Download to read offline
Uploaded byAravindan A
application security basics
This document provides an overview of topics related to analyzing and attacking web applications. It discusses techniques for reconnaissance like using Wireshark, browser plugins, proxies, scanners and fuzzers to gather information. It also covers mapping applications, identifying vulnerabilities outlined in the OWASP Top 10 like injection, XSS and insecure authentication, and additional risks like clickjacking, denial of service and information leakage.
More Related Content
Similar to application security basics
application security basics
- 1.
- 2. Reconnaissance Topics Covered: • WebApplication Analysis • Web Application Mapping Module 2–Chapter 1
- 3. Web Applications Analysis TopicsCovered: • Wireshark • BrowserPlugins • Proxies • Scanners • Fuzzers Module 2–Chapter 1
- 4. Wireshark • Profile networktraffic •Capturesrawtraffic • Packetanalyzer • 2.1 – Reconnaissance
- 5. Browser Plugins • Show/ChangehowthebrowserinteractswiththeWebApplication • PopularPlugins • TamperData • LiveHTTPHeaders • 2.1 – Reconnaissance Web Server Request Response Browser
- 6. Proxies • Control howdataisexchangedbetweenthebrowserandweb app • Canvirtually tamper any request/response • 2.1 – Reconnaissance Web Server Request Response Request Response Browser Proxy
- 7. Scanners • Attemptto findvulnerabilities usingknownattacks • Canautomatically try to exploitthe vulnerabilities • 2.1 – Reconnaissance Web Server Database Scanner
- 8. Fuzzers • Submit invalidandunexpectedrandomdatatotheweb application • Evaluate how exceptionsare handled • Mightunveil bugsintheapplication code • 2.1 – Reconnaissance Web AppFuzzer
- 9. Web Applications Mapping TopicsCovered: • Web Applications Mapping • Spiders 2.1–Reconnaissance
- 10. Web Applications Mapping •Collect theinfogatheredin theanalysisprocess • Mapeach infoto the appropriate resource • 2.1 – Reconnaissance Database Web Server • SW version • OS version • Net info Web App • Language • … Web Server Lucas
- 11. Spiders • Automatically sendrequestsandinterpretresponses •Create a map of the web application resources • 2.1 – Reconnaissance Web AppSpider Database
- 12. Web Applications Attacks TopicsCovered: • OWASP TOP 10 – 2013 • AdditionalRisks Module 2–Chapter 2
- 13. The Game Changer •2.2 – Web Applications Attacks Tommy HeisenbergLucas • Userinput…Cannot be trusted! Web App Request Response Request Response
- 14. OWASP TOP 10- 2013 A1:Injection A2:BrokenAuthenticationandSessionManagement A3:Cross-SiteScripting(XSS) A4:InsecureDirectObjectReferences A5:SecurityMisconfiguration • 2.2 – Web Applications Attacks A6:SensitiveDataExposure A7: MissingFunctionLevelAccessControl A8:CrossSiteRequestForgery(CSRF) A9:UsingKnownVulnerableComponents A10:UnvalidatedRedirectsandForwards
- 15. A1: Injection • Text-basedattacksthatexploitthesyntax of thetargetedinterpreter • 2.2 – Web Applications Attacks OS Command Database Logs XML XML JavaScript JS LDAPAttack Payload
- 16. SQL Injections • Databaseexecutesthecode in theattackerpayload • 2.2 – Web Applications Attacks SELECT * FROM Movies WHERE Title = a‘ OR 1 = 1 ORDER BY Year data code escape character HTTP Request HTTP Response SQL Query SQL output Database Web Browser Title: Year: Price: a ‘ OR 1 = 1 Eisenberg Web App dumpdump
- 17. A2: Broken Auth.and Session Management • Attackerusesexposed credentialsor session IDs to impersonate users • 2.2 – Web Applications Attacks Tommy Eisenberg HTTP Request http://airline.com/login.html HTTP Response http://airline.com/?SESSIONID=03098301 Web App HTTP Request http://airline.com/?SESSIONID=03098301
- 18. A3: Cross-Site Scripting(XSS) • Attackpayload storedin applicationdatabase(JavaScript Injection) • Reflected directlyinto the client • 2.2 – Web Applications Attacks Eisenberg Tommy HTTP Request HTTP Request HTTP Response Browser HTTP Request Hackerland Web App
- 19. A4: Insecure DirectObject References • Usersable to accessunauthorizedfiles data • 2.2 – Web Applications Attacks Eisenberg HTTP Request http://mybank.com/?acct=1000 HTTP Response http://mybank.com/?acct=1000 HTTP Request http://mybank.com/?acct=1001 HTTP Response http://mybank.com/?acct=1001 Web App
- 20. A5: Security Misconfiguration •Anycomponent of anysystemnot properly secured • Defaultaccounts,unpatchedflaws,unprotectedfilesanddirectories • 2.2 – Web Applications Attacks Eisenberg HTTP Request Components: • Operating System • Web Server Software • Web App Technology Database HTTP Request Web Server
- 21. A6: Sensitive DataExposure • Attackergain accessandretrieve sensitive data • Stealingencryptionkeysorcleartextdata • 2.2 – Web Applications Attacks Eisenberg HTTP Request Web App Database HTTP Response Encrypted Data SQL Query Clear Text Data
- 22. A7: Missing FunctionLevel Access Control • Private functionsare notprotectedagainstunauthorizedaccess • 2.2 – Web Applications Attacks Eisenberg HTTP Request http://myportal.com/?action=search HTTP Request http://myportal.com/?action=admin Web App
- 23. A8: Cross SiteRequest Forgery (CSRF) • Attackerforges HTTP requestsonbehalf of theuser • Canbeembeddedinimagestags,XSSetc. • Attacksucceedsonlyifuserisauthenticated • 2.2 – Web Applications Attacks Tommy Hackerland Web App Browser HTTP Request http://hackedwebsite.com http://hackedwebsite.com/welcome.html HTTP Response HTTP Request http://mybank.com/transfer?amm=1000&dest=1308921 mybank.com session cookie welcome.html <html>…. <img src= http://mybank.com/transfer? amm=1000&dest=1308921 ……</html> mybank.com session cookie
- 24. A9: Using KnownVulnerable Components • Attackerscans, identifies, andexploits vulnerable modules of webapp • Automatedtoolscanbeused • 2.2 – Web Applications Attacks Eisenberg ZAP Web App
- 25. A10: Unvalidated Redirectsand Forwards • Attackersredirectvictim toa specific website • 2.2 – Web Applications Attacks HTTP Request HTTP Response HTTP Request Hackerland Web App Tommy Browser http://shop.com/prod.jsp?p=120&dest=http://hackerland.com HTTP Response Redirect to http://hackerland.com
- 26. Additional Risks Topics Covered: •Clickjacking • Application Denialof Service • Information Leakage Module 2–Chapter 2
- 27. Clickjacking • Attackerhidesclickableelements insideaniframe •User unknowinglyinteractswith theattackerpage • 2.2 – Web Applications Attacks Tommy Hackerland HTTP Request Info sent to http://hackerland.com
- 28. Application Denial ofService • Attackerconsumes all theavailable systemresources • Webapplicationstakedowntheentire system • Attackercantargetspecific usersor modules of aweb application • Common HTTP DoS attacks: • Slowloris: SlowHTTPHeadersVulnerability • RUDY(R-U-Dead-Yet):Slow HTTPPOSTVulnerability • Slow-ReadDoSAttack • 2.2 – Web Applications Attacks
- 29. Information Leakage • Webapplication reveals sensitive data regarding • Webapplicationitself • Hosting environment • Userdataintoerrorresponses • 2.2 – Web Applications Attacks Eisenberg Web App HTTP Request HTTP Response 503 – DB 192.168.0.23 unreachable