CSCD27 Web Security

Web Security Thierry Sans

1991 Sir Tim Berners-Lee

2014 Collaboration Customer Resources Managemen Accounting and Billing Content Management
E-Learning E-Health Publishing Web Portals Social Networks

Web security is a major concern

The Big Picture

The web architecture Server Side Client Side Web Server Database
Web Browser

Securing the web architecture means securing ... • The network
• The DNS (Domain Name System) • The web server operating system • The web server application (Apache for instance) • The database application (Oracle for instance) • The web application Our focus here!

What is a web application? program running   on the
browser + program running   on the server

The State of Web Security

How big is the threat? Statistics based on data collected
by the Whitehat security tool that monitors15,000 websites source “WhiteHat Website Security Statistics report 2013” from WhiteHat Security

Overall Vulnerability Population source “WhiteHat Website Security Statistics report 2013”
from WhiteHat Security What are the attacks?

Average Number of Vulnerabilities (based on 7000 websites) source “WhiteHat
Website Security Statistics report 2012” from WhiteHat Security Who is vulnerable?

Anatomy of a web application

The HTTP protocol Network protocol for requesting/receiving data on the
Web • Standard TCP protocol on port 80 (by default) • URI/URL speciﬁes what resource is being accessed • Different request methods

Let’s look at what a web server does > telnet
whitehat.local 80 GET / telnet to a web server enter HTTP requests

Anatomy of a URL http://whitehat.local/index.php?filter=hello protocol server query string path
resource get parameters

Authentication and Authorization ✓ Authentication • Who are the authorized
users?  ✓ Authorization • Who can access what and how?

The simple recipe for user authentication 1. Ask the user
for a login and password and send it to the server (HTTP/POST request) 2. Verify the login/password based on information stored on the server (usually in the database) 3. Start a session once the user has been authenticated 4. Grant access to resources according to the session

The concept of session There is a session id (aka
token)   between the browser and the web application This session id should be unique and unforgeable   (usually a long random number or a hash) ➡ Stored in the cookie The session id is bind to key/value pairs data ➡ Stored on the server

The big picture Web Server Web Browser HTTP request HTTP
response HTTP request HTTP response Cookie : key/value pairs stored in the requests The user can create, modify, delete the session ID in the cookie Session : key/value pairs stored on the server But cannot access the key/value pairs stored on the server

Hacking Authentication

How to steal user’s credentials • Brute force the password
• Brute force the session ID • Steal the user’s password • Steal the user’s session ID

Where to start? password = 123456 password = 123456 password
= 123456

Do you trust the network? interesting! id=scACRSm... <html><... ๏ An
attacker can eavesdrop messages sent back and forth

Do you really trust the network? I am id=scACRSm... <html><...
๏ An attacker can tamper with messages sent back and forth

Conﬁdentiality and Integrity Conﬁdentiality: how do exchange information secretly? ✓
Encryption Integrity: How do we exchange information reliably? ✓ Digital Signature

Generic solution - HTTPS ➡ SSL provides • end-to-end secure
channel (conﬁdentially) • authentication handshake (integrity) ✓ HTTPS = HTTP + SSL 

When to use HTTPS? We need to protect • Login
and password • Session ID ✓ HTTPS must be used during the entire session

Limitation of HTTPS password = 123456 password = 123456 E#%FY7*5EZ$#G

Stealing passwords from the client • Social engineering - Phishing
• Keyloggers (keystroke logging) • Data mining (emails, logs) • Hack the client’s code

Stealing passwords from the server • Hack the server •
Hack the server’s side code

Hacking the Client’s Side Code

Client side’s attacks Incomplete Mediation ➡ hijacking the interactions between
the client and the server Content Spooﬁng ➡ inject arbitrary HTML content into a webpage CSRF ➡ inject arbitrary urls into a webpage XSS ➡ inject arbitrary Javascript code into a webpage

Incomplete Mediation  The shopping cart attack order=(#2956,10,9,90) Server Trusted Domain
Client Trusted Domain * Notice that Amazon is not vulnerable to this attack * Thank you for your order! The total is calculated by a script on the client The order is generated based on the request 10

comment = “<a href=”myad.com”>Fun stuff ... * Notice that Youtube
is not vulnerable to this attack GET /?videoid=527 <html ... GET /?videoid=527 <html ... Content Spooﬁng  injecting arbitrary HTML content into a webpage The page contains the attacker’s code.

GET View/?profileid=53 GET Delete/?profileid=53 ??? ...... GET setProfile/?url=Delete/?profileid=53 GET View/?profileid=86
<img src=”Delete/?profileid=53 GET Delete/?profileid=53 Hey Alice, check my proﬁle id url name 53 www.alice.com/ profilepic Alice 86 www.badwebsite.com/ Delete/?imageid=53 Charlie www.badwebsite.com <img src=”www.alice.com/profilepic Done! profileid=86 GET profilepic www.alice.com CSRF attack  injecting arbitrary urls into a webpage

comment = “<script> ... * Notice that Youtube is not
vulnerable to this attack login=Alice&password=123456 GET /?videoid=527 <html ... GET /?videoid=527 <html ... The script contained in the comments modiﬁes the page to look like the login page! XSS attack  injecting arbitrary javascript into a webpage

Scope of XSS attacks ๏ Inject illegitimate content in the
page  (same as content spooﬁng) ๏ Perform illegitimate HTTP requests through Ajax   (same as a CSRF attack) ๏ Steal Session ID from the cookie ๏ Steal user’s login/password by modifying the page to forge a perfect scam

It gets worst - XSS Worms Spread on social networks
• Samy targeting MySpace (2005) • JTV.worm targeting Justin.tv (2008) • Twitter worm targeting Twitter (2010)

Hacking the Server’s Side Code

Server’s side attacks SQL injection ➡ inject arbitrary SQL code
executed on the server’s database File inclusion ➡ inject arbitrary code executed on the server

SQL Injection Attack inject arbitrary SQL code executed on the
server’s database Access Deny! name=Alice&pwd=123456 checkPassword.php loginPage.html 123456’ OR ‘1’=‘1 Access Granted! <?php $uid = SQLQuery("SELECT uid FROM LoginTable WHERE login=" . $_POST['name'] . "AND password =" . $POST['pwd ']); if ($uid) echo "Access Granted"; else echo "Access Denied"; ?>

Scope of SQL injection attacks ๏ retrieves, adds, modiﬁes, deletes
arbitrary information ๏ bypasses authentication ๏ installs a reverse shell

File Inclusion Attack  inject arbitrary code executed on the server

Web Penetration Testing

Web application security tools • Proxy mapper • Vulnerability scanner
• Replay HTTP requests • (Exploit tool) Nikto Burp Suite W3af Acunetix AppScan Vega Commercial Open Source … among others

Conclusion Server Side Client Side Web Server Database Web Browser
You have absolutely no control on the client

References • Mozilla Secure Coding Guideline  https://wiki.mozilla.org/WebAppSec/Secure_Coding_Guidelines • Ruby on
Rails Security Page  http://guides.rubyonrails.org/security.html • Django Security Page  https://docs.djangoproject.com/en/dev/topics/security/ • PHP Security Pages  http://php.net/manual/en/security.php  http://phpsec.org/projects/guide/

CSCD27 Web Security

CSCD27 Web Security

More Decks by ThierrySans

Featured

Transcript