Web Applications Security What are web Applications? IT College, Andres Käver, 2017-2018, autumn semester Web: http://enos.Itcollege.ee/~akaver/WebSec Skype: akaver Email: akaver@itcollege.ee

TODO Download and modify for your choice of VM engine https://sourceforge.net/projects/owaspbwa/files/ Install into windows Microsoft Threat Modeling Tool 2016 http://aka.ms/tmt2016

Web Applications - overview Initial web was just static pages, no dynamic interaction with user was possible CGI (Common Gateway Interface) was developed – allows input from user to be sent to an external program/script and then result rendered back to the user. CGI is very rare now, but the concept is parent to all current web technologies.

WebApp - Technologies CGI – mostly not used today. Very fast, applications are written in C/C++. Low level languages don’t have direct HTML output. Write-compile-deploy cycle is slow. CGI does not support session/authorization controls. Language barrier is high. C and C++ suffer fro buffer overflow and resource leaks.

WebApp - Technologies Filters – low level components (C/C++), living within execution context of webserver itself. Apache server modules, MS ISAPI. Perl, PHP, MS ASP

WebApp - Technologies Scripting – interpreters run script code within the web server process. Not compiled – write-deploy-run cycle is quicker. Usually do not suffer from buffer overflows or resource leaks. Most are not strongly typed and do not promote good programming practices. Slower. As apps grow, codebase becomes unmaintainable. Multi-tier large scale apps are hard to implement. ASP, Perl, PHP,…

WebApp - Technologies Application frameworks – J2EE, ASP.NET J2EE Fast (almost on the level of C++) Large distributed apps Session and auth controls Strongly typed- prevents many common security and programming issues Hard to learn (similar to C)

WebApp - Technologies MS ASP.NET .NET framework, just in time MSIL compiler Lot of J2EE problem areas are improved Easier to do smaller apps Supports many languages, garbage collection, buffer overflow protection Fast (near to C++ speed) Strongly typed Used to be windows centric – but not anymore. Native support on most platforms (.net core)

WebApp – small scale apps Most applications are small/medium scale. Usual architecture is simple linear procedural script. Can be written in any language/platform (rarer on J2EE or ASP.NET) Easy to write, few skills are needed to maintain the code Many typical issues Dynamic db queries constructed from direct user input Bad user input validation Poor error handling Weak session/auth control

WebApp – large scale apps Need a different architecture to that of simple survey or feedback form. Scalable architecture becomes necessity (rather than being an luxury) – when more than 5 tables in db or more than 20-50 functions to user are provided. Often divided into tiers and broken down into re-usable chunks - allows distributed application (at the expense of complexity). MVC is common pattern.

THE END