Python is a language that in a easy way allows to scale up from starter projects to complex applications for data processing and serving dynamic web pages. But as you increase complexity in your applications, it can be easy to introduce potential problems and vulnerabilities. In this talk, I will highlight the biggest problems we can find in python functions, how to use then in a secure way and tools and services that help you identify vulnerabilities in the python source code. These could be the main talking points: -Introduction to secure programming in python. -Introduce dangerous functions for code inyection and how we can solve this issues from a security point of view. -Common attack vectors on Python applications like Remote Command Execution and SQL injection -Best practices for avoid execution of malicious commands -Tools that help us to protect and obfuscate our source code

1. Testing python security
PyconIE 2018 1 @jmortegac
Testing Python Security
José Manuel Ortega
@jmortegac

2. Testing python security
PyconIE 2018 2 @jmortegac
● Develop Python scripts for automating security and
pentesting tasks
● Discover the Python standard library's main modules
used for performing security-related tasks
● Automate analytical tasks and the extraction of
information from servers
● Explore processes for detecting and exploiting
vulnerabilities in servers
● Use network software for Python programming
● Perform server scripting and port scanning with Python
● Identify vulnerabilities in web applications with Python
● Use Python to extract metadata and forensics

3. Testing python security
PyconIE 2018 3 @jmortegac
jmortega.github.io

4. Testing python security
PyconIE 2018 4 @jmortegac
1. Secure coding
2. Dangerous functions
3. Common attack vectors
4. Static analisys tools
5. Other security issues

5. Testing python security
PyconIE 2018 5 @jmortegac
Secure coding
1. Analysis of architectures involved
2. Review of implementation details
3. Verification of code logic and syntax
4. Operational testing (unit testing, white-box)
5. Functional testing (black-box)

6. Testing python security
PyconIE 2018 6 @jmortegac
Unsafe python components

7. Testing python security
PyconIE 2018 7 @jmortegac
Dangerous Python Functions

8. Testing python security
PyconIE 2018 8 @jmortegac
Security issues
Here’s a list of handful of other potential issues to
watch for:
● Dangerous python functions like eval()
● Serialization and deserialization objects with
pickle
● SQL and JavaScript snippets
● API keys included in source code
● HTTP calls to internal or external web services

9. Testing python security
PyconIE 2018 9 @jmortegac
Improper input/output validation

10. Testing python security
PyconIE 2018 10 @jmortegac
eval()
eval(expression[, globals[, locals]])

11. Testing python security
PyconIE 2018 11 @jmortegac
eval()
No globals

12. Testing python security
PyconIE 2018 12 @jmortegac
eval()
eval("__import__('os').system('clear')
", {})
eval("__import__('os').system('rm -rf')", {})

13. Testing python security
PyconIE 2018 13 @jmortegac
eval()
Refuse access to the builtins

14. Testing python security
PyconIE 2018 14 @jmortegac
eval()

15. Testing python security
PyconIE 2018 15 @jmortegac
Serialization and Deserialization with Pickle
WARNING: pickle or cPickle are NOT designed as
safe/secure solution for serialization

16. Testing python security
PyconIE 2018 16 @jmortegac
Serialization and Deserialization with Pickle

17. Testing python security
PyconIE 2018 17 @jmortegac
Serialization and Deserialization with Pickle

18. Testing python security
PyconIE 2018 18 @jmortegac
Serialization and Deserialization with Pickle

19. Testing python security
PyconIE 2018 19 @jmortegac
Serialization and Deserialization with Pickle

20. Testing python security
PyconIE 2018 20 @jmortegac
Security issues
Overflow errors
● The buffer overflow
● The integer or arithmetic overflow
>> print xrange(2**63)
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
OverflowError: Python int too large to convert to C long
>>> print range(2**63)
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
OverflowError: range() result has too many items

21. Testing python security
PyconIE 2018 21 @jmortegac
Input injection attacks

22. Testing python security
PyconIE 2018 22 @jmortegac
Command Injection
@app.route('/menu',methods =['POST'])
def menu():
param = request.form [ ' suggestion ']
command = ' echo ' + param + ' >> ' + ' menu.txt '
subprocess.call(command,shell = True)
with open('menu.txt','r') as f:
menu = f.read()
return render_template('command_injection.html',
menu = menu)

23. Testing python security
PyconIE 2018 23 @jmortegac
Command Injection
@app.route('/menu',methods =['POST'])
def menu():
param = request.form [ ' suggestion ']
command = ' echo ' + param + ' >> ' + ' menu.txt '
subprocess.call(command,shell = False)
with open('menu.txt','r') as f:
menu = f.read()
return render_template('command_injection.html',
menu = menu)

24. Testing python security
PyconIE 2018 24 @jmortegac
Command Injection

25. Testing python security
PyconIE 2018 25 @jmortegac
shlex module

26. Testing python security
PyconIE 2018 26 @jmortegac
PyExecCmd

27. Testing python security
PyconIE 2018 27 @jmortegac
Common attack vectors on web applications
OWASP TOP 10:
A1 Injection
A2 Broken Authentication and Session Management
A3 Cross-Site Scripting (XSS)
A4 Insecure Direct Object References
A5 Security Misconfiguration
A6 Sensitive Data Exposure
A7 Missing Function Level Access Control
A8 Cross-Site Request Forgery (CSRF)
A9 Using Components with Known Vulnerabilities
A10 Unvalidated Redirects and Forwards

28. Testing python security
PyconIE 2018 28 @jmortegac
SQL Injection
@app.route('/filtering')
def filtering():
param = request.args.get('param', 'not set')
Session = sessionmaker(bind = db.engine)
session = Session()
result = session.query(User).filter(" username ={}
".format(param))
for value in result:
print(value.username , value.email)
return ' Result is displayed in console.'

29. Testing python security
PyconIE 2018 29 @jmortegac
Prevent SQL injection attacks
Prevent SQL injection attacks
● NEVER concatenate untrusted inputs in SQL
code.
● Concatenate constant fragments of SQL
(literals) with parameter placeholders.
● cur.execute("SELECT * FROM students
WHERE name= '%s';" % name)
● c.execute("SELECT * from students WHERE
name=(?)" , name)

30. Testing python security
PyconIE 2018 30 @jmortegac
Prevent SQL injection attacks

31. Testing python security
PyconIE 2018 31 @jmortegac
XSS
from flask import Flask , request , make_response
app = Flask(__name__)
@app.route ('/XSS_param',methods =['GET ])
def XSS():
param = request.args.get('param','not set')
html = open('templates/XSS_param.html ').read()
resp = make_response(html.replace('{{ param}}',param))
return resp
if __name__ == ' __main__ ':
app.run(debug = True)

32. Testing python security
PyconIE 2018 32 @jmortegac
XSS
Server Side Template Injection (SSTI)

33. Testing python security
PyconIE 2018 33 @jmortegac
XSS

34. Testing python security
PyconIE 2018 34 @jmortegac
XSS

35. Testing python security
PyconIE 2018 35 @jmortegac
Automated security testing
Automatic Scanning tools:
● SQLMap: Sql injection
● XSScrapy: Sql injection and XSS
Source Code Analysis tools:
● Bandit: Open Source and can be
easily integrated with Jenkins CI/CD

36. Testing python security
PyconIE 2018 36 @jmortegac
XSScrapy
https://github.com/DanMcInerney/xsscrapy

37. Testing python security
PyconIE 2018 37 @jmortegac
SQLMap

38. Testing python security
PyconIE 2018 38 @jmortegac
SQLMap

39. Testing python security
PyconIE 2018 39 @jmortegac
Bandit

40. Testing python security
PyconIE 2018 40 @jmortegac
Bandit

41. Testing python security
PyconIE 2018 41 @jmortegac
Bandit Test plugins

42. Testing python security
PyconIE 2018 42 @jmortegac
Bandit Test plugins

43. Testing python security
PyconIE 2018 43 @jmortegac
Bandit Test plugins

44. Testing python security
PyconIE 2018 44 @jmortegac
Bandit Test plugins

45. Testing python security
PyconIE 2018 45 @jmortegac
Bandit Test plugins

46. Testing python security
PyconIE 2018 46 @jmortegac
Bandit Test plugins

47. Testing python security
PyconIE 2018 47 @jmortegac
Bandit Test plugins
SELECT %s FROM derp;” % var
“SELECT thing FROM ” + tab
“SELECT ” + val + ” FROM ” + tab + …
“SELECT {} FROM derp;”.format(var)

48. Testing python security
PyconIE 2018 48 @jmortegac
Syntribos
Buffer Overflow
Command Injection
CORS Wildcard
Integer Overflow
LDAP Injection
SQL Injection
String Validation
XML External Entity
Cross Site Scripting (XSS)
Regex Denial of Service (ReDoS)

49. Testing python security
PyconIE 2018 49 @jmortegac
Other security issues
CPython vulnerabilities

50. Testing python security
PyconIE 2018 50 @jmortegac
Other security issues
Insecure packages
– acqusition (uploaded 2017-06-03 01:58:01, impersonates
acquisition)
– apidev-coop (uploaded 2017-06-03 05:16:08, impersonates
apidev-coop_cms)
– bzip (uploaded 2017-06-04 07:08:05, impersonates bz2file)
– crypt (uploaded 2017-06-03 08:03:14, impersonates crypto)
– django-server (uploaded 2017-06-02 08:22:23, impersonates
django-server-guardian-api)
– pwd (uploaded 2017-06-02 13:12:33, impersonates pwdhash)
– setup-tools (uploaded 2017-06-02 08:54:44, impersonates
setuptools)
– telnet (uploaded 2017-06-02 15:35:05, impersonates telnetsrvlib)
– urlib3 (uploaded 2017-06-02 07:09:29, impersonates urllib3)
– urllib (uploaded 2017-06-02 07:03:37, impersonates urllib3)

51. Testing python security
PyconIE 2018 51 @jmortegac
Other security issues

52. Testing python security
PyconIE 2018 52 @jmortegac
Interesting links
https://github.com/jmortega/testing_python_security

53. Testing python security
PyconIE 2018 53 @jmortegac
Interesting links
https://security.openstack.org/#bandit-static-analysis-for-python
https://security.openstack.org/guidelines/dg_use-subprocess-securely.html
https://security.openstack.org/guidelines/dg_avoid-shell-true.html
https://security.openstack.org/guidelines/dg_parameterize-database-querie
s.html
https://security.openstack.org/guidelines/dg_cross-site-scripting-xss.html
https://security.openstack.org/guidelines/dg_avoid-dangerous-input-parsin
g-libraries.html

54. Testing python security
PyconIE 2018 54 @jmortegac
Q&A
Q & A