XSS vulnerabilities allow attackers to inject malicious scripts into web pages viewed by other users. There are three main types: stored XSS injects scripts into stored data like forums; reflected XSS uses malicious links; DOM-based XSS modifies the DOM. Successful XSS can steal users' cookies and passwords, hijack sessions, deface websites, and distribute malware. Developers can prevent XSS by escaping untrusted data, using safe templating systems, and implementing a content security policy.

1. Security App. web
Ivan Ortega
Benjamin Porta

2. A1: SQL Injection
SQL injection is a technique where malicious users can
inject SQL commands into an SQL statement, via web page
input.
Injected SQL commands can alter SQL statement and
compromise the security of a web application.
SQL injection is considered one of the top 10 web
application vulnerabilities of 2007 and 2010

3. WARNING
In its most common form, a SQL injection attack gives
access to sensitive information such as social
security numbers, credit card numbers or other
financial data. SQL injection is one of the most
prevalent types of web application security
vulnerability.

4. Reasons
Incorrectly filtered escape characters
Incorrect type handling
' OR '1'='1' --
' OR '1'='1' ({
' OR '1'='1' /*
1;DROP TABLE users

5. Preventing SQL Injection 1 / 2
● Adopt an input validation technique in which user
input is authenticated against a set of defined
rules for length, type and syntax.
● Users with the permission to access the database
must have the least privileges. Also, you should
always make sure that a database user is created
only for a specific application and this user is
not able to access other applications.

6. Preventing SQL Injection 2 / 2
● Use strongly typed parameterized query APIs
with placeholder substitution markers, even
when calling stored procedures.
● Show care when using stored procedures can be
injectable (such as via the use of exec() or
concatenating arguments within the stored
procedure).

7. Environment / Context 1/3
CLIENT
SERVER
(php)
SQLClient send data
to server

8. Environment / Context 2/3
CLIENT
SERVER
(php)
SQL
You must verify
data before
sending them to
server

9. Environment / Context 3/3
CLIENT
SERVER
(php)
SQLData are sent to server
(treated with php) and then,
they are sent to client
SQL can protect from
DROP and ALTER if
parametrized

10. Example 1: Injection 1/3
This program is web page link to an SQL
database which show the list of movies
present in database and allow anyone to add a
new entry in database.
Movie 1: Normal use case

11. Example 1: Injection 2/3
But we can easily attack this web page because
server doesn't check presence of javascript from
inputs added by users. We will show an example of
possible attack (injection of javascript code) on
this web page.
With this attack, each client is affected !!!
Movie 1: Attack use case

12. Example 1: Injection 3/3
To prevent of this kind of attack, we have to
block all the javascript which provide from
user, to do it, it's very simple, we have to
use a specific method from php, strip_tags().
It remove tags "<" and ">" but also tags like
"&lt;" and "&gt;"
Movie 1: Prevent use case

13. Example 2: SQL Injection 1/3
This program is a web page link to an SQL
database that show the list of users present
in database and allow anyone to subscribe. If
you are subscribed, you can log in.
Movie 2: Normal use case

14. Example 2: SQL Injection 2/3
The attack consist in connect and steal all personal informations of
an user with his login but without his password. It’s simple, a
request look like this:
$query = "SELECT * FROM user WHERE pseudo='".$p."' AND
mdp='".$pass."' ";
So attacker can inject a code after his pseudo (' -- ) and the end
of the request SQL will be interpreted as:
SELECT * FROM user WHERE pseudo='PSEUDO' -- AND mdp='WHATYOUWANT'
As you can see, AND mdp='...' is interpreted as a commentary!
Movie 2: Attack use case

15. Example 2: SQL Injection 3/3
To prevent of this kind of attack, use:
mysqli_real_escape_string() or bin2hex()
$link = mysqli_connect("127.0.0.1", "root", "", "secuweb");
$login = mysqli_real_escape_string($link,$login);
$user = $ins->getUserFromPseudoAndPassword($login,$pass);
Then, the input string change and replace ' -- to ' --
Movie 2: Prevent use case

16. Exemple 3: SQL Injection* 1/2
In reality, a lot of problems induced by SQL injection
are already fixed. For example in php, you can’t submit
multiple request to mysql without using mysqli->multi_query
Probably because it is very dangerous. You can modify data,
table and also delete them.
For this example, mysqli_real_escape_string
is deactivated.
Movie 3: Multi-request attack

17. Exemple 3: SQL Injection* 2/2
Allow only what is
necessary to an user, it
can prevent a lot of
actions

18. About SQL injection
Finally, it’s not difficult to prevent from SQL
injection, problem provides from webmaster because
they don’t check all cases of possible attack. There
is a lot of way to secure data inputted like methods
quoted before or others as preparation of request with
bindParam.
FIN de la partie 1

19. OwaspA3
CrossSiteScripting
XSS

20. CrossSiteScripting
1. What is it?
2. Types of XSS
3. Consequences
4. OWASP Prevention Cheat
Sheet
5. Testing my application

21. CrossSiteScripting
1. What is it?
2. Types of XSS
3. Consequences
4. OWASP Prevention Cheat
Sheet
5. Testing my application

22. What is it?
XSS attacks are a type of
injection
An attacker uses a web application to send malicious scripts
which will be executed when the page is built

23. Howcaniinjectcode?

24. CrossSiteScripting
1. What is it?
2. Types of XSS
3. Consequences
4. OWASP Prevention Cheat
Sheet
5. Testing my application

25. Types of Cross-Site Scripting
Stored XSS (Persistent or Type I)
Reflected XSS (Non-Persistent or Type II)
DOM Based XSS (Type-0)

26. Stored XSS
Most frequent vulnerabilities sites: where user input is
stored on the target server, such as in a database, in a
message forum, visitor log, comment field, etc.
Attacker use this input to inject
The injected script is permanently stored on the target
servers.
The victim then retrieves the malicious script from the
server when it requests the stored information.

28. StoredXSS

29. Reflected XSS
The injected script is reflected off the web server, such as
response that includes some or all of the input sent to the
server as part of the request
Reflected attacks are delivered to victims via another
route, such as in an e-mail message, or on some other web
site.

30. Reflected XSS
Then the user click on a malicious link that contain XSS
injection as part of request to “trusted site” which
reflects the attack back to the user’s browser.
The browser then executes the code because it came from a
"trusted" server.

32. Reflected xss-ExecutingJS
ReflectedXSS-Phishing

33. DOM Based XSS
It’s an XSS attack wherein the attack payload is executed as
a result of modifying the DOM in the victim’s browser used
by the original client side script.

35. Ihavebeenattacked!
Whathappennow?

36. CrossSiteScripting
1. What is it?
2. Types of XSS
3. Consequences
4. OWASP Prevention Cheat
Sheet
5. Testing my application

37. Consequences
The consequences are the same although it
changes the type of XSS

38. Consequences
The consequences are the same although it
changes the type of XSS
ACCESS TO EXECUTE JAVASCRIPT
cookies, user files, installation of Trojan
horse programs, redirect the user to some
other page, modify presentation of content...

39. Whatcanidoto
preventXSSattacks?

40. CrossSiteScripting
1. What is it?
2. Types of XSS
3. Consequences
4. OWASP Prevention Cheat
Sheet
5. Testing my application

41. owaspPreventionCheatSheet
https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)
_Prevention_Cheat_Sheet
7 RULES TO PREVENT XSS
“Many organizations may find that allowing
only Rule #1 and Rule #2 are sufficient for
their needs.”

42. owaspPreventionCheatSheet
RULE#1-HTMLEscapeBeforeInsertingUntrustedDatainto
HTMLElementContent
<body>...ESCAPE UNTRUSTED DATA BEFORE PUTTING HERE...</body>
<div>...ESCAPE UNTRUSTED DATA BEFORE PUTTING HERE...</div>
any other normal HTML elements
& --> &amp;
< --> &lt;
> --> &gt;
" --> &quot;
' --> &#x27;

43. owaspPreventionCheatSheet
RULE#2-AttributeEscapeBeforeInsertingUntrustedData
intoHTMLCommonAttributes
<div attr=...ESCAPE UNTRUSTED DATA BEFORE PUTTING HERE...>content</div>
inside UNquoted attribute
<div attr='...ESCAPE UNTRUSTED DATA BEFORE PUTTING HERE...'>content</div>
inside single quoted attribute
<div attr="...ESCAPE UNTRUSTED DATA BEFORE PUTTING HERE...">content</div>
inside double quoted attribute

44. owaspPreventionCheatSheet
RULE#1-5-
EscapeBeforeInsertingUntrustedData
intoHTML

45. owaspPreventionCheatSheet
RULE#1-5-EscapeBeforeInsertingUntrustedDataintoHTML
HOW CAN I ESCAPE
UNTRUSTED DATA?

46. owaspPreventionCheatSheet
RULE#1-5-EscapeBeforeInsertingUntrustedDataintoHTML
https://www.owasp.org/index.php/PHP_Security_Cheat_Sheet#XSS_Cheat_Sheet

47. escapinghtmlwithphp
Filteringuserinputwithphp

48. owaspPreventionCheatSheet
RULE#6-SanitizeHTMLMarkupwithaLibraryDesignedfor
theJob
● HtmlSanitizer - https://github.com/mganss/HtmlSanitizer
● OWASP AntiSamy - https://www.owasp.org/index.php/Category:
OWASP_AntiSamy_Project
● PHP Html Purifier - http://htmlpurifier.org/
● JavaScript/Node.JS Bleach - https://github.com/ecto/bleach
● Python Bleach - https://pypi.python.org/pypi/bleach

49. owaspPreventionCheatSheet
RULE#6-SanitizeHTMLMarkupwithaLibraryDesignedfortheJob
HtmlSanitizer - https://github.com/mganss/HtmlSanitizer
An open-source .Net library.
The HTML is cleaned with a white list approach.

50. owaspPreventionCheatSheet
RULE#7-PreventDOM-basedXSS
Testing Tools and Techniques
● The DOMinator Tool - A commercial tool based on the Firefox browser with modified
Spidermonkey Javascript engine that helps testers identify and verify DOM based XSS flaws
https://dominator.mindedsecurity.com/
● The DOM XSS Wiki - The start of a Knowledgebase for defining sources of attacker
controlled inputs and sinks which could potentially introduce DOM Based XSS issues. http://code.
google.com/p/domxsswiki/
● DOM Snitch - An experimental Chrome extension that enables developers and testers to
identify insecure practices commonly found in client-side code. From Google. http://code.
google.com/p/domsnitch/
Defense Techniques
https://www.owasp.org/index.php/DOM_based_XSS_Prevention_Cheat_Sheet

51. owaspPreventionCheatSheet:RESUME
RULE#0-NeverInsertUntrustedDataExceptinAllowedLocations
RULE#1-#5:ESCAPEUNTRUSTEDDATA
RULE#6-SanitizeHTMLMarkupwithaLibraryDesignedfortheJob
RULE#7-PreventDOM-basedXSS

52. owaspPreventionCheatSheet: BONUSRULES
4 BONUS RULES
Bonus Rule #1: Use HTTPOnly cookie flag
Bonus Rule #2: Implement Content Security Policy
Bonus Rule #3: Use an Auto-Escaping Template System
Bonus Rule #4: Use the X-XSS-Protection Response Header

53. owaspPreventionCheatSheet: BONUSRULES
BonusRule#1:UseHTTPOnlycookieflag
To help mitigate the impact of an XSS flaw on your site, OWASP also
recommends you set the HTTPOnly flag on your session cookie and any custom
cookies you have that are not accessed by any Javascript you wrote.
PHP
JAVA
PYTHON

54. owaspPreventionCheatSheet: BONUSRULES
BonusRule#2:ImplementContentSecurityPolicy
No execute any inline script if it isn’t declare in CSP whitelist.
Whitelists “safe” scripts hosts
default-src
script-src
style-src
img-src
frame-src
OWASP PAGE: https://www.owasp.org/index.php/Content_Security_Policy

55. owaspPreventionCheatSheet: BONUSRULES
BonusRule#3:UseanAuto-EscapingTemplateSystem
Many web application frameworks provide automatic contextual escaping functionality such as AngularJS
strict contextual escaping.

56. owaspPreventionCheatSheet: BONUSRULES
BonusRule#4:UsetheX-XSS-ProtectionResponseHeader
This HTTP response header enables the Cross-site scripting
(XSS) filter built into some modern web browsers.
Re-enable if the user disable the option for some sites.

57. Ifinishmywebsite
Howcanitestit?

58. CrossSiteScripting
1. What is it?
2. Types of XSS
3. Consequences
4. OWASP Prevention Cheat
Sheet
5. Testing my application

59. vulnerabilitytest
OWASP testing guide: https://www.owasp.org/index.
php/Testing_for_Cross_site_scripting
Tools
● OWASP CAL9000 - http://www.owasp.org/index.php/Category:
OWASP_CAL9000_Project
“CAL9000 includes a sortable implementation of RSnake's XSS Attacks,
Character Encoder/Decoder, HTTP Request Generator and Response
Evaluator, Testing Checklist, Automated Attack Editor and much more.”
It's hosted at: http://sec101.sourceforge.net/CAL9000/
● PHP Charset Encoder(PCE) - http://yehg.net/encoding
● HackVector(HVR) - http://www.businessinfo.co.
uk/labs/hackvertor/hackvertor.php

60. Thisattack...
Exist?

61. AccordingtotheWebHackingIncidentDatabase,11.3%ofwebattacksutilizeXSS.(2014)

62. Iunderstandnothing.
questions?