Successfully reported this slideshow.
OWASP Top 10 Project Presented by ISAM Staff Tyler Hargis [GSEC, GWAS,GCIH] - and - Michael Morrison [GSEC, GWAS, CPTS, NS...
Overview <ul><li>Disclaimer </li></ul><ul><li>Common Misconceptions </li></ul><ul><li>Open Web Application Security Projec...
Disclaimer <ul><li>The information contained in this presentation is intended to be used to educate developers about secur...
Common Misconceptions <ul><li>Aren’t I protected by firewalls or something? </li></ul><ul><li>I thought you just needed to...
Open Web Application Security Project <ul><li>The Open Web Application Security Project (OWASP) is an open community dedic...
OWASP TOP 10 <ul><li>#1 Cross Site Scripting (XSS) Flaws </li></ul><ul><li>XSS flaws occur whenever an application takes u...
OWASP TOP 10 <ul><li>Cross Site Scripting (XSS) Recommendations </li></ul><ul><li>Input validation </li></ul><ul><li>Stron...
OWASP TOP 10 <ul><li>Cross Site Scripting (XSS) Recommendations </li></ul><ul><li>Java:  Use Struts output mechanisms such...
OWASP TOP 10 <ul><li>#2 Injection Flaws </li></ul><ul><li>Injection flaws, particularly SQL injection, are common in web a...
OWASP TOP 10 <ul><li>Injection Flaw Recommendations </li></ul><ul><li>Input validation.  </li></ul><ul><li>Use strongly ty...
OWASP TOP 10 <ul><li>Injection Flaw Recommendations </li></ul><ul><li>Java EE  - use strongly typed PreparedStatement, or ...
OWASP TOP 10 <ul><li>#3 Malicious File Execution </li></ul><ul><li>Code vulnerable to remote file inclusion (RFI) allows a...
OWASP TOP 10 <ul><li>Malicious File Execution Recommendations </li></ul><ul><li>Use an indirect object reference map (hash...
OWASP TOP 10 <ul><li>Malicious File Execution Recommendations </li></ul><ul><li>PHP : Disable allow_url_fopen and allow_ur...
OWASP TOP 10 <ul><li>#4 Insecure Direct Object Reference </li></ul><ul><li>A direct object reference occurs when a develop...
OWASP TOP 10 <ul><li>Insecure Direct Object Reference Recommendations </li></ul><ul><li>Avoid exposing your private object...
OWASP TOP 10 <ul><li>#5 Cross Site Request Forgery (CSRF) </li></ul><ul><li>A CSRF attack forces a logged-on victim's brow...
OWASP TOP 10 <ul><li>Cross Site Request Forgery (CSRF) Recommendations </li></ul><ul><li>Ensure that there are no XSS vuln...
OWASP TOP 10 <ul><li>#6 Information Leakage and Improper Error Handling  </li></ul><ul><li>Applications can unintentionall...
OWASP TOP 10 <ul><li>#7 Broken Authentication and Session Management </li></ul><ul><li>Account credentials and session tok...
OWASP TOP 10 <ul><li>#8 Insecure Cryptographic Storage </li></ul><ul><li>Web applications rarely use cryptographic functio...
OWASP TOP 10 <ul><li>#9 Insecure Communications </li></ul><ul><li>Applications frequently fail to encrypt network traffic ...
OWASP TOP 10 <ul><li>#10 Failure to Restrict URL Access </li></ul><ul><li>Frequently, an application only protects sensiti...
How Do I Protect My Applications? <ul><li>Take advantage of free sites like OWASP for details on remediating the vulnerabi...
How Can DoIT Help? <ul><li>Inspections by ISAM will reveal many common vulnerabilities in applications as well as systems....
Practice Sites <ul><li>WebGoat </li></ul><ul><ul><li>http://www.owasp.org/index.php/Category:OWASP_WebGoat_Project </li></...
Practice Sites <ul><li>The Web Hacking Incidents Database http://packetstormsecurity.org/papers/attack/Web-Hacking-Inciden...
Upcoming SlideShare
Loading in …5
×

OWASP Top10 2010

3,618 views

Published on

The goal of the Top 10 project is to raise awareness about application security by identifying some of the most critical risks facing organizations. The Top 10 project is referenced by many standards, books, tools, and organizations, including MITRE, PCI DSS, DISA, FTC, and many more. This release of the OWASP Top 10 marks this project’s eighth year of raising awareness of the importance of application security risks. The OWASP Top 10 was first released in 2003, minor updates were made in 2004 and 2007, and this is the 2010 release.

Published in: Technology
  • Be the first to comment

OWASP Top10 2010

  1. 1. OWASP Top 10 Project Presented by ISAM Staff Tyler Hargis [GSEC, GWAS,GCIH] - and - Michael Morrison [GSEC, GWAS, CPTS, NSA IAM]
  2. 2. Overview <ul><li>Disclaimer </li></ul><ul><li>Common Misconceptions </li></ul><ul><li>Open Web Application Security Project </li></ul><ul><li>OWASP Top Vulnerabilities </li></ul><ul><li>Conclusion </li></ul><ul><li>Q&A </li></ul>
  3. 3. Disclaimer <ul><li>The information contained in this presentation is intended to be used to educate developers about security vulnerabilities commonly found in Web Applications. </li></ul><ul><li>This presentation is not intended as training material for those with malicious intent against information systems. </li></ul><ul><li>Exploitation of the vulnerabilities listed in this presentation on systems or applications not owned or developed by the viewer is illegal in jurisdictions worldwide. </li></ul><ul><li>It is a violation of the University of Missouri Acceptable Use policy to transmit these exploits across the MU network without explicit permission of the system or application owner they are directed at. </li></ul><ul><li>The presenters are trained professionals, don’t try this at home… </li></ul>
  4. 4. Common Misconceptions <ul><li>Aren’t I protected by firewalls or something? </li></ul><ul><li>I thought you just needed to keep things patched? </li></ul><ul><li>I’m not using Microsoft, so I must be secure. </li></ul><ul><li>Isn’t keeping me secure your job? </li></ul>
  5. 5. Open Web Application Security Project <ul><li>The Open Web Application Security Project (OWASP) is an open community dedicated to enabling organizations to develop, purchase, and maintain applications that can be trusted. </li></ul><ul><li>All of the OWASP tools, documents, forums, and chapters are free and open to anyone interested in improving application security. </li></ul><ul><li>http://www.owasp.org </li></ul>
  6. 6. OWASP TOP 10 <ul><li>#1 Cross Site Scripting (XSS) Flaws </li></ul><ul><li>XSS flaws occur whenever an application takes user supplied data and sends it to a web browser without first validating or encoding that content. </li></ul><ul><li>XSS allows attackers to execute script in the victim's browser which can hijack user sessions, deface web sites, possibly introduce worms, etc. </li></ul>
  7. 7. OWASP TOP 10 <ul><li>Cross Site Scripting (XSS) Recommendations </li></ul><ul><li>Input validation </li></ul><ul><li>Strong output encoding </li></ul><ul><li>Specify the output encoding </li></ul><ul><li>Do not use &quot;blacklist&quot; validation </li></ul><ul><li>Watch out for canonicalization errors </li></ul>
  8. 8. OWASP TOP 10 <ul><li>Cross Site Scripting (XSS) Recommendations </li></ul><ul><li>Java: Use Struts output mechanisms such as <bean:write … >, or use the default JSTL escapeXML=&quot;true&quot; attribute in <c:out … >. </li></ul><ul><li>.NET: Use the Microsoft Anti-XSS Library 1.5 freely available from MSDN. Understand which .NET controls automatically encode output data. </li></ul><ul><li>PHP: Ensure output is passed through htmlentities() or htmlspecialchars() or use the soon to be released OWASP PHP Anti-XSS library. Disable register_globals if it is not already disabled </li></ul>
  9. 9. OWASP TOP 10 <ul><li>#2 Injection Flaws </li></ul><ul><li>Injection flaws, particularly SQL injection, are common in web applications. Injection occurs when user-supplied data is sent to an interpreter as part of a command or query. The attacker's hostile data tricks the interpreter into executing unintended commands or changing data. </li></ul>
  10. 10. OWASP TOP 10 <ul><li>Injection Flaw Recommendations </li></ul><ul><li>Input validation. </li></ul><ul><li>Use strongly typed parameterized query APIs </li></ul><ul><li>Enforce least privilege when connecting to databases </li></ul><ul><li>Avoid detailed error messages </li></ul><ul><li>Show care when using stored procedures </li></ul><ul><li>Do not use dynamic query interfaces </li></ul><ul><li>Do not use simple escaping functions - simple escaping functions cannot escape table names! </li></ul><ul><li>Watch out for canonicalization errors </li></ul>
  11. 11. OWASP TOP 10 <ul><li>Injection Flaw Recommendations </li></ul><ul><li>Java EE - use strongly typed PreparedStatement, or ORMs such as Hibernate or Spring </li></ul><ul><li>.NET - use strongly typed parameterized queries, such as SqlCommand with SqlParameter or an ORM like Hibernate. </li></ul><ul><li>PHP - use PDO with strongly typed parameterized queries (using bindParam()) </li></ul>
  12. 12. OWASP TOP 10 <ul><li>#3 Malicious File Execution </li></ul><ul><li>Code vulnerable to remote file inclusion (RFI) allows attackers to include hostile code and data, resulting in devastating attacks, such as total server compromise. Malicious file execution attacks affect PHP, XML and any framework which accepts filenames or files from users. </li></ul>
  13. 13. OWASP TOP 10 <ul><li>Malicious File Execution Recommendations </li></ul><ul><li>Use an indirect object reference map (hash the reference) </li></ul><ul><li>Use explicit taint checking mechanisms, if supported (see OWASP) </li></ul><ul><li>Strongly validate user input </li></ul><ul><li>Add firewall rules </li></ul><ul><li>Check any user supplied files or filenames </li></ul><ul><li>Consider implementing a chroot jail or virtualization (sand box mechanisms) </li></ul>
  14. 14. OWASP TOP 10 <ul><li>Malicious File Execution Recommendations </li></ul><ul><li>PHP : Disable allow_url_fopen and allow_url_include in php.ini </li></ul><ul><li>PHP : Disable register_globals and use E_STRICT to find uninitialized variables </li></ul><ul><li>PHP : Ensure that all file and streams functions (stream_*) are carefully vetted. </li></ul><ul><li>PHP : Be extremely cautious if data is passed to system() eval() passthru() or ` (the backtick operator) </li></ul><ul><li>J2EE , ensure that the security manager is enabled and properly configured and that the application is demanding permissions appropriately </li></ul><ul><li>ASP.NET , please refer to the documentation on partial trust, and design your applications to be segmented in trust, so that most of the application exists in the lowest possible trust state possible </li></ul>
  15. 15. OWASP TOP 10 <ul><li>#4 Insecure Direct Object Reference </li></ul><ul><li>A direct object reference occurs when a developer exposes a reference to an internal implementation object, such as a file, directory, database record, or key, as a URL or form parameter. Attackers can manipulate those references to access other objects without authorization. </li></ul>
  16. 16. OWASP TOP 10 <ul><li>Insecure Direct Object Reference Recommendations </li></ul><ul><li>Avoid exposing your private object references to users whenever possible, such as primary keys or filenames </li></ul><ul><li>Validate any private object references </li></ul><ul><li>Verify authorization to all referenced objects </li></ul>
  17. 17. OWASP TOP 10 <ul><li>#5 Cross Site Request Forgery (CSRF) </li></ul><ul><li>A CSRF attack forces a logged-on victim's browser to send a pre-authenticated request to a vulnerable web application, which then forces the victim's browser to perform a hostile action to the benefit of the attacker. CSRF can be as powerful as the web application that it attacks. </li></ul>
  18. 18. OWASP TOP 10 <ul><li>Cross Site Request Forgery (CSRF) Recommendations </li></ul><ul><li>Ensure that there are no XSS vulnerabilities in your application </li></ul><ul><li>Insert custom random tokens into every form and URL (For ASP.NET, set a ViewStateUserKey.) </li></ul><ul><li>For sensitive data or value transactions, re-authenticate or use transaction signing </li></ul><ul><li>Do not use GET requests (URLs) for sensitive data or to perform value transactions. </li></ul><ul><li>POST alone is insufficient a protection. </li></ul>
  19. 19. OWASP TOP 10 <ul><li>#6 Information Leakage and Improper Error Handling </li></ul><ul><li>Applications can unintentionally leak information about their configuration, internal workings, or violate privacy through a variety of application problems. Attackers use this weakness to steal sensitive data, or conduct more serious attacks. </li></ul>
  20. 20. OWASP TOP 10 <ul><li>#7 Broken Authentication and Session Management </li></ul><ul><li>Account credentials and session tokens are often not properly protected. Attackers compromise passwords, keys, or authentication tokens to assume other users' identities. </li></ul>
  21. 21. OWASP TOP 10 <ul><li>#8 Insecure Cryptographic Storage </li></ul><ul><li>Web applications rarely use cryptographic functions properly to protect data and credentials. Attackers use weakly protected data to conduct identity theft and other crimes, such as credit card fraud. </li></ul>
  22. 22. OWASP TOP 10 <ul><li>#9 Insecure Communications </li></ul><ul><li>Applications frequently fail to encrypt network traffic when it is necessary to protect sensitive communications. </li></ul>
  23. 23. OWASP TOP 10 <ul><li>#10 Failure to Restrict URL Access </li></ul><ul><li>Frequently, an application only protects sensitive functionality by preventing the display of links or URLs to unauthorized users. Attackers can use this weakness to access and perform unauthorized operations by accessing those URLs directly. </li></ul>
  24. 24. How Do I Protect My Applications? <ul><li>Take advantage of free sites like OWASP for details on remediating the vulnerabilities demonstrated today. ( http://www.owasp.org/index.php/Top_10_2007-Where_to_Go_From_Here ) </li></ul><ul><li>Fortify Source Code Analyzer is available at a reduced cost from DoIT. </li></ul><ul><li>Security Training of any type (DoIT, SANS, etc.) </li></ul>
  25. 25. How Can DoIT Help? <ul><li>Inspections by ISAM will reveal many common vulnerabilities in applications as well as systems. </li></ul><ul><li>Our Tipping Point IPS blocks many attacks, but is not a good substitute for solid programming. </li></ul><ul><li>MU Root SSL Certificates and Verisign Certificates are Available </li></ul>
  26. 26. Practice Sites <ul><li>WebGoat </li></ul><ul><ul><li>http://www.owasp.org/index.php/Category:OWASP_WebGoat_Project </li></ul></ul><ul><ul><li>Requires a Java Virtual Machine be available on the local machine, and runs from the local machine. </li></ul></ul><ul><li>HACME Bank / HACME Books </li></ul><ul><ul><li>http://www.foundstone.com </li></ul></ul><ul><ul><li>Note you will have to install these on a system you can run an appropriate web server on. </li></ul></ul><ul><li>Hack This Site! </li></ul><ul><ul><li>http://www.hackthissite.org/ </li></ul></ul><ul><li>Bright Shadows Challenges </li></ul><ul><ul><li>http://www.bright-shadows.net/ </li></ul></ul>
  27. 27. Practice Sites <ul><li>The Web Hacking Incidents Database http://packetstormsecurity.org/papers/attack/Web-Hacking-Incidents-Database-Annual-Report-2007.pdf </li></ul><ul><li>UM System Database Hacked http://www.techshout.com/internet/2007/09/university-of-missouri-system-database-hacked-over-22000-social-security-numbers-stolen/ </li></ul><ul><li>YGN Ethical Hacker Group (WebGoat Videos) http://yehg.net/lab/pr0js/training/webgoat.php </li></ul>

×