NoSQL Injection in Meteor.js Application
•Download as PPTX, PDF•
0 likes•360 views
Websites: https://www.designveloper.com Visit our blog https://www.designveloper.com/blog Like Facebook page https://www.facebook.com/designveloper/ Youtube: http://bit.ly/29PTtFS
Recommended
Recommended
More Related Content
Similar to NoSQL Injection in Meteor.js Application
Similar to NoSQL Injection in Meteor.js Application (20)
More from Designveloper
More from Designveloper (20)
Recently uploaded
Recently uploaded (20)
NoSQL Injection in Meteor.js Application
- 3. Hello! I am Son Le o At Designveloper for > 2 years o Work with Meteor for > a year You can find me at: @sonlexqt
- 5. Don’t get me wrong ! is NOT INSECURE WWW.DESIGNVELOPER.COM
- 6. SQL Injection Queries use STRINGs as the control mechanism. WWW.DESIGNVELOPER.COM
- 7. Exploits of a Mom // query INSERT INTO Students VALUES ( '$Name' ) // input Robert'); DROP TABLE Students; -- // result INSERT INTO Students VALUES ( 'Robert' ); DROP TABLE Students; --' ) source: https://xkcd.com/327 WWW.DESIGNVELOPER.COM
- 8. SQL Injection - One more example // query SELECT * FROM users WHERE username='peter’ AND (password= ('$PWD')) // input ' OR '1'='1’ // result SELECT * FROM users WHERE username='peter' AND (password='' OR '1'='1') WWW.DESIGNVELOPER.COM
- 9. NoSQL Injection Queries use OBJECTs as the control mechanism. WWW.DESIGNVELOPER.COM
- 10. 2. DEMO TIME Meteor-shop web application WWW.DESIGNVELOPER.COM
- 11. Let’s play a role of a hacker ! With NoSQL Injection skill. WWW.DESIGNVELOPER.COM
- 13. “MAKE ASSERTIONS ON USER INPUT DATA WWW.DESIGNVELOPER.COM
- 14. CHECK to the rescue https://atmospherejs.com/meteor/check Check whether a value matches a pattern $ meteor add check check(slug, String); ERROR: Expected String, got Object WWW.DESIGNVELOPER.COM
- 15. CHECK-CHECKER https://atmospherejs.com/east5th/check-checker Scan the code to detect methods / publish functions which haven’t checked for its input data. $ meteor add east5th:check- checker WWW.DESIGNVELOPER.COM
- 16. Thanks! Any questions? o meteor-shop demo application https://github.com/sonlexqt/meteor-shop WWW.DESIGNVELOPER.COM
Editor's Notes
- This topic will require a little bit of your familiarity with Meteor & MongoDB
- At first: please don’t get me wrong ! I don’t say that Meteor apps is insecure. Although Meteor it self has a package called INSECURE, but it’s a different story right ? In fact, Meteor is quite good at handling security if us developers pay enought attention to it
- In the world of SQL, queries use STRINGs as the control mechanism. So SQL INJECTION will be the technique that the attackers use to take advantages of this mechanism. What does that mean ? Well, let’s get to the examples !
- Classic example of SQL Injection To summary this example: a mom is sending her son to a new school. Of course he has to be registered to the school computer system right ? So the query to do that is INSERT INTO ... What if the son has some weird name like Robert quote close parentheses ... So in the result, there’s a DROP TABLE Students query comes along, which will remove the whole Students table data.
- Let’s say the query to get one user data with usename=‘peter’ is this: SELECT * FROM ... and the password is the input What if the input for password is: ' OR '1'='1 We get the result query here, which will always be succeed because the condition: (password='' OR '1'='1') is always true ! So this way, the attacker can get any arbitrary user data, given the username That’s basically how SQL Injection works
- Instead of using STRINGs as the control mechanism, NOSQL INJECTION queries use OBJECTs as the control mechanism What does that mean ? Let’s dive in to the demo
- - Here’s the good news: In contrast with the problems, the solutions are quite easy
- The solution is simple: we have to MAKE ASSERTIONS ON USER INPUT DATA You know that Meteor uses DDP (Distributed Transfer Protocol) which can transfer many types of data: String, Number, Array, Object ... If you know exactly what is the data user passed in, we can deal with them safely But how can we know exactly what is the data user passed in
- - In the scope of Meteor, there’s a useful package called CHECK - We are going to use this check package for every method / publication function that we need to validate user input
- There’re cases that you have so many methods & publication functions that you don’t know if they’re CHECKED or not ? Well, we also have a package called check-checker here, which helps ... and return a warning if there’s an unchecked method
- So that’s it ! I hope my presentation gives you a better look on security prospective so that you can make a BETTER and SAFER app.