Advertisement
Ihor Bliumental - WebSockets
Mar. 4, 2018•0 likes•342 views
0 likes
Be the first to like this
Show More
views
Total views
0
On Slideshare
0
From embeds
0
Number of embeds
0
Download to read offline
Report
Technology
WebSockets security analysis methods and techniques.
OWASP KyivFollow
OWASP KyivAdvertisement
Ihor Bliumental - WebSockets
- Ihor Bliumental OWASP Kyiv Chapter Lead ihor.bliumental@owasp.org WebSocket security
- WebSocket handshake
- WebSocket protocol
- WebSocket handshake
- WebSocket handshake
- WebSocket – Javascript API
- Authentication
- Authorization • An attacker can access the data/functions without authorization • An attacker can access the data/functions which require higher level of authorization • An attacker can access other same level user's restricted data/functions
- Cross Origin Resource Sharing
- Cross Origin Resource Sharing
- Traffic encryption • All sensitive data should be transferred using TLS (wss://) • TLS should be implemented correctly (no weak ciphers)
- Resource Exhaustion • Connection is being kept until client or server close it • An attacker can exhausts all available connections • Modern clients have limits (e.g. Chrome: 256 total WS connections, 30 per one host; Firefox: 200 total WS connections)
- Improper input validation • A1 - Injections (SQLi, Code injections, Template injections, etc.) • A4 - XXE • A7 - XSS • A8 - Insecure deserialisation
- Chrome developer tools
- Simple WebSocket Client (FF/Chrome addon)
- Burp Suite Community Edition
- Burp Suite Pro
- Burp Suite Pro
- OWASP ZAP
- OWASP ZAP
- Example
- Questions?
Advertisement