Web Architecture - Mechanism and Threats

Web Architecture - Mechanism and Threats
© Copyright 2013 i-secure Co., Ltd. The information contained herein is subject to change without notice.
Sumedt Jitpukdebodin
Senior Security Researcher
CompTIA Security+, LPIC-1 , NCLA, C|EHv6, eCPPT, eWPT, IWSS, CPTE

~# whoami
 Name: Sumedt Jitpukdebodin(สุเมธ จิตภักดีบดินทร์)
 My blog: http://www.r00tsec.com, http://twitter.com/materaj, https://www.facebook.com/hackandsecbook
 Jobs
– I-SECURE Co., Ltd.
– Research And Develop Engineer, Senior Web Application Security Specialist, Senior Security Researcher
– Writer
– English article@ http://packetstormsecurity.com/files/author/9011/ and please google my name.
– Many Thai article, please google my Thai name.
– หนังสือ “Hacking & Security Book "Network Security หนังสือฉบับก้าวสู่นักทดสอบและป้องกันการเจาะระบบ”
 Hobby: Penetration Testing, Hacking, Reading Info Security, Play Games, Traveling around the world, Write
Article, Teaching and more...

Agenda

Agenda
 Web Architecture
 Web Architecture Attack
 Security Controls & Mechanism

Web Architecture

Basic Web Architecture
 Two Tier Architecture
– Web browser display content that return from Web Server
– Web server provide resource for client

HTML
 HTML(Hyper Text Markup Language)
– Document Layout Language
– Viewed by using Web Browser.

URI
 URI(Universal Resource Identifier)

URI(2)
 URL(Universal Resource Locator)
 URN(Universal Resource Name)

HTTP
 HTTP(Hyper Text Transfer Protocol)
 HTTP is an application layer.
 HTTP has 2 way communication: HTTP Request and HTTP Response.

HTTP(2)
 Request Message
– Request Line
– Request Header
– An empty line
– An optional Message Body

HTTP(3)

Request Method
– HEAD
– GET
– POST
– PUT
– DELETE
– TRACE
– OPTIONS
– CONNECT

Safe Method
– HEAD
– GET
– OPTIONS
– TRACE
– POST
– PUT
– DELETE
– CONNECT

Status Code
 Success: 2xx
 Redirection: 3xx
 Client-Side Error: 4xx
 Server-Side Error: 5xx

HTTP Session State
 HTTP is stateless Protocol
 Solutions
– Cookies
– Sessions
– Hidden variable
– URL encode parameter( /index.php?session_id=$session_code)

Web Architecture Extension
 Two tier architecture is not enough
 Common Gateway Interface(CGI)
 Standard protocol for interfacing with external application software with
a web server
 CGI program are executable programs that run on the web server.

Javascript
 Scripting language designed for dynamic, interactive web application
 Run on client side.
 Preprocessing data on the client before submission to a server.
 Changing content type and styles

Three tier web architecture

Make HTTP to stateful(2)
 Cookie
 A text stored on a client’s computer by a web browser.
 Sent as an HTTP Header
 Can used for authenticating, session tracking

Server and Client Processing
 Server-Side Processing
 PHP
 ASP
 ASP.NET
 Perl
 J2EE
 Python, Django
 Ruby On Rail
 Client-Side Processing
 CSS
 HTML
 Javascript
 Adobe Flash
 Microsoft Silverlight

AJAX
 Asynchronous Javascript and XML(AJAX)
 Create by Jesse James Garrett, Febuary 18, 2005
 Ajax Incorporates
 XHTML, CSS, Document Object Model(DOM), XML and XSLT,
XMLHttpRequest, Javascript

AJAX(2)

AJAX(3)

JSON
 Javascript Object Notation(JSON)
 JSON is lightweight computer data interchange format.
 JSON is based on a subset of Javascript programming language.
 Using of XML format.

JSON Request && Response

JSON(2)

XML
 eXtensible Markup Language
 Using for information exchange.
 Two primary building blocks of XML are elements and attributes.
 Elements are tags and have values.
 Elements are structured as a tree.
 Alternatively, elements may have both attributes as well as data.
 Attributes help you to give more meaning and describe your
element more efficiently and clearly.

XML(2)
 Tag
 Element
 Content

XML(3)

XML(4)

XML vs JSON

Web Services
 Web service is a software system designed to support machine-to-machine
intraction over a network.
 Web service are frequently just used to Internet Application
Programming Interfaces(API).
 Web service use HTTP for transmitting messages(RPC,SOAP,REST)

SOAP vs REST
 SOAP(Simple Object Access Protocol)
– Web service based on XML
 REST(Representational State Transfer)
– Web service represent in format of application

SOAP vs REST

SOAP Example
Reference:: http://www.soapui.org/The-World-Of-API-Testing/soap-vs-rest-challenges.
html

REST Example
Reference:: http://www.soapui.org/The-World-Of-API-Testing/soap-vs-rest-challenges.
html

Web Architecture Attack

Web Architecture
Reference :: Web Application Hacking/Security
101(https://docs.google.com/presentation/d/1fw7fO7kmVTcfXuupGTezSM76cdQH3IbYos5xu95L
yMs/edit#slide=id.p)

Web Architecture Attack
Reference :: Web Application Hacking/Security
101(https://docs.google.com/presentation/d/1fw7fO7kmVTcfXuupGTezSM76cdQH3IbYos5xu95L
yMs/edit#slide=id.p)

OWASP 2013
 Injection
 Broken Authentication and Session Management
 Cross-Site Scripting(XSS)
 Insecure Direct Object Rerefence
 Security Misconfiguration
 Sensitive Data Exposure
 Missing Function Level Access Control
 Cross-Site Request Forgery(CSRF)
 Using Components with Known Vulnerability
 Unvalidated Redirects and Forwards

Security Controls & Mechanism

Security Control
 Application Layer
 Network Layer

Application Layer
 Input Validation
 Sessions Management
 Authentication Method
 Strong Policy(Such as password policy)
 Same-Origin Policy

Network Layer
 Firewall
 Intrusion Detection System/Intrusion Prevention System(IDS/IPS)
 Web Application Firewall(WAF)
 Centralize Log Server

Network Layer Diagram
Reference :: http://www.umv.co.kr/main_eng/sm_enterprise.php

Web Architecture - Mechanism and Threats

More Related Content

What's hot (20)

Similar to Web Architecture - Mechanism and Threats (20)

More from Sumedt Jitpukdebodin (13)

Recently uploaded (20)

Web Architecture - Mechanism and Threats