OWASP A7 and A8
•Download as PPTX, PDF•
0 likes•340 views
Null Hyderabad 11th February 2017. OWSAP A7: Missing Function Level Access Control A8: Cross Site Request Forgery (CSRF)
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Viewers also liked
Viewers also liked (19)
Similar to OWASP A7 and A8
Similar to OWASP A7 and A8 (20)
Recently uploaded
Recently uploaded (20)
OWASP A7 and A8
- 1. OWASP A7 & A8 pavanw3b Hyd 11th February ServiceNow
- 2. $ whoami Pavan aka pavanw3b Security Engineer @ Core member - n|u Hyd Free time bug bounty participant
- 3. OWASP talks continued at n|u Hyd.. Open Web Application Security Project ◦ Top 10 ◦ Tools ◦ Testing guide ◦ Cheat sheets Web Top Ten 2013
- 4. A7 - Missing Function Level Access Control
- 5. A7-Missing Function Level Access Control https://pavanw3b.com/report/user
- 6. A7-Missing Function Level Access Control https://pavanw3b.com/report/admin
- 7. How is it done? ◦ Force browse URL: /site/admin ◦ Parameter: ?action=getappinfo
- 8. Wait a min.. Isn’t it IDOR? A4 Insecure Direct Object Reference
- 9. Revisit A4 – Insecure Direct Object Reference https://biller.com/download?bill_id=1337
- 10. Missing Function Level Access Control
- 11. Missing Function Level Access Control Performs some operation Ability to
- 12. Missing Function Level Access Control Performs some operation Ability to control the to
- 13. Missing Function Level Access Control Performs some operation Ability to control the to Missing
- 14. How to find? ◦ Navigation, Form action, API ◦ Escalate Privilege ◦ Server-side Authentication & Authorization
- 15. How is different from IDOR? ◦ Function level ◦ Usually invokes a function ◦ For Programmers ◦ Mostly about Vertical Privilege Escalation? ◦ It’s a type of IDOR? ◦ Not all IDOR are MFLA?
- 16. Prevent MFLA ◦ Access Control at Server Side ◦ Don’t just hide UI ◦ Modular level authorization
- 17. A8 – Cross Site Request Forgery (CSRF)
- 18. A8 – Cross Site Request Forgery Cross site : Outside Request : Perform Action Forgery : Fake “Fake an user action outside the site”
- 19. How CSRF happens? ◦ GET /delete?user_id=1001 ◦ POST /transact?toAccount=900123&amount=100 ◦ Innocent looking page ◦ Hidden iframe – form – img – submit ◦ Success!
- 20. Why it works? ◦ Authenticated session exists ◦ (Stupid) Browser sends cookies by default! ◦ Server can’t verify origin of the request
- 21. A few facts to note ◦ Happens on someone’s site hence ◦ CSRF = XSRF ◦ Inducing User action ◦ Unknown to the User ◦ Riding on User session
- 22. The worst CSRF ◦ Admin site – Neglected – CSRF & SQLi ◦ Home DSL Router – Default cred – CSRF ◦ Stored Self XSS & CSRF !
- 23. A few non-CSRF Scenario ◦ Public action: Contact, logout ◦ Read only – No state change
- 24. Preventing CSRF ◦ Token - nonce ◦ URL ◦ Form hidden field ◦ HTTP Header ◦Confirm User interaction: Re-authenticate, CAPTCHA
- 25. Token Security ◦ Should be treated as session token ◦ Crypto random ◦ Time bound ◦ Can limit to user session, form
- 26. A few CSRF blunders ◦ Multi stage form process ◦ CSRF Token in Cookies ◦ Redirection ◦ Depending on HTTP Referer: Old version of flash & meta refresh tag
- 27. Reference ◦ OWASP.org ◦ Web Application Hackers Handbook