Pony Pwning Djangocon 2010

Pony Pwning
Djangocon 2010 // Adam Baldwin

Wednesday, September 8, 2010

Hi, I’m not that Adam Baldwin.

I’m this one:
@adam_baldwin
ngenuity-is.com
evilpacket.net


I break stuff


Django = pile
of awesome


Django isn’t
perfect


Developers
aren’t perfect


I WANT TO
HELP YOU
AVOID
HUGE ASS
MISTAKES

Captain Howdy McAssumptions,
the nGenuity Mascot

INTRODUCING!

Completely
made up
statistics


60% of security
failures

project
constraints!

30% of security
failures

incompetence
or ignorance

See http://evilpacket.net/2010/jan/14/miﬁ-geopwn/

9% of security
failures

needle in
the haystack

See http://evilpacket.net/2009/jul/9/rackspace-cloud-xss-root/
and http://evilpacket.net/2009/jul/9/theft-rackspace-cloud-api-key/

1% of security
failures

0 days

Let’s talk
about the 90%

Sad Pony
Warning


cross-site scripting


{
the
“ double quote

Big ‘ single quote

& ampersand
Five < less than

> greater than


{% autoescape off %}

|safe ﬁlter

mark_safe( )

Context matters.
<a href=”{{object.absolute_url}}” alt=”{{object.name}}”>
{{object.name}}</a>

<a href={{object.absolute_url}} alt={{object.name}}>
{{object.name}}</a>

Missing quotes in the second URL make it possible
to inject malicious code.

Which is bad.


swingset
OWASP ESAPI Swingset by Craig Younkins
http://www.owasp.org/index.php/ESAPI_Swingset

Browser behavior
This works in IE8, without the “big ﬁve” and executes
without user interaction.

<style /><a href="[user provided data here]">click</a>
<style /><a href="}@import/**/data:text/css
%3Bbase64,Knt4OmV4cHJlc3Npb24oYWxlcnQoMSkpf
Q%3D%3D;">click</a>


Avoid • Consider OWASP ESAPI

• Audit templates
getting • Audit reusables and snippets

burned • Educate designers


FILE UP
LOADS

Evil Avatars
Images can contain PHP.

ImageField does not care.

ImageField does not check extensions.

File uploads often are put in
unprotected directories.


Avoid • Check ﬁle extensions

• Disable PHP
getting
burned


File upload TMI

secret_report.pdf

secret_report_1.pdf


Avoid • Put user content behind a ﬁle API

• Obfuscate ﬁlenames of uploads
getting
burned


Direct
Object
Access


General TMI

“Not Found”

vs.

“Forbidden” / “Access denied”


Avoid • Return consistent results
(preferably “Not Found”)

getting • Log security violations

burned


Doing stupid things

Privileged operations with HTTP GET

eg /object/delete/2


Avoid • Don’t do stupid things.

• Consider Django-Piston for REST
getting
burned


Click
Jacking
What the hell is it?


Click jackets
/admin/ is vulnerable.

pre-ﬁlling forms removes
most user interaction


Avoid • Set X-FRAME-OPTIONS DENY
header

getting • Use django-xframeoptions
middleware

burned • Implement frame breakout code


Abusing
:(
/admin/

Wuh-oh, kids.

[ REDACTED ]


Avoid • I HAVE NO IDEA.

• security@djangoproject.com
getting needs to check their email ;)

burned


I have a
hard job

Your job
is harder.

Questions?
@adam_baldwin // ngenuity-is.com // evilpacket.net

Pony Pwning Djangocon 2010

Recommended

Recommended

More Related Content

Similar to Pony Pwning Djangocon 2010

Similar to Pony Pwning Djangocon 2010 (20)

More from Adam Baldwin

More from Adam Baldwin (14)

Recently uploaded

Recently uploaded (20)

Pony Pwning Djangocon 2010