Hacking NodeJS applications for fun and profit Testing NodeJS - - PowerPoint PPT Presentation

▶
hacking nodejs applications for fun and profit
SMART_READER_LITE
LIVE PREVIEW

Hacking NodeJS applications for fun and profit Testing NodeJS - - PowerPoint PPT Presentation

May 13, 2023 316 likes •764 views

Hacking NodeJS applications for fun and profit Testing NodeJS Security by @jmortegac Agenda Introduction nodejS security Npm security packages Node Goat project Tools Node JS JavaScript in the backend Built on

slide-1
SLIDE 1

Hacking NodeJS applications for fun and profit

Testing NodeJS Security

by @jmortegac

slide-2
SLIDE 2

Agenda

▪ Introduction nodejS security ▪ Npm security packages ▪ Node Goat project ▪ Tools

slide-3
SLIDE 3

Node JS

▪ JavaScript in the backend ▪ Built on Chrome´s Javascript runtime(V8) ▪ NodeJs is based on event loop ▪ Designed to be asynchronous ▪ Single Thread ▪ Node.js is resilient to flooding attacks since there’s no limit on the number of concurrent requests.

slide-4
SLIDE 4

Security updates

https://expressjs.com/en/advance d/security-updates.html

slide-5
SLIDE 5

Package vulnerabilities

https://www.npmjs.com/advisories

slide-6
SLIDE 6

Npm security packages

▪ Helmet ▪ express-session ▪ cookie-session ▪ csurf ▪ express-validator ▪ bcrypt-node ▪ express-enforces-ssl

slide-7
SLIDE 7

Security HTTP Headers

▪ Strict-Transport-Security ▪ X-Frame-Options ▪ X-XSS-Protection ▪ X-Content-Type-Options ▪ Content-Security-Policy

slide-8
SLIDE 8

Helmet module

▪ https://www.npmjs.com/package /helmet

slide-9
SLIDE 9

Helmet module

▪ https://github.com/helmetjs/helmet

slide-10
SLIDE 10

Helmet module

▪ hidePoweredBy ▪ Hpkp→protection MITM ▪ Hsts→forces https connections ▪ noCache→desactive client cache ▪ Frameguard→protection clickjacking ▪ xssFilter→protection XSS

slide-11
SLIDE 11

Helmet CSP

slide-12
SLIDE 12

Check headers security

▪ http://cyh.herokuapp.com/cyh ▪ https://securityheaders.io/

slide-13
SLIDE 13

Express versions

▪ https://www.shodan.io/ search?query=express

slide-14
SLIDE 14

Disable x-powered-by

slide-15
SLIDE 15

Disable x-powered-by

▪ Avoid framework fingerprinting

slide-16
SLIDE 16

Disable x-powered-by

▪ Use Helmet and use “hide-powered-by” plugin

slide-17
SLIDE 17

Sessions management

▪ secure ▪ httpOnly ▪ domain ▪ path ▪ expires ▪ https://www.npmjs.com/pack age/cookie-session

slide-18
SLIDE 18

httpOnly & secure:true

slide-19
SLIDE 19

XSS attacks

▪ An attacker can exploit XSS vulnerability to:

▪ Steal session cookies/Sesion hijacking ▪ Redirect user to malicious sites ▪ Defacing and content manipulation ▪ Cross Site Request forgery

slide-20
SLIDE 20

CSRF attacks

slide-21
SLIDE 21

https://www.npmjs.com/package/csurf

slide-22
SLIDE 22

CSRF

<form action="/process" method="POST"> <input type="hidden" name="_csrf" value="{{csrfToken}}"> <button type="submit">Submit</button> </form> app.use(function (request, response, next) { response.locals.csrftoken = request.csrfToken(); next(); });

slide-23
SLIDE 23

CSRF

slide-24
SLIDE 24

Filter/sanitize user input

▪ Fixing XSS attacks

▪ https://www.npmjs.com/package/sanitizer

▪ Module express-validator

▪ https://www.npmjs.com/package/express-validator

slide-25
SLIDE 25

Express Validator

slide-26
SLIDE 26
slide-27
SLIDE 27

Bcrypt-node

▪ https://github.com/kelektiv/node.bcrypt.js

slide-28
SLIDE 28
slide-29
SLIDE 29
slide-30
SLIDE 30

Node Goat

▪ http://nodegoat.herokuapp.com /tutorial

slide-31
SLIDE 31

Node Goat

▪ https://github.com/OWASP/Node Goat

slide-32
SLIDE 32

EVAL() ATTACKS

res.end(require('fs').read dirSync('.').toString())

slide-33
SLIDE 33

Insecure Direct Object References

▪ Use session instead of request param ▪ var userId = req.session.userId;

slide-34
SLIDE 34

Tools

▪ KrakenJS ▪ Lusca middleware ▪ NodeJsScan

slide-35
SLIDE 35

http://krakenjs.com/

slide-36
SLIDE 36

https://github.com/krakenjs/lusca

slide-37
SLIDE 37

NodeJsScan

▪ https://github.com/ajinabra ham/NodeJsScan

slide-38
SLIDE 38

NodeJsScan

https://github.com/jmorteg a/NodeJsScan/blob/maste r/rules.xml

slide-39
SLIDE 39

NodeJsScan

slide-40
SLIDE 40

GitHub repositories

▪ https://github.com/jmortega/testing_nodejs_security ▪ https://github.com/cr0hn/vulnerable-node ▪ https://github.com/rdegges/svcc-auth ▪ https://github.com/strongloop/loopback-getting-start ed-intermediate ▪ https://github.com/Feeld/strong-node

slide-41
SLIDE 41

Node security learning

▪ https://www.udemy.com/nodejs-security- pentesting-and-exploitation/

slide-42
SLIDE 42

Books

slide-43
SLIDE 43

References

▪ https://blog.risingstack.com/node-js-security-checklist/ ▪ https://blog.risingstack.com/node-js-security-tips/ ▪ https://www.npmjs.com/package/helmet ▪ https://expressjs.com/en/advanced/best-practice-security.html ▪ https://expressjs.com/en/advanced/security-updates.html ▪ http://nodegoat.herokuapp.com/tutorial ▪ https://www.owasp.org/index.php/Projects/OWASP_Node_js_Goa t_Project