Web Security: A Journey - UC San Diego
•
1 gefällt mir•1,100 views
A short introduction to the root causes of security issues with web applications and HTTP.
Empfohlen
Empfohlen
Weitere ähnliche Inhalte
Ähnlich wie Web Security: A Journey - UC San Diego
Ähnlich wie Web Security: A Journey - UC San Diego (20)
Mehr von Saumil Shah
Mehr von Saumil Shah (20)
Kürzlich hochgeladen
Kürzlich hochgeladen (20)
Web Security: A Journey - UC San Diego
- 1. net-square UCSD July '15 Web Security: A Journey Saumil Shah CEO Net Square UC San Diego – 23 July 2015
- 2. net-square UCSD July '15 Saumil Shah @therealsaumil saumilshah hacker speaker trainer entrepreneur traveler photographer calligrapher kite-flyer software breaker rebel global net-square.com
- 3. net-square UCSD July '15 WE ARE HACKERS WE PUSH THE ENVELOPE WE THRIVE ON FACTS AND LOGIC.. ..AND LATERAL THINKING WE QUESTION AND CHALLENGE AND WORK ON LIMITED RESOURCES
- 4. net-square UCSD July '15 Enter the WEB
- 5. net-square UCSD July '15 HTTP • Deliver HTML pages to browsers. • Cross platform document delivery. • Application independent. • Standard markup. • CLIENT: Web browser • SERVER: HTTP server
- 6. net-square UCSD July '15 Web Applications WebServer App Server DB
- 7. net-square UCSD July '15 Client/Server vs. Web Apps Application Protocol Authentication Concurrent Sessions Data Representation DataValidation Business Logic Presentation HTTP Authentication Concurrent Sessions Data Representation DataValidation Business Logic Presentation
- 8. net-square UCSD July '15 Application Delivery HTTP Authentication Statefulness Data Types Data Validation CGI HTML JS AJAX Flash HTML5 Silverlight Web sockets Web workers Local storage
- 9. net-square UCSD July '15 Browser Architecture DOM HTML+CSS Javascript ActiveX mimetypes toolbars Flash libraries <div> <img> <iframe> <body> <form> <input> <table> <style> <object> <embed> <script>
- 10. net-square UCSD July '15 1995-1998
- 11. net-square UCSD July '15
- 12. net-square UCSD July '15
- 13. net-square UCSD July '15 2008-present
- 14. net-square UCSD July '15 A Revival
- 15. net-square UCSD July '15 What shall your response be? GET / HTTP/1.0 GET /nonexist.ent HTTP/1.0
- 16. net-square UCSD July '15 What shall your response be? ZOMFG / HTTP/1.0 GET / HTTP/3.0 GET / JUNK/1.0
- 17. net-square UCSD July '15 The responders Test Apache Microsoft IIS SunONE GET / HTTP/1.0 200 200 200 GET /nonexist.ent HTTP/1.0 404 404 404 DELETE / HTTP/1.0 405 403 401 GET / HTTP/3.0 400 200 505 GET / JUNK/1.0 200 400 none
- 18. net-square UCSD July '15 x=hello&x=world • A: "hello" • B: "world" • C: "hello, world" • D: WTF
- 19. net-square UCSD July '15 x=hello&x=world Web Server Value of x Apache "world" IBM HTTP Server "hello" Domino "world" IIS "hello, world" Tomcat "hello" Python/Zope Array ['hello', 'world']
- 20. net-square UCSD July '15 Sources of Software Errors User Input Race Condition Environment Resource Exhaustion
- 21. net-square UCSD July '15 The "banana" test I CAN HAZ BANANA?
- 22. net-square UCSD July '15 Circle of HTTP Trust Your Users
- 23. net-square UCSD July '15 The user's going to pick dancing pigs over security every time. Bruce Schneier
- 24. net-square UCSD July '15 Technology in the hands of users
- 25. net-square UCSD July '15 Thank You... Questions? saumil@net-square.com @therealsaumil