Security Bootcamp 2013 - Lap trinh web an toan

web coding security
Huỳnh Hải Âu
Công ty ISePRO

Đơn vị tổ chức:

Đơn vị tài trợ:

Contents
• SQL Injection
• XSS
• File upload

SQL Injection
• Introduction
• Bad codes
• Preventing solutions

• Types: 3 types
– Union base
• Inject a union query to extract data from database

– Error base
• Inject SQL characters, queries to make the application
query fail and raise errors
• Use sql errors to extract data from database

– Blind SQLi
• Inject sql characters to ask the database true or false
questions and determines the answer based on the
applications response

– Bad code 1:
if(isset($_POST['user']) && isset($_POST['password']))
{
$u = $_POST['user'];
$p = $_POST['password'];
$u = preg_replace('/union|select|from|where|and|or/i','',$u);
$p = preg_replace('/union|select|from|where|and|or/i','',$p);
$q = mysql_query("select * from user where username='$u' and
password='$p'");
if($r=mysql_fetch_assoc($q))
{
echo " Log in successfully !";
echo " Hello $r[username]";
}
else
echo " Invalid login !";
}

– Bad code 2:
{
$u = preg_replace(“/’/i”,””,$u);
$p = preg_replace(“/’/i”,””,$p);
$q = mysql_query("select * from user where username='$u' and
password='$p'");
{
}
else
}

– Bad code 3:
if(isset($_GET['id']))
{
$id = $_GET['id'];
$id = mysql_real_escape_string($id);
$q = mysql_query("select * from user where id=$id");
{
echo " Profile: $r[username]";
echo " Age: $r[Age]";
echo " Phone: $r[Phone]";
echo " Mail: $r[Mail]";
echo " Address: $r[Address]";
}
else
echo " Invalid id !";
}

– Bad code 4:
{
$u = mysql_real_escape_string($_POST['user']);
$p = mysql_real_escape_string($_POST['password']);
$p = hash("whirlpool", $p, true);
$q = mysql_query("select * from user where username='$u' and password='$p'");
{
}
else
Echo " Invalid login !";
}

• Preventing solutions:
– Prepare statement
• aka parameterized statement
• Template of sql query structure
– INSERT INTO PRODUCT (name, price) VALUES (?, ?)

• Separation of control flow & data flow

{
$q = $sql->prepare("select * from user where username=? and password=?");
$q->bind_param("ss", $u, $p);
$q->execute();
$res = $q->get_result();
if($r=$res->fetch_assoc())
{
}
else
$q->close();
}

Cross Site Scripting (XSS)
• Introduction
• Bad codes

• TYPES:
1.
2.

Non-Persistent
Persistent

• Non-Persistent:
In this type of XSS vulnerability an attacker is able to
execute his own code into a webpage but no changes
can be done in that website.

•

Persistent:
In this case attacker stores his executable script in the
vulnerable website database which is being executed every
time webpage is showing the data.

•

Common targets are:
–
–
–
–

Comments
Chat messages
E-mail messages
Wall posts, etc.

• Bad codes
– Bad code 1:
if (isset($_GET['color']))
{
$color = $_GET['color'];
$color = htmlspecialchars($color);
echo "<body bgcolor='". $color."'></body>";
}

– Bad code 2:
if (isset($_GET['color']))
{
$color = $_GET['color'];
$color = htmlspecialchars($color, ENT_QUOTES);
echo "<body bgcolor=$color></body>";
}

• Preventing solutions:
– Input validation
– Output encoding

• Input validation
– whitelist of acceptable inputs
– Consider potential input properties: length, type, range
of acceptable values, syntax

function validate($input)
{
if(!is_string($input))
die(“input must be string !”);
if(strlen($input) > 10)
die(“input length must lower than 10”);
if(!pregmatch(“/^city/”,$input))
die(“input must begin with city word”);
$whitelist={“red”, “green”, “blue”};
if(!in_array($input, $whitelist))
die(“bad input”);

}

• Output encoding
– Sanitizing all values before outputing to browser
– Output encoding functions:
• htmlentities: convert all applicable characters to
HTML entities

function encoding($output)
{
return htmlenties($output);

}
$safe_value = encoding($value);
echo $safe_value;

File Upload Attack
• Introduction
• Bad codes

• Allow attacker to upload malicious files to server
• Most of time, it’s web shell to take control over web
server
• Risk:
–
–
–
–
–
–

Web-shell upload
Website deface
XSS
Phishing
Malware upload
…

• Bad codes
– Bad code 1:
if (isset($_POST['submit']))
{
if($_FILES['userfile']['type'] != "image/gif")
{
echo "Sorry, we only allow uploading GIF images";
exit;
}
$uploaddir = 'uploads/';
$uploadfile= $uploaddir.basename($_FILES['userfile']['name']);
if (move_uploaded_file($_FILES['userfile']['tmp_name'], $uploadfile))
echo "File is valid, and was successfully uploaded.n";
else
echo "File uploading failed.n";
}

– Bad code 2:
{
$imageinfo = getimagesize($_FILES['userfile']['tmp_name']);
if($imageinfo['mime'] != 'image/gif' && $imageinfo['mime'] != 'image/jpeg')
{
echo "Sorry, we only accept GIF and JPEG imagesn";
exit;
}
$uploaddir = 'uploads/';
else
}

– Bad code 3:
{
$uploaddir = ‘D:/uploads/';

{
echo "<IMG SRC='" . $uploadfile . "'>";
}
else
}

– Keep uploaded files where they cannot be directly accessed
by the users via a direct URL
• Outside of webroot
• Or configure web server to deny access to upload directory

– Use system-generated file names instead of the names
supplied by users when storing files

{
$uploaddir = ‘D:/uploads/';
$new_file_name = rand(1,1000);
$uploadfile = $uploaddir . $new_file_name;
{
echo "<IMG SRC='" . $uploadfile . "'>";
}
else
}

Security Bootcamp 2013 - Lap trinh web an toan

More Related Content

What's hot (17)

Viewers also liked (16)

Similar to Security Bootcamp 2013 - Lap trinh web an toan (20)

More from Security Bootcamp (20)

Recently uploaded (20)

Security Bootcamp 2013 - Lap trinh web an toan