1. Web Application Security
COSC380
Zach Haupin

2. Overview Defining the problem Common Vulnerabilities Prevention
Poor Session Management
Cross-Site Scripting
SQL Injection
Prevention
Software design practices
Third-party tools

3. Defining the problem
Born out of advent of dynamic scripting technologies like:
Javascript
ASP
PHP
Allow user input to interact with web site instead of just displaying static pages.

4. Common Vulnerabilities
Incorrect Authentication/Session Management
XSS – Cross-Site Scripting
SQL Injection

5. Common Vulnerabilities – Authentication/Session Management
Session Management – Storing unique information across multiple web pages.
Most commonly done via cookies.
I-mail session:

6. Common Vulnerabilities – Authentication/Session Management
Weak session-management scheme involves small integers that are sequential.
Example – Cookie defines the web session as “1004”. By changing cookie to “1003”, personal information can be compromised.

7. Common Vulnerabilities – XSS – Cross-Site Scripting
XSS (sometimes called code injection)
Takes advantage of applications that allow user input.
User may be able to insert Javascript or shell commands inside of a text field that will be processed on the response page.

8. Common Vulnerabilities – SQL Injection
Data-driven applications vulnerable to SQL injection
Applications that use SQL queries based on form information.
Invalid or nonexistent data validation checks before SQL statement.

9. Common Vulnerabilities – SQL Injection
Data-driven applications vulnerable to SQL injection
Example – Simple authentication system:
SQL Injection Example

10. Prevention Architectural considerations Third-Party Tools
Properly-Segmented Network
Firewalls Between Segments
Input Validation
Third-Party Tools
Vulnerability Scanners

11. Prevention – Architectural Considerations
3-Tier/Layer design approach – minimize the attack surface
UI/Interface
Logic
Data

12. Prevention – Architectural Considerations
Network Topology
Isolating public networks from intranets
Use of firewalls between network segments

13. Prevention – Third-Party Tools
Vulnerability Scanners
Most will probe the web application for a set of known security holes.
Nikto
Aware of “over 3300 potentially dangerous files/CGIs, versions on over 625 servers, and version specific problems on over 230 servers. “ (Nikto Website)

14. Web Application Security Summary
Reason for concern
Dynamic user input
Common vulnerabilities
XSS, Sessions, SQL Injection
Best Defenses
Application Design, 3rd party tools