The document covers various aspects of web security, specifically focusing on preventing common vulnerabilities such as XSS, SQL injection, and security misconfigurations. It provides guidelines for best practices including the use of HTTPS, proper session management, and educational resources for further learning. Additionally, it introduces tools and references for enhancing security in Sitecore applications.

1. Presented by:
Bas Lijten - @BasLijten
Keeping Hackers out

2. © 2001-2016 Sitecore Corporation A/S. All rights reserved. Sitecore® and Own the Experience® are registered trademarks of Sitecore Corporation A/S. All other brand and product names are the property of their respective owners.
#Sitecore SYM

3. © 2001-2016 Sitecore Corporation A/S. All rights reserved. Sitecore® and Own the Experience® are registered trademarks of Sitecore Corporation A/S. All other brand and product names are the property of their respective owners.
#Sitecore SYM
3

4. © 2001-2016 Sitecore Corporation A/S. All rights reserved. Sitecore® and Own the Experience® are registered trademarks of Sitecore Corporation A/S. All other brand and product names are the property of their respective owners.
#Sitecore SYMTracker.Current.Session.Identify
bas
linkedin.com/in/baslijten
blog.baslijten.com
Twitter.com/baslijten
Bas Lijten
The Netherlands
PrincipalArchitect

5. What can you expect?
• DEMOS!
5

7. © 2001-2016 Sitecore Corporation A/S. All rights reserved. Sitecore® and Own the Experience® are registered trademarks of Sitecore Corporation A/S. All other brand and product names are the property of their respective owners.
#Sitecore SYMOWASP – reference card

8. © 2001-2016 Sitecore Corporation A/S. All rights reserved. Sitecore® and Own the Experience® are registered trademarks of Sitecore Corporation A/S. All other brand and product names are the property of their respective owners.
#Sitecore SYM
8

9. © 2001-2016 Sitecore Corporation A/S. All rights reserved. Sitecore® and Own the Experience® are registered trademarks of Sitecore Corporation A/S. All other brand and product names are the property of their respective owners.
#Sitecore SYMMeet Evilcore™….
Download my security module on github.com/BasLijten/SitecoreSecurity

10. © 2001-2016 Sitecore Corporation A/S. All rights reserved. Sitecore® and Own the Experience® are registered trademarks of Sitecore Corporation A/S. All other brand and product names are the property of their respective owners.
#Sitecore SYM
10
Bobby Hack
… and meet Bobby Hack - pwn the eXperience
https://twitter.com/bobbyhack_sc

11. © 2001-2016 Sitecore Corporation A/S. All rights reserved. Sitecore® and Own the Experience® are registered trademarks of Sitecore Corporation A/S. All other brand and product names are the property of their respective owners.
#Sitecore SYM
11 of 127
Man in the middle attack

12. © 2001-2016 Sitecore Corporation A/S. All rights reserved. Sitecore® and Own the Experience® are registered trademarks of Sitecore Corporation A/S. All other brand and product names are the property of their respective owners.
#Sitecore SYM
12 of 127
Man in the middle attack

13. © 2001-2016 Sitecore Corporation A/S. All rights reserved. Sitecore® and Own the Experience® are registered trademarks of Sitecore Corporation A/S. All other brand and product names are the property of their respective owners.
#Sitecore SYM
13
Man in the middle attack

14. © 2001-2016 Sitecore Corporation A/S. All rights reserved. Sitecore® and Own the Experience® are registered trademarks of Sitecore Corporation A/S. All other brand and product names are the property of their respective owners.
#Sitecore SYM
14
PineappleWiFi
?? YES

15. © 2001-2016 Sitecore Corporation A/S. All rights reserved. Sitecore® and Own the Experience® are registered trademarks of Sitecore Corporation A/S. All other brand and product names are the property of their respective owners.
#Sitecore SYM
15
PineappleWiFi - Jasager

16. © 2001-2016 Sitecore Corporation A/S. All rights reserved. Sitecore® and Own the Experience® are registered trademarks of Sitecore Corporation A/S. All other brand and product names are the property of their respective owners.
#Sitecore SYM
17
HTTP 1.1
It’s faster
HTTP 2

17. © 2001-2016 Sitecore Corporation A/S. All rights reserved. Sitecore® and Own the Experience® are registered trademarks of Sitecore Corporation A/S. All other brand and product names are the property of their respective owners.
#Sitecore SYM
18
It’s better for SEO

18. © 2001-2016 Sitecore Corporation A/S. All rights reserved. Sitecore® and Own the Experience® are registered trademarks of Sitecore Corporation A/S. All other brand and product names are the property of their respective owners.
#Sitecore SYM
19
https://security.googleblog.com/2016/09/moving-towards-more-secure-web.html

19. © 2001-2016 Sitecore Corporation A/S. All rights reserved. Sitecore® and Own the Experience® are registered trademarks of Sitecore Corporation A/S. All other brand and product names are the property of their respective owners.
#Sitecore SYM
20
It’s Free
http://blog.baslijten.com/sitecore-security-4-serve-your-site-securely-over-https-with-lets-encrypt/

20. © 2001-2016 Sitecore Corporation A/S. All rights reserved. Sitecore® and Own the Experience® are registered trademarks of Sitecore Corporation A/S. All other brand and product names are the property of their respective owners.
#Sitecore SYM
22
Unsafe http to https redirects using a 301

21. © 2001-2016 Sitecore Corporation A/S. All rights reserved. Sitecore® and Own the Experience® are registered trademarks of Sitecore Corporation A/S. All other brand and product names are the property of their respective owners.
#Sitecore SYM
23
HSTS – Internal 307 redirect
http://blog.baslijten.com/sitecore-security-2-secure-connections-and-how-
to-force-the-browser-to-use-the-secure-connection/

22. © 2001-2016 Sitecore Corporation A/S. All rights reserved. Sitecore® and Own the Experience® are registered trademarks of Sitecore Corporation A/S. All other brand and product names are the property of their respective owners.
#Sitecore SYM
24
• Don’t access publicWiFi
• Transport Layer Security
• HTTP StrictTransport Security
Mitigations

23. XSS –CrossSiteScripting
Possibility to inject client-side scripts into webpages
• Reflective
• Persistent
• Leads to other risks, such as Session Hijacking, browser takeovers
25

24. © 2001-2016 Sitecore Corporation A/S. All rights reserved. Sitecore® and Own the Experience® are registered trademarks of Sitecore Corporation A/S. All other brand and product names are the property of their respective owners.
#Sitecore SYM
26
XSS – Reflective XSS
$('#searchTerm').val(' searchterm ');
Trusted data Trusted dataUntrusted data

25. © 2001-2016 Sitecore Corporation A/S. All rights reserved. Sitecore® and Own the Experience® are registered trademarks of Sitecore Corporation A/S. All other brand and product names are the property of their respective owners.
#Sitecore SYM
27
XSS – Reflective XSS
$('#searchTerm').val(' ');alert('pwned');// ');
Trusted data Trusted dataUntrusted data

26. © 2001-2016 Sitecore Corporation A/S. All rights reserved. Sitecore® and Own the Experience® are registered trademarks of Sitecore Corporation A/S. All other brand and product names are the property of their respective owners.
#Sitecore SYM
31
Beef – capture video

27. © 2001-2016 Sitecore Corporation A/S. All rights reserved. Sitecore® and Own the Experience® are registered trademarks of Sitecore Corporation A/S. All other brand and product names are the property of their respective owners.
#Sitecore SYM
32
Content Security Policy

28. © 2001-2016 Sitecore Corporation A/S. All rights reserved. Sitecore® and Own the Experience® are registered trademarks of Sitecore Corporation A/S. All other brand and product names are the property of their respective owners.
#Sitecore SYM
33
XSS
• Output encoding (CSS, Javascript, Xml, HTML)
• Content Security Policy (http://blog.baslijten.com/sitecore-security-3-
prevent-xss-using-content-security-policy/)
Bad Session management
• Don’t clear cookies
• Change your Session ID after Login and Logout
XSS – mitigations & Bad Session Management

29. © 2001-2016 Sitecore Corporation A/S. All rights reserved. Sitecore® and Own the Experience® are registered trademarks of Sitecore Corporation A/S. All other brand and product names are the property of their respective owners.
#Sitecore SYMSQL Injection

30. © 2001-2016 Sitecore Corporation A/S. All rights reserved. Sitecore® and Own the Experience® are registered trademarks of Sitecore Corporation A/S. All other brand and product names are the property of their respective owners.
#Sitecore SYM
35
Security Misconfiguration
coremasterweb
Sitecore

31. © 2001-2016 Sitecore Corporation A/S. All rights reserved. Sitecore® and Own the Experience® are registered trademarks of Sitecore Corporation A/S. All other brand and product names are the property of their respective owners.
#Sitecore SYM
36
Security Misconfiguration
coremasterwebComments
Sitecore
comments

32. © 2001-2016 Sitecore Corporation A/S. All rights reserved. Sitecore® and Own the Experience® are registered trademarks of Sitecore Corporation A/S. All other brand and product names are the property of their respective owners.
#Sitecore SYM
37
Same credentials
Same instance
Security Misconfiguration
coremasterwebComments
Sitecore
comments

33. © 2001-2016 Sitecore Corporation A/S. All rights reserved. Sitecore® and Own the Experience® are registered trademarks of Sitecore Corporation A/S. All other brand and product names are the property of their respective owners.
#Sitecore SYM
38
Separate credentials
Least privilege
Security Misconfiguration
coremasterwebComments
Sitecore
comments

34. © 2001-2016 Sitecore Corporation A/S. All rights reserved. Sitecore® and Own the Experience® are registered trademarks of Sitecore Corporation A/S. All other brand and product names are the property of their respective owners.
#Sitecore SYM
39
Separate credentials
Least privilege
Separate instance
Security Misconfiguration
coremasterwebComments
Sitecore
comments

35. © 2001-2016 Sitecore Corporation A/S. All rights reserved. Sitecore® and Own the Experience® are registered trademarks of Sitecore Corporation A/S. All other brand and product names are the property of their respective owners.
#Sitecore SYM
40
• Parameterize your queries
• Use another service account
• Separate custom databases from Sitecore
SQL Injection & Security Misconfiguration

36. © 2001-2016 Sitecore Corporation A/S. All rights reserved. Sitecore® and Own the Experience® are registered trademarks of Sitecore Corporation A/S. All other brand and product names are the property of their respective owners.
#Sitecore SYM
41
Insufficient Transport Layer Protection
• UseTransport Layer Security
• Enforce HTTPS (HSTS header) to
prevent stripping
Summary
Broken authentication / session
management
• Session fixation
• Don’t remove cookies
XSS (Reflective/Persistent)
• Don’t trust data
• Encode your (untrusted) data
SQL Injection
• Parameterize queries
• Use frameworks
Security Misconfiguration
• Least privileges
• Don’t share accounts for
connections

37. Next steps/Resources
42
What to do
• Get to know the OWASP top 10
• Follow pluralsight courses – Hack yourself first / OWASP
• Three months –Write secure code
Resources available
• Get educated (See resources)
• Code on Github

38. © 2001-2016 Sitecore Corporation A/S. All rights reserved. Sitecore® and Own the Experience® are registered trademarks of Sitecore Corporation A/S. All other brand and product names are the property of their respective owners.
#Sitecore SYM
43
Topic Url
Secure connections HSTS for Sitecore
Secure connections Understanding HTTP Strict Transport Security
Secure connections Serve your Sitecore site securely over https with letsencrypt
Secure connections Wifi Pineapple
Secure connections Certificate Pinning
XSS XSS Prevention Cheat Sheet
XSS Content Security Policy Header
XSS Report-uri.io
XSS Content Security Policy for Sitecore
SQL Injection SQL Injection Cheat Sheet
Replace password hashing mechanism Sitecore password hashing algorithm
Security Misconfiguration OWASP
Broken Session and Authentication Management OWASP
Topic specific information

39. © 2001-2016 Sitecore Corporation A/S. All rights reserved. Sitecore® and Own the Experience® are registered trademarks of Sitecore Corporation A/S. All other brand and product names are the property of their respective owners.
#Sitecore SYM
44
Source Description
Bas Lijten My blog ;)
Securitycore My evilcore/safecore Github repository
Pluralsight Ethical hacking courses – 40+ hours on security training
OWASP Open Web Application Security Project
Troy hunt Security blogger
Dale Meredith Security blogger, author of ethical hacking courses
Microsoft SDLC Microsoft Secure Development Lifecycle
Beef Browser Exploitation Framework
General sources of Information

40. FOR DISCUSSION PURPOSESONLY. Sitecore
Confidential and Proprietary. © 2016 Sitecore
Corporation A/S. All rights reserved. Sitecore®
and Own the Experience® are registered
trademarks of Sitecore Corporation A/S. All
other brand and product names are the
property of their respective owners.