Downloaded 18 times
Uploaded byCláudio André
Hacker, you shall not pass!
This document discusses common web application vulnerabilities like SQL injection, cross-site scripting (XSS), and cross-site request forgery (CSRF). It provides examples of each vulnerability and demonstrates how they can be exploited. The document also recommends best practices for authentication, authorization, and access control to prevent security issues. It introduces resources from the Open Web Application Security Project (OWASP) like the Top 10 list of vulnerabilities and a directory of vulnerable web applications for testing. The document promotes the use of tools like Burp Suite to aid in security testing of web applications.
More Related Content
Similar to Hacker, you shall not pass!
Hacker, you shall not pass!
- 1. Hacker, you shallnot pass! Web application secure development Cláudio André | claudioandre (at) gmail.com | @clviper
- 2. whoami ● 10+ yearsworking in Information Systems ● Penetration Tester @ ● Web applications, Mobile applications and Infrastructure ● Blog: security.claudio.pt
- 4.
- 5. SQL Injection ● SQLquery manipulation via input data from client; https://www.owasp.org/index.php/SQL_Injection
- 6. SQL Injection ● SQLquery manipulation via input data from client; ● String concatenation; https://www.owasp.org/index.php/SQL_Injection
- 7. SQL Injection select namefrom users where user = ‘admin’ and password = ‘ubberpa$$w0rd’ https://www.owasp.org/index.php/SQL_Injection
- 8. SQL Injection select namefrom users where user = ‘admin’ and password = ‘ubberpa$$w0rd’ select name from users where user = ‘admin’ and password = ‘xpto’ or 1=1--’ https://www.owasp.org/index.php/SQL_Injection
- 9.
- 10. Fixing SQL Injection ●Use of prepared statements (Parameterized Queries) https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet
- 11. Fixing SQL Injection ●Use of prepared statements (Parameterized Queries) https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet
- 12. Cross Site Scripting(XSS) ● Injection of malicious scripts via input data from the client; https://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29
- 13. Cross Site Scripting(XSS) ● Injection of malicious scripts via input data from the client; ● Script reflection on the page; https://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29
- 14. Cross Site Scripting(XSS) ● Injection of malicious scripts via input data from the client; ● Script reflection on the page; ● Reflected, Stored and DOM based; https://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29
- 15. Cross Site Scripting(XSS) Request: http://vulnerablesite.local/index?name=Guest Response: <html> <body> <div> Hello Guest </div> </body> </html> https://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29
- 16. Cross Site Scripting(XSS) Request: http://vulnerablesite.local/index?name=<script>alert(“xss”)</script> Response: <html> <body> <div> Hello <script>alert(“xss”)</script> </div> </body> </html> https://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29
- 17. Cross Site Scripting(XSS) Request: http://vulnerablesite.local/index?name=<script>alert(“xss”)</script> Response: <html> <body> <div> Hello <script>alert(“xss”)</script> </div> </body> </html> https://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29
- 18. Cross Site Scripting(XSS) Demo
- 19. Fixing XSS ● Notstraightforward; ● Start with HTML Escape and Attribute Escape. https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet
- 20. Cross Site RequestForgery (CSRF) ● Force user to execute unwanted actions on a web application; https://www.owasp.org/index.php/Cross-Site_Request_Forgery_%28
- 21. Cross Site RequestForgery (CSRF) ● Force user to execute unwanted actions on a web application; ● Session Riding; https://www.owasp.org/index.php/Cross-Site_Request_Forgery_%28
- 22. Cross Site RequestForgery (CSRF) ● Force user to execute unwanted actions on a web application; ● Session Riding; ● Phishing Attacks https://www.owasp.org/index.php/Cross-Site_Request_Forgery_%28
- 23. Cross Site RequestForgery (CSRF) Request: http://vulnerablesite.local/changepassword?newpwd=MyS3cr3tPa$$word https://www.owasp.org/index.php/Cross-Site_Request_Forgery_%28
- 24. Cross Site RequestForgery (CSRF) Request: http://vulnerablesite.local/changepassword?newpwd=MyS3cr3tPa$$word Attack: <img src=”http://vulnerablesite.local/changepassword?newpwd=owned”> https://www.owasp.org/index.php/Cross-Site_Request_Forgery_%28
- 25. Cross Site RequestForgery (CSRF) Demo
- 26. Fixing CSRF ● SynchronizerToken Pattern https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet
- 27. Fixing CSRF ● SynchronizerToken Pattern https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet
- 28. Triple A ● Authentication ●Authorization ● Access Control
- 29. Some best practiceson Authentication ● NO PLAIN TEXT!!! Use of strong cryptographic algorithms; https://www.owasp.org/index.php/Authentication_Cheat_Sheet
- 30. Some best practiceson Authentication ● NO PLAIN TEXT!!! Use of strong cryptographic algorithms; ● No limit for character set and max lengths; https://www.owasp.org/index.php/Authentication_Cheat_Sheet
- 31. Some best practiceson Authentication ● NO PLAIN TEXT!!! Use of strong cryptographic algorithms; ● No limit for character set and max lengths; ● Enforce strong password policy; https://www.owasp.org/index.php/Authentication_Cheat_Sheet
- 32. Some best practiceson Authentication ● Prevent Brute-Force Attacks. Implement Captcha. https://www.owasp.org/index.php/Authentication_Cheat_Sheet
- 33. Some best practiceson Authentication ● Prevent Brute-Force Attacks. Implement Captcha. ● Normalize error messages; https://www.owasp.org/index.php/Authentication_Cheat_Sheet
- 34. Access Control ● VerticalAccess Control Attack https://www.owasp.org/index.php/Access_Control_Cheat_Sheet
- 35. Access Control ● VerticalAccess Control Attack https://www.owasp.org/index.php/Access_Control_Cheat_Sheet Request: http://vulnerablesite.local/mainPage
- 36. Access Control ● VerticalAccess Control Attack https://www.owasp.org/index.php/Access_Control_Cheat_Sheet Request: http://vulnerablesite.local/mainPage Request: http://vulnerablesite.local/adminPage
- 37. Access Control ● HorizontalAccess Control Attack https://www.owasp.org/index.php/Access_Control_Cheat_Sheet
- 38. Access Control ● HorizontalAccess Control Attack https://www.owasp.org/index.php/Access_Control_Cheat_Sheet Request: http://vulnerablesite.local/getUserProfile?id=1337
- 39. Access Control ● HorizontalAccess Control Attack https://www.owasp.org/index.php/Access_Control_Cheat_Sheet Request: http://vulnerablesite.local/getUserProfile?id=1337 Request: http://vulnerablesite.local/getUserProfile?id=1338
- 40. Access Control ● BusinessLogic Access Control Attack https://www.owasp.org/index.php/Access_Control_Cheat_Sheet
- 41. Access Control ● BusinessLogic Access Control Attack https://www.owasp.org/index.php/Access_Control_Cheat_Sheet http://vulnerablesite.local/shop?action=chooseFormat http://vulnerablesite.local/shop?action=makePayment http://vulnerablesite.local/shop?action=downloadMovie
- 42. Some best practiceson Access Control ● Implement roles and permissions https://www.owasp.org/index.php/Access_Control_Cheat_Sheet
- 43. Some best practiceson Access Control ● Implement roles and permissions ● Perform authorization validation on all pages. https://www.owasp.org/index.php/Access_Control_Cheat_Sheet
- 44. Some best practiceson Access Control ● Implement roles and permissions ● Perform authorization validation on all pages. ● Data-Context access controls https://www.owasp.org/index.php/Access_Control_Cheat_Sheet
- 45. Open Web ApplicationSecurity Project (OWASP) ● Not-for-profit charitable organization focused on improving the security of software;
- 46. Open Web ApplicationSecurity Project (OWASP) ● Not-for-profit charitable organization focused on improving the security of software; ● Best practices;
- 47. Open Web ApplicationSecurity Project (OWASP) ● Not-for-profit charitable organization focused on improving the security of software; ● Best practices; ● OWASP Top 10;
- 48.
- 49. OWASP Vulnerable WebApplications Directory ● Vulnerable web applications for web dev, security auditors and pentesters. ● Offline, Online, Virtual Machines and ISOs. https://www.owasp.org/index.php/OWASP_Vulnerable_Web_Applications_Directory_Project#tab=Main
- 50. Portswigger Burp Suite ●Integrated platform for web application security tests.
- 51. Portswigger Burp Suite ●Integrated platform for web application security tests. ● Has free version and is cross platform.
- 52. Portswigger Burp Suite ●Integrated platform for web application security tests. ● Has free version and is cross platform. ● Not only for infosec guys. Devs should use it.