SOAP(Simple Object Access Protocol)
– Web service based on XML
 REST(Representational State Transfer)
– Web service represent in format of application

SOAP vs REST

SOAP Example
Reference:: http://www.soapui.org/The-World-Of-API-Testing/soap-vs-rest-challenges.
html

REST Example
Reference:: http://www.soapui.org/The-World-Of-API-Testing/soap-vs-rest-challenges.
html

Web Architecture Attack

Web Architecture
Reference :: Web Application Hacking/Security
101(https://docs.google.com/presentation/d/1fw7fO7kmVTcfXuupGTezSM76cdQH3IbYos5xu95L
yMs/edit#slide=id.p)

Web Architecture Attack
Reference :: Web Application Hacking/Security
101(https://docs.google.com/presentation/d/1fw7fO7kmVTcfXuupGTezSM76cdQH3IbYos5xu95L
yMs/edit#slide=id.p)

OWASP 2013
 Injection
 Broken Authentication and Session Management
 Cross-Site Scripting(XSS)
 Insecure Direct Object Rerefence
 Security Misconfiguration
 Sensitive Data Exposure
 Missing Function Level Access Control
 Cross-Site Request Forgery(CSRF)
 Using Components with Known Vulnerability
 Unvalidated Redirects and Forwards

Security Controls & Mechanism

Security Control
 Application Layer
 Network Layer

Application Layer
 Input Validation
 Sessions Management
 Authentication Method
 Strong Policy(Such as password policy)
 Same-Origin Policy

Network Layer
 Firewall
 Intrusion Detection System/Intrusion Prevention System(IDS/IPS)
 Web Application Firewall(WAF)
 Centralize Log Server

Network Layer Diagram
Reference :: http://www.umv.co.kr/main_eng/sm_enterprise.php

Web Architecture

Empfohlen

Empfohlen

Weitere ähnliche Inhalte

Was ist angesagt?

Was ist angesagt? (20)

Ähnlich wie Web Architecture

Ähnlich wie Web Architecture (20)

Mehr von Sumedt Jitpukdebodin

Mehr von Sumedt Jitpukdebodin (13)

Kürzlich hochgeladen

Kürzlich hochgeladen (20)

Web Architecture