1. Cloud = Web, Web = Hacked! Fabio Viggiani

2. Why Web Apps? Every organization exposes web apps Most common entry point Image source: http://i.imgur.com Image source: https://www.flickr.com/photos/ brianklug/6870002408

3. Focus SQL injection, XSS… again with that old stuff??? Well, we DO find them every day! Why?

4. Demo Environment

5. Let’s hack! Basic stuff – warm up and understand Cross Site Scripting (XSS) SQL injection Image source: http://gizmodo.com/5498412/sql-injection-license-plate-hopes-to-foil-euro-traffic-cameras

6. We should be able to fix this XSS filters available online Prepared statements – easy and well documented Let’s do it

7. Let’s hack, again. Image source: http://www.ekantipur.com

8. Demo Environment

9. 2nd order SQL injection

10. What went wrong? Best practices Input validation / Output encoding Whitelist / Blacklist Localized fixes Code structure Default behaviors

11. We hack once again. For real now.