AVOIDING THE OWASP
Top 10 security exploits
Saturday, 5 October, 13

ME
Illustrator turned developer
PHP developer for 8 years
Architect/Developer at FreshBooks
Lead developer of CakePHP
Saturday, 5 October, 13

SECURITY
Saturday, 5 October, 13

SECURITY CONTINUUM
( )unusable unrestricted
Saturday, 5 October, 13

OWASP
Open Web Application Security Project
Saturday, 5 October, 13

OWASP TOP 10
Saturday, 5 October, 13

INJECTION
‘ OR 1=1 ‘--
1Saturday, 5 October, 13

RISKS
Command - Permits arbitrary shell commands.
SQL - Permits query manipulation, and arbitrary SQL.
Bad guys can run arbitrary code/queries.
Saturday, 5 October, 13

$username = $_POST[‘username’];
$password = $_POST[‘password’];
$query = “SELECT * FROM user
WHERE username = ‘$username’
AND password = ‘$password’”;
$user = $db->query($query);
SQL INJECTION EXAMPLE
Saturday, 5 October, 13

$username = “root”;
$password = “‘ OR 1 = 1 --”;
USER INPUT
Saturday, 5 October, 13

FINAL QUERY
$query = “SELECT * FROM user
WHERE username = ‘root’
AND password = ‘‘ OR 1 = 1 --”;
Saturday, 5 October, 13

FINAL QUERY
$query = “SELECT * FROM user
WHERE username = ‘root’
AND password = ‘‘ OR 1 = 1 --”;
Saturday, 5 October, 13

PREVENTION
Use an ORM or Database abstraction layer that
provides escaping. Doctrine, ZendTable, and
CakePHP all do this.
Use PDO and prepared statements.
Never interpolate user data into a query.
Never use regular expressions, magic quotes, or
addslashes()
Saturday, 5 October, 13

EXAMPLE (PDO)
$query = “SELECT * FROM user
WHERE username = ?
AND password = ?”;
$stmt = $db->prepare($query);
$stmt->bindValue($username);
$stmt->bindValue($password);
$result = $db->execute();
Saturday, 5 October, 13

COMMAND INJECTION
$file = $_POST[‘file’];
$res = file_get_contents($file);
echo $res;
Saturday, 5 October, 13

$f = “../../../../../../etc/passwd”;
USER INPUT
Saturday, 5 October, 13

PREVENTION
Escape and validate input.
Check for ..
Check for ;
Ensure the realpath resolves to a file that is allowed.
Saturday, 5 October, 13

2BROKEN AUTHENTICATION
& SESSION MANAGEMENT
/index.php?PHPSESSID=pwned
Saturday, 5 October, 13

RISKS
Identity theft.
Firesheep was an excellent example.
Saturday, 5 October, 13

SESSION FIXATION EXAMPLE
<?php
session_start();
if (isset($_GET[‘sessionid’]) {
session_id($_GET[‘sessionid’]);
}
Saturday, 5 October, 13

SESSION FIXATION EXAMPLE
<?php
session_start();
if (isset($_GET[‘sessionid’]) {
session_id($_GET[‘sessionid’]);
}
Saturday, 5 October, 13

PREVENTION
Rotate session identifiers upon login/logout
Set the HttpOnly flag on session cookies.
Use well tested / mature libraries for authentication.
SSL is always a good idea.
Saturday, 5 October, 13

3XSS
<script>alert(‘cross site scripting’);</script>
Saturday, 5 October, 13

RISKS
Allows bad guys to do things as the person viewing a
page.
Steal identities, passwords, credit cards, hijack pages
and more.
Saturday, 5 October, 13

XSS EXAMPLE
<p>
<?php echo $user[‘bio’]; ?>
</p>
Saturday, 5 October, 13

XSS EXAMPLE
<p>
<?php echo $user[‘bio’]; ?>
</p>
Saturday, 5 October, 13

I know, I can use regular expressions!
Saturday, 5 October, 13

NO
Saturday, 5 October, 13

PREVENTION
Regular expressions and strip_tags leave you
vulnerable.
The only robust solution is output encoding.
Saturday, 5 October, 13

EXAMPLE
<p>
<?php echo htmlentities(
$user[‘bio’],
ENT_QUOTES,
‘UTF-8’
); ?>
</p>
Saturday, 5 October, 13

DANGERS
Manually encoding is error prone, and you will make
a mistake.
Using a template library like Twig that provides auto-
escaping reduces the chances of screwing up.
Encoding is dependent on context.
Saturday, 5 October, 13

4INSECURE DIRECT OBJECT
REFERENCE
Saturday, 5 October, 13

RISKS
Bad guys can access information they shouldn’t
Bad guys can modify data they shouldn’t.
Saturday, 5 October, 13

BROKEN PASSWORD UPDATE
<form action=”/user/update” method=”post”>
<input type=”hidden” name=”userid” value=”4654” />
<input type=”text” name=”new_password” />
<button type=”submit”>Save</button>
</form>
Saturday, 5 October, 13

PREVENTION
Remember hidden inputs are not really hidden, and
can be changed by users.
Validate access to all things, don’t depend on things
being hidden/invisible.
If you need to refer to the current user, use session
data not form inputs.
Whitelist properties any form can update.
Saturday, 5 October, 13

5SECURITY
MISCONFIGURATION
Saturday, 5 October, 13

RISKS
Default settings can be insecure, and intended for
development not production.
Attackers can use misconfigured software to gain
knowledge and access.
Saturday, 5 October, 13

PREVENTION
Know the tools you use, and configure them
correctly.
Keep up to date on vulnerabilities in the tools you
use.
Remove/disable any services/features you aren’t using.
Saturday, 5 October, 13

6SENSITIVE DATA EXPOSURE
4012 8888 8888 1881
Saturday, 5 October, 13

RISKS
Bad guys get credit cards, personal identification,
passwords or health records.
Your company could be fined or worse.
Saturday, 5 October, 13

ASSESSING RISK
Do you have sensitive data?
Is it in plaintext?
Any old/bad crypto in use?
Missing SSL?
Who can access sensitive data?
Saturday, 5 October, 13

7MISSING FUNCTION LEVEL
ACCESS CONTROL
Saturday, 5 October, 13

RISKS
Anyone on the internet can request things.
Missing access control could mean bad guys can do
things they shouldn’t be able to.
Saturday, 5 October, 13

PREVENTION
No simple solutions sadly.
Good automated tests help.
Saturday, 5 October, 13

8CROSS SITE REQUEST
FORGERY
(CSRF)
Saturday, 5 October, 13

RISKS
Evil websites can perform actions for users logged
into your site.
Side effects on GET can be performed via images or
CSS files.
Remember the Gmail contact hack.
Saturday, 5 October, 13

CSRF EXAMPLE
Your app
Evil site
Saturday, 5 October, 13

CSRF EXAMPLE
Your app
Evil site
Login
Saturday, 5 October, 13

CSRF EXAMPLE
Your app
Evil site
Login
Accidentally visit
Saturday, 5 October, 13

CSRF EXAMPLE
Your app
Evil site
Login
Accidentally visit
Submit form for evil
Saturday, 5 October, 13

PREVENTION
Add opaque expiring tokens to all forms.
Requests missing tokens or containing invalid tokens
should be rejected.
Saturday, 5 October, 13

SAMPLE CSRFVALIDATION
<?php
if (!$this->validCsrfToken($data, ‘csrf’)) {
throw new ForbiddenException();
}
Saturday, 5 October, 13

9USING COMPONENTS WITH
KNOWNVULNERABILITIES
CVE bingo
Saturday, 5 October, 13

RISK
Using old busted software can expose you to
documented issues.
CVE databases are filled with version numbers and
matching exploits.
Saturday, 5 October, 13

PREVENTION
Do routine upgrades. Keep up to date with all your
software.
Read mailing lists and keep an eye out for security
releases.
Saturday, 5 October, 13

PREVENTION
Several vulnerability databases around.
https://cve.mitre.org/cve/
Saturday, 5 October, 13

10UNVALIDATED REDIRECTS &
FORWARDS
Saturday, 5 October, 13

RISKS
Trusting user input for redirects opens phishing
attacks.
Breach of trust with your users.
Saturday, 5 October, 13

PREVENTION
Don’t trust user data when handling redirects.
Saturday, 5 October, 13

THANKYOU
Saturday, 5 October, 13