SlideShare a Scribd company logo

Content Security Policies: Let's Break Stuff for PHPSW at Bath Digital

•
•
Matt Brunt
Matt Brunt

Content Security Policies are another tool we should have in our security toolbelt to help protect users of our sites. In this session I’ll cover what they are, why they’re needed, how they work and the limitations on what they can & cannot do to protect users. I’ll demo attacks a CSP will block, break things, show what the different CSP directives & options will do and introduce some of the tools available to help with implementing a CSP on your sites!

Technology
1 of 47
Download to read offline
@BruntyCSP: Let’s Break Stuff CONTENT SECURITY POLICIES LET’S BREAK STUFF
@BruntyCSP: Let’s Break Stuff BECAUSE YOU ALL TOTALLY CARE ABOUT THIS, RIGHT?! ABOUT ME ▸ Senior Software Engineer at Viva IT
 (those folks in orange hoodies at some conferences & events you may have been to) ▸ @Brunty ▸ @PHPem ▸ mfyu.co.uk ▸ matt@mfyu.co.uk
@BruntyCSP: Let’s Break Stuff BLAH BLAH… JUST GET ON WITH THE TALK THINGS I DO ▸ Dungeon master for D&D campaigns ▸ Mentor, lead & teach apprentices & junior developers ▸ Run & organise PHP East Midlands ▸ Speak at user groups and conferences ▸ Break production sites with incorrectly configured content security policies
@BruntyCSP: Let’s Break Stuff OH GOOD, FINALLY WE’RE GETTING STARTED A TALK IN 3 PARTS ▸ XSS
 ▸ CSP
 ▸ Break stuff

@BruntyCSP: Let’s Break Stuff THE SCARY STUFF
@BruntyCSP: Let’s Break Stuff FIRST, SOME BACKGROUND WHAT IS CROSS-SITE-SCRIPTING (XSS)? ▸ XSS enables an attacker to inject client-side scripts into non-malicious web pages viewed by other users ▸ In 2016 there was a 61% likelihood of a browser-based vulnerability being found in a web application ▸ Of those browser based vulnerabilities, 86% were found to be XSS related ▸ That’s just over 52% of all web application vulnerabilities
 https://www.edgescan.com/assets/docs/reports/2016-edgescan-stats-report.pdf
@BruntyCSP: Let’s Break Stuff I MEAN, IT’S JUST A JOKE VULNERABILITY, RIGHT?! WHAT CAN BE DONE WITH XSS? ▸ Put pictures of cats in web pages ▸ alert(‘💩’); ▸ Rickroll a user ▸ Twitter self-retweeting tweet
 https://www.youtube.com/watch?v=zv0kZKC6GAM ▸ Samy worm
 https://en.wikipedia.org/wiki/Samy_(computer_worm)
@BruntyCSP: Let’s Break Stuff WELL… MAYBE IT’S NOT A JOKE VULNERABILITY WHAT CAN BE DONE WITH XSS? ▸ Make modifications to the DOM - replace a form action to point to your own script to capture credentials. ▸ Use XMLHttpRequest to send HTTP requests and load in additional resources ▸ Access HTML5 APIs - webcam, microphone, geolocation ▸ Steal cookies (and therefore steal session cookies)
@BruntyCSP: Let’s Break Stuff
@BruntyCSP: Let’s Break Stuff IT’S REALLY NOT A JOKE VULNERABILITY WHAT CAN BE DONE WITH XSS? https://www.wired.com/2008/03/hackers-assault-epilepsy-patients-via-computer/
@BruntyCSP: Let’s Break Stuff TYPES OF XSS ATTACK STORED XSS (AKA PERSISTENT OR TYPE I) ▸ Occurs when input is stored - generally in a server-side database, but not always ▸ This could also be within a HTML5 database, thus never being sent to the server at all ▸ who.is was a site Rickrolled by a TXT record in the DNS of a website (yes, really)
@BruntyCSP: Let’s Break Stuff TYPES OF XSS ATTACK REFLECTED XSS (AKA NON-PERSISTENT OR TYPE II) ▸ Occurs when user input provided in the request is immediately returned - such as in an error message, search string etc ▸ Data is not stored, and in some instances, may not even reach the server (see the next type of XSS)
@BruntyCSP: Let’s Break Stuff TYPES OF XSS ATTACK DOM-BASED XSS (AKA TYPE-0) ▸ The entire flow of the attack takes place within the browser ▸ For example, if JavaScript in the site takes input, and uses something like document.write based on that input, it can be vulnerable to a DOM-based XSS attack
@BruntyCSP: Let’s Break Stuff TYPES OF XSS ATTACK SELF XSS ▸ Social-engineering form of XSS ▸ Requires the user to execute code in the browser ▸ Doing so via the console can’t be protected by a lot of methods ▸ Not considered a ‘true’ XSS attack due to requiring the user to execute the code
@BruntyCSP: Let’s Break Stuff
@BruntyCSP: Let’s Break Stuff STOP THE HACKERS LET’S FIGHT BACK
@BruntyCSP: Let’s Break Stuff HTTP RESPONSE HEADER TO HELP REDUCE XSS RISKS WHAT IS A CSP?
@BruntyCSP: Let’s Break Stuff DECLARES WHAT RESOURCES ARE ALLOWED TO LOAD HOW DOES A CSP WORK?
@BruntyCSP: Let’s Break Stuff BROWSER SUPPORT
@BruntyCSP: Let’s Break Stuff
@BruntyCSP: Let’s Break Stuff CSP TO THE RESCUE! WHAT CAN WE PROTECT? ▸ default-src ▸ script-src ▸ style-src ▸ img-src ▸ form-action ▸ update-insecure-requests
@BruntyCSP: Let’s Break Stuff FULL REFERENCE:https://content-security-policy.com
 https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
@BruntyCSP: Let’s Break Stuff img-src * ALLOWS ANY URL EXCEPT DATA: BLOB: FILESYSTEM: SCHEMES.
@BruntyCSP: Let’s Break Stuff object-src 'none' DON’T LOAD RESOURCES FROM ANY SOURCE
@BruntyCSP: Let’s Break Stuff style-src ‘self' ALLOW LOADING FROM SAME SCHEME, HOST AND PORT
@BruntyCSP: Let’s Break Stuff script-src 'unsafe-inline' ALLOWS USE OF INLINE SOURCE ELEMENTS SUCH AS STYLE ATTRIBUTE, ONCLICK, OR SCRIPT TAG BODIES
@BruntyCSP: Let’s Break Stuff DON’T USE UNSAFE-INLINE
@BruntyCSP: Let’s Break Stuff <script nonce="$RANDOM">...</script> script-src 'self' 'nonce-$RANDOM'
@BruntyCSP: Let’s Break Stuff Content-Security-Policy: default-src 'none'; script-src 'self' https://*.google.com 'nonce-random123'; style-src 'self'; img-src 'self'; upgrade-insecure-requests; form- action 'self';
@BruntyCSP: Let’s Break Stuff I BROKE PRODUCTION WITH A BAD CSP LEARN FROM MY MISTAKES
@BruntyCSP: Let’s Break Stuff DON’T DO WHAT I DID
@BruntyCSP: Let’s Break Stuff REPORT-URI
@BruntyCSP: Let’s Break Stuff WHEN A POLICY FAILURE OCCURS, THE BROWSER SENDS A JSON PAYLOAD TO THAT URL
@BruntyCSP: Let’s Break Stuff { "csp-report": { "blocked-uri": "self", "document-uri": "https://mysite.com", "line-number": 1, "original-policy": "script-src 'self'", "script-sample": "try { for(var lastpass_iter=0; lastpass...", "source-file": "https://mysite.com", "violated-directive": "script-src 'self'" } }
@BruntyCSP: Let’s Break Stuff REPORT-URI.IO
@BruntyCSP: Let’s Break Stuff
@BruntyCSP: Let’s Break Stuff REPORT-ONLY
@BruntyCSP: Let’s Break Stuff Content-Security-Policy-Report-Only: [policy]; report- uri https://app.report-uri.io/r/default/csp/reportOnly;
@BruntyCSP: Let’s Break Stuff TRIAL STUFF BEFORE ENFORCING
@BruntyCSP: Let’s Break Stuff THERE WILL BE NOISE, LOTS OF NOISE
@BruntyCSP: Let’s Break Stuff WAYS TO MAKE DEALING WITH A CSP EASIER TIPS ▸ Have an easy and quick way to disable the CSP in production if required ▸ Better yet, have a way to switch it from enforced to report only so you can get violations reported to help you debug ▸ Add the CSP at an application level if you need a nonce
@BruntyCSP: Let’s Break Stuff WAYS TO REMOVE BARRIERS IN DEVELOPMENT NONCES ▸ Don’t generate multiple nonces in the same request (but do generate a new nonce on each separate request) ▸ If using a templating engine (such as twig) - add the nonce as a global so it’s available in every template by default ▸ Write a helper in your template engine to generate script tags with a nonce if it’s available
@BruntyCSP: Let’s Break Stuff DEMO TIME! LET’S BREAK STUFF
@BruntyCSP: Let’s Break Stuff @SCOTT_HELME HE KNOWS HIS STUFF! (THIS ISN’T ME)
@BruntyCSP: Let’s Break Stuff HOMEWORK TIME! LINKS & FURTHER READING ▸ https://www.owasp.org/index.php/Cross-site_Scripting_(XSS) ▸ https://content-security-policy.com ▸ https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy ▸ https://report-uri.io ▸ https://scotthelme.co.uk/just-how-much-traffic-can-you-generate-using-csp/ ▸ https://www.edgescan.com/assets/docs/reports/2016-edgescan-stats-report.pdf ▸ http://theharmonyguy.com/oldsite/2011/04/21/recent-facebook-xss-attacks-show- increasing-sophistication/ ▸ https://github.com/Brunty/csp-demo
@BruntyCSP: Let’s Break Stuff THANK YOU
@BruntyCSP: Let’s Break Stuff QUESTIONS? JOIND.IN/TALK/9845D @BRUNTY @PHPEM MFYU.CO.UK MATT@MFYU.CO.UK

Recommended

Content Security Policies: Let's Break Stuff @ PHP London, Sept 2017
Content Security Policies: Let's Break Stuff @ PHP London, Sept 2017Content Security Policies: Let's Break Stuff @ PHP London, Sept 2017
Content Security Policies: Let's Break Stuff @ PHP London, Sept 2017
Matt Brunt
 
Content Security Policies: Let's Break Stuff @ Scotland PHP
Content Security Policies: Let's Break Stuff @ Scotland PHPContent Security Policies: Let's Break Stuff @ Scotland PHP
Content Security Policies: Let's Break Stuff @ Scotland PHP
Matt Brunt
 
Content Security Policies: Let's Break Stuff for WordCamp London
Content Security Policies: Let's Break Stuff for WordCamp LondonContent Security Policies: Let's Break Stuff for WordCamp London
Content Security Policies: Let's Break Stuff for WordCamp London
Matt Brunt
 
CSPs: Let's Break Stuff for PHP Benelux
CSPs: Let's Break Stuff for PHP BeneluxCSPs: Let's Break Stuff for PHP Benelux
CSPs: Let's Break Stuff for PHP Benelux
Matt Brunt
 
Content Security Policies: Let's Break Stuff @ PHP South Coast 2017
Content Security Policies: Let's Break Stuff @ PHP South Coast 2017Content Security Policies: Let's Break Stuff @ PHP South Coast 2017
Content Security Policies: Let's Break Stuff @ PHP South Coast 2017
Matt Brunt
 
Content Security Policies: Let's Break Stuff
Content Security Policies: Let's Break StuffContent Security Policies: Let's Break Stuff
Content Security Policies: Let's Break Stuff
Matt Brunt
 
Are Today's Good Practices… Tomorrow's Performance Anti-Patterns
Are Today's Good Practices… Tomorrow's Performance Anti-PatternsAre Today's Good Practices… Tomorrow's Performance Anti-Patterns
Are Today's Good Practices… Tomorrow's Performance Anti-Patterns
Andy Davies
 
Are Today’s Good Practices... Tomorrow’s Performance Anti-Patterns?
Are Today’s Good Practices... Tomorrow’s Performance Anti-Patterns?Are Today’s Good Practices... Tomorrow’s Performance Anti-Patterns?
Are Today’s Good Practices... Tomorrow’s Performance Anti-Patterns?
Andy Davies
 

Recommended

Content Security Policies: Let's Break Stuff @ PHP London, Sept 2017
Content Security Policies: Let's Break Stuff @ PHP London, Sept 2017Content Security Policies: Let's Break Stuff @ PHP London, Sept 2017
Content Security Policies: Let's Break Stuff @ PHP London, Sept 2017
Matt Brunt
 
Content Security Policies: Let's Break Stuff @ Scotland PHP
Content Security Policies: Let's Break Stuff @ Scotland PHPContent Security Policies: Let's Break Stuff @ Scotland PHP
Content Security Policies: Let's Break Stuff @ Scotland PHP
Matt Brunt
 
Content Security Policies: Let's Break Stuff for WordCamp London
Content Security Policies: Let's Break Stuff for WordCamp LondonContent Security Policies: Let's Break Stuff for WordCamp London
Content Security Policies: Let's Break Stuff for WordCamp London
Matt Brunt
 
CSPs: Let's Break Stuff for PHP Benelux
CSPs: Let's Break Stuff for PHP BeneluxCSPs: Let's Break Stuff for PHP Benelux
CSPs: Let's Break Stuff for PHP Benelux
Matt Brunt
 
Content Security Policies: Let's Break Stuff @ PHP South Coast 2017
Content Security Policies: Let's Break Stuff @ PHP South Coast 2017Content Security Policies: Let's Break Stuff @ PHP South Coast 2017
Content Security Policies: Let's Break Stuff @ PHP South Coast 2017
Matt Brunt
 
Content Security Policies: Let's Break Stuff
Content Security Policies: Let's Break StuffContent Security Policies: Let's Break Stuff
Content Security Policies: Let's Break Stuff
Matt Brunt
 
Are Today's Good Practices… Tomorrow's Performance Anti-Patterns
Are Today's Good Practices… Tomorrow's Performance Anti-PatternsAre Today's Good Practices… Tomorrow's Performance Anti-Patterns
Are Today's Good Practices… Tomorrow's Performance Anti-Patterns
Andy Davies
 
Are Today’s Good Practices... Tomorrow’s Performance Anti-Patterns?
Are Today’s Good Practices... Tomorrow’s Performance Anti-Patterns?Are Today’s Good Practices... Tomorrow’s Performance Anti-Patterns?
Are Today’s Good Practices... Tomorrow’s Performance Anti-Patterns?
Andy Davies
 
Sucuri Webinar: Leveraging Sucuri's API
Sucuri Webinar: Leveraging Sucuri's APISucuri Webinar: Leveraging Sucuri's API
Sucuri Webinar: Leveraging Sucuri's API
Sucuri
 
Csp vortrag
Csp vortragCsp vortrag
Csp vortrag
András Ottó
 
Faster Frontends
Faster FrontendsFaster Frontends
Faster Frontends
Andy Davies
 
Sucuri Webinar: How to Optimize Your Website for Best Performance
Sucuri Webinar: How to Optimize Your Website for Best PerformanceSucuri Webinar: How to Optimize Your Website for Best Performance
Sucuri Webinar: How to Optimize Your Website for Best Performance
Sucuri
 
WordPress Security Begins With Good Posture
WordPress Security Begins With Good PostureWordPress Security Begins With Good Posture
WordPress Security Begins With Good PostureTony Perez
 
WordCamp Baltimore - WordPress Security: Fundamentals for Business
WordCamp Baltimore - WordPress Security: Fundamentals for BusinessWordCamp Baltimore - WordPress Security: Fundamentals for Business
WordCamp Baltimore - WordPress Security: Fundamentals for BusinessJoseph Herbrandson
 
Go Faster, Webmasters
Go Faster, WebmastersGo Faster, Webmasters
Go Faster, Webmasters
Mike Bailey
 
Sucuri Webinar: WAF (Firewall) and CDN Feature Benefit Guide
Sucuri Webinar: WAF (Firewall) and CDN Feature Benefit GuideSucuri Webinar: WAF (Firewall) and CDN Feature Benefit Guide
Sucuri Webinar: WAF (Firewall) and CDN Feature Benefit Guide
Sucuri
 
Hacked - What do you do now?
Hacked - What do you do now?Hacked - What do you do now?
Hacked - What do you do now?
Tony Perez
 
Everything is Awful (And You're Not Helping)
Everything is Awful (And You're Not Helping)Everything is Awful (And You're Not Helping)
Everything is Awful (And You're Not Helping)
Jan Schaumann
 
Sucuri Webinar: Beginner's Guide to CDNs
Sucuri Webinar: Beginner's Guide to CDNsSucuri Webinar: Beginner's Guide to CDNs
Sucuri Webinar: Beginner's Guide to CDNs
Sucuri
 
Brute forcing your privacy
Brute forcing your privacyBrute forcing your privacy
Brute forcing your privacy
AngelRoblesCordero
 
Protecting Web App users in today’s hostile environment
Protecting Web App users in today’s hostile environmentProtecting Web App users in today’s hostile environment
Protecting Web App users in today’s hostile environment
ajitdhumale
 
Tsc summit #2 - HTTP Header Security
Tsc summit #2 - HTTP Header SecurityTsc summit #2 - HTTP Header Security
Tsc summit #2 - HTTP Header Security
Mikal Villa
 
Happy Browser, Happy User! WordSesh 2019
Happy Browser, Happy User! WordSesh 2019Happy Browser, Happy User! WordSesh 2019
Happy Browser, Happy User! WordSesh 2019
Katie Sylor-Miller
 
Rails security: above and beyond the defaults
Rails security: above and beyond the defaultsRails security: above and beyond the defaults
Rails security: above and beyond the defaults
Matias Korhonen
 
DrupalCamp London 2017 - Web site insecurity
DrupalCamp London 2017 - Web site insecurity DrupalCamp London 2017 - Web site insecurity
DrupalCamp London 2017 - Web site insecurity
George Boobyer
 
Building Better Responsive Websites
Building Better Responsive WebsitesBuilding Better Responsive Websites
Building Better Responsive Websites
Holger Bartel
 
Browser Wars 2019 - Implementing a Content Security Policy
Browser Wars 2019 - Implementing a Content Security PolicyBrowser Wars 2019 - Implementing a Content Security Policy
Browser Wars 2019 - Implementing a Content Security Policy
George Boobyer
 
Smart mobile storytelling christy robinson - denver news train - april 11-1...
Smart mobile storytelling christy robinson - denver news train - april 11-1...Smart mobile storytelling christy robinson - denver news train - april 11-1...
Smart mobile storytelling christy robinson - denver news train - april 11-1...
News Leaders Association's NewsTrain
 
NKU Cybersecurity Symposium: Active Defense - Helping threat actors hack them...
NKU Cybersecurity Symposium: Active Defense - Helping threat actors hack them...NKU Cybersecurity Symposium: Active Defense - Helping threat actors hack them...
NKU Cybersecurity Symposium: Active Defense - Helping threat actors hack them...
ThreatReel Podcast
 
BSides Cleveland: Active Defense - Helping threat actors hack themselves!
BSides Cleveland: Active Defense - Helping threat actors hack themselves!BSides Cleveland: Active Defense - Helping threat actors hack themselves!
BSides Cleveland: Active Defense - Helping threat actors hack themselves!
ThreatReel Podcast
 

More Related Content

What's hot

Sucuri Webinar: Leveraging Sucuri's API
Sucuri Webinar: Leveraging Sucuri's APISucuri Webinar: Leveraging Sucuri's API
Sucuri Webinar: Leveraging Sucuri's API
Sucuri
 
Csp vortrag
Csp vortragCsp vortrag
Csp vortrag
András Ottó
 
Faster Frontends
Faster FrontendsFaster Frontends
Faster Frontends
Andy Davies
 
Sucuri Webinar: How to Optimize Your Website for Best Performance
Sucuri Webinar: How to Optimize Your Website for Best PerformanceSucuri Webinar: How to Optimize Your Website for Best Performance
Sucuri Webinar: How to Optimize Your Website for Best Performance
Sucuri
 
WordPress Security Begins With Good Posture
WordPress Security Begins With Good PostureWordPress Security Begins With Good Posture
WordPress Security Begins With Good PostureTony Perez
 
WordCamp Baltimore - WordPress Security: Fundamentals for Business
WordCamp Baltimore - WordPress Security: Fundamentals for BusinessWordCamp Baltimore - WordPress Security: Fundamentals for Business
WordCamp Baltimore - WordPress Security: Fundamentals for BusinessJoseph Herbrandson
 
Go Faster, Webmasters
Go Faster, WebmastersGo Faster, Webmasters
Go Faster, Webmasters
Mike Bailey
 
Sucuri Webinar: WAF (Firewall) and CDN Feature Benefit Guide
Sucuri Webinar: WAF (Firewall) and CDN Feature Benefit GuideSucuri Webinar: WAF (Firewall) and CDN Feature Benefit Guide
Sucuri Webinar: WAF (Firewall) and CDN Feature Benefit Guide
Sucuri
 
Hacked - What do you do now?
Hacked - What do you do now?Hacked - What do you do now?
Hacked - What do you do now?
Tony Perez
 
Everything is Awful (And You're Not Helping)
Everything is Awful (And You're Not Helping)Everything is Awful (And You're Not Helping)
Everything is Awful (And You're Not Helping)
Jan Schaumann
 
Sucuri Webinar: Beginner's Guide to CDNs
Sucuri Webinar: Beginner's Guide to CDNsSucuri Webinar: Beginner's Guide to CDNs
Sucuri Webinar: Beginner's Guide to CDNs
Sucuri
 
Brute forcing your privacy
Brute forcing your privacyBrute forcing your privacy
Brute forcing your privacy
AngelRoblesCordero
 

What's hot (12)

Sucuri Webinar: Leveraging Sucuri's API
Sucuri Webinar: Leveraging Sucuri's APISucuri Webinar: Leveraging Sucuri's API
Sucuri Webinar: Leveraging Sucuri's API
 
Csp vortrag
Csp vortragCsp vortrag
Csp vortrag
 
Faster Frontends
Faster FrontendsFaster Frontends
Faster Frontends
 
Sucuri Webinar: How to Optimize Your Website for Best Performance
Sucuri Webinar: How to Optimize Your Website for Best PerformanceSucuri Webinar: How to Optimize Your Website for Best Performance
Sucuri Webinar: How to Optimize Your Website for Best Performance
 
WordPress Security Begins With Good Posture
WordPress Security Begins With Good PostureWordPress Security Begins With Good Posture
WordPress Security Begins With Good Posture
 
WordCamp Baltimore - WordPress Security: Fundamentals for Business
WordCamp Baltimore - WordPress Security: Fundamentals for BusinessWordCamp Baltimore - WordPress Security: Fundamentals for Business
WordCamp Baltimore - WordPress Security: Fundamentals for Business
 
Go Faster, Webmasters
Go Faster, WebmastersGo Faster, Webmasters
Go Faster, Webmasters
 
Sucuri Webinar: WAF (Firewall) and CDN Feature Benefit Guide
Sucuri Webinar: WAF (Firewall) and CDN Feature Benefit GuideSucuri Webinar: WAF (Firewall) and CDN Feature Benefit Guide
Sucuri Webinar: WAF (Firewall) and CDN Feature Benefit Guide
 
Hacked - What do you do now?
Hacked - What do you do now?Hacked - What do you do now?
Hacked - What do you do now?
 
Everything is Awful (And You're Not Helping)
Everything is Awful (And You're Not Helping)Everything is Awful (And You're Not Helping)
Everything is Awful (And You're Not Helping)
 
Sucuri Webinar: Beginner's Guide to CDNs
Sucuri Webinar: Beginner's Guide to CDNsSucuri Webinar: Beginner's Guide to CDNs
Sucuri Webinar: Beginner's Guide to CDNs
 
Brute forcing your privacy
Brute forcing your privacyBrute forcing your privacy
Brute forcing your privacy
 

Similar to Content Security Policies: Let's Break Stuff for PHPSW at Bath Digital

Protecting Web App users in today’s hostile environment
Protecting Web App users in today’s hostile environmentProtecting Web App users in today’s hostile environment
Protecting Web App users in today’s hostile environment
ajitdhumale
 
Tsc summit #2 - HTTP Header Security
Tsc summit #2 - HTTP Header SecurityTsc summit #2 - HTTP Header Security
Tsc summit #2 - HTTP Header Security
Mikal Villa
 
Happy Browser, Happy User! WordSesh 2019
Happy Browser, Happy User! WordSesh 2019Happy Browser, Happy User! WordSesh 2019
Happy Browser, Happy User! WordSesh 2019
Katie Sylor-Miller
 
Rails security: above and beyond the defaults
Rails security: above and beyond the defaultsRails security: above and beyond the defaults
Rails security: above and beyond the defaults
Matias Korhonen
 
DrupalCamp London 2017 - Web site insecurity
DrupalCamp London 2017 - Web site insecurity DrupalCamp London 2017 - Web site insecurity
DrupalCamp London 2017 - Web site insecurity
George Boobyer
 
Building Better Responsive Websites
Building Better Responsive WebsitesBuilding Better Responsive Websites
Building Better Responsive Websites
Holger Bartel
 
Browser Wars 2019 - Implementing a Content Security Policy
Browser Wars 2019 - Implementing a Content Security PolicyBrowser Wars 2019 - Implementing a Content Security Policy
Browser Wars 2019 - Implementing a Content Security Policy
George Boobyer
 
Smart mobile storytelling christy robinson - denver news train - april 11-1...
Smart mobile storytelling christy robinson - denver news train - april 11-1...Smart mobile storytelling christy robinson - denver news train - april 11-1...
Smart mobile storytelling christy robinson - denver news train - april 11-1...
News Leaders Association's NewsTrain
 
NKU Cybersecurity Symposium: Active Defense - Helping threat actors hack them...
NKU Cybersecurity Symposium: Active Defense - Helping threat actors hack them...NKU Cybersecurity Symposium: Active Defense - Helping threat actors hack them...
NKU Cybersecurity Symposium: Active Defense - Helping threat actors hack them...
ThreatReel Podcast
 
BSides Cleveland: Active Defense - Helping threat actors hack themselves!
BSides Cleveland: Active Defense - Helping threat actors hack themselves!BSides Cleveland: Active Defense - Helping threat actors hack themselves!
BSides Cleveland: Active Defense - Helping threat actors hack themselves!
ThreatReel Podcast
 
CollabSphere SC 103 : Domino on the Web : Yes, It's (Probably) Hackable
CollabSphere SC 103 : Domino on the Web : Yes, It's (Probably) HackableCollabSphere SC 103 : Domino on the Web : Yes, It's (Probably) Hackable
CollabSphere SC 103 : Domino on the Web : Yes, It's (Probably) Hackable
Darren Duke
 
Migration Best Practices - SMX West 2019
Migration Best Practices - SMX West 2019Migration Best Practices - SMX West 2019
Migration Best Practices - SMX West 2019
Bastian Grimm
 
Beyond Mirai: The new age of MDDoS attacks
Beyond Mirai: The new age of MDDoS attacksBeyond Mirai: The new age of MDDoS attacks
Beyond Mirai: The new age of MDDoS attacks
APNIC
 
LavaCon 2017 - Evolving the New Content Order
LavaCon 2017 - Evolving the New Content OrderLavaCon 2017 - Evolving the New Content Order
LavaCon 2017 - Evolving the New Content Order
Jack Molisani
 
Better Safe Than Sorry with HTTPS - SMX East 2016 - Patrick Stox
Better Safe Than Sorry with HTTPS - SMX East 2016 - Patrick StoxBetter Safe Than Sorry with HTTPS - SMX East 2016 - Patrick Stox
Better Safe Than Sorry with HTTPS - SMX East 2016 - Patrick Stox
patrickstox
 
Security and Privacy on the Web in 2015
Security and Privacy on the Web in 2015Security and Privacy on the Web in 2015
Security and Privacy on the Web in 2015
Francois Marier
 
Why Traditional Web Security Technologies no Longer Suffice to Keep You Safe
Why Traditional Web Security Technologies no Longer Suffice to Keep You SafeWhy Traditional Web Security Technologies no Longer Suffice to Keep You Safe
Why Traditional Web Security Technologies no Longer Suffice to Keep You Safe
Philippe De Ryck
 
How Chunky Do You Need To Be?: Adaptive Content Strategies For The Real World
How Chunky Do You Need To Be?: Adaptive Content Strategies For The Real WorldHow Chunky Do You Need To Be?: Adaptive Content Strategies For The Real World
How Chunky Do You Need To Be?: Adaptive Content Strategies For The Real World
Christopher Grant Ward
 
OISF Aniversary: Active Defense - Helping threat actors hack themselves!
OISF Aniversary: Active Defense - Helping threat actors hack themselves!OISF Aniversary: Active Defense - Helping threat actors hack themselves!
OISF Aniversary: Active Defense - Helping threat actors hack themselves!
ThreatReel Podcast
 
Content Security Policy
Content Security PolicyContent Security Policy
Content Security Policy
Ryan LaBouve
 

Similar to Content Security Policies: Let's Break Stuff for PHPSW at Bath Digital (20)

Protecting Web App users in today’s hostile environment
Protecting Web App users in today’s hostile environmentProtecting Web App users in today’s hostile environment
Protecting Web App users in today’s hostile environment
 
Tsc summit #2 - HTTP Header Security
Tsc summit #2 - HTTP Header SecurityTsc summit #2 - HTTP Header Security
Tsc summit #2 - HTTP Header Security
 
Happy Browser, Happy User! WordSesh 2019
Happy Browser, Happy User! WordSesh 2019Happy Browser, Happy User! WordSesh 2019
Happy Browser, Happy User! WordSesh 2019
 
Rails security: above and beyond the defaults
Rails security: above and beyond the defaultsRails security: above and beyond the defaults
Rails security: above and beyond the defaults
 
DrupalCamp London 2017 - Web site insecurity
DrupalCamp London 2017 - Web site insecurity DrupalCamp London 2017 - Web site insecurity
DrupalCamp London 2017 - Web site insecurity
 
Building Better Responsive Websites
Building Better Responsive WebsitesBuilding Better Responsive Websites
Building Better Responsive Websites
 
Browser Wars 2019 - Implementing a Content Security Policy
Browser Wars 2019 - Implementing a Content Security PolicyBrowser Wars 2019 - Implementing a Content Security Policy
Browser Wars 2019 - Implementing a Content Security Policy
 
Smart mobile storytelling christy robinson - denver news train - april 11-1...
Smart mobile storytelling christy robinson - denver news train - april 11-1...Smart mobile storytelling christy robinson - denver news train - april 11-1...
Smart mobile storytelling christy robinson - denver news train - april 11-1...
 
NKU Cybersecurity Symposium: Active Defense - Helping threat actors hack them...
NKU Cybersecurity Symposium: Active Defense - Helping threat actors hack them...NKU Cybersecurity Symposium: Active Defense - Helping threat actors hack them...
NKU Cybersecurity Symposium: Active Defense - Helping threat actors hack them...
 
BSides Cleveland: Active Defense - Helping threat actors hack themselves!
BSides Cleveland: Active Defense - Helping threat actors hack themselves!BSides Cleveland: Active Defense - Helping threat actors hack themselves!
BSides Cleveland: Active Defense - Helping threat actors hack themselves!
 
CollabSphere SC 103 : Domino on the Web : Yes, It's (Probably) Hackable
CollabSphere SC 103 : Domino on the Web : Yes, It's (Probably) HackableCollabSphere SC 103 : Domino on the Web : Yes, It's (Probably) Hackable
CollabSphere SC 103 : Domino on the Web : Yes, It's (Probably) Hackable
 
Migration Best Practices - SMX West 2019
Migration Best Practices - SMX West 2019Migration Best Practices - SMX West 2019
Migration Best Practices - SMX West 2019
 
Beyond Mirai: The new age of MDDoS attacks
Beyond Mirai: The new age of MDDoS attacksBeyond Mirai: The new age of MDDoS attacks
Beyond Mirai: The new age of MDDoS attacks
 
LavaCon 2017 - Evolving the New Content Order
LavaCon 2017 - Evolving the New Content OrderLavaCon 2017 - Evolving the New Content Order
LavaCon 2017 - Evolving the New Content Order
 
Better Safe Than Sorry with HTTPS - SMX East 2016 - Patrick Stox
Better Safe Than Sorry with HTTPS - SMX East 2016 - Patrick StoxBetter Safe Than Sorry with HTTPS - SMX East 2016 - Patrick Stox
Better Safe Than Sorry with HTTPS - SMX East 2016 - Patrick Stox
 
Security and Privacy on the Web in 2015
Security and Privacy on the Web in 2015Security and Privacy on the Web in 2015
Security and Privacy on the Web in 2015
 
Why Traditional Web Security Technologies no Longer Suffice to Keep You Safe
Why Traditional Web Security Technologies no Longer Suffice to Keep You SafeWhy Traditional Web Security Technologies no Longer Suffice to Keep You Safe
Why Traditional Web Security Technologies no Longer Suffice to Keep You Safe
 
How Chunky Do You Need To Be?: Adaptive Content Strategies For The Real World
How Chunky Do You Need To Be?: Adaptive Content Strategies For The Real WorldHow Chunky Do You Need To Be?: Adaptive Content Strategies For The Real World
How Chunky Do You Need To Be?: Adaptive Content Strategies For The Real World
 
OISF Aniversary: Active Defense - Helping threat actors hack themselves!
OISF Aniversary: Active Defense - Helping threat actors hack themselves!OISF Aniversary: Active Defense - Helping threat actors hack themselves!
OISF Aniversary: Active Defense - Helping threat actors hack themselves!
 
Content Security Policy
Content Security PolicyContent Security Policy
Content Security Policy
 

More from Matt Brunt

BDD & Behat for PHPUK
BDD & Behat for PHPUKBDD & Behat for PHPUK
BDD & Behat for PHPUK
Matt Brunt
 
BDD & Behat for PHPNE
BDD & Behat for PHPNEBDD & Behat for PHPNE
BDD & Behat for PHPNE
Matt Brunt
 
BDD & Behat for Glasgow PHP
BDD & Behat for Glasgow PHPBDD & Behat for Glasgow PHP
BDD & Behat for Glasgow PHP
Matt Brunt
 
BDD & Behat
BDD & BehatBDD & Behat
BDD & Behat
Matt Brunt
 
BDD & Behat for Srijan Technologies
BDD & Behat for Srijan TechnologiesBDD & Behat for Srijan Technologies
BDD & Behat for Srijan Technologies
Matt Brunt
 
CSP - What? Why? How? PHPNW16
CSP - What? Why? How? PHPNW16CSP - What? Why? How? PHPNW16
CSP - What? Why? How? PHPNW16
Matt Brunt
 
PHPNW16 Matt Brunt - BDD & Behat
PHPNW16 Matt Brunt - BDD & BehatPHPNW16 Matt Brunt - BDD & Behat
PHPNW16 Matt Brunt - BDD & Behat
Matt Brunt
 
BDD - telling stories through code for PHPem
BDD - telling stories through code for PHPemBDD - telling stories through code for PHPem
BDD - telling stories through code for PHPem
Matt Brunt
 
BDD: Telling stories through code [For TechNotts]
BDD: Telling stories through code [For TechNotts]BDD: Telling stories through code [For TechNotts]
BDD: Telling stories through code [For TechNotts]
Matt Brunt
 

More from Matt Brunt (10)

BDD & Behat for PHPUK
BDD & Behat for PHPUKBDD & Behat for PHPUK
BDD & Behat for PHPUK
 
BDD & Behat for PHPNE
BDD & Behat for PHPNEBDD & Behat for PHPNE
BDD & Behat for PHPNE
 
BDD & Behat for Glasgow PHP
BDD & Behat for Glasgow PHPBDD & Behat for Glasgow PHP
BDD & Behat for Glasgow PHP
 
BDD & Behat
BDD & BehatBDD & Behat
BDD & Behat
 
BDD & Behat for Srijan Technologies
BDD & Behat for Srijan TechnologiesBDD & Behat for Srijan Technologies
BDD & Behat for Srijan Technologies
 
CSP - What? Why? How? PHPNW16
CSP - What? Why? How? PHPNW16CSP - What? Why? How? PHPNW16
CSP - What? Why? How? PHPNW16
 
PHPNW16 Matt Brunt - BDD & Behat
PHPNW16 Matt Brunt - BDD & BehatPHPNW16 Matt Brunt - BDD & Behat
PHPNW16 Matt Brunt - BDD & Behat
 
BDD - telling stories through code for PHPem
BDD - telling stories through code for PHPemBDD - telling stories through code for PHPem
BDD - telling stories through code for PHPem
 
BDD: Telling stories through code [For TechNotts]
BDD: Telling stories through code [For TechNotts]BDD: Telling stories through code [For TechNotts]
BDD: Telling stories through code [For TechNotts]
 
Intro to Gulp
Intro to GulpIntro to Gulp
Intro to Gulp
 

Recently uploaded

Builder.ai Founder Sachin Dev Duggal's Strategic Approach to Create an Innova...
Builder.ai Founder Sachin Dev Duggal's Strategic Approach to Create an Innova...Builder.ai Founder Sachin Dev Duggal's Strategic Approach to Create an Innova...
Builder.ai Founder Sachin Dev Duggal's Strategic Approach to Create an Innova...
Ramesh Iyer
 
Assuring Contact Center Experiences for Your Customers With ThousandEyes
Assuring Contact Center Experiences for Your Customers With ThousandEyesAssuring Contact Center Experiences for Your Customers With ThousandEyes
Assuring Contact Center Experiences for Your Customers With ThousandEyes
ThousandEyes
 
Accelerate your Kubernetes clusters with Varnish Caching
Accelerate your Kubernetes clusters with Varnish CachingAccelerate your Kubernetes clusters with Varnish Caching
Accelerate your Kubernetes clusters with Varnish Caching
Thijs Feryn
 
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
James Anderson
 
Bits & Pixels using AI for Good.........
Bits & Pixels using AI for Good.........Bits & Pixels using AI for Good.........
Bits & Pixels using AI for Good.........
Alison B. Lowndes
 
Unsubscribed: Combat Subscription Fatigue With a Membership Mentality by Head...
Unsubscribed: Combat Subscription Fatigue With a Membership Mentality by Head...Unsubscribed: Combat Subscription Fatigue With a Membership Mentality by Head...
Unsubscribed: Combat Subscription Fatigue With a Membership Mentality by Head...
Product School
 
The Future of Platform Engineering
The Future of Platform EngineeringThe Future of Platform Engineering
The Future of Platform Engineering
Jemma Hussein Allen
 
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdfFIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance
 
De-mystifying Zero to One: Design Informed Techniques for Greenfield Innovati...
De-mystifying Zero to One: Design Informed Techniques for Greenfield Innovati...De-mystifying Zero to One: Design Informed Techniques for Greenfield Innovati...
De-mystifying Zero to One: Design Informed Techniques for Greenfield Innovati...
Product School
 
Search and Society: Reimagining Information Access for Radical Futures
Search and Society: Reimagining Information Access for Radical FuturesSearch and Society: Reimagining Information Access for Radical Futures
Search and Society: Reimagining Information Access for Radical Futures
Bhaskar Mitra
 
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdfFIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
FIDO Alliance
 
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdfFIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance
 
UiPath Test Automation using UiPath Test Suite series, part 4
UiPath Test Automation using UiPath Test Suite series, part 4UiPath Test Automation using UiPath Test Suite series, part 4
UiPath Test Automation using UiPath Test Suite series, part 4
DianaGray10
 
From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...
From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...
From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...
Product School
 
IOS-PENTESTING-BEGINNERS-PRACTICAL-GUIDE-.pptx
IOS-PENTESTING-BEGINNERS-PRACTICAL-GUIDE-.pptxIOS-PENTESTING-BEGINNERS-PRACTICAL-GUIDE-.pptx
IOS-PENTESTING-BEGINNERS-PRACTICAL-GUIDE-.pptx
Abida Shariff
 
Empowering NextGen Mobility via Large Action Model Infrastructure (LAMI): pav...
Empowering NextGen Mobility via Large Action Model Infrastructure (LAMI): pav...Empowering NextGen Mobility via Large Action Model Infrastructure (LAMI): pav...
Empowering NextGen Mobility via Large Action Model Infrastructure (LAMI): pav...
Thierry Lestable
 
When stars align: studies in data quality, knowledge graphs, and machine lear...
When stars align: studies in data quality, knowledge graphs, and machine lear...When stars align: studies in data quality, knowledge graphs, and machine lear...
When stars align: studies in data quality, knowledge graphs, and machine lear...
Elena Simperl
 
DevOps and Testing slides at DASA Connect
DevOps and Testing slides at DASA ConnectDevOps and Testing slides at DASA Connect
DevOps and Testing slides at DASA Connect
Kari Kakkonen
 
Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...
Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...
Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...
Jeffrey Haguewood
 
ODC, Data Fabric and Architecture User Group
ODC, Data Fabric and Architecture User GroupODC, Data Fabric and Architecture User Group
ODC, Data Fabric and Architecture User Group
CatarinaPereira64715
 

Recently uploaded (20)

Builder.ai Founder Sachin Dev Duggal's Strategic Approach to Create an Innova...
Builder.ai Founder Sachin Dev Duggal's Strategic Approach to Create an Innova...Builder.ai Founder Sachin Dev Duggal's Strategic Approach to Create an Innova...
Builder.ai Founder Sachin Dev Duggal's Strategic Approach to Create an Innova...
 
Assuring Contact Center Experiences for Your Customers With ThousandEyes
Assuring Contact Center Experiences for Your Customers With ThousandEyesAssuring Contact Center Experiences for Your Customers With ThousandEyes
Assuring Contact Center Experiences for Your Customers With ThousandEyes
 
Accelerate your Kubernetes clusters with Varnish Caching
Accelerate your Kubernetes clusters with Varnish CachingAccelerate your Kubernetes clusters with Varnish Caching
Accelerate your Kubernetes clusters with Varnish Caching
 
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
 
Bits & Pixels using AI for Good.........
Bits & Pixels using AI for Good.........Bits & Pixels using AI for Good.........
Bits & Pixels using AI for Good.........
 
Unsubscribed: Combat Subscription Fatigue With a Membership Mentality by Head...
Unsubscribed: Combat Subscription Fatigue With a Membership Mentality by Head...Unsubscribed: Combat Subscription Fatigue With a Membership Mentality by Head...
Unsubscribed: Combat Subscription Fatigue With a Membership Mentality by Head...
 
The Future of Platform Engineering
The Future of Platform EngineeringThe Future of Platform Engineering
The Future of Platform Engineering
 
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdfFIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
 
De-mystifying Zero to One: Design Informed Techniques for Greenfield Innovati...
De-mystifying Zero to One: Design Informed Techniques for Greenfield Innovati...De-mystifying Zero to One: Design Informed Techniques for Greenfield Innovati...
De-mystifying Zero to One: Design Informed Techniques for Greenfield Innovati...
 
Search and Society: Reimagining Information Access for Radical Futures
Search and Society: Reimagining Information Access for Radical FuturesSearch and Society: Reimagining Information Access for Radical Futures
Search and Society: Reimagining Information Access for Radical Futures
 
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdfFIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
 
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdfFIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
 
UiPath Test Automation using UiPath Test Suite series, part 4
UiPath Test Automation using UiPath Test Suite series, part 4UiPath Test Automation using UiPath Test Suite series, part 4
UiPath Test Automation using UiPath Test Suite series, part 4
 
From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...
From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...
From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...
 
IOS-PENTESTING-BEGINNERS-PRACTICAL-GUIDE-.pptx
IOS-PENTESTING-BEGINNERS-PRACTICAL-GUIDE-.pptxIOS-PENTESTING-BEGINNERS-PRACTICAL-GUIDE-.pptx
IOS-PENTESTING-BEGINNERS-PRACTICAL-GUIDE-.pptx
 
Empowering NextGen Mobility via Large Action Model Infrastructure (LAMI): pav...
Empowering NextGen Mobility via Large Action Model Infrastructure (LAMI): pav...Empowering NextGen Mobility via Large Action Model Infrastructure (LAMI): pav...
Empowering NextGen Mobility via Large Action Model Infrastructure (LAMI): pav...
 
When stars align: studies in data quality, knowledge graphs, and machine lear...
When stars align: studies in data quality, knowledge graphs, and machine lear...When stars align: studies in data quality, knowledge graphs, and machine lear...
When stars align: studies in data quality, knowledge graphs, and machine lear...
 
DevOps and Testing slides at DASA Connect
DevOps and Testing slides at DASA ConnectDevOps and Testing slides at DASA Connect
DevOps and Testing slides at DASA Connect
 
Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...
Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...
Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...
 
ODC, Data Fabric and Architecture User Group
ODC, Data Fabric and Architecture User GroupODC, Data Fabric and Architecture User Group
ODC, Data Fabric and Architecture User Group
 

Content Security Policies: Let's Break Stuff for PHPSW at Bath Digital

  • 1. @BruntyCSP: Let’s Break Stuff CONTENT SECURITY POLICIES LET’S BREAK STUFF
  • 2. @BruntyCSP: Let’s Break Stuff BECAUSE YOU ALL TOTALLY CARE ABOUT THIS, RIGHT?! ABOUT ME ▸ Senior Software Engineer at Viva IT
 (those folks in orange hoodies at some conferences & events you may have been to) ▸ @Brunty ▸ @PHPem ▸ mfyu.co.uk ▸ matt@mfyu.co.uk
  • 3. @BruntyCSP: Let’s Break Stuff BLAH BLAH… JUST GET ON WITH THE TALK THINGS I DO ▸ Dungeon master for D&D campaigns ▸ Mentor, lead & teach apprentices & junior developers ▸ Run & organise PHP East Midlands ▸ Speak at user groups and conferences ▸ Break production sites with incorrectly configured content security policies
  • 4. @BruntyCSP: Let’s Break Stuff OH GOOD, FINALLY WE’RE GETTING STARTED A TALK IN 3 PARTS ▸ XSS
 ▸ CSP
 ▸ Break stuff

  • 5. @BruntyCSP: Let’s Break Stuff THE SCARY STUFF
  • 6. @BruntyCSP: Let’s Break Stuff FIRST, SOME BACKGROUND WHAT IS CROSS-SITE-SCRIPTING (XSS)? ▸ XSS enables an attacker to inject client-side scripts into non-malicious web pages viewed by other users ▸ In 2016 there was a 61% likelihood of a browser-based vulnerability being found in a web application ▸ Of those browser based vulnerabilities, 86% were found to be XSS related ▸ That’s just over 52% of all web application vulnerabilities
 https://www.edgescan.com/assets/docs/reports/2016-edgescan-stats-report.pdf
  • 7. @BruntyCSP: Let’s Break Stuff I MEAN, IT’S JUST A JOKE VULNERABILITY, RIGHT?! WHAT CAN BE DONE WITH XSS? ▸ Put pictures of cats in web pages ▸ alert(‘💩’); ▸ Rickroll a user ▸ Twitter self-retweeting tweet
 https://www.youtube.com/watch?v=zv0kZKC6GAM ▸ Samy worm
 https://en.wikipedia.org/wiki/Samy_(computer_worm)
  • 8. @BruntyCSP: Let’s Break Stuff WELL… MAYBE IT’S NOT A JOKE VULNERABILITY WHAT CAN BE DONE WITH XSS? ▸ Make modifications to the DOM - replace a form action to point to your own script to capture credentials. ▸ Use XMLHttpRequest to send HTTP requests and load in additional resources ▸ Access HTML5 APIs - webcam, microphone, geolocation ▸ Steal cookies (and therefore steal session cookies)
  • 10. @BruntyCSP: Let’s Break Stuff IT’S REALLY NOT A JOKE VULNERABILITY WHAT CAN BE DONE WITH XSS? https://www.wired.com/2008/03/hackers-assault-epilepsy-patients-via-computer/
  • 11. @BruntyCSP: Let’s Break Stuff TYPES OF XSS ATTACK STORED XSS (AKA PERSISTENT OR TYPE I) ▸ Occurs when input is stored - generally in a server-side database, but not always ▸ This could also be within a HTML5 database, thus never being sent to the server at all ▸ who.is was a site Rickrolled by a TXT record in the DNS of a website (yes, really)
  • 12. @BruntyCSP: Let’s Break Stuff TYPES OF XSS ATTACK REFLECTED XSS (AKA NON-PERSISTENT OR TYPE II) ▸ Occurs when user input provided in the request is immediately returned - such as in an error message, search string etc ▸ Data is not stored, and in some instances, may not even reach the server (see the next type of XSS)
  • 13. @BruntyCSP: Let’s Break Stuff TYPES OF XSS ATTACK DOM-BASED XSS (AKA TYPE-0) ▸ The entire flow of the attack takes place within the browser ▸ For example, if JavaScript in the site takes input, and uses something like document.write based on that input, it can be vulnerable to a DOM-based XSS attack
  • 14. @BruntyCSP: Let’s Break Stuff TYPES OF XSS ATTACK SELF XSS ▸ Social-engineering form of XSS ▸ Requires the user to execute code in the browser ▸ Doing so via the console can’t be protected by a lot of methods ▸ Not considered a ‘true’ XSS attack due to requiring the user to execute the code
  • 16. @BruntyCSP: Let’s Break Stuff STOP THE HACKERS LET’S FIGHT BACK
  • 17. @BruntyCSP: Let’s Break Stuff HTTP RESPONSE HEADER TO HELP REDUCE XSS RISKS WHAT IS A CSP?
  • 18. @BruntyCSP: Let’s Break Stuff DECLARES WHAT RESOURCES ARE ALLOWED TO LOAD HOW DOES A CSP WORK?
  • 19. @BruntyCSP: Let’s Break Stuff BROWSER SUPPORT
  • 21. @BruntyCSP: Let’s Break Stuff CSP TO THE RESCUE! WHAT CAN WE PROTECT? ▸ default-src ▸ script-src ▸ style-src ▸ img-src ▸ form-action ▸ update-insecure-requests
  • 22. @BruntyCSP: Let’s Break Stuff FULL REFERENCE:https://content-security-policy.com
 https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
  • 23. @BruntyCSP: Let’s Break Stuff img-src * ALLOWS ANY URL EXCEPT DATA: BLOB: FILESYSTEM: SCHEMES.
  • 24. @BruntyCSP: Let’s Break Stuff object-src 'none' DON’T LOAD RESOURCES FROM ANY SOURCE
  • 25. @BruntyCSP: Let’s Break Stuff style-src ‘self' ALLOW LOADING FROM SAME SCHEME, HOST AND PORT
  • 26. @BruntyCSP: Let’s Break Stuff script-src 'unsafe-inline' ALLOWS USE OF INLINE SOURCE ELEMENTS SUCH AS STYLE ATTRIBUTE, ONCLICK, OR SCRIPT TAG BODIES
  • 27. @BruntyCSP: Let’s Break Stuff DON’T USE UNSAFE-INLINE
  • 28. @BruntyCSP: Let’s Break Stuff <script nonce="$RANDOM">...</script> script-src 'self' 'nonce-$RANDOM'
  • 29. @BruntyCSP: Let’s Break Stuff Content-Security-Policy: default-src 'none'; script-src 'self' https://*.google.com 'nonce-random123'; style-src 'self'; img-src 'self'; upgrade-insecure-requests; form- action 'self';
  • 30. @BruntyCSP: Let’s Break Stuff I BROKE PRODUCTION WITH A BAD CSP LEARN FROM MY MISTAKES
  • 31. @BruntyCSP: Let’s Break Stuff DON’T DO WHAT I DID
  • 32. @BruntyCSP: Let’s Break Stuff REPORT-URI
  • 33. @BruntyCSP: Let’s Break Stuff WHEN A POLICY FAILURE OCCURS, THE BROWSER SENDS A JSON PAYLOAD TO THAT URL
  • 34. @BruntyCSP: Let’s Break Stuff { "csp-report": { "blocked-uri": "self", "document-uri": "https://mysite.com", "line-number": 1, "original-policy": "script-src 'self'", "script-sample": "try { for(var lastpass_iter=0; lastpass...", "source-file": "https://mysite.com", "violated-directive": "script-src 'self'" } }
  • 35. @BruntyCSP: Let’s Break Stuff REPORT-URI.IO
  • 37. @BruntyCSP: Let’s Break Stuff REPORT-ONLY
  • 38. @BruntyCSP: Let’s Break Stuff Content-Security-Policy-Report-Only: [policy]; report- uri https://app.report-uri.io/r/default/csp/reportOnly;
  • 39. @BruntyCSP: Let’s Break Stuff TRIAL STUFF BEFORE ENFORCING
  • 40. @BruntyCSP: Let’s Break Stuff THERE WILL BE NOISE, LOTS OF NOISE
  • 41. @BruntyCSP: Let’s Break Stuff WAYS TO MAKE DEALING WITH A CSP EASIER TIPS ▸ Have an easy and quick way to disable the CSP in production if required ▸ Better yet, have a way to switch it from enforced to report only so you can get violations reported to help you debug ▸ Add the CSP at an application level if you need a nonce
  • 42. @BruntyCSP: Let’s Break Stuff WAYS TO REMOVE BARRIERS IN DEVELOPMENT NONCES ▸ Don’t generate multiple nonces in the same request (but do generate a new nonce on each separate request) ▸ If using a templating engine (such as twig) - add the nonce as a global so it’s available in every template by default ▸ Write a helper in your template engine to generate script tags with a nonce if it’s available
  • 43. @BruntyCSP: Let’s Break Stuff DEMO TIME! LET’S BREAK STUFF
  • 44. @BruntyCSP: Let’s Break Stuff @SCOTT_HELME HE KNOWS HIS STUFF! (THIS ISN’T ME)
  • 45. @BruntyCSP: Let’s Break Stuff HOMEWORK TIME! LINKS & FURTHER READING ▸ https://www.owasp.org/index.php/Cross-site_Scripting_(XSS) ▸ https://content-security-policy.com ▸ https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy ▸ https://report-uri.io ▸ https://scotthelme.co.uk/just-how-much-traffic-can-you-generate-using-csp/ ▸ https://www.edgescan.com/assets/docs/reports/2016-edgescan-stats-report.pdf ▸ http://theharmonyguy.com/oldsite/2011/04/21/recent-facebook-xss-attacks-show- increasing-sophistication/ ▸ https://github.com/Brunty/csp-demo
  • 46. @BruntyCSP: Let’s Break Stuff THANK YOU
  • 47. @BruntyCSP: Let’s Break Stuff QUESTIONS? JOIND.IN/TALK/9845D @BRUNTY @PHPEM MFYU.CO.UK MATT@MFYU.CO.UK