Download to read offline
Uploaded byIMMUNIO
RailsConf 2015 - Metasecurity: Beyond Patching Vulnerabilities
The document discusses the prevalence of web application vulnerabilities, including SQL injection and cross-site scripting (XSS), and the average time vulnerabilities remain undisclosed. It highlights the importance of implementing web application firewalls and various defensive coding practices to mitigate risks. Additionally, it mentions Immun.io as a solution for automated protection against various types of attacks and emphasizes the need for ongoing security audits and education.
More Related Content
Similar to RailsConf 2015 - Metasecurity: Beyond Patching Vulnerabilities
![Coded Agents – with UiPath SDK + LangGraph [Virtual Hands-on Workshop]](https://cdn.slidesharecdn.com/ss_thumbnails/codedagentsdeck-251215155422-5497c599-thumbnail.jpg?width=640&height=640&fit=bounds)
RailsConf 2015 - Metasecurity: Beyond Patching Vulnerabilities
- 1. Metasecurity: Beyond Patching Vulnerabilities ChaseDouglas Immun.io
- 2. Anatomy of asecurity attack Vulnerability Attacker
- 3. How to defendagainst vulnerabilities?
- 5. PHP: Over 24 vulnerabilitiesreported every year! cvedetails.com Rails: Over 7 vulnerabilities reported every year!
- 6. How fast canyou spin this wheel?
- 7. Vulnerabilities sold remain privatefor an average of 151 days The Known Unknowns - Stefan Frei - NSS Labs https://www.nsslabs.com/reports/known-unknowns-0
- 8. How many vulnerabilities arelurking, unfound?
- 9. How to defendagainst attackers?
- 10.
- 11.
- 12. Field Trip! CastleGaillard
- 13.
- 14. Anatomy of asecurity attack Vulnerability Attacker Exploitation
- 15.
- 16. Exploitations • SQL Injection •Cross Site Scripting (XSS)
- 17.
- 18.
- 19.
- 20.
- 21.
- 22.
- 23.
- 24.
- 25. Cross Site Scripting(XSS) But I didn’t click on anything!
- 26.
- 27.
- 28.
- 29.
- 30.
- 31. Rails Rendering Start withan empty SafeBuffer Buffer:
- 32. Rails Rendering Append templateafter calling html_safe on it Buffer: <head> <title>
- 33. Rails Rendering Append expressionresult Buffer: <head> <title><script>alert(1)</script> I tried to inject <script>alert(1)</script> here!
- 34. Rails Rendering Append templateafter calling html_safe on it Buffer: <head> <title><script>alert(1)</script></title>
- 35. Rails Rendering Append expressionresult Buffer: <head> <title><script>alert(1)</script></title> <script src=“/application.js”></script> javascript_include_tag returned a SafeBuffer
- 36. Rails Rendering Append templateafter calling html_safe on it Buffer: <head> <title><script>alert(1)</script></title> <script src=“/application.js”></script> </head>
- 37.
- 38.
- 39. XSS params => {id:“<script>alert(1)</script>”} <div class=“alert”> User id <script>alert(1)</script> does not exist </div> Rendered HTML:
- 40.
- 41.
- 42.
- 43. XSS params => {id:“<script>alert(1)</script>”} <div class=“alert”> User id <script>alert(1)</script> does not exist </div> Rendered HTML: +
- 44.
- 45.
- 46. How to FixXSS
- 47. How to FixSQL Injection • Check that args for all `Calculate` methods are actual table names • Always use hashes or arrays when using `delete_all`/`destroy_all`/ `where` • Always use hashes when using `find_by`/`find_by!` • Always convert user input to strings when passed to `exists?` • Never pass user input to `group`/`joins`/`order`/`reorder`/`pluck`/ `select`/`having` • Don’t use `find` unless you are a security guru • etc. etc.
- 48. “Once you’re donewith that, can you audit all our dependencies too?”
- 49. “Can you teacheveryone else about security?”
- 50. “All changes willbe reviewed by the security team” “It won’t be a bottleneck, we’ve got two security engineers”
- 51.
- 52. Metasecurity for XSS Shouldthere be script tags here?
- 53. Metasecurity for XSS •Wrap `html_safe` method • If called from a known good location, like a Rails helper, let the string through unimpeded • Otherwise, escape any <script> tags first
- 54.
- 55. How do wedetermine expected structures?
- 56. Every Query isExecuted at the Top of a Call Stack
- 57. Match Call Stackto a Learned Structure Eoknk
- 58. Verify Structure Eoknk Ok! Eoknkno1&1o1 Bad! Block and respondwith 403 Expected Structure: Eoknk
- 59.
- 60. Immunio is Metasecurity Automaticprotection against: Cross Site Scripting SQL Injection Remote Command Execution ShellShock Open Redirects Unauthorized File I/O CSRF Tampering Brute Force Authentication Attempts HTTP Header Split HTTP Method Tampering Automated Scanners And more…