2015-12-06 Артем Зиненко - Что делать, если браузеры клиентов действуют против них?

•

0 likes•246 views

This document discusses common browser vulnerabilities that can allow hackers to access user data. It covers topics like cross-site scripting (XSS), cross-site request forgery (CSRF), unvalidated redirects, clickjacking, and cross-origin resource sharing (CORS) configuration issues. The document provides examples of how these vulnerabilities can be exploited, such as hijacking user sessions after login or changing user account details without consent. Proper validation of user input and access controls are necessary to prevent unauthorized access to user data and accounts.

ПОЧЕМУБРАУЗЕРЫ
ОТДАЮТВАШИ
ДАННЫЕХАКЕРАМ?
Артем Зиненко
<art@hackerdom.ru>

XSS
CSRF
UNVALIDATED REDIRECT
CLICKJACKING

https://site.com
http://site.com
https://a.site.com
https://site.com:9090

Accept
Accept-Language
Content-Language
Content-Type
HEADERS

application/x-www-
form-urlencoded
multipart/form-
data
text/plain
CONTENT-TYPE

var r = new
XMLHttpRequest();
r.open('GET',
‘http://site2.com’,
true);
r.send();

GET / HTTP/1.1
Host: site2.com
Origin:
http://site1.com/

HTTP/1.1 200 OK
Access-Control-
Allow-Origin:
http://site1.com
[Data]

var r = new
XMLHttpRequest();
r.open('GET', ‘http://
site2.com’, true);
r.withCredentials =
true;
r.send();

GET / HTTP/1.1
Host: site2.com
Origin:
http://site1.com/
Cookie: token=ab7…

HTTP/1.1 200 OK
Access-Control-Allow-
Origin: http://
site1.com
Access-Control-Allow-
Credentials: true
[Data]

var r = new XMLHttpRequest();
r.open('POST', ‘http://
site2.com’, true);
r.setRequestHeader(‘Content-
Type’,'application/json');
r.setRequestHeader('X-HEADER',
'lalala');
r.send(data);

OPTIONS / HTTP/1.1
Host: site2.com
Origin:
http://site1.com/
Access-Control-Request-
Method: POST
Access-Control-Request-
Headers: X-HEADER

HTTP/1.1 200 OK
Access-Control-Allow-Origin:
http://site1.com
Access-Control-Allow-
Methods: POST, GET, OPTIONS
Access-Control-Allow-
Headers: X-HEADER

POST / HTTP/1.1
Host: site2.com
Origin: http://site1.com/
X-HEADER: lalala
Content-Type:
application/json
[Data]

Cross-origin reads
var r = new
XMLHttpRequest();
r.open('GET', ‘http://
site2.com’, true);
r.withCredentials = true;
r.send();

Cross-origin writes
var c = new XMLHttpRequest();
c.withCredentials = true;
c.open("POST", ...);
c.setRequestHeader("Content-
Type", “...”);
c.send(...);

Cross-origin embedding
$(‘…’).append(
‘<img src=“…”>’
);

Access-Control-
Allow-Origin: *
Access-Control-
Allow-
Credentials: true

<script>
window.onload =
function(){
…
form.submit();
}
</script>

POST /proﬁle
name, password
GET evil.com

<img
src=“https://...
/confirm?
code=67a50…” />

https://
site.com/login?
back=https%3A%2F
%2Fqqq.site.com
SUBDOMAIN

HTTP/1.1 302 Found
Location: https://
qqq.site.com/
Set-Cookie:token=djnD…;
domain=.site.com;

https://
site.com/login?
back=https%3A%2F
%2Fqqq-site.com
ANOTHER DOMAIN

HTTP/1.1 302 Found
Location: https://
qqq-site.com/?
token=djnD…

https://speakerdeck.com
/ar7z1/happydev-2015

DEMYSTIFYING REST Kirsten Jones REST web services are everywhere! It seems like everything you want is available via a web service, but getting started with one of these web services can be overwhelming – and debugging the interactions bewilders some of the smartest developers I know. In this talk, I will talk about HTTP, how it works, and how to watch and understand the traffic between your system and the server. From there I’ll proceed to REST – how REST web services layer on top of HTTP and how you can expect a REST web service to behave. We’ll go over how to monitor and understand requests and responses for these services. Once we’ve covered that, I’ll talk about how OAuth is used for authentication in the framework of a REST application. PHP code samples will be shown for interacting with an OAuth REST web service, and I will cover http monitoring tools for multiple OS’s. When you’re done with this talk you’ll understand enough about REST web services to be able to get started confidently, and debug many of the common issues you may encounter.

Charles guide sharing

Vincent Chang

How to optimise TTFB - BrightonSEO 2020

Roxana Stingu

The document discusses optimizing the time to first byte (TTFB) of a website. It defines TTFB as the time it takes for the first byte of information to be sent in response to a request. It then provides tips for measuring TTFB and describes factors that contribute to TTFB like DNS lookup, SSL negotiation, and server response time. Various techniques are presented for improving TTFB, such as using a CDN, HTTP/2, browser caching, and content delivery optimization.

URL to HTML

Francois Marier

Modern web applications depend on a lot of auxiliary scripts which are often hosted on third-party CDNs. Should an attacker be able to tamper with the files hosted on such a CDN, millions of sites could be compromised. Web developers need a way to guarantee the integrity of scripts hosted elsewhere. This is the motivation behind a new addition to the web platform being introduced by the W3C: sub-resource integrity. Both Firefox and Chrome have initial implementations of this new specification and a few early adopters are currently evaluating this feature.

[CB16] 80時間でWebを一周:クロムミウムオートメーションによるスケーラブルなフィンガープリント by Isaac Dawson

CODE BLUE

分散型のスキャナーの構築は挑戦のし甲斐があり、実在のブラウザを使って作る場合はなおさらである。今回紹介するスキャナーでは、ChromiumにJSのライブラリやそのバージョンを得るためのJavaScriptを注入することで、スキャンしたサイトのすべてのHTMLとJavaScript、独自アーキテクチャを必要とするセキュリティヘッダを保存できる。このスキャナーでトップの100万サイトに対してスキャンを行い、現在のWeb上の状況を調べることが可能となるスケーラブルなシステムを設計する際に克服した課題についてカバーした。本講演では、データ分析で得られた興味深い点にも触れるつもりである。 --- アイザック・ドーソンIsaac Dawson アイザック・ドーソンは、Veracode社の主要なセキュリティ研究者の一人で、彼の率いる同社の研究開発チームは、Veracode社の動的解析の提供に努めている。 Veracode社の前は@stake社とSymantec社でコンサルタントをしていた。 2004年にアプリケーションセキュリティのコンサルティングチーム発足させるため、日本へやってきた。 Veracode社での勤務が始まった後、彼の中で日本があまりにも快適であることがはっきりしたので、それ以降、滞在し続けることを決めたのだった。 Go言語の熱心なプログラマーであり、分散システムに関心があり、特にWebのスキャニングに強い関心をもっている。

Yarochkin, kropotov, chetvertakov tracking surreptitious malware distributi...

DefconRussia

1) The document discusses malware distribution campaigns from 2012 that used dynamically generated domain names and short-lived domains to serve malicious content through advertisement networks and legitimate websites. 2) Malware was distributed by simulating advertisement networks through JavaScript and using short-term disposable domain names that pointed to the same IP addresses. 3) One campaign only rendered malicious content if mouse movement was detected on a page, requiring user interaction to trigger the exploit.

Cross site calls with javascript - the right way with CORS

Michael Neale

Krzysztof Kotowicz - Hacking HTML5

DefconRussia

The document provides instructions for setting up a lab environment to practice HTML5 hacking techniques. It includes details on installing VirtualBox and shared folders, as well as IP addresses to use for the "localvictim" and "evil" servers. The remainder of the document outlines a plan to cover various HTML5-related attacks, including bypassing the same-origin policy, exploiting XSS vectors in HTML5, attacking with cross-origin resource sharing and web messaging, targeting client-side storage, and using web sockets. Disclaimers are provided about the practical nature of the workshops and limited time.

Marianasá

truecoloursetw

Las mascotas olímpicas (Guillem i Nazariy)

tottical

Este documento presenta información sobre las mascotas olímpicas. Explica que las mascotas representan la zona anfitriona de los Juegos Olímpicos y son importantes para los productos licenciados. Luego describe las mascotas de los Juegos de Barcelona 1992 (Cobi), Beijing 2008 (Beibei, Jingjing, Huanhuan, Yingying, Nini), Vancouver 2010 (Miga, Quatchi, Sumi) y Londres 2012 (Wenlock, Mandeville). Finalmente, comparte curiosidades sobre la mascota de Moscú 1980,

Manuela

truecoloursetw

Ciberbullying

andrea multimedia

El ciberbullying implica el uso de medios electrónicos como Internet y teléfonos móviles para acosar psicológicamente a otros menores. No incluye acoso sexual o cuando adultos están involucrados. El ciberbullying puede tomar la forma de publicar imágenes o datos personales de la víctima sin su permiso, crear perfiles falsos, o dejar comentarios ofensivos. Las consecuencias para la víctima incluyen sentirse insegura, humillada, y que su desarrollo personal sea afectado.

2015-12-05 Андрей Сидоренко - Сценарии использования и их роль в процессе раз...

HappyDev

¿Quién puede participar (carla y andreea)

tottical

Carolinan

truecoloursetw

The document expresses a preference for the color blue because it represents the speaker's football team and things they enjoy like the sea. The sea provides a calming effect where they can forget problems while listening to the waves, which are likened to music. Blue is described as the color of dreams, and the speaker sees themselves as a dream surfer riding clouds in the blue sky, which is portrayed as a box holding dreams.

Aplicacion Metodologia coaching learning

UNIVERSIDAD DE SEVILLA

Antisorgailuak

lauragonzalez0103

El baile (Èlia y Lucia)

tottical

Este documento resume los aspectos fundamentales del baile. Explica que el baile surgió como forma de expresión corporal de los estados de ánimo y sentimientos. Define el baile como un arte que utiliza el movimiento del cuerpo, normalmente con música, con fines de entretenimiento, arte u otros. Finalmente, detalla algunos elementos clave como los diferentes espacios donde se puede bailar, la duración y participantes que varían según el estilo, y el material necesario.

Purple by Ana

truecoloursetw

The document discusses the color purple and its various meanings and associations. Purple represents qualities like creativity, wisdom, dignity, peace, pride, mystery, independence and magic. It is associated with royalty and power. Purple flowers like lavender, orchid, lilac and violet have calming effects on the mind and body. Different shades of purple each carry their own meanings. The color is also associated with uniqueness through phrases like "purple cow" and exaggeration through terms like "purple prose".

Deportes olímpicos (Ernesto y Loanmy)

tottical

juan Características del emprendedor

caregay

Как жить в согласии с SOLID?

etyumentcev

Azot

AnushikNikoghosyan

Anillos olímpicos (ilianna, mireia y idaira)

tottical

What's hot

Php Security

ricardophp

Integrity protection for third-party JavaScript

Francois Marier

[CB16] 80時間でWebを一周:クロムミウムオートメーションによるスケーラブルなフィンガープリント by Isaac Dawson

CODE BLUE

Yarochkin, kropotov, chetvertakov tracking surreptitious malware distributi...

DefconRussia

Cross site calls with javascript - the right way with CORS

Michael Neale

Krzysztof Kotowicz - Hacking HTML5

DefconRussia

What's hot (6)

Php Security

Integrity protection for third-party JavaScript

[CB16] 80時間でWebを一周:クロムミウムオートメーションによるスケーラブルなフィンガープリント by Isaac Dawson

Yarochkin, kropotov, chetvertakov tracking surreptitious malware distributi...

Cross site calls with javascript - the right way with CORS

Krzysztof Kotowicz - Hacking HTML5

Viewers also liked

Marianasá

truecoloursetw

Las mascotas olímpicas (Guillem i Nazariy)

tottical

Manuela

truecoloursetw

Ciberbullying

andrea multimedia

2015-12-05 Андрей Сидоренко - Сценарии использования и их роль в процессе раз...

HappyDev

¿Quién puede participar (carla y andreea)

tottical

Carolinan

truecoloursetw

Aplicacion Metodologia coaching learning

UNIVERSIDAD DE SEVILLA

Antisorgailuak

lauragonzalez0103

El baile (Èlia y Lucia)

tottical

Purple by Ana

truecoloursetw

Deportes olímpicos (Ernesto y Loanmy)

tottical

juan Características del emprendedor

caregay

Как жить в согласии с SOLID?

etyumentcev

Azot

AnushikNikoghosyan

Anillos olímpicos (ilianna, mireia y idaira)

tottical

Open Data - Rada Innowacyjności [polish only]

Olga Mierzwa-Sulima

Viewers also liked (17)

Marianasá

Las mascotas olímpicas (Guillem i Nazariy)

Manuela

Ciberbullying

2015-12-05 Андрей Сидоренко - Сценарии использования и их роль в процессе раз...

¿Quién puede participar (carla y andreea)

Carolinan

Aplicacion Metodologia coaching learning

Antisorgailuak

El baile (Èlia y Lucia)

Purple by Ana

Deportes olímpicos (Ernesto y Loanmy)

juan Características del emprendedor

Как жить в согласии с SOLID?

Azot

Anillos olímpicos (ilianna, mireia y idaira)

Open Data - Rada Innowacyjności [polish only]

Similar to 2015-12-06 Артем Зиненко - Что делать, если браузеры клиентов действуют против них?

Web Application Security

Stuart Colville

This document discusses common web application security issues such as cross-site scripting (XSS), cross-site request forgery (CSRF), SQL injection, regular expression denial of service (ReDos), and open redirects. It provides examples of each vulnerability and outlines solutions such as input filtering, parameterized queries, and whitelisting redirect domains. The document concludes with tips for keeping applications secure such as code reviews, security announcements, and documentation of common patterns.

01. http basics v27

Eoin Keary

HTTP is the protocol used to transmit data over the web. It is stateless and requires sessions to track state. Requests and responses use headers to transmit metadata. Sensitive data should only be sent over HTTPS and only through POST, PUT, PATCH requests never in the URL query string. Response headers like HSTS, CSP, and CORS help secure applications by controlling caching, framing, and cross-origin requests.

Evolution Of Web Security

Chris Shiflett

This is a multi-faceted workshop that explores new concepts in web security. After a solid grounding in well-known exploits like cross-site scripting (XSS) and cross-site request forgeries (CSRF), I'll demonstrate how traditional exploits are being used together and with other technologies like Ajax to launch sophisticated attacks that penetrate firewalls, target users, and spread like worms. I'll then discuss some ideas for the future, such as evaluating trends to identify suspicious activity and understanding human tendencies and behavior to help provide a better, more secure user experience.

DVWA BruCON Workshop

testuser1223

The document provides an introduction to web application security and the Damn Vulnerable Web Application (DVWA). It discusses common web vulnerabilities like cross-site scripting (XSS), SQL injection, and information leakage. It demonstrates how to find and exploit these vulnerabilities in DVWA, including stealing cookies, extracting database information, and creating a backdoor PHP shell. The document is intended to educate users about web security risks and show how hackers can compromise applications.

RESTful API - GDG Tech Talk - Novembro de 2014

Marlon Carvalho

The document discusses best practices for designing RESTful APIs, including: - Resources should be nouns, not verbs, and be pluralized. Requests should use HTTP methods like GET, POST, PUT, DELETE. - Responses should include status codes to indicate success or errors. Common formats are JSON and XML. - APIs should have versioning, support filtering, pagination, and partial responses for performance. - HATEOAS principles encourage making the API self-documenting through returned links.

HTTP Caching in Web Application

Martins Sipenko

Neat tricks to bypass CSRF-protection

Mikhail Egorov

Xssandcsrf

Prabhanshu Saraswat

Cross-site scripting (XSS) and cross-site request forgery (CSRF) are web security vulnerabilities. XSS occurs when a malicious script is executed in a user's browser session from a web application. CSRF tricks a user's browser into making requests to a trusted site where the user is currently authenticated. The Samy worm exploited an XSS vulnerability on MySpace to propagate to over 1 million user profiles in under 24 hours. Developers can prevent XSS by validating and encoding all user input, and prevent CSRF by requiring secret tokens in POST requests.

Penetration testing web application web application (in) security

Nahidul Kibria

CROSS-SITE REQUEST FORGERY - IN-DEPTH ANALYSIS 2011

Samvel Gevorgyan

Cross-Site Request Forgery (CSRF in short) is a kind of a web application vulnerability which allows malicious website to send unauthorized requests to a vulnerable website using active session of its authorized users In simple words, it’s when an “evil” website posts a new status in your twitter account on your visit while the login session is active on twitter. For security reasons the same origin policy in browsers restricts access for browser-side programming languages such as Javascript to access a remote content. As the browsers configurations may be modified, the best way to protect web application against CSRF is to secure web application itself.

Defeating Cross-Site Scripting with Content Security Policy (updated)

Francois Marier

Hacking HTML5 offensive course (Zeronights edition)

Krzysztof Kotowicz

The document provides instructions for setting up a lab environment to demonstrate HTML5 hacking techniques, including exploiting the same origin policy, cross-site scripting using HTML5 features, exploiting web messaging, attacking with cross origin resource sharing, targeting client-side storage, bypassing content security policy, and analyzing browser cross-site scripting filters. It outlines various HTML5-based attacks and provides URLs to demonstration sites to try out the exploits hands-on.

Application Security for RIAs

johnwilander

Phpnw security-20111009

Paul Lemon

Sharing our agency experience of developing secure web applications for some of the UK's leading high street banks and brands with a focus on the pitfalls you face when developing code in PHP. The talk will contain specific details on the many attack vectors that hackers will use to attempt to access and exploit your site and how you can improve your development process to avoid them. Topics covered will include some old chestnuts like XSS (Cross Site Scripting) and SQL injection through to issues like aSession Hijacking. The talk is aimed at developers who have perhaps not truly considered security of their applications before to developers who would like to extend their knowledge. The talk is aimed at software developers and will contain practical code-based examples and solutions.

Identifying Web Servers: A First-look Into the Future of Web Server Fingerpri...

Jeremiah Grossman

CSP - What? Why? How? PHPNW16

Matt Brunt

[WSO2 Integration Summit Madrid 2019] Integration + Ballerina

WSO2

Increasingly, developers and architects are disaggregating their architectures to create more scalable and agile applications. As this happens, everything is becoming a programmable endpoint. Ballerina is a new programming language designed around this problem. This deck introduces the challenges and background of why Ballerina has been created, as well as demonstrate the core features of the language.

Web Attacks - Top threats - 2010

Shreeraj Shah

The document summarizes various web application vulnerabilities from 2010, including client-side attacks like cross-site scripting (XSS) and cross-site request forgery (CSRF), and server-side attacks like SQL injection, XML injection, and remote code execution via stored procedures. It provides examples of exploiting these vulnerabilities on modern web applications and defenses against these attacks.

Cross Site Attacks

UTD Computer Security Group

CROSS-SITE REQUEST FORGERY - IN-DEPTH ANALYSIS 2011

Samvel Gevorgyan

Similar to 2015-12-06 Артем Зиненко - Что делать, если браузеры клиентов действуют против них? (20)

Web Application Security

01. http basics v27

Evolution Of Web Security

DVWA BruCON Workshop

RESTful API - GDG Tech Talk - Novembro de 2014

HTTP Caching in Web Application

Neat tricks to bypass CSRF-protection

Xssandcsrf

Penetration testing web application web application (in) security

CROSS-SITE REQUEST FORGERY - IN-DEPTH ANALYSIS 2011

Defeating Cross-Site Scripting with Content Security Policy (updated)

Hacking HTML5 offensive course (Zeronights edition)

Application Security for RIAs

Phpnw security-20111009

Identifying Web Servers: A First-look Into the Future of Web Server Fingerpri...

CSP - What? Why? How? PHPNW16

[WSO2 Integration Summit Madrid 2019] Integration + Ballerina

Web Attacks - Top threats - 2010

Cross Site Attacks

CROSS-SITE REQUEST FORGERY - IN-DEPTH ANALYSIS 2011

More from HappyDev

2015-12-06 Aнтон Непомнящих - Принципы канбан и теории ограничений на примере...

HappyDev

2015-12-05 Антон Непомнящих - Agile — как уложиться в сроки и бюджет?

HappyDev

2015 12-05 Александр Шиповалов - Инструмент для тестирования Sikuli script

HappyDev

This document provides an overview of SikuliX, an automation tool that uses image recognition to control and interact with graphical user interfaces. It describes the main classes in SikuliX including App, Region, Screen, Offset, Math, Similarity, and Pattern. Methods for these classes are also outlined for performing actions like opening applications, finding regions on the screen, mouse and keyboard input, and image matching.

2015-12-06 Константин Борисов - Как собеседовать программиста?

HappyDev

2015-12-05 Данил Никифоров - NoSQL для мобайла с синхронизацией данных

HappyDev

2015-12-06 Букуров Алексей - Автоматическое формирование интерфейса по метаоп...

HappyDev

2015-12-06 Евгений Тюменцев - Практики разработки серверных приложений

HappyDev

2015-12-06 Александр Чернышев - Технологии открытости мобильных приложений

HappyDev

2015-12-05 Вадим Литвинов - Нагрузочное тестирование с MZBench

HappyDev

2015-12-05 Александр Шиповалов - Веселые картинки в тестировании

HappyDev

2015-12-05 Александр Бындю, Андрей Шапиро - Пять самых важных составляющих пр...

HappyDev

2015-12-05 Александр Коротков, Иван Панченко - Слабо-структурированные данные...

HappyDev

2015-12-06 Юрий Мельничек - Руководство для разработчиков по маркетингу мобил...

HappyDev

2015-12-06 Сергей Хрущев - Человеческим языком о суперкомпьютерах

HappyDev

2015-12-06 Максим Юнусов - Проектирование REST приложения, или нужно ли прогр...

HappyDev

2015-12-06 Евгений Тюменцев - Разработка надежных параллельных, распределенны...

HappyDev

2015-12-06 Антон Тарасенко - Ваш следующий сервис будет асинхронным

HappyDev

2015-12-06 Андрей Коновалов - От сервисной компании к продуктовой: что нужно,...

HappyDev

2015-12-05 Вадим Литвинов - Проблемы разработки распределённых систем

HappyDev

2015-12-05 Максим Дорофеев - Сила первого шага или сессия групповой депрокрас...

HappyDev

More from HappyDev (20)