Lesson 6 web based attacks


Published on

Published in: Technology
  • Be the first to comment

  • Be the first to like this

No Downloads
Total views
On SlideShare
From Embeds
Number of Embeds
Embeds 0
No embeds

No notes for slide
  • OWASP does not endorse or recommend commercial products or services, allowing our community
  • Certificate is sent. The certificate contains the public key along with the private key on the server
  • Lesson 6 web based attacks

    1. 1. Web Based Attacks CNG275 Frank H. Vianzon
    2. 2. Why Web Attacks? • Everything is on the web – Banking portals – E-commerce – Admin interfaces • Traditional Firewalls do not block
    3. 3. OWASP OWASP is the Open Web Application Security Project www.owasp.org worldwide not-for-profit charitable organization focused on improving the security of software. Our mission is to make software security visible, so that individuals and organizations worldwide can make informed decisions about true software security risks.
    4. 4. OWASP TOP 10 • A1-Injection • A2-Broken Authentication and Session Management • A3-Cross-Site Scripting • A4-Insecure Direct Object References
    5. 5. • A5 – Security Misconfiguration • A6- Sensitive Data Exposure • A7-Missing Function Level Access Control • A8 –Cross-Site Request Forgery
    6. 6. • A9 – Using components with known vulnerabilities • A10-unvalidated redirects
    7. 7. Verizon Breech Report
    8. 8. Basics – HTTP Protocol HTTP is the base of the web, it's really important to have a deep understanding of this protocol in order to perform web security testing. Knowing and understanding HTTP specificities will often allow you to find vulnerabilities and exploit them.
    9. 9. Client-Server Dialog HTTP is a dialog between one client and one server. The client, the browser, sends a request to the server, and then the server responds to this request. HTTP has the advantages of being a text protocol and therefore really easy to read, understand and learn for a human being. By default, most web servers are available on port TCP/80.
    10. 10. HTTPS Start with TCP 3 way handshake SYN SYN-ACK ACK
    11. 11. HTTPS Hello Client_Hello Server_Hello
    12. 12. HTTPS Certificate Client Verify
    13. 13. How do we see certificates? • Internet Explorer – Tools  Internet Options  Content  Certificates • Firefox – Tools  options  Advance  Certificates • Chrome – Bar  Settings  Advance  HTTPS/SSL Managed Certificates
    14. 14. Cookies Used to track user activity Same origin policy blocks
    15. 15. Name that site • DNS resolution occurs after typing the name of a web browser
    16. 16. • The most common request occurs when a browser asks the server for content. The browser sends a request composed of the following elements: • An HTTP method that will allow the server to understand what kind of operation the browser wants to perform.
    17. 17. • A resource that corresponds to what the client is trying to access on the server. • A version that will allow the server to know what version of HTTP the browser is talking. (user agent string) • Optionally, various headers giving more information to the server like the browser's name and version, the preferred language of the user (like in English, German, French,...),
    18. 18. HTTP Methods Many HTTP methods exist: • The GET method: to request for content, it's the most common request sent by browsers; • The POST method: POST is used to send a larger amount of data, it's used by most forms and also for file upload.
    19. 19. • The HEAD method: the HEAD method is very similar to the GET request, the only difference is in the response provided by the server, the response will only contain the headers and no body. HEAD is massively used by web spiders to check if a web page has been updated without downloading the full page content. • There are many other HTTP methods: PUT, DELETE, PATCH, TRACE
    20. 20. HTTP Headers • HTTP requests contain a lot of HTTP Headers. You can obviously manipulate all of them but if you provide incorrect values the request is likely to be rejected or the header won't be used.
    21. 21. Example Headers • Referer: to know where the clients come from; • Cookie: to retrieve the cookies; • User-Agent: to know what browser users use; • X-Forwarded-For: to get the source IP address (even if it's not the best method to do this).
    22. 22. HTTP Responses Example
    23. 23. Common HTTP Response Codes • 200 OK: the request was processed successfully. • 302 Found: used to redirect users for example when they logout to • send them back to the login page. • 401 Unauthorized: when the resource's access is restricted.
    24. 24. HTTP Response Codes • 404 Not found: the resource requested by the client was not found. • 500 Internal Server Error: an error occurred during the processing of the request.
    25. 25. URL Encoding • As we have seen, some characters are used in HTTP to distinguish between:
    26. 26. Cross-Site Scripting Attacks Two types of XSS attacks • Reflective • Stored
    27. 27. Reflective XSS (OWASP-DV-001) Reflected Cross-site Scripting (XSS) is another name for non-persistent XSS, where the attack doesn't load with the vulnerable web application but is originated by the victim loading the offending URI. In this article we will see some ways to test a web application for this kind of vulnerability.
    28. 28. Stored XSS Stored Cross Site Scripting (XSS) is the most dangerous type of Cross Site Scripting. Web applications that allow users to store data are potentially exposed to this type of attack.
    29. 29. XSS Excersice
    30. 30. Cross-Site Request Forgery • CSRF is an attack which forces an end user to execute unwanted actions on a web application in which he/she is currently authenticated. With a little help of social engineering (like sending a link via email/chat), an attacker may force the users of a web application to execute actions of the attacker's choosing. A successful CSRF exploit can compromise end user data and operation, when it targets a normal user. If the targeted end user is the administrator account, a CSRF attack can compromise the entire web application.
    31. 31. CSRF Example
    32. 32. SQL Injection • • A SQL injection attack consists of insertion or "injection" of a SQL query via the input data from the client to the application. A successful SQL injection exploit can read sensitive data from the database, modify database data (Insert/Update/Delete), execute administration operations on the database (such as shutdown the DBMS), recover the content of a given file existing on the DBMS file system and, in some cases, issue commands to the operating system. SQL injection attacks are a type of injection attack, in which SQL commands are injected into data-plane input in order to affect the execution of predefined SQL commands.