1. Keeping a commercial site secure
- Outside-in approach
-- Sri Harsha

2. Agenda

3. Mobile applications Where do I start !
DDoS Public API
SQL Injection
XSS Network Security
Request Forgery
Session Management
Replay Attacks
Open Redirects
Just Too Many !
Transport Layer
Data Validation
Third Party Password Storage
Integration
Local/Remote file
injection
Access / Role
privileges Clickjacking
Business Logic
Denial Of Service

4. Back to basics
Let's state Flipkart's Business in a simple sentence

5. Back to basics
Raju pays 100 + 30 Rupees and buys one copy of "Revolution
2020"
This statement is loaded with assumptions !

6. Assumptions
Raju pays 100 + 30 Rupees and buys one copy of "Revolution
2020"
Really ?
Raju "pays" 130 Rs

8. Flipkart Payment Gateways Banks

10. Raju "pays" 130 Rs
Flipkart has multiple payment methods
Flipkart has multiple payment gateway integrations
Flipkart has mobile site and apps

11. Assumptions
Raju pays 100 + 30 Rupees and buys one copy of "Revolution
2020" Alrighty !
Raju pays "130 Rs"

12. Raju pays "130 Rs"

13. Assumptions
Raju pays 100 + 30 Rupees and buys one copy of "Revolution
2020"
"Raju" buys Revolution 2020 for 130 Rs

14. Guess the password
Bruteforce
Hijack Session
Steal the Database
Social Logins
Mobile sites, Mobile Apps ...
Phishing Attacks
Clickjacking
Social Engineering
Try all of the above options

15. Assumptions
Raju pays 100 + 30 Rupees and buys one copy of "Revolution
2020"
Raju buys "Revolution 2020" for 130 Rs

16. Assumptions
Raju pays 100 + 30 Rupees and buys one copy of "Revolution
2020"
Raju "pays 100 for the book"
Raju pays for "Revolution 2020"
"Raju" buys the book
Raju buys "One copy"
Question each of these assumptions !

17. Back to Basics
Breaking down assumptions makes easy to visualize the
vulnerabilities

18. Rinse and repeat
State an assumption
Break it
Repeat
???
Profit !!!

19. Recap

20. Questions ?
sharsha@flipkart
@mylittlefinger