SSP - Web Security with Adam & Ryan <;'"}()[]>{ - - PowerPoint PPT Presentation

▶
ssp web security
SMART_READER_LITE
LIVE PREVIEW

SSP - Web Security with Adam & Ryan <;'"}()[]>{ - - PowerPoint PPT Presentation

Apr 26, 2023 10 likes •384 views

SSP - Web Security with Adam & Ryan <;'"}()[]>{ XSSFish says, "Swim wif us" Todays Topics Sessions Why do we need them? What weaknesses can attackers take advantage of? Cross-site Scripting

slide-1
SLIDE 1

SSP - Web Security

with Adam & Ryan

<;'"}()[]>{ XSSFish says, "Swim wif us"

slide-2
SLIDE 2

Today’s Topics

  • Sessions
  • Why do we need them?
  • What weaknesses can attacker’s take

advantage of?

  • Cross-site Scripting
  • Conceptually, what is it?
  • What can an attacker do with it?
slide-3
SLIDE 3

A World w/o Sessions

get /control_panel Please login

slide-4
SLIDE 4

A World w/o Sessions

send /login data from form: user name = john password = money$ Welcome John!

slide-5
SLIDE 5

A World w/o Sessions

get /control_panel Please login

slide-6
SLIDE 6

Example with Sessions

get /control_panel Please login session id: TH2S234S

slide-7
SLIDE 7

Example with Sessions

send /login data from form: user name = john password = money$ Welcome John! session id: TH2S234S

slide-8
SLIDE 8

Example with Sessions

get /control_panel Hi John. Here’s your control panel session id: TH2S234S

slide-9
SLIDE 9

Sessions Shouldn’t Be

  • Predictable
  • Settable (session fixation)
slide-10
SLIDE 10

Sessions Shouldn’t Be

  • Predictable
  • Settable (session fixation)
slide-11
SLIDE 11

Predictable Sessions

Session ID is one digit

send /login data from form: user name = john password = money$ Welcome John! session id: 3 Victim

slide-12
SLIDE 12

Predictable Sessions

session id: 3 Victim

slide-13
SLIDE 13

Predictable Sessions

session id: 3 Victim get /control_panel Please login session id: 1 Attacker

slide-14
SLIDE 14

Predictable Sessions

session id: 3 Victim get /control_panel Please login session id: 2 Attacker

slide-15
SLIDE 15

Predictable Sessions

session id: 3 Victim get /control_panel Hi John. Here’s your control panel session id: 3 Attacker

slide-16
SLIDE 16

Sessions Shouldn’t Be

  • Predictable
  • Settable (session fixation)
slide-17
SLIDE 17

Session Fixation

slide-18
SLIDE 18

Session Fixation

go here /login?SID=I_KNOW

slide-19
SLIDE 19

Session Fixation

get /login?SID=I_KNOW go here /login?SID=I_KNOW

slide-20
SLIDE 20

Session Fixation

get /login?SID=I_KNOW

Please login

session id:

I_KNOW

go here /login?SID=I_KNOW

slide-21
SLIDE 21

Session Fixation

session id:

I_KNOW

slide-22
SLIDE 22

Session Fixation

session id:

I_KNOW

send /login data from form: user name = john password = money$

slide-23
SLIDE 23

Session Fixation

session id:

I_KNOW

send /login data from form: user name = john password = money$

Welcome John!

slide-24
SLIDE 24

Session Fixation

session id:

I_KNOW

slide-25
SLIDE 25

Session Fixation

session id:

I_KNOW

session id:

I_KNOW get /control_panel Hi John. Here’s your control panel

slide-26
SLIDE 26

Cross Site Scripting (XSS)

  • What is it?
  • Attacker is able to place his own code
  • n a website
  • Why does it happen?
  • Website fails to sanitize data that

attacker sends to it

slide-27
SLIDE 27

Cross Site Scripting (XSS)

  • XSS Attack
  • Attacker places JavaScript on a website
  • Website visitors unknowingly run the

JavaScript

  • Attacker has control of website visitor
  • he can force the visitor to perform an

action on the website

  • he can steal Session IDs (and thus become

the visitor)

slide-28
SLIDE 28

XSS Example: A Blog

/submit_comment is vulnerable to XSS

slide-29
SLIDE 29

XSS Example: A Blog

/submit_comment is vulnerable to XSS XSS Payload submit /submit_comment

slide-30
SLIDE 30

XSS Example: A Blog

/submit_comment is vulnerable to XSS XSS Payload submit /submit_comment Thank you for your comment

slide-31
SLIDE 31

XSS Example: A Blog

/view_comments contains XSS Payload

slide-32
SLIDE 32

XSS Example: A Blog

/view_comments contains XSS Payload session id: TH2S234S

slide-33
SLIDE 33

XSS Example: A Blog

/view_comments contains XSS Payload get /view_comments session id: TH2S234S

slide-34
SLIDE 34

XSS Example: A Blog

/view_comments contains XSS Payload get /view_comments Here are the comments session id: TH2S234S

slide-35
SLIDE 35

XSS Example: A Blog

/view_comments contains XSS Payload session id: TH2S234S session id: TH2S234S

slide-36
SLIDE 36

XSS Example: A Blog

attacker knows victim’s session id session id: TH2S234S get /control_panel

slide-37
SLIDE 37

XSS Example: A Blog

attacker knows victim’s session id session id: TH2S234S get /control_panel Hi John. Here’s your control panel