1. Web Application Vulnerabilities ECE 4112 Internetwork Security, Spring 2005 Chris Kelly Chris Lewis April 28, 2005 ECE 4112 Internetwork Security, Spring 2005 Chris Kelly Chris Lewis April 28, 2005

2. Web Application Vulnerabilities  Cross Site Scripting (XSS) with JavaScript injection  SQL Injection  Cross Site Scripting (XSS) with JavaScript injection  SQL Injection

3. Cross Site Scripting (XSS)  Allows attackers to run scripts from remote sites  Can be used to steal your cookies  Allows masquerading  Allows attackers to run scripts from remote sites  Can be used to steal your cookies  Allows masquerading

4. How does this happen?  Not validating data  Printing query_string directly to screen  Not validating data  Printing query_string directly to screen

5. How can I tell?  Find page that prints data from query_string  Create link as follows:  Page.cgi? alert(‘I am vulnerable’)  If popup box is displayed, you are vulnerable to XSS  Find page that prints data from query_string  Create link as follows:  Page.cgi? alert(‘I am vulnerable’)  If popup box is displayed, you are vulnerable to XSS

6. How can I prevent this?  Validate / Sanitize your input!!!!!  Languages provide build it functions for this  Treat all input as evil input  Validate / Sanitize your input!!!!!  Languages provide build it functions for this  Treat all input as evil input

7. What you will do in lab  Look at a XSS exploit.  Have your cookie stolen by this script.  Look at a XSS exploit.  Have your cookie stolen by this script.

8. SQL Injection  Allows attackers to interact more directly with your database than you intend  Can be used to bypass security  Can be used for information discovery  Allows attackers to interact more directly with your database than you intend  Can be used to bypass security  Can be used for information discovery

9. How does this happen?  Not validating data  Including user input directly in SQL statements  Form input  URL parameters  Not validating data  Including user input directly in SQL statements  Form input  URL parameters

10. How can I tell?  Use ‘ and “ in input boxes on your site and see if it causes error messages  Google for SQL error messages on your site  Use ‘ and “ in input boxes on your site and see if it causes error messages  Google for SQL error messages on your site

11. How can I prevent this?  Validate / Sanitize your input!!!!!  Languages provide built in functions for this  Treat all input as evil input  Validate / Sanitize your input!!!!!  Languages provide built in functions for this  Treat all input as evil input

12. What you will do in lab  Explore the possibilities of SQL Injection on a vulnerable website  See how big of a problem this is and learn how to prevent it.  Explore the possibilities of SQL Injection on a vulnerable website  See how big of a problem this is and learn how to prevent it.

13. Questions?