GenCyber Day 5 5.3 Website Security
Objectives of Lesson 5.3 Explain the basics of HTML Explain the concept of a Content Management System Explain the concept of malvertisement Explain how a drive-by-download works Explain the concept of browser plugins Demonstrate minimal secure browser settings
HTML HTML is tag based The tags are < and > For every < > tag, there must be a closing tag </ > For example: <html> </html> You can write HTML with any text editor, just save as .html You don’t need a web server, just open .html file in browser
Exercise 1 Using Chrome, visit https://www.w3schools.com Right click on blank area of page and select View Page Source Review various parts of the HTML for the site
Exercise 2 Using the white search box, open Notepad Once Notepad opens, click File and Save As
Exercise 2 Select the Downloads folder along the left
Exercise 2 Name the file HellowWorld.html Change the Save as type and select All Files and then click Save
Exercise 2 In Chrome, type the following URL into the URL bar and press Enter/Return
Exercise 2 You should see Hello World in the browser
Content Management Systems Content Management Systems provide WYSIWYG What You See Is What You Get You don’t have to know HTML It’s almost like editing a Word document Most use the Model / View / Controller structure The good, bad, and ugly of CMS
Exercise 2 In Chrome, visit https://www.fork-cms.com/demo Click the “Fork CMS Back-end” link
Exercise 2 Login with the credentials listed below
Exercise 2 Click Pages along the left
Exercise 2 Give your page a unique name
Exercise 2 On the right side of page, in the Top section, click Add block
Exercise 2 Make sure the drop down is set to editor and click Add
Exercise 2 You should see an editor almost like Word Mouse over all the icons to see what they are named Add some cool text and click Add
Exercise 2 Under the main section, click Add block
Exercise 2 Make sure the drop down is set to editor and click Add
Exercise 2 You should see an editor almost like Word Add some text that will be the main body of your page When you are ready, click Add
Exercise 2 In the bottom right, click Add page
Exercise 2 Now click the link under the page title
Malvertisements and Drive By Download Advertisements can be a source of attacks A program could be installed just by visiting the wrong site Review handout from Sophos Visit: https://www.scmagazine.com/hackers-spread-malware-via-yahoo-ads/article/532507/
Demo of a Potential Drive-By Download Attack A program could be installed just by visiting the wrong site Review handout from Sophos
Browser Plugins Firefox and Chrome have plugins available to help with security NoScript Security fatigue
Browser Settings Do not save passwords Block pop-ups Install security plugins Set browser to empty cache when browser is closed Do not save encrypted pages to disk Keep browser updated https://www.us-cert.gov/publications/securing-your-web-browser