Web Application Security

Slides:

Advertisements

Similar presentations

1 Verification by Model Checking. 2 Part 1 : Motivation.

Advertisements

AmeriCorps is introducing a new online payment system for the processing of AmeriCorps forms

1 Computational Asset Description for Cyber Experiment Support using OWL Telcordia Contact: Marian Nodine Telcordia Technologies Applied Research

Welcome to the Award Winning Easiest to Use & Most Advanced View, Manage, and Control Security, Access Control, Video, Energy & Lighting Systems, & Critical.

Click Here for Download the Installation Files Click Here for Guide How to Extract Installation Files.

OWASP Periodic Table of Vulnerabilities James Landis

Day anti-virus anti-virus 1 detecting a malicious file malware, detection, hiding, removing.

SOFTWARE SECURITY JORINA VAN MALSEN 1 FLAX: Systematic Discovery of Client-Side Validation Vulnerabilities in Rich Web Applications.

Internal Control Concepts Knowledge. Best Practices for IT Governance IT Governance Structure of Relationship Audit Role in IT Governance.

Information Networking Security and Assurance Lab National Chung Cheng University The Ten Most Critical Web Application Security Vulnerabilities Ryan J.W.

Information Networking Security and Assurance Lab National Chung Cheng University 1 Top Vulnerabilities in Web Applications (I) Unvalidated Input:  Information.

CS 290C: Formal Models for Web Software Lecture 1: Introduction Instructor: Tevfik Bultan.

Chapter 4 Application Security Knowledge and Test Prep

Sara SartoliAkbar Siami Namin NSF-SFS workshop July 14-18, 2014.

Create New Account. Use of the Winland EnviroAlert EA800-ip requires an account for remote access to: –View real-time sensor data –Modify setting configurations.

Web Application Vulnerabilities Checklist. EC-Council Parameter Checklist  URL request  URL encoding  Query string  Header  Cookie  Form field 

Incident Response Updated 03/20/2015

Secure Software Development Mini Zeng University of Alabama in Huntsville 1.

Copyright© 2003 Avaya Inc. All rights reserved Upgrade to Communication Manager 2.0 with Migration to Linux 8.0 Purpose: This presentation was prepared.

1. Topics to be discussed Introduction Objectives Testing Life Cycle Verification Vs Validation Testing Methodology Testing Levels 2.

www.ursamajorconsulting.com1 Avoid Getting Hacked Joomla! Web Security Northern Virginia Joomla Users Group January 2012 Dorothy Firsching, Ursa.

Computer Security and Penetration Testing

Systems Development Lifecycle Testing and Documentation.

Varun Sharma Application Consulting and Engineering (ACE) Team, Microsoft India.

Analysis of SQL injection prevention using a proxy server By: David Rowe Supervisor: Barry Irwin.

Test Your Knowledge. x + 3 =6 a.5 b.4 c.3 d.2 y - 11= 78 a. 69 b. 89 c. 87 d. 68.

© 2001 by Carnegie Mellon University SS5 -1 OCTAVE SM Process 5 Background on Vulnerability Evaluations Software Engineering Institute Carnegie Mellon.

NMD202 Web Scripting Week3. What we will cover today Includes Exercises PHP Forms Exercises Server side validation Exercises.

Security Problems at Colleges All materials posted at samsclass.info and free to use.

Application Security Testing A practitioner’s rambling advice & musings.

An Ad Hoc Writable Rule Language for White-Box Security Scanners Author:Sebastian Schinzel Referent:Prof. Dr. Alexander del Pino Korreferent:Prof. Dr.

Analysis of SQL injection prevention using a filtering proxy server By: David Rowe Supervisor: Barry Irwin.

1 AGRIDES Walk-through. 2 AGRIDES - File Content AGRIDES allows to upload one file per transaction:  File –Message 1 Document A –Message 2 Document B.

The attacks ● XSS – type 1: non-persistent – type 2: persistent – Advanced: other keywords (, prompt()) or other technologies such as Flash.

Input Validation – common associated risks  ______________ user input controls SQL statements ultimately executed by a database server

Middleware Vulnerabilities Damian Tamayo Kansas State University MSE 2 nd Semester.

Building Secure Web Applications With ASP.Net MVC.

Cloud = Web, Web = Hacked! Fabio Viggiani. Why Web Apps? Every organization exposes web apps Most common entry point Image source:

Computer Literacy for IC 3 Unit 1: Computing Fundamentals © 2010 Pearson Education, Inc. | Publishing as Prentice Hall.1 Chapter 4: Identifying Software.

Securing Your Enterprise with Enterprise Manager 10g Amir Najmi Principal Member of Technical Staff System Management Products Oracle Corporation Session.

1 guy looking at iLo 2 and 3 for 4 days and finding more than 5 bugs Veysel Özer hardwear.io 2015.

Workflow Demo: Upload, Review and Approve. Cpay : Users & Functionalities Customer AdministratorCustomer AuthorizerUploaderReviewerApproverInterceptor.

Engineering Secure Software. Agenda  What is IoT?  Security implications of IoT  IoT Attack Surface Areas  IoT Testing Guidelines  Top IoT Vulnerabilities.

Mr. Justin “JET” Turner CSCI 3000 – Fall 2015 CRN Section A – TR 9:30-10:45 CRN – Section B – TR 5:30-6:45.

Copy of the from the secure website - click on the AccoridaLife.zip link.

Copyright © The OWASP Foundation This work is available under the Creative Commons SA 2.5 license The OWASP Foundation OWASP Denver February 2012.

Example – SQL Injection MySQL & PHP code: // The next instruction prompts the user is to supply an ID $personID = getIDstringFromUser(); $sqlQuery = "SELECT.

1 Idea: Using System Level Testing for Revealing SQL Injection-Related Error Message Information Leaks Ben Smith Laurie Williams Andrew Austin North Carolina.

Form Data (part 2) MIS 3502, Fall 2015 Brad N Greenwood, PhD Department of MIS Fox School of Business Temple University 11/10/2015 Slide 1.

Web Applications on the battlefield Alain Abou Tass.

COMPUTER SECURITY Ashesi University College Benson Wachira Julateh Mulbah.

Input Validation vulnerabilities in Android System Services Sukwon Choi scho668.

Web Application Security

Module: Software Engineering of Web Applications

Chapter 3 Installing and Learning Software

WEB APPLICATION TESTING

Secure Software Confidentiality Integrity Data Security Authentication

Using the HTML and CSS Validation Services

1 Positives Negatives Product Process: Barcode Scanner

What is REST API ? A REST (Representational State Transfer) Server simply provides access to resources and the REST client accesses and presents the.

A Security Review Process for Existing Software Applications

ICT meeting Business needs

Penetration Test Debrief

How to Fix Windows 10 Update Error 0x ?.

Barbara Palmer APD Director

Information Security Awareness

Lecture 2 - SQL Injection

University of Kentucky E-IRB

VENDOR STOCK MASS UPLOAD MANUAL Enter the login id and password

Security and JavaScript

Presentation transcript:

Web Application Security A Concrete Discussion with Brad brad@vt.edu

Common Web App Security Issues XSS SQLi Code Injection Command Injection File Uploads Data Extraction

Some Examples Follow The people are real The vulnerabilities are real The findings are final

Brad Was Here... Again

The Randy Award

Randy Squared

Randy Randy Randy

Manual Process Expensive Slow Knowledge Time Motivation

Dorkbot Automation All notifications will come from security@utexas.edu All checks will come from autoscan.infosec.utexas.edu (146.6.15.11) You might see some manual verification from 146.6.193.0/24

Dorkbot Report

Closing Remarks University Policy 7010 ‘Maintain the operating system and application software with appropriate updates’ Appropriate updates means patches and updates that correct vulnerable code. Standard for Securing Web Technology Resources https://it.vt.edu/resources/policies/index.html Input validation is to developers what weak passwords are to users.