OWASP TOP 10 & .NET

OWASP TOP 10 & .NET
DANIEL KRASNOKUCKI, EQUINIX & GROUPKA

WHOAMI?
/ Bezpiecznik (AppSec)
/ DevSecOps
/ Programista
/ Trener
/ Wykładowca
2OWASP TOP 10 & .NET | DANIEL KRASNOKUCKI | OWASP SILESIA | 25.09.2019

WHY R U HERE?
OWASP TOP 10 & .NET | DANIEL KRASNOKUCKI | OWASP SILESIA | 25.09.2019 3

TEXT
USERS AND PROGRAMERS VS. SECURITY
OWASP TOP 10 & .NET | DANIEL KRASNOKUCKI | OWASP SILESIA | 25.09.2019 4

A1 - INJECTIONS
A2 - BROKEN
AUTHENTICATION
A3 - SENSITIVE DATA
EXPOSURE
A4 - XML EXTERNAL
ENTITIES
A5 - BROKEN ACCESS
CONTROL
A6 - SECURITY
MISCONFIGURATION
A7 - CROSS-SITE
SCRIPTING
A8 - INSECURE
DESERIALISATION
A9 - USING
COMPONENTS WITH
KNOWN
VULNERABILITIES
A10 - INSUFFICIENT
LOGGING &
MONITORING
OWASP TOP 10 WEB APPLICATION VULNERABILITIES

A1 - INJECTIONS
A2 - BROKEN
AUTHENTICATION
A3 - SENSITIVE DATA
EXPOSURE
A4 - XML EXTERNAL
ENTITIES
A5 - BROKEN ACCESS
CONTROL
A6 - SECURITY
MISCONFIGURATION
A7 - CROSS-SITE
SCRIPTING
A8 - INSECURE
DESERIALISATION
A9 - USING
COMPONENTS WITH
KNOWN
VULNERABILITIES
A10 - INSUFFICIENT
LOGGING &
MONITORING
STARTING WITH THE OBVIOUS ONES…

A10 - INSUFFICIENT LOGGING & MONITORING
Insufﬁcient logging and monitoring, coupled with missing or ineffective
integration with incident response, allows attackers to further attack systems,
maintain persistence, pivot to more systems, and tamper, extract, or destroy data.
Most breach studies show time to detect a breach is over 200 days, typically
detected by external parties rather than internal processes or monitoring.

LOGGING IN .NET
Logging guidance from Microsoft
https://microsoft.github.io/code-with-engineering-playbook/Engineering/DevOpsLoggingDetailsCSharp.html
Where possible, always log:
• Input and output validation failures e.g. protocol violations, unacceptable encodings, invalid parameter names and
values
• Authentication successes and failures and Authorization (access control) failures
• Session management failures e.g. cookie session identiﬁcation value modiﬁcation
• Application errors and system events
• Application and related systems start-ups and shut-downs, and logging initialization (starting, stopping or pausing)
• Use of higher-risk functionality
• Legal and other opt-ins e.g. permissions for mobile phone capabilities, terms & conditions, PII data usage consent

A1 - INJECTIONS
A2 - BROKEN
AUTHENTICATION
A3 - SENSITIVE DATA
EXPOSURE
A4 - XML EXTERNAL
ENTITIES
A5 - BROKEN ACCESS
CONTROL
A6 - SECURITY
MISCONFIGURATION
A7 - CROSS-SITE
SCRIPTING
A8 - INSECURE
DESERIALISATION
A9 - USING
COMPONENTS WITH
KNOWN
VULNERABILITIES
A10 - INSUFFICIENT
LOGGING &
MONITORING
ANOTHER OBVIOUS ONE…

A9 - USING COMPONENTS WITH KNOWN VULNERABILITIES
Components, such as libraries, frameworks, and other software modules, run with
the same privileges as the application. If a vulnerable component is exploited,
such an attack can facilitate serious data loss or server takeover. Applications and
APIs using components with known vulnerabilities may undermine application
defences and enable various attacks and impacts.

A1 - INJECTIONS
A2 - BROKEN
AUTHENTICATION
A3 - SENSITIVE DATA
EXPOSURE
A4 - XML EXTERNAL
ENTITIES
A5 - BROKEN ACCESS
CONTROL
A6 - SECURITY
MISCONFIGURATION
A7 - CROSS-SITE
SCRIPTING
A8 - INSECURE
DESERIALISATION
A9 - USING
COMPONENTS WITH
KNOWN
VULNERABILITIES
A10 - INSUFFICIENT
LOGGING &
MONITORING

A8 - INSECURE DESERIALISATION
Insecure deserialization often leads to remote code execution. Even if
deserialization ﬂaws do not result in remote code execution, they can be used to
perform attacks, including replay attacks, injection attacks, and privilege
escalation attacks.
OWASP TOP 10 & .NET | DANIEL KRASNOKUCKI | OWASP SILESIA | 25.09.2019
{ 
"$type": "System.Windows.Data.ObjectDataProvider, PresentationFramework",  
“ObjectInstance": {  
"$type":"System.Diagnostics.Process, System”},  
"MethodParameters":{  
"$type":"System.Collections.ArrayList, mscorlib",  
"$values":["calc"]},  
"MethodName":"Start"  
}

ANY FLOWS IN .NET?

INSECURE DESERIALISATION MITIGATION
‣ Do not deserialize untrusted data!
‣ … do not deserialize untrusted data!
‣ If you really need to deserialize:
‣ Make sure to evaluate the security and of the chosen library
‣ Avoid libraries without strict Type control
‣ Never use user-controlled data to deﬁne the deserializer expected Type
‣ Do not roll your own format

A1 - INJECTIONS
A2 - BROKEN
AUTHENTICATION
A3 - SENSITIVE DATA
EXPOSURE
A4 - XML EXTERNAL
ENTITIES
A5 - BROKEN ACCESS
CONTROL
A6 - SECURITY
MISCONFIGURATION
A7 - CROSS-SITE
SCRIPTING
A8 - INSECURE
DESERIALISATION
A9 - USING
COMPONENTS WITH
KNOWN
VULNERABILITIES
A10 - INSUFFICIENT
LOGGING &
MONITORING

A7 - CROSS-SITE SCRIPTING
XSS ﬂaws occur whenever an application includes untrusted data in a new web
page without proper validation or escaping, or updates an existing web page
with user-supplied data using a browser API that can create HTML or JavaScript.
XSS allows attackers to execute scripts in the victim's browser which can hijack
user sessions, deface web sites, or redirect the user to malicious sites.

IT’S MOSTLY SECURED BY DEFAULT IN .NET, BUT …
‣ Stop reinventing the wheel
‣ Do not be smarter than the framework
‣ If you use Razor, then use Razor. If you use something else, then use something
else, but do not use your own Razor-ish, MVC-ish, .NET-ish…
‣ Validate and whitelist each input and parameter
‣ Use proper output encoding

A1 - INJECTIONS
A2 - BROKEN
AUTHENTICATION
A3 - SENSITIVE DATA
EXPOSURE
A4 - XML EXTERNAL
ENTITIES
A5 - BROKEN ACCESS
CONTROL
A6 - SECURITY
MISCONFIGURATION
A7 - CROSS-SITE
SCRIPTING
A8 - INSECURE
DESERIALISATION
A9 - USING
COMPONENTS WITH
KNOWN
VULNERABILITIES
A10 - INSUFFICIENT
LOGGING &
MONITORING

A6 - SECURITY MISCONFIGURATION
Security misconfiguration is the most commonly seen issue. This is a result of
insecure default configurations, incomplete or ad hoc configurations, open cloud
storage, misconfigured HTTP headers, and verbose error messages containing
sensitive information. Not only must all operating systems, frameworks, libraries,
and applications be securely configured, but they must be patched/upgraded in
a timely fashion.

POSSIBLE .NET MISCONFIGURATION
‣ Missing appropriate security hardening across any part of the application stack, or improperly
conﬁgured permissions on cloud services.
‣ Unnecessary features are enabled or installed
‣ Default accounts and their passwords still enabled and unchanged
‣ Error handling without custom errors
‣ For upgraded systems, latest security features are disabled or not conﬁgured securely
‣ The security settings in the application servers, application frameworks, libraries, databases, etc.
not set to secure values.
‣ The server does not send security headers or directives or they are not set to secure values.

SECURITY HEADERS

EXAMPLE: CONTENT SECURITY POLICY

SECURITY CONFIGURATIONS IN .NET - COOKIES

A1 - INJECTIONS
A2 - BROKEN
AUTHENTICATION
A3 - SENSITIVE DATA
EXPOSURE
A4 - XML EXTERNAL
ENTITIES
A5 - BROKEN ACCESS
CONTROL
A6 - SECURITY
MISCONFIGURATION
A7 - CROSS-SITE
SCRIPTING
A8 - INSECURE
DESERIALISATION
A9 - USING
COMPONENTS WITH
KNOWN
VULNERABILITIES
A10 - INSUFFICIENT
LOGGING &
MONITORING

A5 - BROKEN ACCESS CONTROL
Restrictions on what authenticated users are allowed to do are often not properly
enforced. Attackers can exploit these ﬂaws to access unauthorized functionality
and/or data, such as access other users' accounts, view sensitive ﬁles, modify
other users' data, change access rights, etc.

IDOR (INSECURE DIRECT OBJECT REFERENCES)
www.mybestandonlystore.com/orders/orderid=900

CORS (CROSS-ORIGIN RESOURCE SHARING)

A1 - INJECTIONS
A2 - BROKEN
AUTHENTICATION
A3 - SENSITIVE DATA
EXPOSURE
A4 - XML EXTERNAL
ENTITIES
A5 - BROKEN ACCESS
CONTROL
A6 - SECURITY
MISCONFIGURATION
A7 - CROSS-SITE
SCRIPTING
A8 - INSECURE
DESERIALISATION
A9 - USING
COMPONENTS WITH
KNOWN
VULNERABILITIES
A10 - INSUFFICIENT
LOGGING &
MONITORING

XXE
string xml = "<?xml version="1.0" ?>
<!DOCTYPE doc
[<!ENTITY win SYSTEM "file:///C:/Users/user/Documents/test.txt">]
><doc>&win;</doc>”;
---------------------
string xml2 = "<?xml version="1.0" ?>
<!DOCTYPE doc [<!ENTITY lin SYSTEM „/etc/passwd">]><doc>&lin;</doc>";

A4 - XML EXTERNAL ENTITIES
Many older or poorly configured XML processors evaluate external entity
references within XML documents. External entities can be used to disclose
internal files using the file URI handler, internal file shares, internal port scanning,
remote code execution, and denial of service attacks.

.NET XML LIBRARIES
Object Safe by default?
XmlReader
< 4.0
4.0 +
XmlTextReader
< 4.0
4.0+
XmlDocument
< 4.6
4.6+

A1 - INJECTIONS
A2 - BROKEN
AUTHENTICATION
A3 - SENSITIVE DATA
EXPOSURE
A4 - XML EXTERNAL
ENTITIES
A5 - BROKEN ACCESS
CONTROL
A6 - SECURITY
MISCONFIGURATION
A7 - CROSS-SITE
SCRIPTING
A8 - INSECURE
DESERIALISATION
A9 - USING
COMPONENTS WITH
KNOWN
VULNERABILITIES
A10 - INSUFFICIENT
LOGGING &
MONITORING

A3 - SENSITIVE DATA EXPOSURE
Many web applications and APIs do not properly protect sensitive data, such as
ﬁnancial, healthcare, and PII. Attackers may steal or modify such weakly protected
data to conduct credit card fraud, identity theft, or other crimes. Sensitive data
may be compromised without extra protection, such as encryption at rest or in
transit, and requires special precautions when exchanged with the browser.

LOOKS FAMILIAR?

A1 - INJECTIONS
A2 - BROKEN
AUTHENTICATION
A3 - SENSITIVE DATA
EXPOSURE
A4 - XML EXTERNAL
ENTITIES
A5 - BROKEN ACCESS
CONTROL
A6 - SECURITY
MISCONFIGURATION
A7 - CROSS-SITE
SCRIPTING
A8 - INSECURE
DESERIALISATION
A9 - USING
COMPONENTS WITH
KNOWN
VULNERABILITIES
A10 - INSUFFICIENT
LOGGING &
MONITORING

A2 - BROKEN AUTHENTICATION
Application functions related to authentication and session management are
often implemented incorrectly, allowing attackers to compromise passwords,
keys, or session tokens, or to exploit other implementation ﬂaws to assume other
users' identities temporarily or permanently.

BROKEN AUTHENTICATION MITIGATIONS
‣ Passwords with proper length and complexity
‣ Use general messages for the user
‣ Limit the attempts of login
‣ Do not show sessionID to the user
‣ Secure your cookies
‣ Use MFA
‣ If you are using hashed passwords, do not use your own
hashing functions and add a salt
http://www.przyklad.com/(S(lit2py15t221z5v65vlsd23s55))/zamowienie.aspx

BROKEN AUTHENTICATION - EXAMPLE SETTINGS

A1 - INJECTIONS
A2 - BROKEN
AUTHENTICATION
A3 - SENSITIVE DATA
EXPOSURE
A4 - XML EXTERNAL
ENTITIES
A5 - BROKEN ACCESS
CONTROL
A6 - SECURITY
MISCONFIGURATION
A7 - CROSS-SITE
SCRIPTING
A8 - INSECURE
DESERIALISATION
A9 - USING
COMPONENTS WITH
KNOWN
VULNERABILITIES
A10 - INSUFFICIENT
LOGGING &
MONITORING

A1 - INJECTIONS
Injection ﬂaws, such as SQL, NoSQL, OS, and LDAP injection, occur when
untrusted data is sent to an interpreter as part of a command or query. The
attacker's hostile data can trick the interpreter into executing unintended
commands or accessing data without proper authorization.

SQL INJECTION - GENERAL CASE
www.somestore.com/Products.aspx?CategoryID=1
www.somestore.com/Products.aspx?CategoryID=1 or 1=1

SQL INJECTION - REAL EXAMPLE
And quick mitigation….

SQL INJECTION MITIGATION
‣ Use .NET security leading practices and OWASP Guidelines
‣ Parametrize your queries
‣ Validate the parameters from the user - ALWAYS!
‣ Use whitelisting of characters
‣ Check the length of the parameter
‣ App should have the minimum required permission in the system (not running
as an admin “because it’s easier and it’s working”)
‣ You can use ORM…

IQUERYABLE<T> VS. IENUMERABLE<T>
‣ IEnumerable is best to query data from in-memory
collections like List, Array, etc.
‣ While query data from a database, IEnumerable
execute a select query on the server side, load data in-
memory on a client-side and then ﬁlter data.
‣ IEnumerable doesn’t support custom query.
‣ IEnumerable doesn’t support lazy loading. Hence not
suitable for paging like scenarios.
‣ Extension methods support by IEnumerable takes
functional objects.
‣ IQueryable is best to query data from out-memory
(like remote database, service) collections.
‣ While query data from a database, IQueryable
execute the select query on the server side with all
ﬁlters.
‣ IQueryable supports custom query using CreateQuery
and Execute methods.
‣ IQueryable support lazy loading. Hence it is suitable
for paging like scenarios.
‣ Extension methods support by IQueryable takes
expression objects means expression tree.

IQUERYABLE<T> VS. IENUMERABLE<T>
public IQueryable<Customer> GetCustomer(int customerId)
‣ A consumer of this query can call .Include("Orders") on the returned IQueryable<Customer> to retrieve data that the
query did not intend to expose. This can be avoided by changing the return type of the method to IEnumerable<T> and
calling a method (such as .ToList()) that materializes the results.
‣ Because IQueryable<T> queries are executed when the results are iterated over, a consumer of a query that exposes
an IQueryable<T> type could catch exceptions that are thrown. Exceptions could contain information not intended for the
consumer.
Avoid returning IQueryable<T> types from methods that are exposed to potentially untrusted callers

.NET CORE VALIDATION PROBLEMS
‣ Laziness (our laziness… not .NET)
‣ Tools ﬁrst! (we do not think)
‣ Front-end validation
‣ Improper feedback for the user

A1 - INJECTIONS
A2 - BROKEN
AUTHENTICATION
A3 - SENSITIVE DATA
EXPOSURE
A4 - XML EXTERNAL
ENTITIES
A5 - BROKEN ACCESS
CONTROL
A6 - SECURITY
MISCONFIGURATION
A7 - CROSS-SITE
SCRIPTING
A8 - INSECURE
DESERIALISATION
A9 - USING
COMPONENTS WITH
KNOWN
VULNERABILITIES
A10 - INSUFFICIENT
LOGGING &
MONITORING

OWASP TOP 10 & .NET | DANIEL KRASNOKUCKI | OWASP SILESIA | 25.09.2019

…?

WYJAŚNIJ CO TO JEST, JAK DZIAŁA  
I GDZIE W .NET-CIE MOŻNA USTAWIĆ
CSP
PYTANIE KONKURSOWE
52

THANK YOU.
DZIĘKUJĘ.
DANIEL.KRASNOKUCKI@OWASP.ORG
53

OWASP TOP 10 & .NET

More Related Content

What's hot (20)

Similar to OWASP TOP 10 & .NET (20)

Recently uploaded (20)

OWASP TOP 10 & .NET