Web Application Security: The Land that Information Security Forgot
![[object Object],[object Object],[object Object],[object Object],Copyright 2001 WhiteHat Security All Rights Reserved](https://image.slidesharecdn.com/blackhateurope2001presentation-100715140747-phpapp01/75/web-application-security-the-land-that-information-security-forgot-1-2048.jpg?cb=1668245163)
![Topics ,[object Object],[object Object],[object Object],2001 © WhiteHat Security, Inc.](https://image.slidesharecdn.com/blackhateurope2001presentation-100715140747-phpapp01/75/web-application-security-the-land-that-information-security-forgot-2-2048.jpg?cb=1668245163)
![Topics ,[object Object],[object Object],[object Object],[object Object],[object Object],2001 © WhiteHat Security, Inc.](https://image.slidesharecdn.com/blackhateurope2001presentation-100715140747-phpapp01/75/web-application-security-the-land-that-information-security-forgot-3-2048.jpg?cb=1668245163)
![But Why!? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],2001 © WhiteHat Security, Inc.](https://image.slidesharecdn.com/blackhateurope2001presentation-100715140747-phpapp01/75/web-application-security-the-land-that-information-security-forgot-4-2048.jpg?cb=1668245163)
![Web Application The Simple Definition ,[object Object],[object Object],[object Object],[object Object],2001 © WhiteHat Security, Inc.](https://image.slidesharecdn.com/blackhateurope2001presentation-100715140747-phpapp01/75/web-application-security-the-land-that-information-security-forgot-6-2048.jpg?cb=1668245163)
![The Implementation ,[object Object],[object Object],[object Object],[object Object],[object Object],E-Commerce Shopping Auctions Banking Stock Trading Just Plain Crazy Printers PDA’s Cell Phones System Configuration .NET/Passport 2001 © WhiteHat Security, Inc.](https://image.slidesharecdn.com/blackhateurope2001presentation-100715140747-phpapp01/75/web-application-security-the-land-that-information-security-forgot-8-2048.jpg?cb=1668245163)
![Trusting Client-Side Data ,[object Object],[object Object],[object Object],[object Object],2001 © WhiteHat Security, Inc.](https://image.slidesharecdn.com/blackhateurope2001presentation-100715140747-phpapp01/75/web-application-security-the-land-that-information-security-forgot-12-2048.jpg?cb=1668245163)
![Trusting Client-Side Data ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],2001 © WhiteHat Security, Inc.](https://image.slidesharecdn.com/blackhateurope2001presentation-100715140747-phpapp01/75/web-application-security-the-land-that-information-security-forgot-13-2048.jpg?cb=1668245163)
![Trusting Client-Side Data ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],2001 © WhiteHat Security, Inc.](https://image.slidesharecdn.com/blackhateurope2001presentation-100715140747-phpapp01/75/web-application-security-the-land-that-information-security-forgot-14-2048.jpg?cb=1668245163)
![Unescaped Special Characters ,[object Object],[object Object],[object Object],[object Object],2001 © WhiteHat Security, Inc.](https://image.slidesharecdn.com/blackhateurope2001presentation-100715140747-phpapp01/75/web-application-security-the-land-that-information-security-forgot-15-2048.jpg?cb=1668245163)
![HTML Character Filtering ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],2001 © WhiteHat Security, Inc.](https://image.slidesharecdn.com/blackhateurope2001presentation-100715140747-phpapp01/75/web-application-security-the-land-that-information-security-forgot-16-2048.jpg?cb=1668245163)
![More mistakes… ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],2001 © WhiteHat Security, Inc.](https://image.slidesharecdn.com/blackhateurope2001presentation-100715140747-phpapp01/75/web-application-security-the-land-that-information-security-forgot-17-2048.jpg?cb=1668245163)
![Information & Discovery ,[object Object],[object Object],[object Object],[object Object],[object Object],2001 © WhiteHat Security, Inc.](https://image.slidesharecdn.com/blackhateurope2001presentation-100715140747-phpapp01/75/web-application-security-the-land-that-information-security-forgot-18-2048.jpg?cb=1668245163)
![Spidering/Site Crawling ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Tools: WGET http://www.gnu.org/software/wget/wget.html 2001 © WhiteHat Security, Inc.](https://image.slidesharecdn.com/blackhateurope2001presentation-100715140747-phpapp01/75/web-application-security-the-land-that-information-security-forgot-19-2048.jpg?cb=1668245163)
![Identifiable Characteristics ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],2001 © WhiteHat Security, Inc.](https://image.slidesharecdn.com/blackhateurope2001presentation-100715140747-phpapp01/75/web-application-security-the-land-that-information-security-forgot-20-2048.jpg?cb=1668245163)
![Error and Response Codes ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],2001 © WhiteHat Security, Inc.](https://image.slidesharecdn.com/blackhateurope2001presentation-100715140747-phpapp01/75/web-application-security-the-land-that-information-security-forgot-21-2048.jpg?cb=1668245163)
![File/Application Enumeration ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],2001 © WhiteHat Security, Inc.](https://image.slidesharecdn.com/blackhateurope2001presentation-100715140747-phpapp01/75/web-application-security-the-land-that-information-security-forgot-22-2048.jpg?cb=1668245163)
![File/Application Enumeration ,[object Object],[object Object],[object Object],[object Object],[object Object],2001 © WhiteHat Security, Inc.](https://image.slidesharecdn.com/blackhateurope2001presentation-100715140747-phpapp01/75/web-application-security-the-land-that-information-security-forgot-23-2048.jpg?cb=1668245163)
![Network Reconnaissance ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],2001 © WhiteHat Security, Inc.](https://image.slidesharecdn.com/blackhateurope2001presentation-100715140747-phpapp01/75/web-application-security-the-land-that-information-security-forgot-24-2048.jpg?cb=1668245163)
![Input Manipulation Parameter Tampering "Twiddling Bits." ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],2001 © WhiteHat Security, Inc.](https://image.slidesharecdn.com/blackhateurope2001presentation-100715140747-phpapp01/75/web-application-security-the-land-that-information-security-forgot-25-2048.jpg?cb=1668245163)
![Cross-Site Scripting Bad name given to a dangerous security issue ,[object Object],[object Object],[object Object],[object Object],[object Object],2001 © WhiteHat Security, Inc.](https://image.slidesharecdn.com/blackhateurope2001presentation-100715140747-phpapp01/75/web-application-security-the-land-that-information-security-forgot-26-2048.jpg?cb=1668245163)
![Client-Side Scripting Languages ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],2001 © WhiteHat Security, Inc.](https://image.slidesharecdn.com/blackhateurope2001presentation-100715140747-phpapp01/75/web-application-security-the-land-that-information-security-forgot-27-2048.jpg?cb=1668245163)
![Accessing the DOM & Outside the DOM ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],2001 © WhiteHat Security, Inc.](https://image.slidesharecdn.com/blackhateurope2001presentation-100715140747-phpapp01/75/web-application-security-the-land-that-information-security-forgot-28-2048.jpg?cb=1668245163)
![Authentication/Authorization “Hand in the cookie jar.” ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],2001 © WhiteHat Security, Inc.](https://image.slidesharecdn.com/blackhateurope2001presentation-100715140747-phpapp01/75/web-application-security-the-land-that-information-security-forgot-29-2048.jpg?cb=1668245163)
![The Scenarios ,[object Object],[object Object],[object Object],[object Object],[object Object],2001 © WhiteHat Security, Inc.](https://image.slidesharecdn.com/blackhateurope2001presentation-100715140747-phpapp01/75/web-application-security-the-land-that-information-security-forgot-30-2048.jpg?cb=1668245163)
![CSS Danger “The Remote Launch Pad.” ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],2001 © WhiteHat Security, Inc.](https://image.slidesharecdn.com/blackhateurope2001presentation-100715140747-phpapp01/75/web-application-security-the-land-that-information-security-forgot-31-2048.jpg?cb=1668245163)
![Dangerous HTML “HTML Bad” ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],2001 © WhiteHat Security, Inc.](https://image.slidesharecdn.com/blackhateurope2001presentation-100715140747-phpapp01/75/web-application-security-the-land-that-information-security-forgot-32-2048.jpg?cb=1668245163)
![Dangerous Attributes “Attributes Bad” ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],2001 © WhiteHat Security, Inc.](https://image.slidesharecdn.com/blackhateurope2001presentation-100715140747-phpapp01/75/web-application-security-the-land-that-information-security-forgot-33-2048.jpg?cb=1668245163)
![Filter Bypassing "JavaScript is a Cockroach" ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],2001 © WhiteHat Security, Inc.](https://image.slidesharecdn.com/blackhateurope2001presentation-100715140747-phpapp01/75/web-application-security-the-land-that-information-security-forgot-34-2048.jpg?cb=1668245163)
![Testing the Filters ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],2001 © WhiteHat Security, Inc.](https://image.slidesharecdn.com/blackhateurope2001presentation-100715140747-phpapp01/75/web-application-security-the-land-that-information-security-forgot-35-2048.jpg?cb=1668245163)
![SCRIPT TAG ,[object Object],[object Object],[object Object],[object Object],[object Object],2001 © WhiteHat Security, Inc.](https://image.slidesharecdn.com/blackhateurope2001presentation-100715140747-phpapp01/75/web-application-security-the-land-that-information-security-forgot-36-2048.jpg?cb=1668245163)
![SRCing JavaScript Protocol ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],2001 © WhiteHat Security, Inc.](https://image.slidesharecdn.com/blackhateurope2001presentation-100715140747-phpapp01/75/web-application-security-the-land-that-information-security-forgot-37-2048.jpg?cb=1668245163)
![SRCing JavaScript Protocol w/ HTML Entities ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],2001 © WhiteHat Security, Inc.](https://image.slidesharecdn.com/blackhateurope2001presentation-100715140747-phpapp01/75/web-application-security-the-land-that-information-security-forgot-38-2048.jpg?cb=1668245163)
![AND CURLY ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],2001 © WhiteHat Security, Inc.](https://image.slidesharecdn.com/blackhateurope2001presentation-100715140747-phpapp01/75/web-application-security-the-land-that-information-security-forgot-39-2048.jpg?cb=1668245163)
![Style Tag Conversion ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],2001 © WhiteHat Security, Inc.](https://image.slidesharecdn.com/blackhateurope2001presentation-100715140747-phpapp01/75/web-application-security-the-land-that-information-security-forgot-40-2048.jpg?cb=1668245163)
![Using CSS ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],2001 © WhiteHat Security, Inc.](https://image.slidesharecdn.com/blackhateurope2001presentation-100715140747-phpapp01/75/web-application-security-the-land-that-information-security-forgot-41-2048.jpg?cb=1668245163)
![Using CSS ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],2001 © WhiteHat Security, Inc.](https://image.slidesharecdn.com/blackhateurope2001presentation-100715140747-phpapp01/75/web-application-security-the-land-that-information-security-forgot-42-2048.jpg?cb=1668245163)
![Twiddling Bits ,[object Object],[object Object],[object Object],2001 © WhiteHat Security, Inc.](https://image.slidesharecdn.com/blackhateurope2001presentation-100715140747-phpapp01/75/web-application-security-the-land-that-information-security-forgot-43-2048.jpg?cb=1668245163)
![Power of the Semi-Colon piping input to the command line. ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],2001 © WhiteHat Security, Inc.](https://image.slidesharecdn.com/blackhateurope2001presentation-100715140747-phpapp01/75/web-application-security-the-land-that-information-security-forgot-44-2048.jpg?cb=1668245163)
![Power of Special Characters piping input to the command line. ,[object Object],[object Object],[object Object],[object Object],2001 © WhiteHat Security, Inc.](https://image.slidesharecdn.com/blackhateurope2001presentation-100715140747-phpapp01/75/web-application-security-the-land-that-information-security-forgot-45-2048.jpg?cb=1668245163)
![Power of the Dots and Slashes piping input to the command line. ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],2001 © WhiteHat Security, Inc.](https://image.slidesharecdn.com/blackhateurope2001presentation-100715140747-phpapp01/75/web-application-security-the-land-that-information-security-forgot-46-2048.jpg?cb=1668245163)
![More Filter Bypassing ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],2001 © WhiteHat Security, Inc.](https://image.slidesharecdn.com/blackhateurope2001presentation-100715140747-phpapp01/75/web-application-security-the-land-that-information-security-forgot-47-2048.jpg?cb=1668245163)
![More bits… ,[object Object],[object Object],2001 © WhiteHat Security, Inc.](https://image.slidesharecdn.com/blackhateurope2001presentation-100715140747-phpapp01/75/web-application-security-the-land-that-information-security-forgot-48-2048.jpg?cb=1668245163)
![System Mis-Configurations “patches, patches, and more patches…" ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],2001 © WhiteHat Security, Inc.](https://image.slidesharecdn.com/blackhateurope2001presentation-100715140747-phpapp01/75/web-application-security-the-land-that-information-security-forgot-49-2048.jpg?cb=1668245163)
![Other Dirty Tricks “Abuse can be far more time consuming, costly and dangerous” ,[object Object],[object Object],[object Object],[object Object],2001 © WhiteHat Security, Inc.](https://image.slidesharecdn.com/blackhateurope2001presentation-100715140747-phpapp01/75/web-application-security-the-land-that-information-security-forgot-50-2048.jpg?cb=1668245163)
![Other Dirty Tricks “Abuse can be far more time consuming, costly and dangerous” ,[object Object],[object Object],[object Object],[object Object],[object Object],2001 © WhiteHat Security, Inc.](https://image.slidesharecdn.com/blackhateurope2001presentation-100715140747-phpapp01/75/web-application-security-the-land-that-information-security-forgot-51-2048.jpg?cb=1668245163)
![Thank You BlackHat and Attendees Questions? ,[object Object],[object Object],[object Object],[object Object],[object Object],2001 © WhiteHat Security, Inc.](https://image.slidesharecdn.com/blackhateurope2001presentation-100715140747-phpapp01/75/web-application-security-the-land-that-information-security-forgot-52-2048.jpg?cb=1668245163)
Web Application Security: The Land that Information Security Forgot
Web Application Security: The Land that Information Security Forgot Today, the vast majority of those within information security have heard about web application security and posses at least a vague understanding of the risks involved. However, the multitude of attacks which make this area of security important, for the most part, go undocumented, unexplained and misunderstood. As a result, our web applications become undefended and at the mercy of a determined attacker. In order to gain a deeper understanding of the threats, witnessing these attacks first hand is essential. Make no mistake, insecure and unprotected web applications are the fastest, easiest, and arguably the most utilized route to compromise networks and exploit users. What's worse is that conventional security measures lack the proper safeguards and offer little protection, resulting in nothing more than a "false sense of security". This discussion will cover theory surrounding some of the more dangerous web application attacks, examples of the attack in action, and possible countermeasures. Founder and chairman of WhiteHat Security, and former information security officer with Yahoo!. As information security officer at Yahoo!, Jeremiah was designing, auditing, and penetration-testing the huge company's web applications which demand highest security. During his past 5 years of employment, Jeremiah has been researching and applying information security with special emphasis on prevention of web application sabotage. Grossman has presented "Web Application Security" talks at many security conventions such as the Defcon, Air Force and Technology Conference, ToorCon, and others. Jeremiah is a lead contributor to the "Open Web Application Security Project" www.owasp.com and considered to be among the foremost web security experts.
More Related Content
What's hot
![[CB16] Electron - Build cross platform desktop XSS, it’s easier than you thin...](https://cdn.slidesharecdn.com/ss_thumbnails/cb16hasegawaen-161109050843-thumbnail.jpg?width=384&fit=bounds)
What's hot(20)
![[CB16] Electron - Build cross platform desktop XSS, it’s easier than you thin...](https://cdn.slidesharecdn.com/ss_thumbnails/cb16hasegawaen-161109050843-thumbnail.jpg?width=768&fit=bounds)
Viewers also liked
Viewers also liked(20)
Similar to Web Application Security: The Land that Information Security Forgot
Similar to Web Application Security: The Land that Information Security Forgot(20)
![[CB20] Operation I am Tom: How APT actors move laterally in corporate network...](https://cdn.slidesharecdn.com/ss_thumbnails/aragorntsengandcharleslicb20-210112140146-thumbnail.jpg?width=768&fit=bounds)
More from Jeremiah Grossman
More from Jeremiah Grossman(20)
![WhiteHat Security Website Statistics [Full Report] (2013)](https://cdn.slidesharecdn.com/ss_thumbnails/wpstatsreport052013-130502135957-phpapp01-thumbnail.jpg?width=768&fit=bounds)
![WhiteHat’s 12th Website Security Statistics [Full Report]](https://cdn.slidesharecdn.com/ss_thumbnails/wpstatssummer1212th-120702164437-phpapp01-thumbnail.jpg?width=768&fit=bounds)
Recently uploaded
Recently uploaded(20)
Web Application Security: The Land that Information Security Forgot
- 5. How much easier can it get!? Oh right. Unicode 2001 © WhiteHat Security, Inc.
- 7. Web Security Layers 2001 © WhiteHat Security, Inc.
- 9. Firewall 2001 © WhiteHat Security, Inc.
- 10. 2001 © WhiteHat Security, Inc.
- 11. Common Web Application Security Mistakes 2001 © WhiteHat Security, Inc.