SlideShare a Scribd company logo

Content Security Policies: Let's Break Stuff @ PHP London, Sept 2017

•
•
Matt Brunt
Matt Brunt

This document contains the slides from a presentation about content security policies (CSP) and cross-site scripting (XSS) attacks. The presentation discusses what XSS is, different types of XSS attacks, and how CSP can help mitigate XSS risks. It also describes how to configure and enforce a CSP, including using report-only mode and report-uri to help debug issues. The presentation concludes with information on common CSP pitfalls and links for further reading.

Technology
1 of 47
Download to read offline
@BruntyCSP: Let’s Break Stuff CONTENT SECURITY POLICIES LET’S BREAK STUFF
@BruntyCSP: Let’s Break Stuff BECAUSE YOU ALL TOTALLY CARE ABOUT THIS, RIGHT?! ABOUT ME ▸ Senior Software Engineer at Viva IT
 (those folks in orange hoodies at some conferences & events you may have been to) ▸ @Brunty ▸ @PHPem ▸ mfyu.co.uk ▸ matt@mfyu.co.uk
@BruntyCSP: Let’s Break Stuff BLAH BLAH… JUST GET ON WITH THE TALK THINGS I DO ▸ Dungeon master for D&D campaigns ▸ Mentor, lead & teach apprentices and junior developers ▸ Run & organise PHP East Midlands ▸ Speak at user groups and conferences ▸ Break production sites with incorrectly configured content security policies
@BruntyCSP: Let’s Break Stuff OH GOOD, FINALLY WE’RE GETTING STARTED A TALK IN 3 PARTS ▸ XSS
 ▸ CSP
 ▸ Break stuff

@BruntyCSP: Let’s Break Stuff THE SCARY STUFF
@BruntyCSP: Let’s Break Stuff FIRST, SOME BACKGROUND WHAT IS CROSS-SITE-SCRIPTING (XSS)? ▸ XSS enables an attacker to inject client-side scripts into non-malicious web pages viewed by other users ▸ In 2016 there was a 61% likelihood of a browser-based vulnerability being found in a web application ▸ Of those browser based vulnerabilities, 86% were found to be XSS related ▸ That’s just over 52% of all web application vulnerabilities
 https://www.edgescan.com/assets/docs/reports/2016-edgescan-stats-report.pdf
@BruntyCSP: Let’s Break Stuff I MEAN, IT’S JUST A JOKE VULNERABILITY, RIGHT?! WHAT CAN BE DONE WITH XSS? ▸ Put pictures of cats in web pages ▸ alert(‘💩’); ▸ Rickroll a user ▸ Twitter self-retweeting tweet
 https://www.youtube.com/watch?v=zv0kZKC6GAM ▸ Samy worm
 https://en.wikipedia.org/wiki/Samy_(computer_worm)
@BruntyCSP: Let’s Break Stuff WELL… IT’S NOT A JOKE VULNERABILITY WHAT CAN BE DONE WITH XSS? ▸ Make modifications to the DOM - replace a form action to point to your own script to capture credentials. ▸ Use XMLHttpRequest to send HTTP requests and load in additional resources ▸ Access HTML5 APIs - webcam, microphone, geolocation ▸ Steal cookies (and therefore steal session cookies)
@BruntyCSP: Let’s Break Stuff
@BruntyCSP: Let’s Break Stuff IT’S REALLY NOT A JOKE VULNERABILITY WHAT CAN BE DONE WITH XSS? https://www.wired.com/2008/03/hackers-assault-epilepsy-patients-via-computer/
@BruntyCSP: Let’s Break Stuff TYPES OF XSS ATTACK STORED XSS (AKA PERSISTENT OR TYPE I) ▸ Occurs when input is stored - generally in a server-side database, but not always ▸ This could also be within a HTML5 database, thus never being sent to the server at all ▸ who.is was a site Rickrolled by a TXT record in the DNS of a website (yes, really)
@BruntyCSP: Let’s Break Stuff TYPES OF XSS ATTACK REFLECTED XSS (AKA NON-PERSISTENT OR TYPE II) ▸ Occurs when user input provided in the request is immediately returned - such as in an error message, search string etc ▸ Data is not stored, and in some instances, may not even reach the server (see the next type of XSS)
@BruntyCSP: Let’s Break Stuff TYPES OF XSS ATTACK DOM-BASED XSS (AKA TYPE-0) ▸ The entire flow of the attack takes place within the browser ▸ For example, if JavaScript in the site takes input, and uses something like document.write based on that input, it can be vulnerable to a DOM-based XSS attack
@BruntyCSP: Let’s Break Stuff TYPES OF XSS ATTACK SELF XSS ▸ Social-engineering form of XSS ▸ Requires the user to execute code in the browser ▸ Doing so via the console can’t be protected by a lot of methods ▸ Not considered a ‘true’ XSS attack due to requiring the user to execute the code
@BruntyCSP: Let’s Break Stuff
@BruntyCSP: Let’s Break Stuff STOP THE HACKERS LET’S FIGHT BACK
@BruntyCSP: Let’s Break Stuff HTTP RESPONSE HEADER TO HELP REDUCE XSS RISKS WHAT IS A CSP?
@BruntyCSP: Let’s Break Stuff DECLARES WHAT RESOURCES ARE ALLOWED TO LOAD HOW DOES A CSP WORK?
@BruntyCSP: Let’s Break Stuff BROWSER SUPPORT
@BruntyCSP: Let’s Break Stuff
@BruntyCSP: Let’s Break Stuff CSP TO THE RESCUE! WHAT CAN WE PROTECT? ▸ default-src ▸ script-src ▸ style-src ▸ img-src ▸ form-action ▸ update-insecure-requests
@BruntyCSP: Let’s Break Stuff FULL REFERENCE:https://content-security-policy.com
 https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
@BruntyCSP: Let’s Break Stuff img-src * ALLOWS ANY URL EXCEPT DATA: BLOB: FILESYSTEM: SCHEMES.
@BruntyCSP: Let’s Break Stuff object-src 'none' DON’T LOAD RESOURCES FROM ANY SOURCE
@BruntyCSP: Let’s Break Stuff style-src ‘self' ALLOW LOADING FROM SAME SCHEME, HOST AND PORT
@BruntyCSP: Let’s Break Stuff script-src 'unsafe-inline' ALLOWS USE OF INLINE SOURCE ELEMENTS SUCH AS STYLE ATTRIBUTE, ONCLICK, OR SCRIPT TAG BODIES
@BruntyCSP: Let’s Break Stuff DON’T USE UNSAFE-INLINE
@BruntyCSP: Let’s Break Stuff <script nonce="$RANDOM">...</script> script-src 'self' 'nonce-$RANDOM'
@BruntyCSP: Let’s Break Stuff Content-Security-Policy: default-src 'none'; script-src 'self' https://*.google.com 'nonce-random123'; style-src 'self'; img-src 'self'; upgrade-insecure-requests; form- action 'self';
@BruntyCSP: Let’s Break Stuff I BROKE PRODUCTION WITH A BAD CSP LEARN FROM MY MISTAKES
@BruntyCSP: Let’s Break Stuff DON’T DO WHAT I DID
@BruntyCSP: Let’s Break Stuff REPORT-URI
@BruntyCSP: Let’s Break Stuff WHEN A POLICY FAILURE OCCURS, THE BROWSER SENDS A JSON PAYLOAD TO THAT URL
@BruntyCSP: Let’s Break Stuff { "csp-report": { "blocked-uri": "self", "document-uri": "https://mysite.com", "line-number": 1, "original-policy": "script-src 'self'", "script-sample": "try { for(var lastpass_iter=0; lastpass...", "source-file": "https://mysite.com", "violated-directive": "script-src 'self'" } }
@BruntyCSP: Let’s Break Stuff REPORT-URI.IO
@BruntyCSP: Let’s Break Stuff
@BruntyCSP: Let’s Break Stuff REPORT-ONLY
@BruntyCSP: Let’s Break Stuff Content-Security-Policy-Report-Only: [policy]; report- uri https://app.report-uri.io/r/default/csp/reportOnly;
@BruntyCSP: Let’s Break Stuff TRIAL STUFF BEFORE ENFORCING
@BruntyCSP: Let’s Break Stuff THERE WILL BE NOISE, LOTS OF NOISE
@BruntyCSP: Let’s Break Stuff WAYS TO MAKE DEALING WITH A CSP EASIER TIPS ▸ Have an easy and quick way to disable the CSP in production if required ▸ Better yet, have a way to switch it from enforced to report only so you can get violations reported to help you debug ▸ Add the CSP at an application level if you need a nonce
@BruntyCSP: Let’s Break Stuff WAYS TO REMOVE BARRIERS IN DEVELOPMENT NONCES ▸ Don’t generate multiple nonces in the same request (but do generate a new nonce on each separate request) ▸ If using a templating engine (such as twig) - add the nonce as a global so it’s available in every template by default ▸ Write a helper to generate tags with a nonce if it’s available
@BruntyCSP: Let’s Break Stuff DEMO TIME! LET’S BREAK STUFF
@BruntyCSP: Let’s Break Stuff @SCOTT_HELME (HE KNOWS HIS STUFF!) (THIS ISN’T ME)
@BruntyCSP: Let’s Break Stuff HOMEWORK TIME! LINKS & FURTHER READING ▸ https://www.owasp.org/index.php/Cross-site_Scripting_(XSS) ▸ https://content-security-policy.com ▸ https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy ▸ https://report-uri.io ▸ https://scotthelme.co.uk/just-how-much-traffic-can-you-generate-using-csp/ ▸ https://www.edgescan.com/assets/docs/reports/2016-edgescan-stats-report.pdf ▸ http://theharmonyguy.com/oldsite/2011/04/21/recent-facebook-xss-attacks-show- increasing-sophistication/ ▸ https://github.com/Brunty/csp-demo
@BruntyCSP: Let’s Break Stuff THANK YOU
@BruntyCSP: Let’s Break Stuff QUESTIONS? @BRUNTY @PHPEM MFYU.CO.UK MATT@MFYU.CO.UK

Recommended

Content Security Policies: Let's Break Stuff for PHPSW at Bath Digital
Content Security Policies: Let's Break Stuff for PHPSW at Bath DigitalContent Security Policies: Let's Break Stuff for PHPSW at Bath Digital
Content Security Policies: Let's Break Stuff for PHPSW at Bath Digital
Matt Brunt
 
Content Security Policies: Let's Break Stuff @ Scotland PHP
Content Security Policies: Let's Break Stuff @ Scotland PHPContent Security Policies: Let's Break Stuff @ Scotland PHP
Content Security Policies: Let's Break Stuff @ Scotland PHP
Matt Brunt
 
Content Security Policies: Let's Break Stuff for WordCamp London
Content Security Policies: Let's Break Stuff for WordCamp LondonContent Security Policies: Let's Break Stuff for WordCamp London
Content Security Policies: Let's Break Stuff for WordCamp London
Matt Brunt
 
CSPs: Let's Break Stuff for PHP Benelux
CSPs: Let's Break Stuff for PHP BeneluxCSPs: Let's Break Stuff for PHP Benelux
CSPs: Let's Break Stuff for PHP Benelux
Matt Brunt
 
Content Security Policies: Let's Break Stuff @ PHP South Coast 2017
Content Security Policies: Let's Break Stuff @ PHP South Coast 2017Content Security Policies: Let's Break Stuff @ PHP South Coast 2017
Content Security Policies: Let's Break Stuff @ PHP South Coast 2017
Matt Brunt
 
Content Security Policies: Let's Break Stuff
Content Security Policies: Let's Break StuffContent Security Policies: Let's Break Stuff
Content Security Policies: Let's Break Stuff
Matt Brunt
 
Are Today's Good Practices… Tomorrow's Performance Anti-Patterns
Are Today's Good Practices… Tomorrow's Performance Anti-PatternsAre Today's Good Practices… Tomorrow's Performance Anti-Patterns
Are Today's Good Practices… Tomorrow's Performance Anti-Patterns
Andy Davies
 
Are Today’s Good Practices... Tomorrow’s Performance Anti-Patterns?
Are Today’s Good Practices... Tomorrow’s Performance Anti-Patterns?Are Today’s Good Practices... Tomorrow’s Performance Anti-Patterns?
Are Today’s Good Practices... Tomorrow’s Performance Anti-Patterns?
Andy Davies
 

Recommended

Content Security Policies: Let's Break Stuff for PHPSW at Bath Digital
Content Security Policies: Let's Break Stuff for PHPSW at Bath DigitalContent Security Policies: Let's Break Stuff for PHPSW at Bath Digital
Content Security Policies: Let's Break Stuff for PHPSW at Bath Digital
Matt Brunt
 
Content Security Policies: Let's Break Stuff @ Scotland PHP
Content Security Policies: Let's Break Stuff @ Scotland PHPContent Security Policies: Let's Break Stuff @ Scotland PHP
Content Security Policies: Let's Break Stuff @ Scotland PHP
Matt Brunt
 
Content Security Policies: Let's Break Stuff for WordCamp London
Content Security Policies: Let's Break Stuff for WordCamp LondonContent Security Policies: Let's Break Stuff for WordCamp London
Content Security Policies: Let's Break Stuff for WordCamp London
Matt Brunt
 
CSPs: Let's Break Stuff for PHP Benelux
CSPs: Let's Break Stuff for PHP BeneluxCSPs: Let's Break Stuff for PHP Benelux
CSPs: Let's Break Stuff for PHP Benelux
Matt Brunt
 
Content Security Policies: Let's Break Stuff @ PHP South Coast 2017
Content Security Policies: Let's Break Stuff @ PHP South Coast 2017Content Security Policies: Let's Break Stuff @ PHP South Coast 2017
Content Security Policies: Let's Break Stuff @ PHP South Coast 2017
Matt Brunt
 
Content Security Policies: Let's Break Stuff
Content Security Policies: Let's Break StuffContent Security Policies: Let's Break Stuff
Content Security Policies: Let's Break Stuff
Matt Brunt
 
Are Today's Good Practices… Tomorrow's Performance Anti-Patterns
Are Today's Good Practices… Tomorrow's Performance Anti-PatternsAre Today's Good Practices… Tomorrow's Performance Anti-Patterns
Are Today's Good Practices… Tomorrow's Performance Anti-Patterns
Andy Davies
 
Are Today’s Good Practices... Tomorrow’s Performance Anti-Patterns?
Are Today’s Good Practices... Tomorrow’s Performance Anti-Patterns?Are Today’s Good Practices... Tomorrow’s Performance Anti-Patterns?
Are Today’s Good Practices... Tomorrow’s Performance Anti-Patterns?
Andy Davies
 
Faster Frontends
Faster FrontendsFaster Frontends
Faster Frontends
Andy Davies
 
Csp vortrag
Csp vortragCsp vortrag
Csp vortrag
András Ottó
 
Everything is Awful (And You're Not Helping)
Everything is Awful (And You're Not Helping)Everything is Awful (And You're Not Helping)
Everything is Awful (And You're Not Helping)
Jan Schaumann
 
Go Faster, Webmasters
Go Faster, WebmastersGo Faster, Webmasters
Go Faster, Webmasters
Mike Bailey
 
WordPress Security Begins With Good Posture
WordPress Security Begins With Good PostureWordPress Security Begins With Good Posture
WordPress Security Begins With Good PostureTony Perez
 
[CB19] Shattering the dark: uncovering vulnerabilities of the dark web by Tak...
[CB19] Shattering the dark: uncovering vulnerabilities of the dark web by Tak...[CB19] Shattering the dark: uncovering vulnerabilities of the dark web by Tak...
[CB19] Shattering the dark: uncovering vulnerabilities of the dark web by Tak...
CODE BLUE
 
Crazy Like A Fox - #Infosec Ideas That Just Might Work
Crazy Like A Fox - #Infosec Ideas That Just Might WorkCrazy Like A Fox - #Infosec Ideas That Just Might Work
Crazy Like A Fox - #Infosec Ideas That Just Might Work
Jan Schaumann
 
Cabeçalhos de Segurança HTTP
Cabeçalhos de Segurança HTTPCabeçalhos de Segurança HTTP
Cabeçalhos de Segurança HTTP
Ismael Goncalves
 
Owasp for dummies handouts
Owasp for dummies handoutsOwasp for dummies handouts
Owasp for dummies handoutsBCC
 
It's the people, stupid.
It's the people, stupid.It's the people, stupid.
It's the people, stupid.
Jan Schaumann
 
Tsc summit #2 - HTTP Header Security
Tsc summit #2 - HTTP Header SecurityTsc summit #2 - HTTP Header Security
Tsc summit #2 - HTTP Header Security
Mikal Villa
 
Protecting Web App users in today’s hostile environment
Protecting Web App users in today’s hostile environmentProtecting Web App users in today’s hostile environment
Protecting Web App users in today’s hostile environment
ajitdhumale
 
DrupalCamp London 2017 - Web site insecurity
DrupalCamp London 2017 - Web site insecurity DrupalCamp London 2017 - Web site insecurity
DrupalCamp London 2017 - Web site insecurity
George Boobyer
 
Happy Browser, Happy User! WordSesh 2019
Happy Browser, Happy User! WordSesh 2019Happy Browser, Happy User! WordSesh 2019
Happy Browser, Happy User! WordSesh 2019
Katie Sylor-Miller
 
Rails security: above and beyond the defaults
Rails security: above and beyond the defaultsRails security: above and beyond the defaults
Rails security: above and beyond the defaults
Matias Korhonen
 
Smart mobile storytelling christy robinson - denver news train - april 11-1...
Smart mobile storytelling christy robinson - denver news train - april 11-1...Smart mobile storytelling christy robinson - denver news train - april 11-1...
Smart mobile storytelling christy robinson - denver news train - april 11-1...
News Leaders Association's NewsTrain
 
Beyond Mirai: The new age of MDDoS attacks
Beyond Mirai: The new age of MDDoS attacksBeyond Mirai: The new age of MDDoS attacks
Beyond Mirai: The new age of MDDoS attacks
APNIC
 
Building Better Responsive Websites
Building Better Responsive WebsitesBuilding Better Responsive Websites
Building Better Responsive Websites
Holger Bartel
 
NKU Cybersecurity Symposium: Active Defense - Helping threat actors hack them...
NKU Cybersecurity Symposium: Active Defense - Helping threat actors hack them...NKU Cybersecurity Symposium: Active Defense - Helping threat actors hack them...
NKU Cybersecurity Symposium: Active Defense - Helping threat actors hack them...
ThreatReel Podcast
 
BSides Cleveland: Active Defense - Helping threat actors hack themselves!
BSides Cleveland: Active Defense - Helping threat actors hack themselves!BSides Cleveland: Active Defense - Helping threat actors hack themselves!
BSides Cleveland: Active Defense - Helping threat actors hack themselves!
ThreatReel Podcast
 
Browser Wars 2019 - Implementing a Content Security Policy
Browser Wars 2019 - Implementing a Content Security PolicyBrowser Wars 2019 - Implementing a Content Security Policy
Browser Wars 2019 - Implementing a Content Security Policy
George Boobyer
 
Juraj vysvader - Python developer's CV
Juraj vysvader - Python developer's CVJuraj vysvader - Python developer's CV
Juraj vysvader - Python developer's CV
Juraj Vysvader
 

More Related Content

What's hot

Faster Frontends
Faster FrontendsFaster Frontends
Faster Frontends
Andy Davies
 
Csp vortrag
Csp vortragCsp vortrag
Csp vortrag
András Ottó
 
Everything is Awful (And You're Not Helping)
Everything is Awful (And You're Not Helping)Everything is Awful (And You're Not Helping)
Everything is Awful (And You're Not Helping)
Jan Schaumann
 
Go Faster, Webmasters
Go Faster, WebmastersGo Faster, Webmasters
Go Faster, Webmasters
Mike Bailey
 
WordPress Security Begins With Good Posture
WordPress Security Begins With Good PostureWordPress Security Begins With Good Posture
WordPress Security Begins With Good PostureTony Perez
 
[CB19] Shattering the dark: uncovering vulnerabilities of the dark web by Tak...
[CB19] Shattering the dark: uncovering vulnerabilities of the dark web by Tak...[CB19] Shattering the dark: uncovering vulnerabilities of the dark web by Tak...
[CB19] Shattering the dark: uncovering vulnerabilities of the dark web by Tak...
CODE BLUE
 
Crazy Like A Fox - #Infosec Ideas That Just Might Work
Crazy Like A Fox - #Infosec Ideas That Just Might WorkCrazy Like A Fox - #Infosec Ideas That Just Might Work
Crazy Like A Fox - #Infosec Ideas That Just Might Work
Jan Schaumann
 
Cabeçalhos de Segurança HTTP
Cabeçalhos de Segurança HTTPCabeçalhos de Segurança HTTP
Cabeçalhos de Segurança HTTP
Ismael Goncalves
 
Owasp for dummies handouts
Owasp for dummies handoutsOwasp for dummies handouts
Owasp for dummies handoutsBCC
 
It's the people, stupid.
It's the people, stupid.It's the people, stupid.
It's the people, stupid.
Jan Schaumann
 

What's hot (10)

Faster Frontends
Faster FrontendsFaster Frontends
Faster Frontends
 
Csp vortrag
Csp vortragCsp vortrag
Csp vortrag
 
Everything is Awful (And You're Not Helping)
Everything is Awful (And You're Not Helping)Everything is Awful (And You're Not Helping)
Everything is Awful (And You're Not Helping)
 
Go Faster, Webmasters
Go Faster, WebmastersGo Faster, Webmasters
Go Faster, Webmasters
 
WordPress Security Begins With Good Posture
WordPress Security Begins With Good PostureWordPress Security Begins With Good Posture
WordPress Security Begins With Good Posture
 
[CB19] Shattering the dark: uncovering vulnerabilities of the dark web by Tak...
[CB19] Shattering the dark: uncovering vulnerabilities of the dark web by Tak...[CB19] Shattering the dark: uncovering vulnerabilities of the dark web by Tak...
[CB19] Shattering the dark: uncovering vulnerabilities of the dark web by Tak...
 
Crazy Like A Fox - #Infosec Ideas That Just Might Work
Crazy Like A Fox - #Infosec Ideas That Just Might WorkCrazy Like A Fox - #Infosec Ideas That Just Might Work
Crazy Like A Fox - #Infosec Ideas That Just Might Work
 
Cabeçalhos de Segurança HTTP
Cabeçalhos de Segurança HTTPCabeçalhos de Segurança HTTP
Cabeçalhos de Segurança HTTP
 
Owasp for dummies handouts
Owasp for dummies handoutsOwasp for dummies handouts
Owasp for dummies handouts
 
It's the people, stupid.
It's the people, stupid.It's the people, stupid.
It's the people, stupid.
 

Similar to Content Security Policies: Let's Break Stuff @ PHP London, Sept 2017

Tsc summit #2 - HTTP Header Security
Tsc summit #2 - HTTP Header SecurityTsc summit #2 - HTTP Header Security
Tsc summit #2 - HTTP Header Security
Mikal Villa
 
Protecting Web App users in today’s hostile environment
Protecting Web App users in today’s hostile environmentProtecting Web App users in today’s hostile environment
Protecting Web App users in today’s hostile environment
ajitdhumale
 
DrupalCamp London 2017 - Web site insecurity
DrupalCamp London 2017 - Web site insecurity DrupalCamp London 2017 - Web site insecurity
DrupalCamp London 2017 - Web site insecurity
George Boobyer
 
Happy Browser, Happy User! WordSesh 2019
Happy Browser, Happy User! WordSesh 2019Happy Browser, Happy User! WordSesh 2019
Happy Browser, Happy User! WordSesh 2019
Katie Sylor-Miller
 
Rails security: above and beyond the defaults
Rails security: above and beyond the defaultsRails security: above and beyond the defaults
Rails security: above and beyond the defaults
Matias Korhonen
 
Smart mobile storytelling christy robinson - denver news train - april 11-1...
Smart mobile storytelling christy robinson - denver news train - april 11-1...Smart mobile storytelling christy robinson - denver news train - april 11-1...
Smart mobile storytelling christy robinson - denver news train - april 11-1...
News Leaders Association's NewsTrain
 
Beyond Mirai: The new age of MDDoS attacks
Beyond Mirai: The new age of MDDoS attacksBeyond Mirai: The new age of MDDoS attacks
Beyond Mirai: The new age of MDDoS attacks
APNIC
 
Building Better Responsive Websites
Building Better Responsive WebsitesBuilding Better Responsive Websites
Building Better Responsive Websites
Holger Bartel
 
NKU Cybersecurity Symposium: Active Defense - Helping threat actors hack them...
NKU Cybersecurity Symposium: Active Defense - Helping threat actors hack them...NKU Cybersecurity Symposium: Active Defense - Helping threat actors hack them...
NKU Cybersecurity Symposium: Active Defense - Helping threat actors hack them...
ThreatReel Podcast
 
BSides Cleveland: Active Defense - Helping threat actors hack themselves!
BSides Cleveland: Active Defense - Helping threat actors hack themselves!BSides Cleveland: Active Defense - Helping threat actors hack themselves!
BSides Cleveland: Active Defense - Helping threat actors hack themselves!
ThreatReel Podcast
 
Browser Wars 2019 - Implementing a Content Security Policy
Browser Wars 2019 - Implementing a Content Security PolicyBrowser Wars 2019 - Implementing a Content Security Policy
Browser Wars 2019 - Implementing a Content Security Policy
George Boobyer
 
Juraj vysvader - Python developer's CV
Juraj vysvader - Python developer's CVJuraj vysvader - Python developer's CV
Juraj vysvader - Python developer's CV
Juraj Vysvader
 
How Chunky Do You Need To Be?: Adaptive Content Strategies For The Real World
How Chunky Do You Need To Be?: Adaptive Content Strategies For The Real WorldHow Chunky Do You Need To Be?: Adaptive Content Strategies For The Real World
How Chunky Do You Need To Be?: Adaptive Content Strategies For The Real World
Christopher Grant Ward
 
OISF Aniversary: Active Defense - Helping threat actors hack themselves!
OISF Aniversary: Active Defense - Helping threat actors hack themselves!OISF Aniversary: Active Defense - Helping threat actors hack themselves!
OISF Aniversary: Active Defense - Helping threat actors hack themselves!
ThreatReel Podcast
 
Better Safe Than Sorry with HTTPS - SMX East 2016 - Patrick Stox
Better Safe Than Sorry with HTTPS - SMX East 2016 - Patrick StoxBetter Safe Than Sorry with HTTPS - SMX East 2016 - Patrick Stox
Better Safe Than Sorry with HTTPS - SMX East 2016 - Patrick Stox
patrickstox
 
W3 conf hill-html5-security-realities
W3 conf hill-html5-security-realitiesW3 conf hill-html5-security-realities
W3 conf hill-html5-security-realities
Brad Hill
 
Security and Privacy on the Web in 2015
Security and Privacy on the Web in 2015Security and Privacy on the Web in 2015
Security and Privacy on the Web in 2015
Francois Marier
 
CollabSphere SC 103 : Domino on the Web : Yes, It's (Probably) Hackable
CollabSphere SC 103 : Domino on the Web : Yes, It's (Probably) HackableCollabSphere SC 103 : Domino on the Web : Yes, It's (Probably) Hackable
CollabSphere SC 103 : Domino on the Web : Yes, It's (Probably) Hackable
Darren Duke
 
CONFidence 2018: XSS is dead. We just don't get it (Mario Heiderich)
CONFidence 2018: XSS is dead. We just don't get it (Mario Heiderich)CONFidence 2018: XSS is dead. We just don't get it (Mario Heiderich)
CONFidence 2018: XSS is dead. We just don't get it (Mario Heiderich)
PROIDEA
 
Xss is more than a simple threat
Xss is more than a simple threatXss is more than a simple threat
Xss is more than a simple threat
Avădănei Andrei
 

Similar to Content Security Policies: Let's Break Stuff @ PHP London, Sept 2017 (20)

Tsc summit #2 - HTTP Header Security
Tsc summit #2 - HTTP Header SecurityTsc summit #2 - HTTP Header Security
Tsc summit #2 - HTTP Header Security
 
Protecting Web App users in today’s hostile environment
Protecting Web App users in today’s hostile environmentProtecting Web App users in today’s hostile environment
Protecting Web App users in today’s hostile environment
 
DrupalCamp London 2017 - Web site insecurity
DrupalCamp London 2017 - Web site insecurity DrupalCamp London 2017 - Web site insecurity
DrupalCamp London 2017 - Web site insecurity
 
Happy Browser, Happy User! WordSesh 2019
Happy Browser, Happy User! WordSesh 2019Happy Browser, Happy User! WordSesh 2019
Happy Browser, Happy User! WordSesh 2019
 
Rails security: above and beyond the defaults
Rails security: above and beyond the defaultsRails security: above and beyond the defaults
Rails security: above and beyond the defaults
 
Smart mobile storytelling christy robinson - denver news train - april 11-1...
Smart mobile storytelling christy robinson - denver news train - april 11-1...Smart mobile storytelling christy robinson - denver news train - april 11-1...
Smart mobile storytelling christy robinson - denver news train - april 11-1...
 
Beyond Mirai: The new age of MDDoS attacks
Beyond Mirai: The new age of MDDoS attacksBeyond Mirai: The new age of MDDoS attacks
Beyond Mirai: The new age of MDDoS attacks
 
Building Better Responsive Websites
Building Better Responsive WebsitesBuilding Better Responsive Websites
Building Better Responsive Websites
 
NKU Cybersecurity Symposium: Active Defense - Helping threat actors hack them...
NKU Cybersecurity Symposium: Active Defense - Helping threat actors hack them...NKU Cybersecurity Symposium: Active Defense - Helping threat actors hack them...
NKU Cybersecurity Symposium: Active Defense - Helping threat actors hack them...
 
BSides Cleveland: Active Defense - Helping threat actors hack themselves!
BSides Cleveland: Active Defense - Helping threat actors hack themselves!BSides Cleveland: Active Defense - Helping threat actors hack themselves!
BSides Cleveland: Active Defense - Helping threat actors hack themselves!
 
Browser Wars 2019 - Implementing a Content Security Policy
Browser Wars 2019 - Implementing a Content Security PolicyBrowser Wars 2019 - Implementing a Content Security Policy
Browser Wars 2019 - Implementing a Content Security Policy
 
Juraj vysvader - Python developer's CV
Juraj vysvader - Python developer's CVJuraj vysvader - Python developer's CV
Juraj vysvader - Python developer's CV
 
How Chunky Do You Need To Be?: Adaptive Content Strategies For The Real World
How Chunky Do You Need To Be?: Adaptive Content Strategies For The Real WorldHow Chunky Do You Need To Be?: Adaptive Content Strategies For The Real World
How Chunky Do You Need To Be?: Adaptive Content Strategies For The Real World
 
OISF Aniversary: Active Defense - Helping threat actors hack themselves!
OISF Aniversary: Active Defense - Helping threat actors hack themselves!OISF Aniversary: Active Defense - Helping threat actors hack themselves!
OISF Aniversary: Active Defense - Helping threat actors hack themselves!
 
Better Safe Than Sorry with HTTPS - SMX East 2016 - Patrick Stox
Better Safe Than Sorry with HTTPS - SMX East 2016 - Patrick StoxBetter Safe Than Sorry with HTTPS - SMX East 2016 - Patrick Stox
Better Safe Than Sorry with HTTPS - SMX East 2016 - Patrick Stox
 
W3 conf hill-html5-security-realities
W3 conf hill-html5-security-realitiesW3 conf hill-html5-security-realities
W3 conf hill-html5-security-realities
 
Security and Privacy on the Web in 2015
Security and Privacy on the Web in 2015Security and Privacy on the Web in 2015
Security and Privacy on the Web in 2015
 
CollabSphere SC 103 : Domino on the Web : Yes, It's (Probably) Hackable
CollabSphere SC 103 : Domino on the Web : Yes, It's (Probably) HackableCollabSphere SC 103 : Domino on the Web : Yes, It's (Probably) Hackable
CollabSphere SC 103 : Domino on the Web : Yes, It's (Probably) Hackable
 
CONFidence 2018: XSS is dead. We just don't get it (Mario Heiderich)
CONFidence 2018: XSS is dead. We just don't get it (Mario Heiderich)CONFidence 2018: XSS is dead. We just don't get it (Mario Heiderich)
CONFidence 2018: XSS is dead. We just don't get it (Mario Heiderich)
 
Xss is more than a simple threat
Xss is more than a simple threatXss is more than a simple threat
Xss is more than a simple threat
 

More from Matt Brunt

BDD & Behat for PHPUK
BDD & Behat for PHPUKBDD & Behat for PHPUK
BDD & Behat for PHPUK
Matt Brunt
 
BDD & Behat for PHPNE
BDD & Behat for PHPNEBDD & Behat for PHPNE
BDD & Behat for PHPNE
Matt Brunt
 
BDD & Behat for Glasgow PHP
BDD & Behat for Glasgow PHPBDD & Behat for Glasgow PHP
BDD & Behat for Glasgow PHP
Matt Brunt
 
BDD & Behat
BDD & BehatBDD & Behat
BDD & Behat
Matt Brunt
 
BDD & Behat for Srijan Technologies
BDD & Behat for Srijan TechnologiesBDD & Behat for Srijan Technologies
BDD & Behat for Srijan Technologies
Matt Brunt
 
CSP - What? Why? How? PHPNW16
CSP - What? Why? How? PHPNW16CSP - What? Why? How? PHPNW16
CSP - What? Why? How? PHPNW16
Matt Brunt
 
PHPNW16 Matt Brunt - BDD & Behat
PHPNW16 Matt Brunt - BDD & BehatPHPNW16 Matt Brunt - BDD & Behat
PHPNW16 Matt Brunt - BDD & Behat
Matt Brunt
 
BDD - telling stories through code for PHPem
BDD - telling stories through code for PHPemBDD - telling stories through code for PHPem
BDD - telling stories through code for PHPem
Matt Brunt
 
BDD: Telling stories through code [For TechNotts]
BDD: Telling stories through code [For TechNotts]BDD: Telling stories through code [For TechNotts]
BDD: Telling stories through code [For TechNotts]
Matt Brunt
 

More from Matt Brunt (10)

BDD & Behat for PHPUK
BDD & Behat for PHPUKBDD & Behat for PHPUK
BDD & Behat for PHPUK
 
BDD & Behat for PHPNE
BDD & Behat for PHPNEBDD & Behat for PHPNE
BDD & Behat for PHPNE
 
BDD & Behat for Glasgow PHP
BDD & Behat for Glasgow PHPBDD & Behat for Glasgow PHP
BDD & Behat for Glasgow PHP
 
BDD & Behat
BDD & BehatBDD & Behat
BDD & Behat
 
BDD & Behat for Srijan Technologies
BDD & Behat for Srijan TechnologiesBDD & Behat for Srijan Technologies
BDD & Behat for Srijan Technologies
 
CSP - What? Why? How? PHPNW16
CSP - What? Why? How? PHPNW16CSP - What? Why? How? PHPNW16
CSP - What? Why? How? PHPNW16
 
PHPNW16 Matt Brunt - BDD & Behat
PHPNW16 Matt Brunt - BDD & BehatPHPNW16 Matt Brunt - BDD & Behat
PHPNW16 Matt Brunt - BDD & Behat
 
BDD - telling stories through code for PHPem
BDD - telling stories through code for PHPemBDD - telling stories through code for PHPem
BDD - telling stories through code for PHPem
 
BDD: Telling stories through code [For TechNotts]
BDD: Telling stories through code [For TechNotts]BDD: Telling stories through code [For TechNotts]
BDD: Telling stories through code [For TechNotts]
 
Intro to Gulp
Intro to GulpIntro to Gulp
Intro to Gulp
 

Recently uploaded

Key Trends Shaping the Future of Infrastructure.pdf
Key Trends Shaping the Future of Infrastructure.pdfKey Trends Shaping the Future of Infrastructure.pdf
Key Trends Shaping the Future of Infrastructure.pdf
Cheryl Hung
 
IOS-PENTESTING-BEGINNERS-PRACTICAL-GUIDE-.pptx
IOS-PENTESTING-BEGINNERS-PRACTICAL-GUIDE-.pptxIOS-PENTESTING-BEGINNERS-PRACTICAL-GUIDE-.pptx
IOS-PENTESTING-BEGINNERS-PRACTICAL-GUIDE-.pptx
Abida Shariff
 
Essentials of Automations: Optimizing FME Workflows with Parameters
Essentials of Automations: Optimizing FME Workflows with ParametersEssentials of Automations: Optimizing FME Workflows with Parameters
Essentials of Automations: Optimizing FME Workflows with Parameters
Safe Software
 
"Impact of front-end architecture on development cost", Viktor Turskyi
"Impact of front-end architecture on development cost", Viktor Turskyi"Impact of front-end architecture on development cost", Viktor Turskyi
"Impact of front-end architecture on development cost", Viktor Turskyi
Fwdays
 
GraphRAG is All You need? LLM & Knowledge Graph
GraphRAG is All You need? LLM & Knowledge GraphGraphRAG is All You need? LLM & Knowledge Graph
GraphRAG is All You need? LLM & Knowledge Graph
Guy Korland
 
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
DanBrown980551
 
The Art of the Pitch: WordPress Relationships and Sales
The Art of the Pitch: WordPress Relationships and SalesThe Art of the Pitch: WordPress Relationships and Sales
The Art of the Pitch: WordPress Relationships and Sales
Laura Byrne
 
Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...
Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...
Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...
UiPathCommunity
 
State of ICS and IoT Cyber Threat Landscape Report 2024 preview
State of ICS and IoT Cyber Threat Landscape Report 2024 previewState of ICS and IoT Cyber Threat Landscape Report 2024 preview
State of ICS and IoT Cyber Threat Landscape Report 2024 preview
Prayukth K V
 
UiPath Test Automation using UiPath Test Suite series, part 3
UiPath Test Automation using UiPath Test Suite series, part 3UiPath Test Automation using UiPath Test Suite series, part 3
UiPath Test Automation using UiPath Test Suite series, part 3
DianaGray10
 
DevOps and Testing slides at DASA Connect
DevOps and Testing slides at DASA ConnectDevOps and Testing slides at DASA Connect
DevOps and Testing slides at DASA Connect
Kari Kakkonen
 
Connector Corner: Automate dynamic content and events by pushing a button
Connector Corner: Automate dynamic content and events by pushing a buttonConnector Corner: Automate dynamic content and events by pushing a button
Connector Corner: Automate dynamic content and events by pushing a button
DianaGray10
 
Smart TV Buyer Insights Survey 2024 by 91mobiles.pdf
Smart TV Buyer Insights Survey 2024 by 91mobiles.pdfSmart TV Buyer Insights Survey 2024 by 91mobiles.pdf
Smart TV Buyer Insights Survey 2024 by 91mobiles.pdf
91mobiles
 
Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024
Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024
Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024
Tobias Schneck
 
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdfFIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance
 
UiPath Test Automation using UiPath Test Suite series, part 4
UiPath Test Automation using UiPath Test Suite series, part 4UiPath Test Automation using UiPath Test Suite series, part 4
UiPath Test Automation using UiPath Test Suite series, part 4
DianaGray10
 
De-mystifying Zero to One: Design Informed Techniques for Greenfield Innovati...
De-mystifying Zero to One: Design Informed Techniques for Greenfield Innovati...De-mystifying Zero to One: Design Informed Techniques for Greenfield Innovati...
De-mystifying Zero to One: Design Informed Techniques for Greenfield Innovati...
Product School
 
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdfFIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance
 
Mission to Decommission: Importance of Decommissioning Products to Increase E...
Mission to Decommission: Importance of Decommissioning Products to Increase E...Mission to Decommission: Importance of Decommissioning Products to Increase E...
Mission to Decommission: Importance of Decommissioning Products to Increase E...
Product School
 
JMeter webinar - integration with InfluxDB and Grafana
JMeter webinar - integration with InfluxDB and GrafanaJMeter webinar - integration with InfluxDB and Grafana
JMeter webinar - integration with InfluxDB and Grafana
RTTS
 

Recently uploaded (20)

Key Trends Shaping the Future of Infrastructure.pdf
Key Trends Shaping the Future of Infrastructure.pdfKey Trends Shaping the Future of Infrastructure.pdf
Key Trends Shaping the Future of Infrastructure.pdf
 
IOS-PENTESTING-BEGINNERS-PRACTICAL-GUIDE-.pptx
IOS-PENTESTING-BEGINNERS-PRACTICAL-GUIDE-.pptxIOS-PENTESTING-BEGINNERS-PRACTICAL-GUIDE-.pptx
IOS-PENTESTING-BEGINNERS-PRACTICAL-GUIDE-.pptx
 
Essentials of Automations: Optimizing FME Workflows with Parameters
Essentials of Automations: Optimizing FME Workflows with ParametersEssentials of Automations: Optimizing FME Workflows with Parameters
Essentials of Automations: Optimizing FME Workflows with Parameters
 
"Impact of front-end architecture on development cost", Viktor Turskyi
"Impact of front-end architecture on development cost", Viktor Turskyi"Impact of front-end architecture on development cost", Viktor Turskyi
"Impact of front-end architecture on development cost", Viktor Turskyi
 
GraphRAG is All You need? LLM & Knowledge Graph
GraphRAG is All You need? LLM & Knowledge GraphGraphRAG is All You need? LLM & Knowledge Graph
GraphRAG is All You need? LLM & Knowledge Graph
 
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
 
The Art of the Pitch: WordPress Relationships and Sales
The Art of the Pitch: WordPress Relationships and SalesThe Art of the Pitch: WordPress Relationships and Sales
The Art of the Pitch: WordPress Relationships and Sales
 
Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...
Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...
Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...
 
State of ICS and IoT Cyber Threat Landscape Report 2024 preview
State of ICS and IoT Cyber Threat Landscape Report 2024 previewState of ICS and IoT Cyber Threat Landscape Report 2024 preview
State of ICS and IoT Cyber Threat Landscape Report 2024 preview
 
UiPath Test Automation using UiPath Test Suite series, part 3
UiPath Test Automation using UiPath Test Suite series, part 3UiPath Test Automation using UiPath Test Suite series, part 3
UiPath Test Automation using UiPath Test Suite series, part 3
 
DevOps and Testing slides at DASA Connect
DevOps and Testing slides at DASA ConnectDevOps and Testing slides at DASA Connect
DevOps and Testing slides at DASA Connect
 
Connector Corner: Automate dynamic content and events by pushing a button
Connector Corner: Automate dynamic content and events by pushing a buttonConnector Corner: Automate dynamic content and events by pushing a button
Connector Corner: Automate dynamic content and events by pushing a button
 
Smart TV Buyer Insights Survey 2024 by 91mobiles.pdf
Smart TV Buyer Insights Survey 2024 by 91mobiles.pdfSmart TV Buyer Insights Survey 2024 by 91mobiles.pdf
Smart TV Buyer Insights Survey 2024 by 91mobiles.pdf
 
Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024
Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024
Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024
 
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdfFIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
 
UiPath Test Automation using UiPath Test Suite series, part 4
UiPath Test Automation using UiPath Test Suite series, part 4UiPath Test Automation using UiPath Test Suite series, part 4
UiPath Test Automation using UiPath Test Suite series, part 4
 
De-mystifying Zero to One: Design Informed Techniques for Greenfield Innovati...
De-mystifying Zero to One: Design Informed Techniques for Greenfield Innovati...De-mystifying Zero to One: Design Informed Techniques for Greenfield Innovati...
De-mystifying Zero to One: Design Informed Techniques for Greenfield Innovati...
 
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdfFIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
 
Mission to Decommission: Importance of Decommissioning Products to Increase E...
Mission to Decommission: Importance of Decommissioning Products to Increase E...Mission to Decommission: Importance of Decommissioning Products to Increase E...
Mission to Decommission: Importance of Decommissioning Products to Increase E...
 
JMeter webinar - integration with InfluxDB and Grafana
JMeter webinar - integration with InfluxDB and GrafanaJMeter webinar - integration with InfluxDB and Grafana
JMeter webinar - integration with InfluxDB and Grafana
 

Content Security Policies: Let's Break Stuff @ PHP London, Sept 2017

  • 1. @BruntyCSP: Let’s Break Stuff CONTENT SECURITY POLICIES LET’S BREAK STUFF
  • 2. @BruntyCSP: Let’s Break Stuff BECAUSE YOU ALL TOTALLY CARE ABOUT THIS, RIGHT?! ABOUT ME ▸ Senior Software Engineer at Viva IT
 (those folks in orange hoodies at some conferences & events you may have been to) ▸ @Brunty ▸ @PHPem ▸ mfyu.co.uk ▸ matt@mfyu.co.uk
  • 3. @BruntyCSP: Let’s Break Stuff BLAH BLAH… JUST GET ON WITH THE TALK THINGS I DO ▸ Dungeon master for D&D campaigns ▸ Mentor, lead & teach apprentices and junior developers ▸ Run & organise PHP East Midlands ▸ Speak at user groups and conferences ▸ Break production sites with incorrectly configured content security policies
  • 4. @BruntyCSP: Let’s Break Stuff OH GOOD, FINALLY WE’RE GETTING STARTED A TALK IN 3 PARTS ▸ XSS
 ▸ CSP
 ▸ Break stuff

  • 5. @BruntyCSP: Let’s Break Stuff THE SCARY STUFF
  • 6. @BruntyCSP: Let’s Break Stuff FIRST, SOME BACKGROUND WHAT IS CROSS-SITE-SCRIPTING (XSS)? ▸ XSS enables an attacker to inject client-side scripts into non-malicious web pages viewed by other users ▸ In 2016 there was a 61% likelihood of a browser-based vulnerability being found in a web application ▸ Of those browser based vulnerabilities, 86% were found to be XSS related ▸ That’s just over 52% of all web application vulnerabilities
 https://www.edgescan.com/assets/docs/reports/2016-edgescan-stats-report.pdf
  • 7. @BruntyCSP: Let’s Break Stuff I MEAN, IT’S JUST A JOKE VULNERABILITY, RIGHT?! WHAT CAN BE DONE WITH XSS? ▸ Put pictures of cats in web pages ▸ alert(‘💩’); ▸ Rickroll a user ▸ Twitter self-retweeting tweet
 https://www.youtube.com/watch?v=zv0kZKC6GAM ▸ Samy worm
 https://en.wikipedia.org/wiki/Samy_(computer_worm)
  • 8. @BruntyCSP: Let’s Break Stuff WELL… IT’S NOT A JOKE VULNERABILITY WHAT CAN BE DONE WITH XSS? ▸ Make modifications to the DOM - replace a form action to point to your own script to capture credentials. ▸ Use XMLHttpRequest to send HTTP requests and load in additional resources ▸ Access HTML5 APIs - webcam, microphone, geolocation ▸ Steal cookies (and therefore steal session cookies)
  • 10. @BruntyCSP: Let’s Break Stuff IT’S REALLY NOT A JOKE VULNERABILITY WHAT CAN BE DONE WITH XSS? https://www.wired.com/2008/03/hackers-assault-epilepsy-patients-via-computer/
  • 11. @BruntyCSP: Let’s Break Stuff TYPES OF XSS ATTACK STORED XSS (AKA PERSISTENT OR TYPE I) ▸ Occurs when input is stored - generally in a server-side database, but not always ▸ This could also be within a HTML5 database, thus never being sent to the server at all ▸ who.is was a site Rickrolled by a TXT record in the DNS of a website (yes, really)
  • 12. @BruntyCSP: Let’s Break Stuff TYPES OF XSS ATTACK REFLECTED XSS (AKA NON-PERSISTENT OR TYPE II) ▸ Occurs when user input provided in the request is immediately returned - such as in an error message, search string etc ▸ Data is not stored, and in some instances, may not even reach the server (see the next type of XSS)
  • 13. @BruntyCSP: Let’s Break Stuff TYPES OF XSS ATTACK DOM-BASED XSS (AKA TYPE-0) ▸ The entire flow of the attack takes place within the browser ▸ For example, if JavaScript in the site takes input, and uses something like document.write based on that input, it can be vulnerable to a DOM-based XSS attack
  • 14. @BruntyCSP: Let’s Break Stuff TYPES OF XSS ATTACK SELF XSS ▸ Social-engineering form of XSS ▸ Requires the user to execute code in the browser ▸ Doing so via the console can’t be protected by a lot of methods ▸ Not considered a ‘true’ XSS attack due to requiring the user to execute the code
  • 16. @BruntyCSP: Let’s Break Stuff STOP THE HACKERS LET’S FIGHT BACK
  • 17. @BruntyCSP: Let’s Break Stuff HTTP RESPONSE HEADER TO HELP REDUCE XSS RISKS WHAT IS A CSP?
  • 18. @BruntyCSP: Let’s Break Stuff DECLARES WHAT RESOURCES ARE ALLOWED TO LOAD HOW DOES A CSP WORK?
  • 19. @BruntyCSP: Let’s Break Stuff BROWSER SUPPORT
  • 21. @BruntyCSP: Let’s Break Stuff CSP TO THE RESCUE! WHAT CAN WE PROTECT? ▸ default-src ▸ script-src ▸ style-src ▸ img-src ▸ form-action ▸ update-insecure-requests
  • 22. @BruntyCSP: Let’s Break Stuff FULL REFERENCE:https://content-security-policy.com
 https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
  • 23. @BruntyCSP: Let’s Break Stuff img-src * ALLOWS ANY URL EXCEPT DATA: BLOB: FILESYSTEM: SCHEMES.
  • 24. @BruntyCSP: Let’s Break Stuff object-src 'none' DON’T LOAD RESOURCES FROM ANY SOURCE
  • 25. @BruntyCSP: Let’s Break Stuff style-src ‘self' ALLOW LOADING FROM SAME SCHEME, HOST AND PORT
  • 26. @BruntyCSP: Let’s Break Stuff script-src 'unsafe-inline' ALLOWS USE OF INLINE SOURCE ELEMENTS SUCH AS STYLE ATTRIBUTE, ONCLICK, OR SCRIPT TAG BODIES
  • 27. @BruntyCSP: Let’s Break Stuff DON’T USE UNSAFE-INLINE
  • 28. @BruntyCSP: Let’s Break Stuff <script nonce="$RANDOM">...</script> script-src 'self' 'nonce-$RANDOM'
  • 29. @BruntyCSP: Let’s Break Stuff Content-Security-Policy: default-src 'none'; script-src 'self' https://*.google.com 'nonce-random123'; style-src 'self'; img-src 'self'; upgrade-insecure-requests; form- action 'self';
  • 30. @BruntyCSP: Let’s Break Stuff I BROKE PRODUCTION WITH A BAD CSP LEARN FROM MY MISTAKES
  • 31. @BruntyCSP: Let’s Break Stuff DON’T DO WHAT I DID
  • 32. @BruntyCSP: Let’s Break Stuff REPORT-URI
  • 33. @BruntyCSP: Let’s Break Stuff WHEN A POLICY FAILURE OCCURS, THE BROWSER SENDS A JSON PAYLOAD TO THAT URL
  • 34. @BruntyCSP: Let’s Break Stuff { "csp-report": { "blocked-uri": "self", "document-uri": "https://mysite.com", "line-number": 1, "original-policy": "script-src 'self'", "script-sample": "try { for(var lastpass_iter=0; lastpass...", "source-file": "https://mysite.com", "violated-directive": "script-src 'self'" } }
  • 35. @BruntyCSP: Let’s Break Stuff REPORT-URI.IO
  • 37. @BruntyCSP: Let’s Break Stuff REPORT-ONLY
  • 38. @BruntyCSP: Let’s Break Stuff Content-Security-Policy-Report-Only: [policy]; report- uri https://app.report-uri.io/r/default/csp/reportOnly;
  • 39. @BruntyCSP: Let’s Break Stuff TRIAL STUFF BEFORE ENFORCING
  • 40. @BruntyCSP: Let’s Break Stuff THERE WILL BE NOISE, LOTS OF NOISE
  • 41. @BruntyCSP: Let’s Break Stuff WAYS TO MAKE DEALING WITH A CSP EASIER TIPS ▸ Have an easy and quick way to disable the CSP in production if required ▸ Better yet, have a way to switch it from enforced to report only so you can get violations reported to help you debug ▸ Add the CSP at an application level if you need a nonce
  • 42. @BruntyCSP: Let’s Break Stuff WAYS TO REMOVE BARRIERS IN DEVELOPMENT NONCES ▸ Don’t generate multiple nonces in the same request (but do generate a new nonce on each separate request) ▸ If using a templating engine (such as twig) - add the nonce as a global so it’s available in every template by default ▸ Write a helper to generate tags with a nonce if it’s available
  • 43. @BruntyCSP: Let’s Break Stuff DEMO TIME! LET’S BREAK STUFF
  • 44. @BruntyCSP: Let’s Break Stuff @SCOTT_HELME (HE KNOWS HIS STUFF!) (THIS ISN’T ME)
  • 45. @BruntyCSP: Let’s Break Stuff HOMEWORK TIME! LINKS & FURTHER READING ▸ https://www.owasp.org/index.php/Cross-site_Scripting_(XSS) ▸ https://content-security-policy.com ▸ https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy ▸ https://report-uri.io ▸ https://scotthelme.co.uk/just-how-much-traffic-can-you-generate-using-csp/ ▸ https://www.edgescan.com/assets/docs/reports/2016-edgescan-stats-report.pdf ▸ http://theharmonyguy.com/oldsite/2011/04/21/recent-facebook-xss-attacks-show- increasing-sophistication/ ▸ https://github.com/Brunty/csp-demo
  • 46. @BruntyCSP: Let’s Break Stuff THANK YOU
  • 47. @BruntyCSP: Let’s Break Stuff QUESTIONS? @BRUNTY @PHPEM MFYU.CO.UK MATT@MFYU.CO.UK