Owasp top 10

AVOIDING THE OWASP
Top 10 security exploits

Friday, 2 November, 12

ME

Illustrator turned developer

Team Lead at FreshBooks

Lead developer of CakePHP

PHP developer for 7 years


SECURITY


SECURITY CONTINUUM

(
unusable
)
unrestricted


OWASP
Open Web Application Security Project


OWASP TOP 10


1
SQL INJECTION
‘ OR 1=1 ‘--

RISKS

Permits query manipulation, and arbitrary SQL.

Bad guys can re-write your queries.


SQL INJECTION EXAMPLE

$username = $_POST[‘username’];
$password = $_POST[‘password’];

$query = “SELECT * FROM user
WHERE username = ‘$username’
AND password = ‘$password’”;

$user = $db->query($query);

USER INPUT

$username = “root”;
$password = “‘ OR 1 = 1 --”;


FINAL QUERY

WHERE username = ‘root’
AND password = ‘‘ OR 1 = 1 --’”;


PREVENTION

Use an ORM or Database abstraction layer that
provides escaping. Doctrine, ZendTable, and
CakePHP all do this.

Use PDO and prepared statements.

Never put user data into a query.

Never use regular expressions, magic quotes, or
addslashes()


EXAMPLE (PDO)

WHERE username = ?
AND password = ?”;

$stmt = $db->prepare($query);
$stmt->bindValue($username);
$stmt->bindValue($password);
$result = $db->execute();


2
XSS
<script>alert(‘cross site scripting’);</script>

RISKS

Allows bad guys to do things as the person viewing a
page.

Steal identities, passwords, credit cards, hijack pages
and more.


XSS EXAMPLE

<p>
<?php echo $user[‘bio’]; ?>
</p>


You may be thinking, I can use regular expressions
to ﬁx this.


PREVENTION

Regular expressions and strip_tags leave you
vulnerable.

The only solution is output encoding.


EXAMPLE

<p>
<?php echo htmlentities(
$user[‘bio’],
ENT_QUOTES,
‘UTF-8’
); ?>
</p>


DANGERS

Manually encoding is error prone, and you will make
a mistake.

Using a template library like Twig that provides auto-
escaping reduces the chances of screwing up.

Encoding is dependent on context.


3 BROKEN AUTHENTICATION
& SESSION MANAGEMENT

/index.php?PHPSESSID=pwned

RISKS

Identity theft.

Firesheep was an excellent example.


SESSION FIXATION EXAMPLE

<?php
session_start();
if (isset($_GET[‘sessionid’]) {
session_id($_GET[‘sessionid’]);
}


PREVENTION

Rotate session identiﬁers upon login/logout

Set the HttpOnly ﬂag on session cookies.

Use well tested / mature libraries for authentication.

SSL is always a good idea.


4 INSECURE DIRECT OBJECT

REFERENCE

RISKS

Bad guys can access information they shouldn’t

Bad guys can modify data they shouldn’t.


BROKEN PASSWORD UPDATE

<form action=”/user/update” method=”post”>
<input type=”hidden” name=”userid” value=”4654” />
<input type=”text” name=”new_password” />
<button type=”submit”>Save</button>
</form>


PREVENTION

Remember hidden inputs are not really hidden, and
can be changed by users.

Validate access to all things, don’t depend on things
being hidden/invisible.

If you need to refer to the current user, use session
data not form inputs.

Whitelist properties any form can update.


5
CROSS SITE REQUEST
FORGERY
(CSRF)

RISKS

Evil websites can perform actions for users logged
into your site.

Side effects on GET can be performed via images or
CSS ﬁles.

Remember the Gmail contact hack.


CSRF EXAMPLE

Your app

Evil site


CSRF EXAMPLE

Your app

Evil site

Login


CSRF EXAMPLE

Your app

Evil site

Login

Accidentally visit


CSRF EXAMPLE

Your app Submit form for evil

Evil site

Login

Accidentally visit


PREVENTION

Add opaque expiring tokens to all forms.

Requests missing tokens or containing invalid tokens
should be rejected.


SAMPLE CSRF VALIDATION

<?php
if (!$this->validCsrfToken($data, ‘csrf’)) {
throw new ForbiddenException();
}


6
SECURITY
MISCONFIGURATION

RISKS

Default settings can be insecure, and intended for
development not production.

Attackers can use misconﬁgured software to gain
knowledge and access.


PREVENTION

Know the tools you use, and conﬁgure them
correctly.

Keep up to date on vulnerabilities in the tools you
use.

Remove/disable any services/features you aren’t using.


7 INSECURE CRYPTOGRAPHIC

STORAGE
md5(‘password’)

RISKS

Weak cryptographic storage can easily be cracked.

Keys can be exposed with encrypted data.

Backups can contain encrypted data & keys.

Compromised passwords can be used to obtain
information on other sites.


BAD PASSWORD HASHING

$password;

md5($password);

sha1($password);


USE BCRYPT FOR
PASSWORDS
only you can prevent bad hashing


PREVENTION

Use strong hashing/encryption.

Use one way hashing for passwords. Never use
symmetric encryption for passwords.

Don’t collect data if you don’t need it.

Keep keys separate from data.

If you’re using symmetric encryption, be able to
rotate keys easily.


BCRYPT IN PHP

// password hashing (bcrypt)
$hashed = crypt(
$pass,
‘$2a$10$asdkbisloqi.fidsliz.df190.d9f40’);

// compare later
$hashed = crypt($plaintext, $storedHash);

// check for match
$hashed === $storedHash


USE MCRYPT

// encrypt (rijndael)
$value = mcrypt_encrypt(
‘rijndael-256’,
$secretKey, $ccnumber,‘cbc’, $iv
);

// decrypt
$value = mcrypt_decrypt(
‘rijndael-256’,
$secretKey, $encrypted,‘cbc’, $iv
);


8 FAILURE TO RESTRICT URL

ACCESS

RISK

Hidden things can easily be found.

Creative people will eventually ﬁnd your hidden URLs

Security through obscurity is a terrible idea.


PREVENTION

Check access to all urls both when you generate
links and more importantly when handling requests.

Don’t rely on things staying hidden.


9 INSUFFICIENT TRANSPORT

LAYER PROTECTION

SSL/TLS

10 UNVALIDATED REDIRECTS &

FORWARDS

RISKS

Trusting user input for redirects opens phishing
attacks.

Breach of trust with your users.


PREVENTION

Don’t trust user data when handling redirects.


QUESTIONS?


Owasp top 10

More Related Content

What's hot

Similar to Owasp top 10

More from markstory

Recently uploaded

Owasp top 10