Downloaded 27 times
More Related Content
Similar to Lesson 6 web based attacks
Lesson 6 web based attacks
- 1. Web Based Attacks CNG275Frank H. Vianzon
- 2. Why Web Attacks? •Everything is on the web – Banking portals – E-commerce – Admin interfaces • Traditional Firewalls do not block
- 3. OWASP OWASP is theOpen Web Application Security Project www.owasp.org worldwide not-for-profit charitable organization focused on improving the security of software. Our mission is to make software security visible, so that individuals and organizations worldwide can make informed decisions about true software security risks.
- 4. OWASP TOP 10 •A1-Injection • A2-Broken Authentication and Session Management • A3-Cross-Site Scripting • A4-Insecure Direct Object References
- 5. • A5 –Security Misconfiguration • A6- Sensitive Data Exposure • A7-Missing Function Level Access Control • A8 –Cross-Site Request Forgery
- 6. • A9 –Using components with known vulnerabilities • A10-unvalidated redirects
- 7.
- 8. Basics – HTTPProtocol HTTP is the base of the web, it's really important to have a deep understanding of this protocol in order to perform web security testing. Knowing and understanding HTTP specificities will often allow you to find vulnerabilities and exploit them.
- 9. Client-Server Dialog HTTP isa dialog between one client and one server. The client, the browser, sends a request to the server, and then the server responds to this request. HTTP has the advantages of being a text protocol and therefore really easy to read, understand and learn for a human being. By default, most web servers are available on port TCP/80.
- 10. HTTPS Start with TCP3 way handshake SYN SYN-ACK ACK
- 11.
- 12.
- 13. How do wesee certificates? • Internet Explorer – Tools Internet Options Content Certificates • Firefox – Tools options Advance Certificates • Chrome – Bar Settings Advance HTTPS/SSL Managed Certificates
- 14. Cookies Used to trackuser activity Same origin policy blocks
- 15. Name that site •DNS resolution occurs after typing the name of a web browser
- 16. • The mostcommon request occurs when a browser asks the server for content. The browser sends a request composed of the following elements: • An HTTP method that will allow the server to understand what kind of operation the browser wants to perform.
- 17. • A resourcethat corresponds to what the client is trying to access on the server. • A version that will allow the server to know what version of HTTP the browser is talking. (user agent string) • Optionally, various headers giving more information to the server like the browser's name and version, the preferred language of the user (like in English, German, French,...),
- 18. HTTP Methods Many HTTPmethods exist: • The GET method: to request for content, it's the most common request sent by browsers; • The POST method: POST is used to send a larger amount of data, it's used by most forms and also for file upload.
- 19. • The HEADmethod: the HEAD method is very similar to the GET request, the only difference is in the response provided by the server, the response will only contain the headers and no body. HEAD is massively used by web spiders to check if a web page has been updated without downloading the full page content. • There are many other HTTP methods: PUT, DELETE, PATCH, TRACE
- 20. HTTP Headers • HTTPrequests contain a lot of HTTP Headers. You can obviously manipulate all of them but if you provide incorrect values the request is likely to be rejected or the header won't be used.
- 21. Example Headers • Referer:to know where the clients come from; • Cookie: to retrieve the cookies; • User-Agent: to know what browser users use; • X-Forwarded-For: to get the source IP address (even if it's not the best method to do this).
- 22.
- 23. Common HTTP Response Codes •200 OK: the request was processed successfully. • 302 Found: used to redirect users for example when they logout to • send them back to the login page. • 401 Unauthorized: when the resource's access is restricted.
- 24. HTTP Response Codes •404 Not found: the resource requested by the client was not found. • 500 Internal Server Error: an error occurred during the processing of the request.
- 25. URL Encoding • Aswe have seen, some characters are used in HTTP to distinguish between:
- 26. Cross-Site Scripting Attacks Twotypes of XSS attacks • Reflective • Stored
- 27. Reflective XSS (OWASP-DV-001) Reflected Cross-siteScripting (XSS) is another name for non-persistent XSS, where the attack doesn't load with the vulnerable web application but is originated by the victim loading the offending URI. In this article we will see some ways to test a web application for this kind of vulnerability.
- 28. Stored XSS Stored CrossSite Scripting (XSS) is the most dangerous type of Cross Site Scripting. Web applications that allow users to store data are potentially exposed to this type of attack.
- 29.
- 30. Cross-Site Request Forgery • CSRFis an attack which forces an end user to execute unwanted actions on a web application in which he/she is currently authenticated. With a little help of social engineering (like sending a link via email/chat), an attacker may force the users of a web application to execute actions of the attacker's choosing. A successful CSRF exploit can compromise end user data and operation, when it targets a normal user. If the targeted end user is the administrator account, a CSRF attack can compromise the entire web application.
- 31.
- 32. SQL Injection • • A SQLinjection attack consists of insertion or "injection" of a SQL query via the input data from the client to the application. A successful SQL injection exploit can read sensitive data from the database, modify database data (Insert/Update/Delete), execute administration operations on the database (such as shutdown the DBMS), recover the content of a given file existing on the DBMS file system and, in some cases, issue commands to the operating system. SQL injection attacks are a type of injection attack, in which SQL commands are injected into data-plane input in order to affect the execution of predefined SQL commands.