© 2009 Stephen Wolff Application Security 1 Spring, 2009 OWASP Top Ten  Ten most critical WebApp security flaws. The top 2 are: 1. XSS – Cross Site Scripting  Unvalidated data sent to a browser 2. Injection Flaws  User supplied data (unvalidated) sent to SQL  This is the consensus of security experts globally  Some of the best are right here in Central Texas! 

© 2009 Stephen Wolff Application Security 2 Spring, 2009 SQL Basic Terminology  SQL is a Relational Database Management System - RDBMS  Table - Rows that have the same attributes  Row - collection of related information  Column - attributes of an object, e.g., an Employee  Primary Key - unique for each row NameEmp#TitleMgrPay Dick101SalesSpot$50 Jane102ITSpot$60 Spot103ExecBoD$100 Employee Table

© 2009 Stephen Wolff Application Security 3 Spring, 2009 SQL Basic Query Format  Select – From – Where  SELECT * FROM employee WHERE (emp# = 102)  This will return which can be used or printed.  SELECT * FROM employee WHERE (TRUE) will return all rows. Jane102ITSpot$60 tablename condition

© 2009 Stephen Wolff Application Security 4 Spring, 2009 Other SQL Syntax  -- is the comment sequence used for documenting code. It causes the SQL interpreter to ignore all else that follows.  ; ends one SQL statement and starts another.  ‘ in matched sets is used to enclose a character string.

© 2009 Stephen Wolff Application Security 5 Spring, 2009 SQL Injection Tutorial (YouTube)  nel_page nel_page  Note: there are plenty of SQL Injection automated tools available, and of course, some are better than others.

© 2009 Stephen Wolff Application Security 6 Spring, 2009 Simple XSS Tutorial (YouTube)  Stored and Reflected XSS  Similar, but reflected doesn’t require login credentials!  Failure on both due to no input or output sanitization. Stored Reflected

© 2009 Stephen Wolff Application Security 7 Spring, 2009 Final Thoughts…  Why consider Application Security?  It’s the most current category of vulnerabilities and attacks, it is widespread, and it is devastating.  Barriers to entry (code skilz) are high but coming down, i.e., more tools like MetaSploit  On Whitehat side: more teaching of secure coding practices, groups like OWASP More tools like MetaSploit, WebGoat  Significant local expertise! Rsnake, Matt Tesauro, The Denim Group, others in OWASP