SlideShare a Scribd company logo

Content Security Policies: Let's Break Stuff @ Scotland PHP

•
•
Matt Brunt
Matt Brunt

Content Security Policies are another tool we should have in our security toolbelt to help protect users of our sites. In this session I’ll cover what they are, why they’re needed, how they work and the limitations on what they can & cannot do to protect users. I’ll demo attacks a CSP will block, break things, show what the different CSP directives & options will do and introduce some of the tools available to help with implementing a CSP on your sites!

Technology
1 of 47
Download to read offline
@BruntyCSP: Let’s Break Stuff CONTENT SECURITY POLICIES LET’S BREAK STUFF
@BruntyCSP: Let’s Break Stuff BECAUSE YOU ALL TOTALLY CARE ABOUT THIS, RIGHT?! ABOUT ME ▸ Senior Software Engineer at Viva IT
 (those folks in orange hoodies at some conferences & events you may have been to) ▸ @Brunty ▸ @PHPem ▸ mfyu.co.uk ▸ matt@mfyu.co.uk
@BruntyCSP: Let’s Break Stuff BLAH BLAH… JUST GET ON WITH THE TALK THINGS I DO ▸ Dungeon master for D&D campaigns ▸ Mentor, lead & teach apprentices & junior developers ▸ Run & organise PHP East Midlands ▸ Speak at user groups and conferences ▸ Break production sites with incorrectly configured content security policies
@BruntyCSP: Let’s Break Stuff OH GOOD, FINALLY WE’RE GETTING STARTED A TALK IN 3 PARTS ▸ XSS
 ▸ CSP
 ▸ Break stuff

@BruntyCSP: Let’s Break Stuff THE SCARY STUFF
@BruntyCSP: Let’s Break Stuff FIRST, SOME BACKGROUND WHAT IS CROSS-SITE-SCRIPTING (XSS)? ▸ XSS enables an attacker to inject client-side scripts into non-malicious web pages viewed by other users ▸ In 2016 there was a 61% likelihood of a browser-based vulnerability being found in a web application ▸ Of those browser based vulnerabilities, 86% were found to be XSS related ▸ That’s just over 52% of all web application vulnerabilities
 https://www.edgescan.com/assets/docs/reports/2016-edgescan-stats-report.pdf
@BruntyCSP: Let’s Break Stuff I MEAN, IT’S JUST A JOKE VULNERABILITY, RIGHT?! WHAT CAN BE DONE WITH XSS? ▸ Put pictures of cats in web pages ▸ alert(‘💩’); ▸ Rickroll a user ▸ Twitter self-retweeting tweet
 https://www.youtube.com/watch?v=zv0kZKC6GAM ▸ Samy worm
 https://en.wikipedia.org/wiki/Samy_(computer_worm)
@BruntyCSP: Let’s Break Stuff WELL… MAYBE IT’S NOT A JOKE VULNERABILITY WHAT CAN BE DONE WITH XSS? ▸ Make modifications to the DOM - replace a form action to point to your own script to capture credentials. ▸ Use XMLHttpRequest to send HTTP requests and load in additional resources ▸ Access HTML5 APIs - webcam, microphone, geolocation ▸ Steal cookies (and therefore steal session cookies)
@BruntyCSP: Let’s Break Stuff
@BruntyCSP: Let’s Break Stuff IT’S REALLY NOT A JOKE VULNERABILITY WHAT CAN BE DONE WITH XSS? https://www.wired.com/2008/03/hackers-assault-epilepsy-patients-via-computer/
@BruntyCSP: Let’s Break Stuff TYPES OF XSS ATTACK STORED XSS (AKA PERSISTENT OR TYPE I) ▸ Occurs when input is stored - generally in a server-side database, but not always ▸ This could also be within a HTML5 database, thus never being sent to the server at all ▸ who.is was a site Rickrolled by a TXT record in the DNS of a website (yes, really)
@BruntyCSP: Let’s Break Stuff TYPES OF XSS ATTACK REFLECTED XSS (AKA NON-PERSISTENT OR TYPE II) ▸ Occurs when user input provided in the request is immediately returned - such as in an error message, search string etc ▸ Data is not stored, and in some instances, may not even reach the server (see the next type of XSS)
@BruntyCSP: Let’s Break Stuff TYPES OF XSS ATTACK DOM-BASED XSS (AKA TYPE-0) ▸ The entire flow of the attack takes place within the browser ▸ For example, if JavaScript in the site takes input, and uses something like document.write based on that input, it can be vulnerable to a DOM-based XSS attack
@BruntyCSP: Let’s Break Stuff TYPES OF XSS ATTACK SELF XSS ▸ Social-engineering form of XSS ▸ Requires the user to execute code in the browser ▸ Doing so via the console can’t be protected by a lot of methods ▸ Not considered a ‘true’ XSS attack due to requiring the user to execute the code
@BruntyCSP: Let’s Break Stuff
@BruntyCSP: Let’s Break Stuff TITLE TEXT BODY LEVEL ONE BODY LEVEL TWO BODY LEVEL THREE BODY LEVEL FOUR @BruntyCSP: Let’s Break Stuff LET’S FIGHT BACK
@BruntyCSP: Let’s Break Stuff HTTP RESPONSE HEADER TO HELP REDUCE XSS RISKS WHAT IS A CSP?
@BruntyCSP: Let’s Break Stuff DECLARES WHAT RESOURCES ARE ALLOWED TO LOAD HOW DOES A CSP WORK?
@BruntyCSP: Let’s Break Stuff BROWSER SUPPORT
@BruntyCSP: Let’s Break Stuff
@BruntyCSP: Let’s Break Stuff CSP TO THE RESCUE! WHAT CAN WE PROTECT? ▸ default-src ▸ script-src ▸ style-src ▸ img-src ▸ form-action ▸ update-insecure-requests
@BruntyCSP: Let’s Break Stuff FULL REFERENCE:https://content-security-policy.com
 https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
@BruntyCSP: Let’s Break Stuff img-src * ALLOWS ANY URL EXCEPT DATA: BLOB: FILESYSTEM: SCHEMES.
@BruntyCSP: Let’s Break Stuff object-src 'none' DON’T LOAD RESOURCES FROM ANY SOURCE
@BruntyCSP: Let’s Break Stuff style-src ‘self' ALLOW LOADING FROM SAME SCHEME, HOST AND PORT
@BruntyCSP: Let’s Break Stuff script-src 'unsafe-inline' ALLOWS USE OF INLINE SOURCE ELEMENTS SUCH AS STYLE ATTRIBUTE, ONCLICK, OR SCRIPT TAG BODIES
@BruntyCSP: Let’s Break Stuff DON’T USE UNSAFE- INLINE
@BruntyCSP: Let’s Break Stuff <script nonce="$RANDOM">...</script> script-src 'self' 'nonce-$RANDOM'
@BruntyCSP: Let’s Break Stuff Content-Security-Policy: default-src 'none'; script-src 'self' https://*.google.com 'nonce-random123'; style-src 'self'; img- src 'self'; upgrade-insecure-requests; form-action 'self';
@BruntyCSP: Let’s Break Stuff I BROKE PRODUCTION WITH A BAD CSP LEARN FROM MY MISTAKES
@BruntyCSP: Let’s Break Stuff DON’T DO WHAT I DID
@BruntyCSP: Let’s Break Stuff REPORT-URI
@BruntyCSP: Let’s Break Stuff WHEN A POLICY FAILURE OCCURS, THE BROWSER SENDS A JSON PAYLOAD TO THAT URL
@BruntyCSP: Let’s Break Stuff { "csp-report": { "blocked-uri": "self", "document-uri": "https://mysite.com", "line-number": 1, "original-policy": "script-src 'self'", "script-sample": "try { for(var lastpass_iter=0; lastpass...", "source-file": "https://mysite.com", "violated-directive": "script-src 'self'" } }
@BruntyCSP: Let’s Break Stuff REPORT-URI.IO
@BruntyCSP: Let’s Break Stuff
@BruntyCSP: Let’s Break Stuff REPORT-ONLY
@BruntyCSP: Let’s Break Stuff Content-Security-Policy-Report-Only: [policy]; report-uri https://app.report-uri.io/r/default/csp/reportOnly;
@BruntyCSP: Let’s Break Stuff TRIAL STUFF BEFORE ENFORCING
@BruntyCSP: Let’s Break Stuff THERE WILL BE NOISE, LOTS OF NOISE
@BruntyCSP: Let’s Break Stuff WAYS TO MAKE DEALING WITH A CSP EASIER TIPS ▸ Have an easy and quick way to disable the CSP in production if required ▸ Better yet, have a way to switch it from enforced to report only so you can get violations reported to help you debug ▸ Add the CSP at an application level if you need a nonce
@BruntyCSP: Let’s Break Stuff WAYS TO REMOVE BARRIERS IN DEVELOPMENT NONCES ▸ Don’t generate multiple nonces in the same request (but do generate a new nonce on each separate request) ▸ If using a templating engine (such as twig) - add the nonce as a global so it’s available in every template by default ▸ Write a helper in your template engine to generate script tags with a nonce if it’s available
@BruntyCSP: Let’s Break Stuff DEMO TIME! LET’S BREAK STUFF
@BruntyCSP: Let’s Break Stuff @SCOTT_HELME HE KNOWS HIS STUFF! (THIS ISN’T ME)
@BruntyCSP: Let’s Break Stuff HOMEWORK TIME! LINKS & FURTHER READING ▸ https://www.owasp.org/index.php/Cross-site_Scripting_(XSS) ▸ https://content-security-policy.com ▸ https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy ▸ https://report-uri.io ▸ https://scotthelme.co.uk/just-how-much-traffic-can-you-generate-using-csp/ ▸ https://www.edgescan.com/assets/docs/reports/2016-edgescan-stats-report.pdf ▸ http://theharmonyguy.com/oldsite/2011/04/21/recent-facebook-xss-attacks-show-increasing-sophistication/ ▸ https://github.com/Brunty/csp-demo
@BruntyCSP: Let’s Break Stuff THANK YOU
@BruntyCSP: Let’s Break Stuff QUESTIONS? JOIND.IN/TALK/BAC20 @BRUNTY @PHPEM MFYU.CO.UK MATT@MFYU.CO.UK

Recommended

Content Security Policies: Let's Break Stuff @ PHP London, Sept 2017
Content Security Policies: Let's Break Stuff @ PHP London, Sept 2017Content Security Policies: Let's Break Stuff @ PHP London, Sept 2017
Content Security Policies: Let's Break Stuff @ PHP London, Sept 2017
Matt Brunt
 
Content Security Policies: Let's Break Stuff for PHPSW at Bath Digital
Content Security Policies: Let's Break Stuff for PHPSW at Bath DigitalContent Security Policies: Let's Break Stuff for PHPSW at Bath Digital
Content Security Policies: Let's Break Stuff for PHPSW at Bath Digital
Matt Brunt
 
CSPs: Let's Break Stuff for PHP Benelux
CSPs: Let's Break Stuff for PHP BeneluxCSPs: Let's Break Stuff for PHP Benelux
CSPs: Let's Break Stuff for PHP Benelux
Matt Brunt
 
Content Security Policies: Let's Break Stuff for WordCamp London
Content Security Policies: Let's Break Stuff for WordCamp LondonContent Security Policies: Let's Break Stuff for WordCamp London
Content Security Policies: Let's Break Stuff for WordCamp London
Matt Brunt
 
Content Security Policies: Let's Break Stuff @ PHP South Coast 2017
Content Security Policies: Let's Break Stuff @ PHP South Coast 2017Content Security Policies: Let's Break Stuff @ PHP South Coast 2017
Content Security Policies: Let's Break Stuff @ PHP South Coast 2017
Matt Brunt
 
Content Security Policies: Let's Break Stuff
Content Security Policies: Let's Break StuffContent Security Policies: Let's Break Stuff
Content Security Policies: Let's Break Stuff
Matt Brunt
 
[CB19] Shattering the dark: uncovering vulnerabilities of the dark web by Tak...
[CB19] Shattering the dark: uncovering vulnerabilities of the dark web by Tak...[CB19] Shattering the dark: uncovering vulnerabilities of the dark web by Tak...
[CB19] Shattering the dark: uncovering vulnerabilities of the dark web by Tak...
CODE BLUE
 
WordPress Security Begins With Good Posture
WordPress Security Begins With Good PostureWordPress Security Begins With Good Posture
WordPress Security Begins With Good Posture
Tony Perez
 

Recommended

Content Security Policies: Let's Break Stuff @ PHP London, Sept 2017
Content Security Policies: Let's Break Stuff @ PHP London, Sept 2017Content Security Policies: Let's Break Stuff @ PHP London, Sept 2017
Content Security Policies: Let's Break Stuff @ PHP London, Sept 2017
Matt Brunt
 
Content Security Policies: Let's Break Stuff for PHPSW at Bath Digital
Content Security Policies: Let's Break Stuff for PHPSW at Bath DigitalContent Security Policies: Let's Break Stuff for PHPSW at Bath Digital
Content Security Policies: Let's Break Stuff for PHPSW at Bath Digital
Matt Brunt
 
CSPs: Let's Break Stuff for PHP Benelux
CSPs: Let's Break Stuff for PHP BeneluxCSPs: Let's Break Stuff for PHP Benelux
CSPs: Let's Break Stuff for PHP Benelux
Matt Brunt
 
Content Security Policies: Let's Break Stuff for WordCamp London
Content Security Policies: Let's Break Stuff for WordCamp LondonContent Security Policies: Let's Break Stuff for WordCamp London
Content Security Policies: Let's Break Stuff for WordCamp London
Matt Brunt
 
Content Security Policies: Let's Break Stuff @ PHP South Coast 2017
Content Security Policies: Let's Break Stuff @ PHP South Coast 2017Content Security Policies: Let's Break Stuff @ PHP South Coast 2017
Content Security Policies: Let's Break Stuff @ PHP South Coast 2017
Matt Brunt
 
Content Security Policies: Let's Break Stuff
Content Security Policies: Let's Break StuffContent Security Policies: Let's Break Stuff
Content Security Policies: Let's Break Stuff
Matt Brunt
 
[CB19] Shattering the dark: uncovering vulnerabilities of the dark web by Tak...
[CB19] Shattering the dark: uncovering vulnerabilities of the dark web by Tak...[CB19] Shattering the dark: uncovering vulnerabilities of the dark web by Tak...
[CB19] Shattering the dark: uncovering vulnerabilities of the dark web by Tak...
CODE BLUE
 
WordPress Security Begins With Good Posture
WordPress Security Begins With Good PostureWordPress Security Begins With Good Posture
WordPress Security Begins With Good Posture
Tony Perez
 
Tsc summit #2 - HTTP Header Security
Tsc summit #2 - HTTP Header SecurityTsc summit #2 - HTTP Header Security
Tsc summit #2 - HTTP Header Security
Mikal Villa
 
DrupalCamp London 2017 - Web site insecurity
DrupalCamp London 2017 - Web site insecurity DrupalCamp London 2017 - Web site insecurity
DrupalCamp London 2017 - Web site insecurity
George Boobyer
 
Smart mobile storytelling christy robinson - denver news train - april 11-1...
Smart mobile storytelling christy robinson - denver news train - april 11-1...Smart mobile storytelling christy robinson - denver news train - april 11-1...
Smart mobile storytelling christy robinson - denver news train - april 11-1...
News Leaders Association's NewsTrain
 
Happy Browser, Happy User! WordSesh 2019
Happy Browser, Happy User! WordSesh 2019Happy Browser, Happy User! WordSesh 2019
Happy Browser, Happy User! WordSesh 2019
Katie Sylor-Miller
 
Protecting Web App users in today’s hostile environment
Protecting Web App users in today’s hostile environmentProtecting Web App users in today’s hostile environment
Protecting Web App users in today’s hostile environment
ajitdhumale
 
Rails security: above and beyond the defaults
Rails security: above and beyond the defaultsRails security: above and beyond the defaults
Rails security: above and beyond the defaults
Matias Korhonen
 
Beyond Mirai: The new age of MDDoS attacks
Beyond Mirai: The new age of MDDoS attacksBeyond Mirai: The new age of MDDoS attacks
Beyond Mirai: The new age of MDDoS attacks
APNIC
 
BSides Cleveland: Active Defense - Helping threat actors hack themselves!
BSides Cleveland: Active Defense - Helping threat actors hack themselves!BSides Cleveland: Active Defense - Helping threat actors hack themselves!
BSides Cleveland: Active Defense - Helping threat actors hack themselves!
ThreatReel Podcast
 
Juraj vysvader - Python developer's CV
Juraj vysvader - Python developer's CVJuraj vysvader - Python developer's CV
Juraj vysvader - Python developer's CV
Juraj Vysvader
 
NKU Cybersecurity Symposium: Active Defense - Helping threat actors hack them...
NKU Cybersecurity Symposium: Active Defense - Helping threat actors hack them...NKU Cybersecurity Symposium: Active Defense - Helping threat actors hack them...
NKU Cybersecurity Symposium: Active Defense - Helping threat actors hack them...
ThreatReel Podcast
 
Browser Wars 2019 - Implementing a Content Security Policy
Browser Wars 2019 - Implementing a Content Security PolicyBrowser Wars 2019 - Implementing a Content Security Policy
Browser Wars 2019 - Implementing a Content Security Policy
George Boobyer
 
Building Better Responsive Websites
Building Better Responsive WebsitesBuilding Better Responsive Websites
Building Better Responsive Websites
Holger Bartel
 
Better Safe Than Sorry with HTTPS - SMX East 2016 - Patrick Stox
Better Safe Than Sorry with HTTPS - SMX East 2016 - Patrick StoxBetter Safe Than Sorry with HTTPS - SMX East 2016 - Patrick Stox
Better Safe Than Sorry with HTTPS - SMX East 2016 - Patrick Stox
patrickstox
 
gRPC vs REST: let the battle begin!
gRPC vs REST: let the battle begin!gRPC vs REST: let the battle begin!
gRPC vs REST: let the battle begin!
Alex Borysov
 
Security and Privacy on the Web in 2015
Security and Privacy on the Web in 2015Security and Privacy on the Web in 2015
Security and Privacy on the Web in 2015
Francois Marier
 
How Chunky Do You Need To Be?: Adaptive Content Strategies For The Real World
How Chunky Do You Need To Be?: Adaptive Content Strategies For The Real WorldHow Chunky Do You Need To Be?: Adaptive Content Strategies For The Real World
How Chunky Do You Need To Be?: Adaptive Content Strategies For The Real World
Christopher Grant Ward
 
Content wants to be free (from projects) - J.boye Aarhus 2015
Content wants to be free (from projects) - J.boye Aarhus 2015Content wants to be free (from projects) - J.boye Aarhus 2015
Content wants to be free (from projects) - J.boye Aarhus 2015
Rasmus Skjoldan
 
Content Security Policy
Content Security PolicyContent Security Policy
Content Security Policy
Ryan LaBouve
 
Migration Best Practices - SMX West 2019
Migration Best Practices - SMX West 2019Migration Best Practices - SMX West 2019
Migration Best Practices - SMX West 2019
Bastian Grimm
 
OISF Aniversary: Active Defense - Helping threat actors hack themselves!
OISF Aniversary: Active Defense - Helping threat actors hack themselves!OISF Aniversary: Active Defense - Helping threat actors hack themselves!
OISF Aniversary: Active Defense - Helping threat actors hack themselves!
ThreatReel Podcast
 
BDD & Behat for PHPUK
BDD & Behat for PHPUKBDD & Behat for PHPUK
BDD & Behat for PHPUK
Matt Brunt
 
BDD & Behat for PHPNE
BDD & Behat for PHPNEBDD & Behat for PHPNE
BDD & Behat for PHPNE
Matt Brunt
 

More Related Content

Similar to Content Security Policies: Let's Break Stuff @ Scotland PHP

DrupalCamp London 2017 - Web site insecurity
DrupalCamp London 2017 - Web site insecurity DrupalCamp London 2017 - Web site insecurity
DrupalCamp London 2017 - Web site insecurity
George Boobyer
 
Happy Browser, Happy User! WordSesh 2019
Happy Browser, Happy User! WordSesh 2019Happy Browser, Happy User! WordSesh 2019
Happy Browser, Happy User! WordSesh 2019
Katie Sylor-Miller
 
Protecting Web App users in today’s hostile environment
Protecting Web App users in today’s hostile environmentProtecting Web App users in today’s hostile environment
Protecting Web App users in today’s hostile environment
ajitdhumale
 
BSides Cleveland: Active Defense - Helping threat actors hack themselves!
BSides Cleveland: Active Defense - Helping threat actors hack themselves!BSides Cleveland: Active Defense - Helping threat actors hack themselves!
BSides Cleveland: Active Defense - Helping threat actors hack themselves!
ThreatReel Podcast
 
NKU Cybersecurity Symposium: Active Defense - Helping threat actors hack them...
NKU Cybersecurity Symposium: Active Defense - Helping threat actors hack them...NKU Cybersecurity Symposium: Active Defense - Helping threat actors hack them...
NKU Cybersecurity Symposium: Active Defense - Helping threat actors hack them...
ThreatReel Podcast
 
Browser Wars 2019 - Implementing a Content Security Policy
Browser Wars 2019 - Implementing a Content Security PolicyBrowser Wars 2019 - Implementing a Content Security Policy
Browser Wars 2019 - Implementing a Content Security Policy
George Boobyer
 
Security and Privacy on the Web in 2015
Security and Privacy on the Web in 2015Security and Privacy on the Web in 2015
Security and Privacy on the Web in 2015
Francois Marier
 
How Chunky Do You Need To Be?: Adaptive Content Strategies For The Real World
How Chunky Do You Need To Be?: Adaptive Content Strategies For The Real WorldHow Chunky Do You Need To Be?: Adaptive Content Strategies For The Real World
How Chunky Do You Need To Be?: Adaptive Content Strategies For The Real World
Christopher Grant Ward
 
OISF Aniversary: Active Defense - Helping threat actors hack themselves!
OISF Aniversary: Active Defense - Helping threat actors hack themselves!OISF Aniversary: Active Defense - Helping threat actors hack themselves!
OISF Aniversary: Active Defense - Helping threat actors hack themselves!
ThreatReel Podcast
 

Similar to Content Security Policies: Let's Break Stuff @ Scotland PHP (20)

Tsc summit #2 - HTTP Header Security
Tsc summit #2 - HTTP Header SecurityTsc summit #2 - HTTP Header Security
Tsc summit #2 - HTTP Header Security
 
DrupalCamp London 2017 - Web site insecurity
DrupalCamp London 2017 - Web site insecurity DrupalCamp London 2017 - Web site insecurity
DrupalCamp London 2017 - Web site insecurity
 
Smart mobile storytelling christy robinson - denver news train - april 11-1...
Smart mobile storytelling christy robinson - denver news train - april 11-1...Smart mobile storytelling christy robinson - denver news train - april 11-1...
Smart mobile storytelling christy robinson - denver news train - april 11-1...
 
Happy Browser, Happy User! WordSesh 2019
Happy Browser, Happy User! WordSesh 2019Happy Browser, Happy User! WordSesh 2019
Happy Browser, Happy User! WordSesh 2019
 
Protecting Web App users in today’s hostile environment
Protecting Web App users in today’s hostile environmentProtecting Web App users in today’s hostile environment
Protecting Web App users in today’s hostile environment
 
Rails security: above and beyond the defaults
Rails security: above and beyond the defaultsRails security: above and beyond the defaults
Rails security: above and beyond the defaults
 
Beyond Mirai: The new age of MDDoS attacks
Beyond Mirai: The new age of MDDoS attacksBeyond Mirai: The new age of MDDoS attacks
Beyond Mirai: The new age of MDDoS attacks
 
BSides Cleveland: Active Defense - Helping threat actors hack themselves!
BSides Cleveland: Active Defense - Helping threat actors hack themselves!BSides Cleveland: Active Defense - Helping threat actors hack themselves!
BSides Cleveland: Active Defense - Helping threat actors hack themselves!
 
Juraj vysvader - Python developer's CV
Juraj vysvader - Python developer's CVJuraj vysvader - Python developer's CV
Juraj vysvader - Python developer's CV
 
NKU Cybersecurity Symposium: Active Defense - Helping threat actors hack them...
NKU Cybersecurity Symposium: Active Defense - Helping threat actors hack them...NKU Cybersecurity Symposium: Active Defense - Helping threat actors hack them...
NKU Cybersecurity Symposium: Active Defense - Helping threat actors hack them...
 
Browser Wars 2019 - Implementing a Content Security Policy
Browser Wars 2019 - Implementing a Content Security PolicyBrowser Wars 2019 - Implementing a Content Security Policy
Browser Wars 2019 - Implementing a Content Security Policy
 
Building Better Responsive Websites
Building Better Responsive WebsitesBuilding Better Responsive Websites
Building Better Responsive Websites
 
Better Safe Than Sorry with HTTPS - SMX East 2016 - Patrick Stox
Better Safe Than Sorry with HTTPS - SMX East 2016 - Patrick StoxBetter Safe Than Sorry with HTTPS - SMX East 2016 - Patrick Stox
Better Safe Than Sorry with HTTPS - SMX East 2016 - Patrick Stox
 
gRPC vs REST: let the battle begin!
gRPC vs REST: let the battle begin!gRPC vs REST: let the battle begin!
gRPC vs REST: let the battle begin!
 
Security and Privacy on the Web in 2015
Security and Privacy on the Web in 2015Security and Privacy on the Web in 2015
Security and Privacy on the Web in 2015
 
How Chunky Do You Need To Be?: Adaptive Content Strategies For The Real World
How Chunky Do You Need To Be?: Adaptive Content Strategies For The Real WorldHow Chunky Do You Need To Be?: Adaptive Content Strategies For The Real World
How Chunky Do You Need To Be?: Adaptive Content Strategies For The Real World
 
Content wants to be free (from projects) - J.boye Aarhus 2015
Content wants to be free (from projects) - J.boye Aarhus 2015Content wants to be free (from projects) - J.boye Aarhus 2015
Content wants to be free (from projects) - J.boye Aarhus 2015
 
Content Security Policy
Content Security PolicyContent Security Policy
Content Security Policy
 
Migration Best Practices - SMX West 2019
Migration Best Practices - SMX West 2019Migration Best Practices - SMX West 2019
Migration Best Practices - SMX West 2019
 
OISF Aniversary: Active Defense - Helping threat actors hack themselves!
OISF Aniversary: Active Defense - Helping threat actors hack themselves!OISF Aniversary: Active Defense - Helping threat actors hack themselves!
OISF Aniversary: Active Defense - Helping threat actors hack themselves!
 

More from Matt Brunt

More from Matt Brunt (10)

BDD & Behat for PHPUK
BDD & Behat for PHPUKBDD & Behat for PHPUK
BDD & Behat for PHPUK
 
BDD & Behat for PHPNE
BDD & Behat for PHPNEBDD & Behat for PHPNE
BDD & Behat for PHPNE
 
BDD & Behat for Glasgow PHP
BDD & Behat for Glasgow PHPBDD & Behat for Glasgow PHP
BDD & Behat for Glasgow PHP
 
BDD & Behat
BDD & BehatBDD & Behat
BDD & Behat
 
BDD & Behat for Srijan Technologies
BDD & Behat for Srijan TechnologiesBDD & Behat for Srijan Technologies
BDD & Behat for Srijan Technologies
 
CSP - What? Why? How? PHPNW16
CSP - What? Why? How? PHPNW16CSP - What? Why? How? PHPNW16
CSP - What? Why? How? PHPNW16
 
PHPNW16 Matt Brunt - BDD & Behat
PHPNW16 Matt Brunt - BDD & BehatPHPNW16 Matt Brunt - BDD & Behat
PHPNW16 Matt Brunt - BDD & Behat
 
BDD - telling stories through code for PHPem
BDD - telling stories through code for PHPemBDD - telling stories through code for PHPem
BDD - telling stories through code for PHPem
 
BDD: Telling stories through code [For TechNotts]
BDD: Telling stories through code [For TechNotts]BDD: Telling stories through code [For TechNotts]
BDD: Telling stories through code [For TechNotts]
 
Intro to Gulp
Intro to GulpIntro to Gulp
Intro to Gulp
 

Recently uploaded

From Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time AutomationFrom Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
Safe Software
 
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Drew Madelung
 
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data DiscoveryTrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc
 
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot TakeoffStrategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
sammart93
 
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
Miguel Araújo
 
Artificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and MythsArtificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and Myths
Joaquim Jorge
 
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
?#DUbAI#??##{{(☎️+971_581248768%)**%*]'#abortion pills for sale in dubai@
 

Recently uploaded (20)

presentation ICT roal in 21st century education
presentation ICT roal in 21st century educationpresentation ICT roal in 21st century education
presentation ICT roal in 21st century education
 
Partners Life - Insurer Innovation Award 2024
Partners Life - Insurer Innovation Award 2024Partners Life - Insurer Innovation Award 2024
Partners Life - Insurer Innovation Award 2024
 
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time AutomationFrom Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
 
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
 
Artificial Intelligence Chap.5 : Uncertainty
Artificial Intelligence Chap.5 : UncertaintyArtificial Intelligence Chap.5 : Uncertainty
Artificial Intelligence Chap.5 : Uncertainty
 
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
 
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data DiscoveryTrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
 
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot TakeoffStrategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
 
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
 
Artificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and MythsArtificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and Myths
 
Powerful Google developer tools for immediate impact! (2023-24 C)
Powerful Google developer tools for immediate impact! (2023-24 C)Powerful Google developer tools for immediate impact! (2023-24 C)
Powerful Google developer tools for immediate impact! (2023-24 C)
 
Real Time Object Detection Using Open CV
Real Time Object Detection Using Open CVReal Time Object Detection Using Open CV
Real Time Object Detection Using Open CV
 
AWS Community Day CPH - Three problems of Terraform
AWS Community Day CPH - Three problems of TerraformAWS Community Day CPH - Three problems of Terraform
AWS Community Day CPH - Three problems of Terraform
 
Manulife - Insurer Innovation Award 2024
Manulife - Insurer Innovation Award 2024Manulife - Insurer Innovation Award 2024
Manulife - Insurer Innovation Award 2024
 
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
 
Top 10 Most Downloaded Games on Play Store in 2024
Top 10 Most Downloaded Games on Play Store in 2024Top 10 Most Downloaded Games on Play Store in 2024
Top 10 Most Downloaded Games on Play Store in 2024
 
2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...
 
The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024
 
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
 
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
 

Content Security Policies: Let's Break Stuff @ Scotland PHP

  • 1. @BruntyCSP: Let’s Break Stuff CONTENT SECURITY POLICIES LET’S BREAK STUFF
  • 2. @BruntyCSP: Let’s Break Stuff BECAUSE YOU ALL TOTALLY CARE ABOUT THIS, RIGHT?! ABOUT ME ▸ Senior Software Engineer at Viva IT
 (those folks in orange hoodies at some conferences & events you may have been to) ▸ @Brunty ▸ @PHPem ▸ mfyu.co.uk ▸ matt@mfyu.co.uk
  • 3. @BruntyCSP: Let’s Break Stuff BLAH BLAH… JUST GET ON WITH THE TALK THINGS I DO ▸ Dungeon master for D&D campaigns ▸ Mentor, lead & teach apprentices & junior developers ▸ Run & organise PHP East Midlands ▸ Speak at user groups and conferences ▸ Break production sites with incorrectly configured content security policies
  • 4. @BruntyCSP: Let’s Break Stuff OH GOOD, FINALLY WE’RE GETTING STARTED A TALK IN 3 PARTS ▸ XSS
 ▸ CSP
 ▸ Break stuff

  • 5. @BruntyCSP: Let’s Break Stuff THE SCARY STUFF
  • 6. @BruntyCSP: Let’s Break Stuff FIRST, SOME BACKGROUND WHAT IS CROSS-SITE-SCRIPTING (XSS)? ▸ XSS enables an attacker to inject client-side scripts into non-malicious web pages viewed by other users ▸ In 2016 there was a 61% likelihood of a browser-based vulnerability being found in a web application ▸ Of those browser based vulnerabilities, 86% were found to be XSS related ▸ That’s just over 52% of all web application vulnerabilities
 https://www.edgescan.com/assets/docs/reports/2016-edgescan-stats-report.pdf
  • 7. @BruntyCSP: Let’s Break Stuff I MEAN, IT’S JUST A JOKE VULNERABILITY, RIGHT?! WHAT CAN BE DONE WITH XSS? ▸ Put pictures of cats in web pages ▸ alert(‘💩’); ▸ Rickroll a user ▸ Twitter self-retweeting tweet
 https://www.youtube.com/watch?v=zv0kZKC6GAM ▸ Samy worm
 https://en.wikipedia.org/wiki/Samy_(computer_worm)
  • 8. @BruntyCSP: Let’s Break Stuff WELL… MAYBE IT’S NOT A JOKE VULNERABILITY WHAT CAN BE DONE WITH XSS? ▸ Make modifications to the DOM - replace a form action to point to your own script to capture credentials. ▸ Use XMLHttpRequest to send HTTP requests and load in additional resources ▸ Access HTML5 APIs - webcam, microphone, geolocation ▸ Steal cookies (and therefore steal session cookies)
  • 10. @BruntyCSP: Let’s Break Stuff IT’S REALLY NOT A JOKE VULNERABILITY WHAT CAN BE DONE WITH XSS? https://www.wired.com/2008/03/hackers-assault-epilepsy-patients-via-computer/
  • 11. @BruntyCSP: Let’s Break Stuff TYPES OF XSS ATTACK STORED XSS (AKA PERSISTENT OR TYPE I) ▸ Occurs when input is stored - generally in a server-side database, but not always ▸ This could also be within a HTML5 database, thus never being sent to the server at all ▸ who.is was a site Rickrolled by a TXT record in the DNS of a website (yes, really)
  • 12. @BruntyCSP: Let’s Break Stuff TYPES OF XSS ATTACK REFLECTED XSS (AKA NON-PERSISTENT OR TYPE II) ▸ Occurs when user input provided in the request is immediately returned - such as in an error message, search string etc ▸ Data is not stored, and in some instances, may not even reach the server (see the next type of XSS)
  • 13. @BruntyCSP: Let’s Break Stuff TYPES OF XSS ATTACK DOM-BASED XSS (AKA TYPE-0) ▸ The entire flow of the attack takes place within the browser ▸ For example, if JavaScript in the site takes input, and uses something like document.write based on that input, it can be vulnerable to a DOM-based XSS attack
  • 14. @BruntyCSP: Let’s Break Stuff TYPES OF XSS ATTACK SELF XSS ▸ Social-engineering form of XSS ▸ Requires the user to execute code in the browser ▸ Doing so via the console can’t be protected by a lot of methods ▸ Not considered a ‘true’ XSS attack due to requiring the user to execute the code
  • 16. @BruntyCSP: Let’s Break Stuff TITLE TEXT BODY LEVEL ONE BODY LEVEL TWO BODY LEVEL THREE BODY LEVEL FOUR @BruntyCSP: Let’s Break Stuff LET’S FIGHT BACK
  • 17. @BruntyCSP: Let’s Break Stuff HTTP RESPONSE HEADER TO HELP REDUCE XSS RISKS WHAT IS A CSP?
  • 18. @BruntyCSP: Let’s Break Stuff DECLARES WHAT RESOURCES ARE ALLOWED TO LOAD HOW DOES A CSP WORK?
  • 19. @BruntyCSP: Let’s Break Stuff BROWSER SUPPORT
  • 21. @BruntyCSP: Let’s Break Stuff CSP TO THE RESCUE! WHAT CAN WE PROTECT? ▸ default-src ▸ script-src ▸ style-src ▸ img-src ▸ form-action ▸ update-insecure-requests
  • 22. @BruntyCSP: Let’s Break Stuff FULL REFERENCE:https://content-security-policy.com
 https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
  • 23. @BruntyCSP: Let’s Break Stuff img-src * ALLOWS ANY URL EXCEPT DATA: BLOB: FILESYSTEM: SCHEMES.
  • 24. @BruntyCSP: Let’s Break Stuff object-src 'none' DON’T LOAD RESOURCES FROM ANY SOURCE
  • 25. @BruntyCSP: Let’s Break Stuff style-src ‘self' ALLOW LOADING FROM SAME SCHEME, HOST AND PORT
  • 26. @BruntyCSP: Let’s Break Stuff script-src 'unsafe-inline' ALLOWS USE OF INLINE SOURCE ELEMENTS SUCH AS STYLE ATTRIBUTE, ONCLICK, OR SCRIPT TAG BODIES
  • 27. @BruntyCSP: Let’s Break Stuff DON’T USE UNSAFE- INLINE
  • 28. @BruntyCSP: Let’s Break Stuff <script nonce="$RANDOM">...</script> script-src 'self' 'nonce-$RANDOM'
  • 29. @BruntyCSP: Let’s Break Stuff Content-Security-Policy: default-src 'none'; script-src 'self' https://*.google.com 'nonce-random123'; style-src 'self'; img- src 'self'; upgrade-insecure-requests; form-action 'self';
  • 30. @BruntyCSP: Let’s Break Stuff I BROKE PRODUCTION WITH A BAD CSP LEARN FROM MY MISTAKES
  • 31. @BruntyCSP: Let’s Break Stuff DON’T DO WHAT I DID
  • 32. @BruntyCSP: Let’s Break Stuff REPORT-URI
  • 33. @BruntyCSP: Let’s Break Stuff WHEN A POLICY FAILURE OCCURS, THE BROWSER SENDS A JSON PAYLOAD TO THAT URL
  • 34. @BruntyCSP: Let’s Break Stuff { "csp-report": { "blocked-uri": "self", "document-uri": "https://mysite.com", "line-number": 1, "original-policy": "script-src 'self'", "script-sample": "try { for(var lastpass_iter=0; lastpass...", "source-file": "https://mysite.com", "violated-directive": "script-src 'self'" } }
  • 35. @BruntyCSP: Let’s Break Stuff REPORT-URI.IO
  • 37. @BruntyCSP: Let’s Break Stuff REPORT-ONLY
  • 38. @BruntyCSP: Let’s Break Stuff Content-Security-Policy-Report-Only: [policy]; report-uri https://app.report-uri.io/r/default/csp/reportOnly;
  • 39. @BruntyCSP: Let’s Break Stuff TRIAL STUFF BEFORE ENFORCING
  • 40. @BruntyCSP: Let’s Break Stuff THERE WILL BE NOISE, LOTS OF NOISE
  • 41. @BruntyCSP: Let’s Break Stuff WAYS TO MAKE DEALING WITH A CSP EASIER TIPS ▸ Have an easy and quick way to disable the CSP in production if required ▸ Better yet, have a way to switch it from enforced to report only so you can get violations reported to help you debug ▸ Add the CSP at an application level if you need a nonce
  • 42. @BruntyCSP: Let’s Break Stuff WAYS TO REMOVE BARRIERS IN DEVELOPMENT NONCES ▸ Don’t generate multiple nonces in the same request (but do generate a new nonce on each separate request) ▸ If using a templating engine (such as twig) - add the nonce as a global so it’s available in every template by default ▸ Write a helper in your template engine to generate script tags with a nonce if it’s available
  • 43. @BruntyCSP: Let’s Break Stuff DEMO TIME! LET’S BREAK STUFF
  • 44. @BruntyCSP: Let’s Break Stuff @SCOTT_HELME HE KNOWS HIS STUFF! (THIS ISN’T ME)
  • 45. @BruntyCSP: Let’s Break Stuff HOMEWORK TIME! LINKS & FURTHER READING ▸ https://www.owasp.org/index.php/Cross-site_Scripting_(XSS) ▸ https://content-security-policy.com ▸ https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy ▸ https://report-uri.io ▸ https://scotthelme.co.uk/just-how-much-traffic-can-you-generate-using-csp/ ▸ https://www.edgescan.com/assets/docs/reports/2016-edgescan-stats-report.pdf ▸ http://theharmonyguy.com/oldsite/2011/04/21/recent-facebook-xss-attacks-show-increasing-sophistication/ ▸ https://github.com/Brunty/csp-demo
  • 46. @BruntyCSP: Let’s Break Stuff THANK YOU
  • 47. @BruntyCSP: Let’s Break Stuff QUESTIONS? JOIND.IN/TALK/BAC20 @BRUNTY @PHPEM MFYU.CO.UK MATT@MFYU.CO.UK