Predrag Cujanovic from OWASP Serbia talking about Cross site scripting, SQL injection and insecure cryptographic storage. Presentation was held on 9.7.2012. on faculty of Electrical Engineering, University of Belgrade.

2. Predrag Cujanović
Kontakt
• mail: predrag@cujanovic.com
• blog: http://www.cujanovic.com
• tw: http://www.twitter.com/cujanovic
• fb: http://www.facebook.com/predrag.cujanovic

3. Sadržaj:
• Cross side scripting (XSS) napad
• SQL injection (SQLi) napad
• Insecure cryptographic storage
• Primeri

4. Cross side scripting (XSS) napad
• Šta je XSS napad?
• Tipovi XSS napada
• Opasnost XSS napada
• Kako sprečiti XSS napad?

5. Šta je XSS napad?

6. Tipovi XSS napada
• Non-Persistent (Reflected)
• Persistent (Stored)
• DOM Based

7. Opasnost XSS napada
XSS Shell

9. Opasnost XSS napada
Cookie stealing
Phishing

10. Kako sprečiti XSS napad?
• Filtriranjem podataka preko već predefinisanih php
funkcija:
strip_tags, htmlspecialchars, htmlentities
• Izbegavati pisanje sopstvenih funkcija samo za ovu
namenu

11. SQL injection (SQLi) napad

Šta je SQLi napad?

Tipovi SQLi napada

Opasnost SQLi napada

Kako sprečiti SQLi napad?

12. Šta je SQLi napad?

13. Tipovi SQLi napada

Incorrectly filtered escape characters
(SELECT * FROM users WHERE name = '' OR '1'='1' -- ';)

Incorrect type handling
(SELECT * FROM userinfo WHERE id=1;DROP TABLE users;)

Blind SQL injection
(SELECT booktitle FROM booklist WHERE bookId = 'OOk14cd' AND '1'='1';)

Time Based SQL injection
(download_key=1' AND 6424=BENCHMARK(5000000,MD5(CHAR(102,100,78,99))) AND 'uzOQ'='uzOQ)

14. Opasnost SQLi napada

Pristup podacima u bazi (UNION SELECT 1,2,3,4--)

Izmena, brisanje podataka u bazi – DROP users;

Čitanje fajlova - load_file('/etc/passwd') ili
load_file(0x2f6574632f706173737764) funkcija

Pravnjenje novih fajlova - INTO OUTFILE
'/var/www/victim.com/shell.php'

15. Kako sprečiti SQLi napad?

mysql_real_escape_string funkcija

is_numeric funkcija

cast to int – (int)

16. Insecure cryptographic storage

17. Insecure cryptographic storage
0. koristiti neki hash algoritam
1. ne korisiti zastrarele hash algoritme
(md5 je zvanično mrtav)
2. korisiti salt, najbolje ih ne čuvati u bazi
(primer Wordpress)
3. korisiti dva različita hash algoritma
(sha1($salt.(des($salt.$pass.$salt))))

18. Insecure cryptographic storage
oclHashcat-plus

19. Hvala na pažnji :)
Pitanja?