Outpost24 webinar - Understanding the 7 deadly web application attack vectors
β’Download as PPTX, PDFβ’
0 likesβ’100 views
This document discusses understanding web application attack vectors by examining the 7 deadly vectors: security mechanisms, page creation methods, degree of distribution, authentication, input vectors, active content technologies, and cookies. It describes the risks associated with each vector, such as non-encrypted traffic, server-side vulnerabilities, cross-domain problems spanning applications, and vulnerabilities in scripting languages exploited via active content. The document also covers assessing an application's attack surface based on these vectors, assigning a risk score, and developing an application security program to pay attention to these risks.
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Outpost24 webinar - Understanding the 7 deadly web application attack vectors
Similar to Outpost24 webinar - Understanding the 7 deadly web application attack vectors (20)
More from Outpost24
More from Outpost24 (20)
Recently uploaded
Recently uploaded (20)
Outpost24 webinar - Understanding the 7 deadly web application attack vectors
- 1. Understanding the 7 deadly web application attack vectors Stephane Konarkowski 22nd July 2020
- 2. Helping customers improve security posture since 2001 Full stack security assessment Over 2,000 customers in all regions of the world Really good at breaking technology
- 3. What you will learn: β’ Think like a hacker β’ Get inside knowledge on how multiple discovery techniques should be used to assess web β’ Delve into the seven deadly β’ Top tips on creating a complete security blueprint of your critical web apps and a continuous application security program based on your attack surface 3
- 4. We look at your Web Application like a hacker does 4
- 5. Pen Tester vs Hacker vs Burglar Hacker Pen TesterBurglar In common 5
- 6. Which Vectors are they looking at
- 7. 7 7 Vectors
- 8. Security Mechanism (SM) HTTP HTTPS http://www.bank-example.com Password: abc123 https://www.bank-example.com Password: e99a18c428cb38d5f260853678922e03 1) SSL Certificate Encryption 2) TLS Transport host port βββββββββ΄ββββββββ ββ΄β http://www.example.com:123/forum/questions/?tag=networking&order=newest#top βββ¬βββββββββββββββ¬βββββββββ¬ββββββββββββββββββββββ¬ββββββββββββββββββ¬ββ scheme authority path query fragment 8
- 9. Security Mechanism (SM) Client side Server side Both = Better Input Validation Can be by-pass 9
- 10. Security Mechanism (SM) Risk Associated with SM 10 β’ Non-Encrypted β’ Intercepted β’ Stolen Data β’ Developers often assume that the client won't modify the data β’ The Web Application Hackers handbook
- 11. Page Creation Method (PM) CS runs scripts on your computer after you've loaded a web page. SS runs scripts before the HTML is loaded Server-side code is source to vulnerabilityClient side Server side PHP ASP Java Python Ruby 11
- 12. Page Creation Method (PM) Risk Associated with PM 12 β’ PHP Object Injection β’ Java deserialization β’ Server-Side Vulnerabilities Like SQL INJECTION Attacks that cause a hosted application to operate in unexpected or unpredictable ways, can result in private data either leaking out through HTTP responses or logs
- 13. Degree of Distribution(DOD) Cross-domain problems are a common source of vulnerabilities WWW.WEBSITE.COM SUBDOMAIN 2nd LEVEL DOMAIN TOP LEVEL DOMAIN More Attack Vectors Spans across 13
- 14. Degree of Distribution(DOD) Risk Associated with DOD 14 β’ A Secure Web Application that connects to other Web Applications or is associated to them Can be attacked from a vulnerable one. β’ A script from page A can only access data from page B if they are of the same origin.
- 16. Authentication (AUTH) Risk Associated with Authentication 16 β’ Curiosity: Yes β’ Trusted: To a degree β’ Important: Maybe β’ Data: Oh yeah
- 17. Input Vectors (IV) The more input vectors the more complex β’ File Upload β’ Search Functions β’ Other Forms β’ External Engines 17
- 18. Input Vectors (IV) Risk Associated with Input Vectors 18 Input Validation Attacks: Cause, Exploits, Impacts Cause: Failure to properly validate data at the entry and exit points of the application Exploits: Injection of malicious input such as code, scripting, commands, that can be interpreted/executed by different targets to exploit vulnerabilities: β’ Browser: XSS, XFS, HTML-Splitting β’ Data repositories: SQL Injection, LDAP injection β’ Server side file processing: XML, XPATH β’ Application/Server/O.S. :File uploads, Buffer Overflow Impacts: Phishing, Information Disclosure (PII), Data Modification, Denial Of service, Financial Loss, Reputation Loss
- 19. Active Content Technology (ACT) β’ JavaScript β’ Java Applet β’ AJAX β’ & more β’ Externally Loaded β’ RIA β’ RSS 19
- 20. Active Content Technology (ACT) Risk Associated with ACT 20 Active content contains programs that trigger automatic actions on a Web page without the user's knowledge or consent. All Web users are regularly exposed to active content. β’ Code that you have copied β’ Code that sits on an external side (No control) Vulnerabilities in the scripting language are exploited to carry malicious code, which could be downloaded through a Web browser and executed on a local system without the user's knowledge or consent
- 21. Cookies (CS) Own Cookies & 21 β’ Session β’ Persistent Foreign Cookies
- 22. Cookies (CS) Risk Associated with Cookies β’ Cross Site Request Forgery Attack (XSRF) β’ Session Fixation β’ Cross-Site Scripting β’ Cookie Tossing Attack β’ Cookie Overflow Attack β’ Tracking/Privacy 22
- 23. How to Score
- 24. 24 Attack Surface based on Vectors Attack Surface Max Score: 39,19
- 25. Business Criticality β’ Is this application revenue generating? β’ Is this application hosting sensitive information and customer data (PII) Update Frequency β’ No application updates β’ Application updates occur once a year β’ Application updates occur several times a year β’ Updates occur continuously Complexity Level β’ Application with a high number of pages β’ Application with dynamic content β’ Application with multiple inputs (forms) Criticality UpdatesComplexity ARS (Application Risk Score) Understanding your application 25
- 26. Application Risk Score (ARS) 26 Application Name Surface Score Criticality Update frequency Appsec Program Availability Confidentiality Integrity demo1.com 20.45 2 2 2 1 5 demo2.com 20.22 3 2 2 2 9 ! CVSS becomes CASS
- 27. Attack Surface Radar Airline Other 27
- 28. ASP Onboarding Scout Application Security Program (ASP) 28 ?=?
- 29. Paying Attention How many have you counted in the presentation? The right answer gets a Free Scout Assessment 29
- 30. Takeaways? 30
- 31. Takeaways 31 β’ Yes Cookies are also in that bag β’ Understand how its built to better defend β’ Not all of them need an in depth assessment β’ If you donβt know what you have β¦ β’ Its not the big door they will open
- 32. Stephane Konarkowski Senior Security Consultant sk@outpost24.com Questions?