Web Security Never, ever, trust user inputs Supankar.
-
Upload
ramiro-patchin -
Category
Documents
-
view
219 -
download
0
Transcript of Web Security Never, ever, trust user inputs Supankar.
Web Security
Never, ever, trust user inputs
Supankar
What is Security?
why does security needs?
Haha! Yes I know it. Its really a funny topic!!
Is it call security?
Security why?
• To prevent stealing important data• To secure Personal Data / Credentials• Compromising Access Privilege• No Data Loss
Common Threats
• Cross-Site Scripting (XSS)• Session Hijack• Click Jacking• Cross-site request forgery (XSRF)• SQL Injection
Never, ever, trust user inputs
Input Validation
• Always use server side validation as client side (javascript) validation can easily be bypassed
• Use white-listed values• Use built-in escape functions• Validate for correct data types, like numbers
example
• supankar<script type="text/javascript" src="http://abcNews24.com/gps/malicious.js"></script>
Input Validation (Cont..)
• Don’t expect the return value from selections, radio buttons or check boxes of a form to be the ones you mentioned. So, always revalidate.
• Example:<input type="radio" name="gender" value="m"
/>Male<input type="radio" name="gender" value="f"
/>Female
Input Validation (Cont..)
• insert userinfo (gender) values($_POST[‘gender’])
• Garbage <input type="radio" name="gender" value=“a"
/>Male<input type="radio" name="gender" value=“c"
/>Female
Input Validation (Cont..)
• Defensive Programming:
$gender=‘m’;If ($_POST[‘gender’]==‘f’)
$gender=‘f’;
PHP: Some Bad FeaturesRegister Globals Consider the following code -
if ($password == "my_password") { $authorized = 1;
} if ($authorized == 1) {
echo "Lots of important stuff."; }
test.php?authorized=1 will produce “Lots of important stuff.” To disable register_globals using .htaccess file – php_flag register_globals 0 To disable register_globals using php.ini – register_globals = Off
Magic Quotes
PHP harmful functions
eval("shell_exec(\"rm -rf {$_SERVER['DOCUMENT_ROOT']}\");");
ini_set(), exec(),fopen(), popen(), passthru(), readfile(), file(), shell_exec() , system(),etc…
SQL InjectionMost common and most destructive security hazardLets see the common way to check username and password entered into a form – $check = mysql_query("SELECT Username, Password, UserLevel FROM Users WHERE Username = '".$_POST['username']."' and Password = '".$_POST['password']."'");
If we enter the following in the “username” input box and submit -' OR 1=1 #
The query that is going to be executed will now look like this –SELECT Username, Password FROM Users WHERE Username = '' OR 1=1 #' and Password = ''
As you can see, this query will return all the users from the database and as generally first user on a user table is the admin, the hacker will easily gain admin privilege.
SQL Injection - Preventing
• Sanitize Properly• User Prepared Statements• Use mysql_real_escape_string()• Turn on magic_quote_gpc with Caution
Error/warring Message
File ManipulationSome sites currently running on the web today have URLs that
look like this:index.php?page=contactus.html
The user can very easily change the "contactus.html" bit to anything they like. For example,index.php?page=.htpasswd
By changing the URL, on some systems, to reference a file on another server, they could even run PHP that they have written on your site.
When users download a file from your server, if the file name depends on user input, he can easily manipulate it to download system files by giving inputs like – “../../../etc/passwd”
• IndexIgnore .htaccess */.??* *~ *# */HEADER* */README* */_vti*
• ini_set('display_errors', 1); ini_set('log_errors', 1); ini_set('error_log', dirname(__FILE__) . '/error_log.txt'); error_reporting(E_ALL);
JavaScript!!!
• A creative innovation.
Giving the user more control over the browser Detecting the user's browser, OS, screen size, etc. Performing simple computations on the client side Validating the user's input Handling dates and time Generating HTML pages on-the-fly without
accessing the Web server.
Cross-Site Scripting (XSS)
• It allows attackers to add keyloggers, tracking scripts or porn banners on your site, or just stop your site working altogether.
• It can also used for cookie hijacking so that a real user can be faked.
• Always use htmlentities() function to output user-generated texts.
• Limit the character set that can used for a particular text type
• Disallow HTML input if possible. If that is not an option, only allow limited HTML tags
I am not Sleeping…….
Yes, I am, because it is boring..
Lets have some fun…
Fun…
• Go to supankar.wordpress.com• http://technotip.com/269/moving-image-
javascript-small-fun-application/Develop
XSS – Preventing
• Sanitize User input properly• Check Character Encoding• Double check before printing GET values fromURL
MVC? Is it secure?
Cross-site request forgery(XSRF)
• Using user’s logged in session to manipulate• http://example.com/admin/delete/post/1
Cross-site request forgery(XSRF) cont..
• User A has a post with ID 112
Cross-site request forgery(XSRF) cont..
• User B Posted on his blog <img src=‘/admin/delete/post/112’/>• No Effect for User B
Cross-site request forgery(XSRF) cont..
• User A visits User B’s blog• <img src=‘/admin/delete/post/112’/>• Delete’s User A’s post with ID 112
XSRF Prevention
• Use POST• Check for the presence of some sort of valid
submission
I have more important tasks please leave me now…
Ok, Ok, Just Summery
• Use common sense• Always check user input• No direct user input at sql query• Disable the error/warring messages at the
production time• Always try to use defensive programming
technique• Update your scripts to the latest versions
Suggestions
• Read security related news and updateso http://www.owasp.org/o http://shiflett.org/o http://www.securityfocus.com/
Toooo much, Supankar!! STOP NOW!!
<?php echo “Question”;?>
• An ounce of prevention is worth a pound of cure -> Benjamin Franklin
Thanks