1. Web Applications Security What are web Applications?
IT College, Andres Käver, , autumn semester
Web:
Skype: akaver

2. TODO Download and modify for your choice of VM engine
Install into windows
Microsoft Threat Modeling Tool 2016

3. Web Applications - overview
Initial web was just static pages, no dynamic interaction with user was possible
CGI (Common Gateway Interface) was developed – allows input from user to be sent to an external program/script and then result rendered back to the user.
CGI is very rare now, but the concept is parent to all current web technologies.

4. WebApp - Technologies
CGI – mostly not used today. Very fast, applications are written in C/C++.
Low level languages don’t have direct HTML output.
Write-compile-deploy cycle is slow.
CGI does not support session/authorization controls.
Language barrier is high.
C and C++ suffer fro buffer overflow and resource leaks.

5. WebApp - Technologies
Filters – low level components (C/C++), living within execution context of webserver itself.
Apache server modules, MS ISAPI.
Perl, PHP, MS ASP

6. WebApp - Technologies
Scripting – interpreters run script code within the web server process.
Not compiled – write-deploy-run cycle is quicker.
Usually do not suffer from buffer overflows or resource leaks.
Most are not strongly typed and do not promote good programming practices.
Slower.
As apps grow, codebase becomes unmaintainable.
Multi-tier large scale apps are hard to implement.
ASP, Perl, PHP,…

7. WebApp - Technologies Application frameworks – J2EE, ASP.NET J2EE
Fast (almost on the level of C++)
Large distributed apps
Session and auth controls
Strongly typed- prevents many common security and programming issues
Hard to learn (similar to C)

8. WebApp - Technologies MS ASP.NET
.NET framework, just in time MSIL compiler
Lot of J2EE problem areas are improved
Easier to do smaller apps
Supports many languages, garbage collection, buffer overflow protection
Fast (near to C++ speed)
Strongly typed
Used to be windows centric – but not anymore. Native support on most platforms (.net core)

9. WebApp – small scale apps
Most applications are small/medium scale.
Usual architecture is simple linear procedural script.
Can be written in any language/platform (rarer on J2EE or ASP.NET)
Easy to write, few skills are needed to maintain the code
Many typical issues
Dynamic db queries constructed from direct user input
Bad user input validation
Poor error handling
Weak session/auth control

10. WebApp – large scale apps
Need a different architecture to that of simple survey or feedback form.
Scalable architecture becomes necessity (rather than being an luxury) – when more than 5 tables in db or more than functions to user are provided.
Often divided into tiers and broken down into re-usable chunks - allows distributed application (at the expense of complexity).
MVC is common pattern.

11. THE END