Web Security Terms such as what is a WAF, Access Control, Output Encoding .pptx
- 2. Web Application Firewalls Essentially bouncers to a web application Do not need the source code to your application A firewall secures the entire network and the WAF secures just the application WAF blocks traffic WAF are placed before application and servers WAFS can help against XSS and DDOS attacks WAFS are on layer 7 (application layer)
- 3. What is a Blocklist A web application firewall uses a blocklist to block possible malicious payloads
- 4. So how do we bypass a web application firewall ? ● One technique is mangling and mutating the code
- 5. Nikto background data for lab 10 ● Nikto is a web vulnerability scanner ● Say nikto –help to find out what commands you can use ! ● Nikto works on any web server or website ● How to specify the host and port ● nikto -h 192.168.1.108 -p 80 -o filenamehere -F txt ● -F indicates the file type (38) Nikto Web Vulnerability Scanner - Web Penetration Testing - #1 - YouTube
- 6. Nikto is very easily picked up by security so you should be careful if you are doing something bad…. Which you shouldn’t be.
- 7. Tip Nikto can show what our application version is and then people can look up how to exploit what your website is powered by….
- 8. Oh look we have put commands meaning we can probably upload some malicious malware And hey! Look! There’s a default account we can sign in with….
- 9. Secure development ● Developing your applications securely will help you be a great developer but it’s usually not just your security ● Secure coding is not perfectly integrates (there isn’t really a standard yet) ● Startups do not have security teams usually so its important to try and learn a bit about security
- 10. Input Validation Concerns incoming (untrusted) data to the application All validation should be made through trusted systems=> don’t do validation on the client side, do it on the server There should be a centralized input validation routine
- 11. Output encoding ● A defensive way to stop injection attacks ● Best applied just before content is passed to the target interpreter ● Output encoding should be done unless you know the code is safe ● One library that does this is DOM purify but it even still has vulnerabilities ● Alphanumeric characters won’t be risky lol
- 12. Session management ● Happens when user logs in and supplies authentication ● A session ID is generated for the user for a period of time ● This is a cookie, form field or URL Session cookie ● Has temporary data and deleted after session or the web browser is closed ● Tracks clients movements in website ● Has an expiration date SESSION INACTIVITY SHOULD ALWAYS BE IMPLEMENTED FOR OPTIMAL SECURITY
- 13. Access control ● Used sessions ● Do not trust anything from the client ● Cookies should be validated and created on your own server ● Single site wide component to authorize ● Enforce authorization controls on every request
- 14. ● Avoid using random open source stuff ● Use the apis for the specific application you are using
- 15. Handling and logging Do not have sensitive info in error responses Error occurs = error message details in burp and then hackers have fun
- 16. Data protection
- 17. Referer header leakage Referer header can let other sites know where you came from which is not good, some older browsers still have this issue