Empfohlen
Weitere ähnliche Inhalte
Was ist angesagt?
Was ist angesagt? (20)
Ähnlich wie Security of Web Applications: Top 6 Risks To Avoid
Ähnlich wie Security of Web Applications: Top 6 Risks To Avoid (20)
Kürzlich hochgeladen
Kürzlich hochgeladen (20)
Security of Web Applications: Top 6 Risks To Avoid
- 1. Security of Web Applications TOP 6 RISKS TO AVOID
- 2. Console.WriteLine(“Hello World”); I'm Audrius Kovalenko .NET Developer Hack for fun @slicklash http://www.notreallycode.com
- 3. Forecasts for Upcoming Years VERY CLOUDY SaaS GROWTH WEB APPLICATIONS IN HIGH-DEMAND
- 4. Web Application Security Today Distribution of Attack Methods in 2011 Source: Web Hacking Incident Database (WHID)
- 5. Puzzle How to pour all liquid into the glass?
- 7. How to deliver secure product knowing little about application security? If that's my bag Who's bag is it then? CSRF ruce B r Agile Steve an XSS Schneie Martin Freem Troy HD M r Fowle TDD Ken Hunt oo t REST Design re Bec Patt erns k Mi ring Za cha Refacto l ew ł SQLi DI sk i Builder vs Breaker
- 8. Problem We don't know what we don't know
- 9. The Unknowns WHAT TO LOOK FOR? WHAT ARE THE MAJOR RISKS? WHAT ARE THE COUNTERMEASURES?
- 10. CWE/SANS Top 25 Most Dangerous Software Errors https://cwe.mitre.org/top25
- 11. Open Web Application Security Project OWASP https://www.owasp.org
- 12. What is a risk anyway?
- 13. The OWASP Top 10 6 Web Risks A1 INJECTION A2 CROSS SITE SCRIPTING (XSS) A3 BROKEN AUTHENTICATION AND SESSION MANAGEMENT A4 INSECURE DIRECT OBJECT REFERENCES A5 CROSS SITE REQUEST FORGERY (CSRF) A6 SECURITY MISCONFIGURATION
- 14. Injections Breaking out of a data context into a code context Why is SQLi still around?
- 15. Injections (2) var catId = Request.QueryString["Category"]; var sql = "SELECT * FROM Products WHERE [CategoryId] = " + catId;
- 16. Anti-Injection ORM PARAMETERIZED QUERIES DON'T BE LAZY
- 17. Cross Site Scripting (XSS) Injection of client-side code into Web pages viewed by other users public static MvcHtmlString DeviceInfoEvil(this HtmlHelper helper) { string s = "<span>" + helper.ViewContext.HttpContext.Request.UserAgent + "</span>"; return MvcHtmlString.Create(s); } [...] Mozilla/5.0 (compatible; MSIE 9.0; Windows Phone OS 7.5;)<script>alert(1);</script> [...] public static MvcHtmlString DeviceInfoGood(this HtmlHelper helper) { TagBuilder userAgent = new TagBuilder("span"); userAgent.SetInnerText(helper.ViewContext.HttpContext.Request.UserAgent); return MvcHtmlString.Create(userAgent.ToString()); }
- 18. Cross Site Request Forgery (CSRF) Forged requests executed by tricking authenticated victim <img src="https://bank.com/smth?param=1" /> <iframe src="https://bank.com/smth?param=1" /> <body onload="document.forms[0].submit"> <form method="post" action="https://bank.com/smth"> <input type="hidden" name="param" value="1" /> </form> </body>
- 19. Anti-XSS INPUT FILTERING OUTPUT FILTERING MICROSOFT AntiXSS ANTIFORGERY TOKENS
- 20. Broken Authentication and Session Management Poor implementation of authentication and session management 6.5 MILLION HASHES 450 000 PASSWORDS PLAIN SHA1 PLAIN TEXT June 2012 July 2012
- 21. Be careful DON'T REINVENT THE WHEEL NO HARDCODED “SHORTCUTS” OUTPUT FILTERING Use #if DEBUG HASH + SALT + STRECHING bcrypt/scrypt TLS https://www.cookiecadger.com
- 22. Insecure Direct Object References Unauthorized access of exposed reference to an internal implementation MASS ASSIGNMENT VULNERABILITY
- 23. Insecure Direct Object References (2) public class User { public string UserName { get; set; } public bool IsAdmin { get; set; } } [Authorize] [AcceptVerbs(HttpVerbs.Post)] public ActionResult UpdateUser(User model) { if (ModelState.IsValid) { var user = db.Users.Single(u => u.UserName == model.UserName); if (TryUpdateModel(user)) { db.SaveChanges(); } } return View(); }
- 24. Insecure Direct Object References (3) public ActionResult UpdateUser([Bind(Exclude="IsAdmin")] User model) //Black Listing - NO [...] public ActionResult UpdateUser([Bind(Include="UserName")] User model) //White Listing – OK [...] public class UserViewModel //Secure by Design - BEST { public string UserName { get; set; } }
- 25. Countermeasures NO COPY-PASTE ACCESS CHECKS CODE REVIEWS
- 26. Security Misconfiguration Improper application configuration
- 27. Web.Config Security Analyzer https://sourceforge.net/projects/wcsa
- 28. Introducing in development ? DEDICATED PERSON SPECIAL TRAINING SELF TRAINING LEARN PRACTICE UNDERSTAND
- 29. Common Excuses NO ONE WILL HACK US Ignorance TIGHT DEADLINESS Budget
- 30. The Real Issue WRONG PERSON IN WRONG PLACE Architect Manager Lazy Co-Worker
- 31. Security is hard but possible when you know
- 32. Don't forget Drowning is your personal problem
- 33. Further Reading
- 34. Highly Recommended ACADEMIC HACKER ENTERPRISE
- 35. Learning From The Breakers Hacking Illustrated Video from Security Conferences http://www.irongeek.com