Hack Your Drupal Application
- Think like a Hacker to Prevent Hacking

Subhransu Sekhar

Drupal Camp Delhi 2013
Why Security?
Cyber Security should be one of the major
concerns of any web application. This
session is all about securin...
OWASP Top Ten 2013
A1-Injection
A2-Broken Authentication and Session Management
A3-Cross-Site Scripting (XSS)
A4-Insecure ...
A1-Injection
Injection flaws, such as SQL, OS, and
LDAP injection occur when untrusted
data is sent to an interpreter as p...
A1-Injection (Example)
You shouldn't use data that you don't trust (as a feed, a user input, another
database, etc) direct...
A2-Broken Authentication and Session Management

Application functions related to
authentication and session management
ar...
A3-Cross-Site Scripting (XSS)
XSS flaws occur whenever an application
takes untrusted data and sends it to a
web browser w...
A3-Cross-Site Scripting (XSS)

Demo
Drupal Camp Delhi 2013
A4-Insecure Direct Object References
A direct object reference occurs when a
developer exposes a reference to an
internal ...
A4-Insecure Direct Object References

Demo
Drupal Camp Delhi 2013
A5-Security Misconfiguration
Good security requires having a secure
configuration defined and deployed for
the application...
A6-Sensitive Data Exposure
Many web applications do not properly protect
sensitive data, such as credit cards, tax IDs,
an...
A6-Sensitive Data Exposure

Demo
Drupal Camp Delhi 2013
A7-Missing Function Level Access Control
Most web applications verify function level
access rights before making that func...
A7-Missing Function Level Access Control

Demo
Drupal Camp Delhi 2013
A8-Cross-Site Request Forgery (CSRF)
A cross-site request forgery is an attack that
involves forcing a victim to send an
H...
A8-Cross-Site Request Forgery (CSRF)

Demo
Drupal Camp Delhi 2013
A9-Using Components with Known Vulnerabilities

Components, such as libraries, frameworks,
and other software modules, alm...
A9-Using Components with Known Vulnerabilities

Demo
Drupal Camp Delhi 2013
A10-Unvalidated Redirects and Forwards

Web applications frequently redirect and
forward users to other pages and websites...
A10-Unvalidated Redirects and Forwards

Demo
Drupal Camp Delhi 2013
Upcoming SlideShare
Loading in …5
×

Drupal security - Subhranshu Sekhar

897 views

Published on

Published in: Technology
0 Comments
0 Likes
Statistics
Notes
  • Be the first to comment

  • Be the first to like this

No Downloads
Views
Total views
897
On SlideShare
0
From Embeds
0
Number of Embeds
2
Actions
Shares
0
Downloads
6
Comments
0
Likes
0
Embeds 0
No embeds

No notes for slide

Drupal security - Subhranshu Sekhar

  1. 1. Hack Your Drupal Application - Think like a Hacker to Prevent Hacking Subhransu Sekhar Drupal Camp Delhi 2013
  2. 2. Why Security? Cyber Security should be one of the major concerns of any web application. This session is all about securing your Drupal Portal as per OWASP Top Ten 2013 In the session I will describe about case studies in Drupal Sites and How to Prevent it. Drupal Camp Delhi 2013
  3. 3. OWASP Top Ten 2013 A1-Injection A2-Broken Authentication and Session Management A3-Cross-Site Scripting (XSS) A4-Insecure Direct Object References A5-Security Misconfiguration A6-Sensitive Data Exposure A7-Missing Function Level Access Control A8-Cross-Site Request Forgery (CSRF) A9-Using Components with Known Vulnerabilities A10-Unvalidated Redirects and Forwards Drupal Camp Delhi 2013
  4. 4. A1-Injection Injection flaws, such as SQL, OS, and LDAP injection occur when untrusted data is sent to an interpreter as part of a command or query. The attacker’s hostile data can trick the interpreter into executing unintended commands or accessing data without proper authorization. Drupal Camp Delhi 2013
  5. 5. A1-Injection (Example) You shouldn't use data that you don't trust (as a feed, a user input, another database, etc) directly in a database query without escape it: index.php?prod_id=32 mysql_query("UPDATE product_table SET value = '". $value ."' WHERE id = ". $_GET['prod_id']); Instead you should use Drupal functions passing the user input as parameters: db_query("UPDATE {product_table } SET value = :value WHERE id = :id", array( ':value' => $value, ':id' => $prod_id); If you need to include dynamic table or column names in your query, you can use db_escape_table(). Drupal Camp Delhi 2013
  6. 6. A2-Broken Authentication and Session Management Application functions related to authentication and session management are often not implemented correctly, allowing attackers to compromise passwords, keys, or session tokens, or to exploit other implementation flaws to assume other users’ identities. Drupal Camp Delhi 2013
  7. 7. A3-Cross-Site Scripting (XSS) XSS flaws occur whenever an application takes untrusted data and sends it to a web browser without proper validation or escaping. XSS allows attackers to execute scripts in the victim’s browser which can hijack user sessions, deface web sites, or redirect the user to malicious sites. Drupal Camp Delhi 2013
  8. 8. A3-Cross-Site Scripting (XSS) Demo Drupal Camp Delhi 2013
  9. 9. A4-Insecure Direct Object References A direct object reference occurs when a developer exposes a reference to an internal implementation object, such as a file, directory, or database key. Without an access control check or other protection, attackers can manipulate these references to access unauthorized data. Drupal Camp Delhi 2013
  10. 10. A4-Insecure Direct Object References Demo Drupal Camp Delhi 2013
  11. 11. A5-Security Misconfiguration Good security requires having a secure configuration defined and deployed for the application, frameworks, application server, web server, database server, and platform. Secure settings should be defined, implemented, and maintained, as defaults are often insecure. Additionally, software should be kept up to date. Drupal Camp Delhi 2013
  12. 12. A6-Sensitive Data Exposure Many web applications do not properly protect sensitive data, such as credit cards, tax IDs, and authentication credentials. Attackers may steal or modify such weakly protected data to conduct credit card fraud, identity theft, or other crimes. Sensitive data deserves extra protection such as encryption at rest or in transit, as well as special precautions when exchanged with the browser. Drupal Camp Delhi 2013
  13. 13. A6-Sensitive Data Exposure Demo Drupal Camp Delhi 2013
  14. 14. A7-Missing Function Level Access Control Most web applications verify function level access rights before making that functionality visible in the UI. However, applications need to perform the same access control checks on the server when each function is accessed. If requests are not verified, attackers will be able to forge requests in order to access functionality without proper authorization. Drupal Camp Delhi 2013
  15. 15. A7-Missing Function Level Access Control Demo Drupal Camp Delhi 2013
  16. 16. A8-Cross-Site Request Forgery (CSRF) A cross-site request forgery is an attack that involves forcing a victim to send an HTTP request to a target destination without their knowledge or intent in order to Perform an action as the victim. The underlying cause is application functionality Using predictable URL/form actions in a repeatable way. Drupal Camp Delhi 2013
  17. 17. A8-Cross-Site Request Forgery (CSRF) Demo Drupal Camp Delhi 2013
  18. 18. A9-Using Components with Known Vulnerabilities Components, such as libraries, frameworks, and other software modules, almost always run with full privileges. If a vulnerable component is exploited, such an attack can facilitate serious data loss or server takeover. Applications using components with known vulnerabilities may undermine application defences and enable a range of possible attacks and impacts. Drupal Camp Delhi 2013
  19. 19. A9-Using Components with Known Vulnerabilities Demo Drupal Camp Delhi 2013
  20. 20. A10-Unvalidated Redirects and Forwards Web applications frequently redirect and forward users to other pages and websites, and use untrusted data to determine the destination pages. Without proper validation, attackers can redirect victims to phishing or malware sites, or use forwards to access unauthorized pages. Drupal Camp Delhi 2013
  21. 21. A10-Unvalidated Redirects and Forwards Demo Drupal Camp Delhi 2013

×