The document outlines common security issues that programmers face such as SQL injection, cross-site scripting, directory traversal, and insecure direct object references, and provides best practices for avoiding these issues such as input validation, output encoding, secure configuration of platforms and frameworks, and keeping software updated. It also warns that users cannot always be trusted and that validation must occur on the server-side as well as client-side.
Interface in java ,multiple inheritance in java, interface implementationHoneyChintal
multiple inheritance in java, interface implementation, abstraction,
multiple inheritance in java using interface, how to use interface,
how to use java, how to execute a java code
Interface in java ,multiple inheritance in java, interface implementationHoneyChintal
multiple inheritance in java, interface implementation, abstraction,
multiple inheritance in java using interface, how to use interface,
how to use java, how to execute a java code
Apresentação sobre Modelo de Componentes de Interface Humano Computador, desenvolvida por alunos da Universidade Federal de Sergipe para a disciplina de Interface Humano Computador.
Este trabalho tem o intuito de apresentar os modelos de componentes mais comuns, mostrando o seu propósito, possibilitam a criação de aplicações mais usáveis.
We are covering following topics:
If...Else...Elseif Statements: if statement executes some code if one condition is true.
Switch Statement: Switch Statement tests a variable against a series of values.
For Loop: For loop executes a block of code a specified number of times.
While Loop: While loop executes a block of code as long as the specified condition is true.
Do…While Loop: Do...While loop will always execute the block of code once, it will then check the condition, and repeat the loop while the specified condition is true.
Telnet é um protocolo de rede utilizado na Internet ou redes locais para proporcionar uma facilidade de comunicação baseada em texto interativo bidirecional usando uma conexão de terminal virtual.
This presentation contains why we need sub netting, how we do sub netting, CIDR, Subnet mask, Subnet mask value, Class A Sub netting, Class B Sub netting, Class C Sub netting.
Apresentação sobre Modelo de Componentes de Interface Humano Computador, desenvolvida por alunos da Universidade Federal de Sergipe para a disciplina de Interface Humano Computador.
Este trabalho tem o intuito de apresentar os modelos de componentes mais comuns, mostrando o seu propósito, possibilitam a criação de aplicações mais usáveis.
We are covering following topics:
If...Else...Elseif Statements: if statement executes some code if one condition is true.
Switch Statement: Switch Statement tests a variable against a series of values.
For Loop: For loop executes a block of code a specified number of times.
While Loop: While loop executes a block of code as long as the specified condition is true.
Do…While Loop: Do...While loop will always execute the block of code once, it will then check the condition, and repeat the loop while the specified condition is true.
Telnet é um protocolo de rede utilizado na Internet ou redes locais para proporcionar uma facilidade de comunicação baseada em texto interativo bidirecional usando uma conexão de terminal virtual.
This presentation contains why we need sub netting, how we do sub netting, CIDR, Subnet mask, Subnet mask value, Class A Sub netting, Class B Sub netting, Class C Sub netting.
Talk on threats to database security. The title is, of course, deadly serious. Wile E. Coyote & other experts on correctness & security are enlisted to help make key points.
Learn about common web application security threats and how to avoid them in your code. We will discuss general security challenges and high level principles, example attacks, social engineering, browser security and more, providing best practices along the way. This talk is a good review of the topic for experienced developers, and is highly recommended for new programmers who have not been exposed to web application security challenges in the past.
This session is not specific to any particular server-side technology. We will not discuss network security (routers, DMZs) or OS security, as this talk is focused on web application developers.
The Drupal project’s responses to the web’s most common software vulnerabilities.
For more Four Kitchens presentations, please visit http://fourkitchens.com/presentations
Some security vulnerabilities are more dangerous than others, or at least more commonly exploited. In this session we'll look at the top 25 most dangerous software weaknesses and learn how to mitigate them in your CFML code.
Intro slides for a tutorial on hacking common vulnerabilities and how to prevent those problems in your own code. This is a PHP based tutorial that's hands on, but the slides can help as reference material for a few common hacks
MySQL is the most popular database on the web but how do you keep your data safe as it is virtualized, contained, put into the cloud, replicated, and sharded out to servers where DBAs have minimal actual control.
2. No matter how well you code they will break it
• Murphy’s Law (he was an optimist really!)
3. Programmers
95% of programmers are
• Smart
• Clever
• Trusting
The other 5% are devious or become management!
Programmers are not natively security conscious
The reason
• Its take a lot longer to write!!
Its not always about code
• Need to know your platform.
• Solid house, bad foundations.
4. Users
They are the known objective in programming
They are who you should code for
5. Advanced Users & Hackers
Are just smarter, more curious and sometimes malicious users
Attempt to open the unlocked door
They are what you secure your code for.
7. Issue # 10 Leaving admin info
Mainly applies to web apps.
Leaving admin info systems on the server to be accessed
You can use Google to find this info
You can find password files, office data files (PST) etc
Old files are possible especially you rename in the same directory. Then possible to
download source code from your site.
Sample: intitle:index.of outlook pst
Also leaving trace output with <trace enabled=“true” and localOnly=“false”> ..
Allows access to trace.axd
8. Issue # 9 Passwords in plain text
Following issue #10
Usernames and passwords should be encrypted.
Sensitive data should be in encrypted
Dont write your own Crypto protocols.
Can also use google code to find these (especially if you leave personal ones there!!!)
http://google.com/codesearch?hl=en&lr=&q=sa+connectionstring+file%3Aweb.config&s
btn=Search
9. Issue # 8 Not patching
One of the easiest ways to get caught
Vulnerability is not in your code but on the system
Especially painful on web servers
Google can be used to find vulnerable web servers
Requires you most of the time to pester the local sys admin
10. Issue # 7 Client side validation
Shouldn’t be the only thing that sanitizes your input
Consider you have a javascript function to see if the number is valid
User views source page and sends you the variables
Do validation on both sides to be sure, but definately server side at least.
11. Validation best practices
Validate all inputs at the server even if client validated
Use a central validation source
Use white lists rather than blacklists
Escape special characters
Validate against RFC rules
Validate XML against the schema
12. Issue # 6 Error messages
You should never show a detailed error message on a production web site.
Use CustomErrors in the web.config
Either RemoteOnly or On
Again also turn off Trace and set Debug=“false”
13. Issue # 5 – Incorrect Permisssions
SQL connection using SA or SysAdm level permissions
Requiring Administrator permissions on the web server!!!!!
Requiring Admin privileges for a windows app
14. Issue # 4 – Directory Traversal
Consider default.aspx?download=filestore/file.exe using BinaryWrite
Change the download variable
Now default.aspx? download=web.config
Page will display the incorrect file and give ideas about what way the machine is
configured and possibly access to a lot more.
15. How to prevent it
Validate your input
• Checking for ../ usually wont work due to URLEncode
• Strong checking of input
Placing web apps on separate partitions to system files
Correct permissions
Web server fully patched
Using scanner tools to validate the web server
• IIS Lockdown
• URL Scan
16. Issue # 3 XSS – Cross Site Scripting
HTML & Script Injection
3 Main types
• DOM
• Non Persistant
• Persistant
Non persistant is the most common, and persistant is the most dangerous.
Certain CMS are vuln, as well as pages taking input and displaying that input back.
Other variations include HTTP response splitting, HTTP header injection, remote file
inclusion
17. Remote File Inclusion
Particularly nasty
More common with scripting languages such as ASP and PHP
Allows you to insert your own file to be run
Not as relevant to .NET but still can cause a problem
Example
http://server/file.aspx?redir=page.aspx
http://server/file.aspx?redir=http://badplace/haha.aspx?
Imagine that with a login and similar look of your own site
18. Mind your cookies!
Make cookies only accessible to server side code
<httpCookies httpOnlyCookies="true">
Use cookie based session state to stop session hijacking
<sessionState cookieless="UseCookies">
Where possible use SSL for authentication cookies
Use unique forms name when using multiple sites with forms auth.
19. How to avoid
Use HtmlEncode to disable special chars
Make sure on redirect its only going to where you expect it to be going
Sanitize your input
Mind your cookies and evaluate web.configs above the web app for vulns
20. Issue # 2 SQL Injection
Allowing straight input to your database
Consider
• SELECT * FROM tbl WHERE (Email=‘RequestData’) AND (PASSWORD=’OtherData’)
Now consider the inputs ” ‘ OR ‘1’=‘1’ ”
SELECT * FROM tbl WHERE (Email=‘’ OR ‘1’=‘1’) AND (PASSWORD=’’ OR ‘1’=‘1’)
Worse
• UPDATE tbl WHERE ID=RequestData
• RequestData = 1;DELETE FROM tbl;
Worst!
• RequestData = 1;DROP tbl;
21. How to avoid
Sanitize your input
Dont blindly allow access to the database from the front end
Use only the permissions required for the option
Consider two level database access
• Reader
• Writer
With SQL Server reduce your permissions to execute only if you are using stored
procs
22. Issue # 1 – Being Trusting!
Trusting your users!!!
Sanitize your input
If you don’t check it, be prepared to deal with the consequences. See issues 2 & 3!
Famous examples: Amazon & Komplett