Known Drupal Vulnerabilities and OWASP’s Top10

▪ ▪ ▪ ▪ ▪ ▪

▪ ▪ ▪ ▪

▪ ▪ ▪ ▪ ▪ ▪ ▪ ▪ ▪

▪ ▪ ▪ ▪ ▪ ▪ ▪ ▪

▪ ▪ ▪

▪ ▪ ▪ ▪ ▪ ▪

▪ ▪ ▪ ▪ ▪ ▪ ▪ ▪

String query = "select * from customers where group =
"; query += request.getParameter("group"); rowMapper = new RowMapper<Customer>() { @Override public Customer mapRow(ResultSet rs, int rowNum) throws SQLException { return new Customer(rs.getLong("id"), rs.getString("first_name"), rs.getString("group")); } }; jdbcTemplate.query(query, new Object[] {}, rowMapper); http://host.tld/customers?group=12

String query = "select * from customers where group =
" query += request.getParameter("group"); jdbcTemplate.query(query, new Object[] {}, rowMapper); http://host.tld/query?group=1 OR 1=1 SELECT * FROM customers where group=1 OR 1=1

▪ ▪

▪ ▪ … ▪ ▪ … ▪ ▪ ▪ ▪

▪ ▪ ▪

<html> <h1>Comentarios</h1> <h3>Hola!</h3> <p><script>alert("Controlado por el intruso")</script></p> </html>

/hello?name=<script>alert(‘xss’)</script> <p>Hi <script>alert(‘xss’)</script></p> @RequestMapping("/hello") @ResponseBody protected String handleHello(HttpServletRequest request){ String
name = request.getParameter("name"); return String.format(“<p>Hi %s</p>", name); }

/hello?name=<script>alert(‘xss’)</script> <p>Hi <script>alert("xss")</script></p> Hi <script>alert(‘xss’)</script> import org.springframework.web.util.HtmlUtils; @RequestMapping("/hello") @ResponseBody protected
String handleHello(HttpServletRequest request){ String name = request.getParameter("name"); return String.format("<p>Hi %s</p>", HtmlUtils.htmlEscape(name)); }

▪ ▪ ▪

▪ ▪ <img src=http://home-banking.com/transfer?dst=1234&amount=3>

▪ •

▪ ▪

▪ …

▪ ▪ if not has_authorization(user, action, object): raise AuthorizationException(user, action,
object) action(user, object)

▪ ▪ ▪ ▪

Known Drupal Vulnerabilities and OWASP’s Top10

Known Drupal Vulnerabilities and OWASP’s Top10

andresriancho

More Decks by andresriancho

Other Decks in Technology

Featured

Transcript

▪ ▪ ▪ ▪ ▪ ▪

▪ ▪ ▪ ▪

▪ ▪ ▪ ▪ ▪ ▪ ▪ ▪ ▪

▪ ▪ ▪ ▪ ▪ ▪ ▪ ▪

▪ ▪ ▪

▪ ▪ ▪ ▪ ▪ ▪

▪ ▪ ▪ ▪ ▪ ▪ ▪ ▪

String query = "select * from customers where group =

String query = "select * from customers where group =

▪ ▪

▪ ▪ … ▪ ▪ … ▪ ▪ ▪ ▪

▪ ▪ ▪

<html> <h1>Comentarios</h1> <h3>Hola!</h3> <p><script>alert("Controlado por el intruso")</script></p> </html>

/hello?name=<script>alert(‘xss’)</script> <p>Hi <script>alert(‘xss’)</script></p> @RequestMapping("/hello") @ResponseBody protected String handleHello(HttpServletRequest request){ String

/hello?name=<script>alert(‘xss’)</script> <p>Hi <script>alert("xss")</script></p> Hi <script>alert(‘xss’)</script> import org.springframework.web.util.HtmlUtils; @RequestMapping("/hello") @ResponseBody protected

▪ ▪ ▪

▪ ▪ <img src=http://home-banking.com/transfer?dst=1234&amount=3>

▪ •

▪

▪ ▪

▪ ▪

▪ …

▪ ▪ if not has_authorization(user, action, object): raise AuthorizationException(user, action,

▪ ▪ ▪ ▪