Download presentation
Presentation is loading. Please wait.
1
Protecting Against Common Web Application Vulnerabilities
Alaa Al-Bahrani Regional Cyber Security Leader, GE
2
Agenda What? Vulnerabilities 01 04 How? Protect 02 05 Top Attacks Q&A
What are web applications? Common vulnerabilities in web applications How? Protect 02 05 How web applications work? How to protect against web application vulnerabilities Top Attacks Q&A 03 06 Top attacks against web applications Questions
3
Web Applications Application hosted on a webserver
Accessed by a web browser Connects to a database backend Favored by many organizations Vulnerable to attacks! This Photo by Unknown Author is licensed under CC BY-SA This Photo by Unknown Author is licensed under CC BY-SA
4
How they work? Web Application Web Server 3rd Party Internet
Web Browser Database
5
Top Web Application Attacks
Source:
6
CMS Market Share Content Management Systems WordPress 60%
Around 27% of the Internet is Powered by WordPress, which means approximately 75 million websites are currently running WordPress as a CMS. Joomla 6.5% Drupal 4.6% Source: w3techs.com, January 2018 Source:
7
WordPress Vulnerabilities
Source: 2407 vulnerabilities
8
Common Vulnerabilities
Parameter Tampering Command Injection Cross-Site Scripting (XSS) SQL Injection
9
Parameter Tampering Attack
Definition Manipulation of parameters exchanged between client and server in order to modify application data URL Parameters <input type=”hidden” id=”1008” name=”cost” value=”70.00”> <input type=”hidden” id=”1008” name=”cost” value=”70.00”> <input type=”hidden” id=”1008” name=”cost” value=”70.00”> <input type=”hidden” id=”1008” name=”cost” value=”70.00”> Hidden Fields
10
Injection Attacks Definition
Unsolicited commands and data are passed to the web application due to not validating input <input type=”hidden” id=”1008” name=”cost” value=”70.00”> <input type=”hidden” id=”1008” name=”cost” value=”70.00”>
11
Injection Attacks
12
Cross-Site Scripting (XSS)
Definition Allows attackers to inject client-side scripts into web pages. The scripts would then be executed once the client visits the vulnerable web page. Stored Reflected When the victim access the vulnerable website, the malicious script executes Hacker injects vulnerable website with malicious scripts to steal information from victim’s browser 02 01 Website The malicious script sends victim information to the attacker Hacker 03 Victim
13
Cross-Site Scripting (XSS)
XSS using Script in Attributes <body onload=alert('test1')> <b onmouseover=alert('Wufff!')>click me!</b> <img src=" onerror=alert(document.cookie);> XSS using Script Via Encoded URI Schemes <IMG SRC=jAvascript:alert('test2')> XSS using code encoding <META HTTP-EQUIV="refresh“ CONTENT="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgndGVzdDMnKTwvc2NyaXB0Pg"> <script>alert('test3')</script>
14
Cross-Site Scripting (XSS)
The same could be used to execute stored XSS attacks in guestbook entries, blog posts, and comments.
15
Cross-Site Scripting (XSS)
Error Page Example Not found: /file_which_not_exist Not found: / (but with JavaScript code <script>alert("TEST");</script>)
16
SQL Injection The placement of malicious code in SQL statements, via web page input It is a fault in the code of the web application, not the DBMS A successful SQL injection exploit can: read sensitive data from the database, modify database data (Insert/Update/Delete) execute administration operations on the database (e.g. shutdown the DBMS) recover the content of a given file present on the DBMS file system issue commands to the operating system Photo Source:
17
SQL Injection 1=1 (Tautology) Example
stringUserID = getRequestString("User_ID"); stringSQL = "SELECT * FROM Users WHERE User_ID = " + stringUserID; 1=1 (Tautology) Example SELECT * FROM Users WHERE User_ID = 110 OR 1=1;
18
SQL Injection Batched SQL Statements Example
stringUserID = getRequestString("User_ID"); stringSQL = "SELECT * FROM Users WHERE User_ID = " + stringUserID; Batched SQL Statements Example SELECT * FROM Users WHERE User_ID = 110; DROP TABLE Suppliers;
19
SQL Injection Search Bar (UNION) Example
stringTitle = getRequestString(“Title”); stringSQL = “SELECT * FROM Authors WHERE Title Like %” + stringTitle + “%”; Search Bar (UNION) Example 1 UNION SELECT 1 FROM information_schema.tables --; SELECT * FROM Authors WHERE Title Like 1 UNION SELECT 1 FROM information_schema.tables --%
20
SQL Injection Many tools automate SQL injection attacks
Any input field can be used Login form Search bar Newsletter registration etc
21
How To Protect
22
Defense in Depth Layer 7 Layer 6 Web Application Layer 5
3rd Party Components Database Web Server Operating System Network Physical Security
23
Protecting Your Web Application
Input Validation Code Testing
24
Web Application Firewall (WAF)
Web Server 3rd Party Internet Web Browser Database
25
Honeypots Honeypots are a security system to detect and divert attacks
They replicate system services such as web services They allow collecting more information about the attack Photo Source:
26
Thank You
Similar presentations
