Pony Pwning Djangocon 2010

Pony Pwning
Djangocon 2010 // Adam Baldwin

Wednesday, September 8, 2010

Hi, I’m not that Adam Baldwin.

I’m this one:
@adam_baldwin
ngenuity-is.com
evilpacket.net


I break stuff


Django = pile
of awesome


Django isn’t
perfect


Developers
aren’t perfect


I WANT TO
HELP YOU
AVOID
HUGE ASS
MISTAKES

Captain Howdy McAssumptions,
the nGenuity Mascot

INTRODUCING!

Completely
made up
statistics


60% of security
failures

project
constraints!

30% of security
failures

incompetence
or ignorance

See http://evilpacket.net/2010/jan/14/miﬁ-geopwn/

9% of security
failures

needle in
the haystack

See http://evilpacket.net/2009/jul/9/rackspace-cloud-xss-root/
and http://evilpacket.net/2009/jul/9/theft-rackspace-cloud-api-key/

1% of security
failures

0 days

Let’s talk
about the 90%

Sad Pony
Warning


cross-site scripting


{
the
“ double quote

Big ‘ single quote

& ampersand
Five < less than

> greater than


{% autoescape off %}

|safe ﬁlter

mark_safe( )

Context matters.
<a href=”{{object.absolute_url}}” alt=”{{object.name}}”>
{{object.name}}</a>

<a href={{object.absolute_url}} alt={{object.name}}>
{{object.name}}</a>

Missing quotes in the second URL make it possible
to inject malicious code.

Which is bad.


swingset
OWASP ESAPI Swingset by Craig Younkins
http://www.owasp.org/index.php/ESAPI_Swingset

Browser behavior
This works in IE8, without the “big ﬁve” and executes
without user interaction.

<style /><a href="[user provided data here]">click</a>
<style /><a href="}@import/**/data:text/css
%3Bbase64,Knt4OmV4cHJlc3Npb24oYWxlcnQoMSkpf
Q%3D%3D;">click</a>


Avoid • Consider OWASP ESAPI

• Audit templates
getting • Audit reusables and snippets

burned • Educate designers


FILE UP
LOADS

Evil Avatars
Images can contain PHP.

ImageField does not care.

ImageField does not check extensions.

File uploads often are put in
unprotected directories.


Avoid • Check ﬁle extensions

• Disable PHP
getting
burned


File upload TMI

secret_report.pdf

secret_report_1.pdf


Avoid • Put user content behind a ﬁle API

• Obfuscate ﬁlenames of uploads
getting
burned


Direct
Object
Access


General TMI

“Not Found”

vs.

“Forbidden” / “Access denied”


Avoid • Return consistent results
(preferably “Not Found”)

getting • Log security violations

burned


Doing stupid things

Privileged operations with HTTP GET

eg /object/delete/2


Avoid • Don’t do stupid things.

• Consider Django-Piston for REST
getting
burned


Click
Jacking
What the hell is it?


Click jackets
/admin/ is vulnerable.

pre-ﬁlling forms removes
most user interaction


Avoid • Set X-FRAME-OPTIONS DENY
header

getting • Use django-xframeoptions
middleware

burned • Implement frame breakout code


Abusing
:(
/admin/

Wuh-oh, kids.

[ REDACTED ]


Avoid • I HAVE NO IDEA.

• security@djangoproject.com
getting needs to check their email ;)

burned


I have a
hard job

Your job
is harder.

Questions?
@adam_baldwin // ngenuity-is.com // evilpacket.net

Pony Pwning Djangocon 2010

More Related Content

Similar to Pony Pwning Djangocon 2010

More from Adam Baldwin

Recently uploaded

Pony Pwning Djangocon 2010