Top 10 Web Security Vulnerabilities
Denunciar
Carol McDonaldSeguir
15 de Oct de 2009•0 gostou•7,703 visualizações
12 gostaram
Seja o primeiro a gostar disto
mostrar mais
visualizações
Vistos totais
0
No Slideshare
0
De incorporações
0
Número de incorporações
0
Check these out next
Top 10 Web Security Vulnerabilities
15 de Oct de 2009•0 gostou•7,703 visualizações
12 gostaram
Seja o primeiro a gostar disto
mostrar mais
visualizações
Vistos totais
0
No Slideshare
0
De incorporações
0
Número de incorporações
0
Baixar para ler offline
Denunciar
Top 10 Web Security Vulnerabilities as defined by the OWASP, and what you can do to protect your application
Carol McDonaldSeguir
Top 10 Web Security Vulnerabilities
- OWASP Top 10 Web Security Vulnerabilities Carol McDonald Sun Microsystems
- WebGoat and WebScarab from OWASP
- Enterprise Security API http://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API
- Enterprise Security API
- Enterprise Security API
- Validation, Encoding, and Injection http://owasp-esapi-java.googlecode.com/files/OWASP%20ESAPI.ppt Any Encoding Any Interpreter Set Character Set Encode For HTML Global Validate Canonicalize Specific Validate Sanitize Canonicalize Validate
- Handling Validation, and Encoding http://owasp-esapi-java.googlecode.com/files/OWASP%20ESAPI.ppt encodeForURL encodeForJavaScript encodeForVBScript encodeForDN encodeForHTML encodeForHTMLAttribute encodeForLDAP encodeForSQL encodeForXML encodeForXMLAttribute encodeForXPath isValidDirectoryPath isValidCreditCard isValidDataFromBrowser isValidListItem isValidFileContent isValidFileName isValidHTTPRequest isValidRedirectLocation isValidSafeHTML isValidPrintable safeReadLine Canonicalization Double Encoding Protection Normalization Sanitization
- Handling Validation, and Encoding http://owasp-esapi-java.googlecode.com/files/OWASP%20ESAPI.ppt encodeForURL encodeForJavaScript encodeForVBScript encodeForDN encodeForHTML encodeForHTMLAttribute encodeForLDAP encodeForSQL encodeForXML encodeForXMLAttribute encodeForXPath isValidDirectoryPath isValidCreditCard isValidDataFromBrowser isValidListItem isValidFileContent isValidFileName isValidHTTPRequest isValidRedirectLocation isValidSafeHTML isValidPrintable safeReadLine Canonicalization Double Encoding Protection Normalization Sanitization
- Real Attack on Australian Tax office attacker changed the tax id in the url , got info on 17,000 companies
- Handling Direct Object References http://app?file=7d3J93 Report123.xls Web Service Database Mainframe File System User Etc… Access Reference Map Indirect Reference Direct Reference Indirect Reference Direct Reference
- Handling Authentication and Identity http://owasp-esapi-java.googlecode.com/files/OWASP%20ESAPI.ppt Strong Passwords Random Tokens CSRF Tokens Lockout Remember Me Screen Name Roles Timeout Users
- ESAPI Handling Authentication and Identity http://owasp-esapi-java.googlecode.com/files/OWASP%20ESAPI.ppt Strong Passwords Random Tokens CSRF Tokens Lockout Remember Me Screen Name Roles Timeout Users
- Handling Sensitive Information http://owasp-esapi-java.googlecode.com/files/OWASP%20ESAPI.ppt Encryption Digital Signatures Integrity Seals Strong GUID Random Tokens Timestamp Salted Hash Safe Config Details
- ACEGI Spring Security
- ESAPI Handling Access Control isAuthorizedForURL isAuthorizedForFunction isAuthorizedForFunction isAuthorizedForService isAuthorizedForData isAuthorizedForFile
Notas do Editor
- The attacker can send data in any encoding. And the interpreters downstream from your application may decide to handle any encoding. Canonicalize Input could be in any character set Double-encoding Multiple encoding schemes Double-encoding with multiple encoding schemes Validation Simple to configure for positive rules Impossible to do perfectly, since you need special characters GetSafeValue Rich content – strip out bad stuff and continue Difficult – need to fully parse HTML Canonicalize and Validate from database Watch out mass SQL injection? EncodeForHTML Not perfect since browsers allow encoded characters to execute (particularly in attributes) Have to avoid double-encoding SetCharacterSet Browser will try to guess the encoding
- The attacker can send data in any encoding. And the interpreters downstream from your application may decide to handle any encoding. Canonicalize Input could be in any character set Double-encoding Multiple encoding schemes Double-encoding with multiple encoding schemes Validation Simple to configure for positive rules Impossible to do perfectly, since you need special characters GetSafeValue Rich content – strip out bad stuff and continue Difficult – need to fully parse HTML Canonicalize and Validate from database Watch out mass SQL injection? EncodeForHTML Not perfect since browsers allow encoded characters to execute (particularly in attributes) SetCharacterSet Browser will try to guess the encoding
- The attacker can send data in any encoding. And the interpreters downstream from your application may decide to handle any encoding. Canonicalize Input could be in any character set Double-encoding Multiple encoding schemes Double-encoding with multiple encoding schemes Validation Simple to configure for positive rules Impossible to do perfectly, since you need special characters GetSafeValue Rich content – strip out bad stuff and continue Difficult – need to fully parse HTML Canonicalize and Validate from database Watch out mass SQL injection? EncodeForHTML Not perfect since browsers allow encoded characters to execute (particularly in attributes) SetCharacterSet Browser will try to guess the encoding
- If an online bank allowed its application to process requests, such as transfer funds, a similar attack might allow high risk transactions such as money transfers The form itself contains the fields name and lastname and the button submit to prevent this to be forgged we add another field which contains the name of the current session identifier cookie name and the current session identifier cookie value <form> <input type=&quot;test&quot; name=&quot;name&quot; value=&quot;John&quot;/> <input type=&quot;test&quot; name=&quot;lastname&quot; value=&quot;Dawson&quot;/> <input type=&quot;test&quot; name=&quot;JSPSESSIONID&quot; value=&quot;7af7a55caff365ca594510586&quot;/> <input type=&quot;submit&quot;/> </form>
- If an online bank allowed its application to process requests, such as transfer funds, a similar attack might allow high risk transactions such as money transfers The form itself contains the fields name and lastname and the button submit to prevent this to be forgged we add another field which contains the name of the current session identifier cookie name and the current session identifier cookie value <form> <input type=&quot;test&quot; name=&quot;name&quot; value=&quot;John&quot;/> <input type=&quot;test&quot; name=&quot;lastname&quot; value=&quot;Dawson&quot;/> <input type=&quot;test&quot; name=&quot;JSPSESSIONID&quot; value=&quot;7af7a55caff365ca594510586&quot;/> <input type=&quot;submit&quot;/> </form>
- If an online bank allowed its application to process requests, such as transfer funds, a similar attack might allow high risk transactions such as money transfers The form itself contains the fields name and lastname and the button submit to prevent this to be forgged we add another field which contains the name of the current session identifier cookie name and the current session identifier cookie value <form> <input type=&quot;test&quot; name=&quot;name&quot; value=&quot;John&quot;/> <input type=&quot;test&quot; name=&quot;lastname&quot; value=&quot;Dawson&quot;/> <input type=&quot;test&quot; name=&quot;JSPSESSIONID&quot; value=&quot;7af7a55caff365ca594510586&quot;/> <input type=&quot;submit&quot;/> </form>
- The attacker can send data in any encoding. And the interpreters downstream from your application may decide to handle any encoding. Canonicalize Input could be in any character set Double-encoding Multiple encoding schemes Double-encoding with multiple encoding schemes Validation Simple to configure for positive rules Impossible to do perfectly, since you need special characters GetSafeValue Rich content – strip out bad stuff and continue Difficult – need to fully parse HTML Canonicalize and Validate from database Watch out mass SQL injection? EncodeForHTML Not perfect since browsers allow encoded characters to execute (particularly in attributes) SetCharacterSet Browser will try to guess the encoding
- If an online bank allowed its application to process requests, such as transfer funds, a similar attack might allow high risk transactions such as money transfers The form itself contains the fields name and lastname and the button submit to prevent this to be forgged we add another field which contains the name of the current session identifier cookie name and the current session identifier cookie value <form> <input type=&quot;test&quot; name=&quot;name&quot; value=&quot;John&quot;/> <input type=&quot;test&quot; name=&quot;lastname&quot; value=&quot;Dawson&quot;/> <input type=&quot;test&quot; name=&quot;JSPSESSIONID&quot; value=&quot;7af7a55caff365ca594510586&quot;/> <input type=&quot;submit&quot;/> </form>
- If an online bank allowed its application to process requests, such as transfer funds, a similar attack might allow high risk transactions such as money transfers The form itself contains the fields name and lastname and the button submit to prevent this to be forgged we add another field which contains the name of the current session identifier cookie name and the current session identifier cookie value <form> <input type=&quot;test&quot; name=&quot;name&quot; value=&quot;John&quot;/> <input type=&quot;test&quot; name=&quot;lastname&quot; value=&quot;Dawson&quot;/> <input type=&quot;test&quot; name=&quot;JSPSESSIONID&quot; value=&quot;7af7a55caff365ca594510586&quot;/> <input type=&quot;submit&quot;/> </form>