Web 2.0 Hacking

•Download as PPT, PDF•

3 likes•532 views

Automated web application scanners have limitations in conducting comprehensive security assessments due to increasing complexities in web technologies. Scanners struggle with dynamic Ajax code, JavaScript obfuscation, complex session handling, backend APIs, and other emerging techniques. A better approach combines automated scanning with manual testing of known attack vectors, application profiling, input and output validation testing, and fuzzing to identify vulnerabilities beyond low-hanging fruit. Comprehensive security requires assessing how specific applications implement authentication, authorization, error handling, and defensive measures.

Technology

Web Application Security Assessments: Beyond the Automated Scanners Presented by: Blake Turrentine, [email_address] Date: August 25, 2008 Locale: DHS Conference and Workshops, Baltimore, MD

The Security Process ,[object Object],[object Object],[object Object],[object Object],[object Object]

Types of Testing Techniques ,[object Object],[object Object],[object Object]

Types of Automated Scanners ,[object Object],[object Object],[object Object],[object Object],[object Object]

[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Today’s Automated Scanners

[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Problems with Automated Scans

[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],More Problems With Automated Scans

[object Object],[object Object],[object Object],[object Object],[object Object],Approaching a Better Solution: Taking a Closer Look

[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Application Profiling

[object Object],[object Object],Examining Known Vectors

[object Object],[object Object],[object Object],[object Object],Client Side: Why scanners have difficulties in handling Advance JavaScript

[object Object],[object Object],Client Side: Why scanners can’t handle Applets

[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Server Side: Input/output of content is getting more complex

[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Server Side: Scanners Lack of Filter Enumeration and Evasion

[object Object],[object Object],Complexity of analysis in Web Services

[object Object],[object Object],[object Object],[object Object],[object Object],Difficulties in Testing Application Logic

[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Sophistication in Combining Attacks Vectors

[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Most Scanners Don’t Look for Infestation CSRF

[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Infestation Detection

[object Object],[object Object],[object Object],[object Object],[object Object],Difficulties in Fuzzing Analysis

[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Closing Remarks

Webmail Application Test: Combining Server & Client Attack Vectors

Webmail Application Test: IE Recognizes File as a HTML

Webmail Application Test: Session Cookie is Displayed

GMail Web Application Test: Screenshot of Attached file

GMail Web Application Test: IE Recognizes File as an HTML

GMail Web Application Test: Javascript Fires

Yahoo Mail Web Application Test: Creating an Email

Yahoo Mail Web Application Test: Contents of ‘Instructions.doc’

Yahoo Mail Web Application Test: Screenshot of Attached File

Yahoo Mail Web Application Test: Norton AV Scans File Before Download

Yahoo Mail Web Application Test: Javascript Fires

Yahoo Mail Web Application Test: Redirection to Another Site

What's hot

Security testingRihab Chebbah

Introduction to Web Application Penetration TestingAnurag Srivastava

A new web application vulnerability assessment frameworkMark Jayson Fuentes

Bank One App Sec TrainingMike Spaulding

Web Application SecurityColin English

3. backup file artifacts - mazin ahmedRashid Khatmey

Security Testing Training With ExamplesAlwin Thayyil

Web Application Penetration Testmartinvoelk

Security by the numbersEoin Keary

Web application testing Nora Alriyes

Web Application Penetration Testing Introductiongbud7

Security testingKhizra Sammad

Pentesting With Web Services in 2012Ishan Girdhar

Security testing presentationConfiz

A7 Missing Function Level Access Controlstevil1224

Owasp first5 presentationAshwini Paranjpe

Analysis of web application penetration testingEngr Md Yusuf Miah

Broken access controlsAkansha Kesharwani

Web application sec_3vhimsikal

Hack applicationsenrizmoore

What's hot (20)

Security testing

Introduction to Web Application Penetration Testing

A new web application vulnerability assessment framework

Bank One App Sec Training

Web Application Security

3. backup file artifacts - mazin ahmed

Security Testing Training With Examples

Web Application Penetration Test

Security by the numbers

Web application testing

Web Application Penetration Testing Introduction

Security testing

Pentesting With Web Services in 2012

Security testing presentation

A7 Missing Function Level Access Control

Owasp first5 presentation

Analysis of web application penetration testing

Broken access controls

Web application sec_3

Hack applications

Viewers also liked

Web Standard Presentationtheb2studio

Validation Improvement TrendAbhishek Srivastava

Webinar SSL EnglishSSL247®

WgsnShreyans Jain

Groking HTTP MethodsHerman Radtke

Enterprise grade firewall and ssl termination to ac by will stevensbuildacloud

The Chronicles of Web Standard III: The Voyage of the HTML5Bess Ho

RESTful APIs with Herman Radtkeventuraphp

Viewers also liked (8)

Web Standard Presentation

Validation Improvement Trend

Webinar SSL English

Wgsn

Groking HTTP Methods

Enterprise grade firewall and ssl termination to ac by will stevens

The Chronicles of Web Standard III: The Voyage of the HTML5

RESTful APIs with Herman Radtke

Similar to Web 2.0 Hacking

Secure SDLC for Software Shreeraj Shah

Romulus OWASPGrupo Gesfor I+D+i

Don't Drop the SOAP: Real World Web Service Testing for Web Hackers Tom Eston

Security Operationsankitmehta21

Hacking web applicationsphanleson

Altitude SF 2017: Security at the edgeFastly

DEVNET-1186 Harnessing the Power of the Cloud to Detect Advanced Threats: Cog...Cisco DevNet

Web 2.0 Application Kung-Fu - Securing Ajax & Web ServicesShreeraj Shah

IBM AppScan Standard - The Web Application Security Solutionhearme limited company

Hacking Web 2.0 - Defending Ajax and Web Services [HITB 2007 Dubai]Shreeraj Shah

Security in the cloud protecting your cloud appsCenzic

Identify Zero-Day Breaches with Cognitive Threat Analytics on Cisco Web Secur...Cisco Security

How to protect your corporate from advanced attacksMicrosoft

Hide and seek - Attack Surface Management and continuous assessment.Eoin Keary

AppSec EU 2016: Automated Mobile Application Security Assessment with MobSFAjin Abraham

mobsf.pdfTaseen Ali

2009: Securing Applications With Web Application Firewalls and Vulnerability ...Neil Matatall

OWASP Top 10 And Insecure Software Root CausesMarco Morana

Hacking web applicationsAdeel Javaid

香港六合彩baoyin

Similar to Web 2.0 Hacking (20)

Secure SDLC for Software

Romulus OWASP

Don't Drop the SOAP: Real World Web Service Testing for Web Hackers

Security Operations

Hacking web applications

Altitude SF 2017: Security at the edge

DEVNET-1186 Harnessing the Power of the Cloud to Detect Advanced Threats: Cog...

Web 2.0 Application Kung-Fu - Securing Ajax & Web Services

IBM AppScan Standard - The Web Application Security Solution

Hacking Web 2.0 - Defending Ajax and Web Services [HITB 2007 Dubai]

Security in the cloud protecting your cloud apps

Identify Zero-Day Breaches with Cognitive Threat Analytics on Cisco Web Secur...

How to protect your corporate from advanced attacks

Hide and seek - Attack Surface Management and continuous assessment.

AppSec EU 2016: Automated Mobile Application Security Assessment with MobSF

mobsf.pdf

2009: Securing Applications With Web Application Firewalls and Vulnerability ...

OWASP Top 10 And Insecure Software Root Causes

Hacking web applications

香港六合彩

Recently uploaded

Search and Society: Reimagining Information Access for Radical FuturesBhaskar Mitra

ODC, Data Fabric and Architecture User GroupCatarinaPereira64715

IOS-PENTESTING-BEGINNERS-PRACTICAL-GUIDE-.pptxAbida Shariff

Speed Wins: From Kafka to APIs in Minutesconfluent

Measures in SQL (a talk at SF Distributed Systems meetup, 2024-05-22)Julian Hyde

Mission to Decommission: Importance of Decommissioning Products to Increase E...Product School

UiPath Test Automation using UiPath Test Suite series, part 1DianaGray10

Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...Jeffrey Haguewood

AI revolution and Salesforce, Jiří KarpíšekCzechDreamin

Integrating Telephony Systems with Salesforce: Insights and Considerations, B...CzechDreamin

Powerful Start- the Key to Project Success, Barbara LaskowskaCzechDreamin

Demystifying gRPC in .Net by John StaveleyJohn Staveley

Unsubscribed: Combat Subscription Fatigue With a Membership Mentality by Head...Product School

Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered QualityInflectra

Custom Approval Process: A New Perspective, Pavel Hrbacek & Anindya HalderCzechDreamin

Introduction to Open Source RAG and RAG EvaluationZilliz

Free and Effective: Making Flows Publicly Accessible, Yumi IbrahimzadeCzechDreamin

To Graph or Not to Graph Knowledge Graph Architectures and LLMsPaul Groth

From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...Product School

Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024Tobias Schneck

Recently uploaded (20)

Search and Society: Reimagining Information Access for Radical Futures

ODC, Data Fabric and Architecture User Group

IOS-PENTESTING-BEGINNERS-PRACTICAL-GUIDE-.pptx

Speed Wins: From Kafka to APIs in Minutes

Measures in SQL (a talk at SF Distributed Systems meetup, 2024-05-22)

Mission to Decommission: Importance of Decommissioning Products to Increase E...

UiPath Test Automation using UiPath Test Suite series, part 1

Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...

AI revolution and Salesforce, Jiří Karpíšek

Integrating Telephony Systems with Salesforce: Insights and Considerations, B...

Powerful Start- the Key to Project Success, Barbara Laskowska

Demystifying gRPC in .Net by John Staveley

Unsubscribed: Combat Subscription Fatigue With a Membership Mentality by Head...

Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality

Custom Approval Process: A New Perspective, Pavel Hrbacek & Anindya Halder

Introduction to Open Source RAG and RAG Evaluation

Free and Effective: Making Flows Publicly Accessible, Yumi Ibrahimzade

To Graph or Not to Graph Knowledge Graph Architectures and LLMs

From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...

Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024

Web 2.0 Hacking

1. Web Application Security Assessments: Beyond the Automated Scanners Presented by: Blake Turrentine, [email_address] Date: August 25, 2008 Locale: DHS Conference and Workshops, Baltimore, MD

2. Scanning Web 1.0 Technology

3. Scanning Today’s Web 2.0 Technology

4. Mashups and Web Widgets

5. Beyond the Browser: Desktop Widgets

10.

11.

12.

13.

14.

15.

16.

17.

18.

19.

20.

21.

22.

23.

24.

25.

26.

27. Webmail Application Test: Combining Server & Client Attack Vectors

28. Webmail Application Test: IE Recognizes File as a HTML

29. Webmail Application Test: Session Cookie is Displayed

30. GMail Web Application Test: Screenshot of Attached file

31. GMail Web Application Test: IE Recognizes File as an HTML

32. GMail Web Application Test: Javascript Fires

33. Yahoo Mail Web Application Test: Creating an Email

34. Yahoo Mail Web Application Test: Contents of ‘Instructions.doc’

35. Yahoo Mail Web Application Test: Screenshot of Attached File

36. Yahoo Mail Web Application Test: Norton AV Scans File Before Download

37. Yahoo Mail Web Application Test: Javascript Fires

38. Yahoo Mail Web Application Test: Redirection to Another Site

39. Q u e s t i o n s ??

Web 2.0 Hacking

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Viewers also liked

Viewers also liked (8)

Similar to Web 2.0 Hacking

Similar to Web 2.0 Hacking (20)

Recently uploaded

Recently uploaded (20)

Web 2.0 Hacking