1. Web Applications on the battlefield Alain Abou Tass

2. About me Security Consultancy at Ward Solutions Previously in Banking Security A couple of Masters degrees Ethical Hacker Involved in Penetration Testing Web Application a number of years.

3. Purpose Advanced attacks using known attack vectors. Combined Attacks using multiple attack vectors Not XSS, CSRF, SQL Injection, Parameter Tampering etc

4. Penetration testing Identifying vulnerabilities Reporting

5. Combined Attacks

6. Scenario 1: Bypassing Account Lockout Customer assumed no brute force due to account lockout policy (lock out after 5 attempts), and password requires 8 characters.

7. Username enumeration + weak password policy Account Registration: username - minimum 4 characters password – minimum 8 characters Login page: Account Lock out after 5 attempts Indication if user exists

8. Scenario 2 – Persistent compromise of corporate LAN using internal intranet XSS can be used to compromise a LAN even if application is not open to internet. Generally XSS on internal applications => not a high issue (e.g. intranet). Insert Java Script (XSS) to intranet using a CSRF attack.

9. Stored XSS and CSRF Logged in CSRF: Update profile and inject Java Script Attack Malicious Website Only available internally

10. Scenario 2 –Defeat anti-CSRF with XSS JS SpaceHero Worm “…but most of all, Samy is my hero”

11. Samy’s profile: Java script injected Get valid Anti-CSRF token - Add Samy as a friend - Update profile - Inject the same Java script 1 2 3 4 Samy

12. Scenario 3: SSRF SSRF - Server Side Request Forgery attacks. The ability to create requests from the vulnerable server to intra/internet. Method of targeting internal services Example

13. Scenario 4: XSPA (Cross Site Port Attack) XSPA (Type of SSRF)

14. Scan the intranet scan.php XSPA

15. Scenario 5: Open proxy (SSRF)

16. Scenario 6: Unrestricted file upload + local file inclusion

17. File Upload: Web Shell

18. ln –s /etc/passwd passwd

19. Other attacks The billion laughs vulnerability (XXE DOS) OS injection (ping) Second order XSS and SQLi WAF evasion Business logic flaws

20. Movies vs Real life