Html5 for Security Folks

•

4 gostaram•1,575 visualizações

n|u - The Open Security Community

null Delhi Chapter - August 2013 Meet

Educação Tecnologia

HTML5 for Security folks!!
Have you upgraded your skillset?
Vaibhav Gupta
Security Researcher - Adobe
Twitter: @vaibhavgupta_1

What is HTML5?
• The next revision for HTML
• Tons of new features/technologies/APIs
• Rich multimedia support
• Its just an update….old HTML still works!
• Blah blah…….“Work in progress”

Information Security Impact
• Most attacks are already possible, HTML5
simply makes them easier or more powerful
• Great majority of these vulnerabilities affect
the browser and doesn’t have any direct
impact on the server

Interesting Features
• Cross Origin Resource Sharing (CORS)
• Web Storage
• IFRAME Sandboxing
• Web Messaging
• Multimedia & Graphics
• Getlocation
• …… many more!

OPTIONS /usermail HTTP/1.1
Origin: mail.example.com
Content-Type: text/html
HTTP/1.0 200 OK
Access-Control-Allow-Origin: http://www.example.com,
https://login.example.com
Access-Control-Allow-Methods: POST, GET, OPTIONS
Access-Control-Allow-Headers: X-Prototype-Version, X-Requested-With,
Content-Type, Accept
Access-Control-Max-Age: 86400
Content-Type: text/html; charset=US-ASCII
Connection: keep-alive
Content-Length: 0
Configuring CORS correctly

• Session Hijacking
• Confidential Information Risk
• User Tracking
• Persistent Attack Vectors

IFRAM Sandboxing
• Really good security feature !
• “sandbox” attribute disables form submissions,
scripts, popups etc.
<iframe sandbox src=“http://e.com”></iframe>
• Can be relaxed with few tokens
<iframe sandbox=“allow-scripts” src=“http://e.com”></iframe>
• !! Disables JS based frame busting defense !!

References:
• Examples: slides.html5rocks.com
• Slides content:
prezi.com/k2ibkogftt2i/understanding-html5-
security
• And……google.com

Mais conteúdo relacionado

Semelhante a Html5 for Security Folks

HTML 5Prof. Erwin Globio

BeEF_EUSecWest-2012_Michele-OrruMichele Orru

DevTeach Ottawa - Silverlight5 and HTML5Frédéric Harper

Html5 Application Securitychuckbt

WHAT IS HTML5?(20100510)Shumpei Shiraishi

Building rich interface components with SharePointLouis-Philippe Lavoie

Attacking with html5(lava kumar)ClubHack

Introduction web techLiaquat Rahoo

Owasp2013 johannesullrichdrewz lin

HTML5 (Štěpán Bechynský)Národní technická knihovna (NTK)

HTML5Cygnet Infotech

Three Developer Behaviors to Eliminate 85 Percent of Accessibility DefectsSean Kelly

HTML5 - Let’s make the WEB more powerfulNaga Harish M

Tapir user managerPaul Houle

Implementing a Multi-Device Approach to E-learning Design (US Session)Raptivity

Implementing a Multi-Device Approach to E-learning Design (APAC Session)Raptivity

Html5, Native and Platform based Mobile ApplicationsYoss Cohen

Html5Western Illinois University Libraries

HTML5: An Introduction To Next Generation Web DevelopmentTilak Joshi

Fundamentals of HTML5St. Petersburg College

Semelhante a Html5 for Security Folks (20)

HTML 5

BeEF_EUSecWest-2012_Michele-Orru

DevTeach Ottawa - Silverlight5 and HTML5

Html5 Application Security

WHAT IS HTML5?(20100510)

Building rich interface components with SharePoint

Attacking with html5(lava kumar)

Introduction web tech

Owasp2013 johannesullrich

HTML5 (Štěpán Bechynský)

HTML5

Three Developer Behaviors to Eliminate 85 Percent of Accessibility Defects

HTML5 - Let’s make the WEB more powerful

Tapir user manager

Implementing a Multi-Device Approach to E-learning Design (US Session)

Implementing a Multi-Device Approach to E-learning Design (APAC Session)

Html5, Native and Platform based Mobile Applications

Html5

HTML5: An Introduction To Next Generation Web Development

Fundamentals of HTML5

Mais de n|u - The Open Security Community

Hardware security testing 101 (Null - Delhi Chapter)n|u - The Open Security Community

Osint primern|u - The Open Security Community

SSRF exploit the trust relationshipn|u - The Open Security Community

Nmap basicsn|u - The Open Security Community

Metasploit primaryn|u - The Open Security Community

Api security-testingn|u - The Open Security Community

Introduction to TLS 1.3n|u - The Open Security Community

Gibson 101 -quick_introduction_to_hacking_mainframes_in_2020_null_infosec_gir...n|u - The Open Security Community

Talking About SSRF,CRLFn|u - The Open Security Community

Building active directory lab for red teamingn|u - The Open Security Community

Owning a company through their logsn|u - The Open Security Community

Introduction to shodann|u - The Open Security Community

Cloud security n|u - The Open Security Community

Detecting persistence in windowsn|u - The Open Security Community

Frida - Objection Tool Usagen|u - The Open Security Community

OSQuery - Monitoring System Processn|u - The Open Security Community

DevSecOps Jenkins Pipeline -Securityn|u - The Open Security Community

Extensible markup language attacksn|u - The Open Security Community

Linux for hackersn|u - The Open Security Community

Android Pentestingn|u - The Open Security Community

Mais de n|u - The Open Security Community (20)

Hardware security testing 101 (Null - Delhi Chapter)

Osint primer

SSRF exploit the trust relationship

Nmap basics

Metasploit primary

Api security-testing

Introduction to TLS 1.3

Gibson 101 -quick_introduction_to_hacking_mainframes_in_2020_null_infosec_gir...

Talking About SSRF,CRLF

Building active directory lab for red teaming

Owning a company through their logs

Introduction to shodan

Cloud security

Detecting persistence in windows

Frida - Objection Tool Usage

OSQuery - Monitoring System Process

DevSecOps Jenkins Pipeline -Security

Extensible markup language attacks

Linux for hackers

Android Pentesting

Último

Congestive Cardiac Failure..presentationdeepaannamalai16

The Emergence of Legislative Behavior in the Colombian CongressMaria Paula Aroca

Team Lead Succeed – Helping you and your team achieve high-performance teamwo...Association for Project Management

Indexing Structures in Database Management system.pdfChristalin Nelson

4.9.24 School Desegregation in Boston.pptxmary850239

4.9.24 Social Capital and Social Exclusion.pptxmary850239

6 ways Samsung’s Interactive Display powered by Android changes the classroomSamsung Business USA

prashanth updated resume 2024 for Teaching ProfessionSri Sairam College Of Engineering Bengaluru

DiskStorage_BasicFileStructuresandHashing.pdfChristalin Nelson

Blowin' in the Wind of Caste_ Bob Dylan's Song as a Catalyst for Social Justi...DhatriParmar

Spearman's correlation,Formula,Advantages,Nigar Kadar Mujawar,Womens College of Pharmacy,Peth Vadgaon,Kolhapur,416112

Shark introduction Morphology and its behaviour characteristicsArubSultan

Q-Factor HISPOL Quiz-6th April 2024, Quiz Club NITWQuiz Club NITW

Chi-Square Test Non Parametric Test Categorical VariableNigar Kadar Mujawar,Womens College of Pharmacy,Peth Vadgaon,Kolhapur,416112

Unraveling Hypertext_ Analyzing Postmodern Elements in Literature.pptxDhatriParmar

Plagiarism,forms,understand about plagiarism,avoid plagiarism,key significanc...Nigar Kadar Mujawar,Womens College of Pharmacy,Peth Vadgaon,Kolhapur,416112

CLASSIFICATION OF ANTI - CANCER DRUGS.pptxAnupam32727

31 ĐỀ THI THỬ VÀO LỚP 10 - TIẾNG ANH - FORM MỚI 2025 - 40 CÂU HỎI - BÙI VĂN V...Nguyen Thanh Tu Collection

Healthy Minds, Flourishing Lives: A Philosophical Approach to Mental Health a...Osopher

Geoffrey Chaucer Works II UGC NET JRF TGT PGT MA PHD Entrance Exam II History...DrVipulVKapoor

Html5 for Security Folks

1. HTML5 for Security folks!! Have you upgraded your skillset? Vaibhav Gupta Security Researcher - Adobe Twitter: @vaibhavgupta_1

2. What is HTML5? • The next revision for HTML • Tons of new features/technologies/APIs • Rich multimedia support • Its just an update….old HTML still works! • Blah blah…….“Work in progress”

3. Information Security Impact • Most attacks are already possible, HTML5 simply makes them easier or more powerful • Great majority of these vulnerabilities affect the browser and doesn’t have any direct impact on the server

4. Interesting Features • Cross Origin Resource Sharing (CORS) • Web Storage • IFRAME Sandboxing • Web Messaging • Multimedia & Graphics • Getlocation • …… many more!

6. Cross Origin Resource Sharing

10. OPTIONS /usermail HTTP/1.1 Origin: mail.example.com Content-Type: text/html HTTP/1.0 200 OK Access-Control-Allow-Origin: http://www.example.com, https://login.example.com Access-Control-Allow-Methods: POST, GET, OPTIONS Access-Control-Allow-Headers: X-Prototype-Version, X-Requested-With, Content-Type, Accept Access-Control-Max-Age: 86400 Content-Type: text/html; charset=US-ASCII Connection: keep-alive Content-Length: 0 Configuring CORS correctly

11.

12.

13. • Session Hijacking • Confidential Information Risk • User Tracking • Persistent Attack Vectors

14. IFRAM Sandboxing • Really good security feature ! • “sandbox” attribute disables form submissions, scripts, popups etc. <iframe sandbox src=“http://e.com”></iframe> • Can be relaxed with few tokens <iframe sandbox=“allow-scripts” src=“http://e.com”></iframe> • !! Disables JS based frame busting defense !!

15. Content Security Policy (CSP)

16.

17.

18.

19. Enough of CRAP !

20. References: • Examples: slides.html5rocks.com • Slides content: prezi.com/k2ibkogftt2i/understanding-html5- security • And……google.com

Html5 for Security Folks

Recomendados

Recomendados

Mais conteúdo relacionado

Semelhante a Html5 for Security Folks

Semelhante a Html5 for Security Folks (20)

Mais de n|u - The Open Security Community

Mais de n|u - The Open Security Community (20)

Último

Último (20)

Html5 for Security Folks