Download as PDF, PPTX
Uploaded byJames Crowley
10 things I’ve learnt about web application security
James Crowley's document outlines ten key learnings about web application security, emphasizing the importance of addressing known vulnerabilities and implementing best practices. He advises developers to hack their own applications, validate inputs, and ensure proper encoding and security configurations. The document also provides actionable recommendations for fortifying web applications against common threats like XSS and CSRF, and highlights the significance of SSL best practices.
More Related Content
![[Cluj] CSP (Content Security Policy)](https://cdn.slidesharecdn.com/ss_thumbnails/csp-151026112506-lva1-app6892-thumbnail.jpg?width=640&height=640&fit=bounds)
Similar to 10 things I’ve learnt about web application security
10 things I’ve learnt about web application security
- 1. 10 things I’velearnt about web application security James Crowley CTO, FundApps @jamescrowley
- 2. Who has writtensoftware with bugs in before?
- 3. Learning #1 –Security vulnerabilities are bugs
- 4. OWASPTop 10 in2013 Injection BrokenAuthentication & Session Management Cross Site Scripting Insecure Direct Object References Security Misconfiguration Sensitive Data Exposure Missing Function Level Access Control Cross Site Request Forgery Using Components with Known vulnerabilities Unvalidated redirects and forwards
- 5. Learning #2 –If you feel confident about security, be afraid!
- 6. Action: Hack yourown applications * Fiddler ZED Attack Proxy Skipfish WATOBO Tamper Data WebScarab Packaged VMs: Beef project, SamuriWTF More here: http://resources.infosecinstitute.com/owasp-top-10-tools-and-tactics/ * Be aware of computer misuse act.
- 7.
- 8. Learning #3 –Fixing the basics are easy and worthwhile.
- 9. Unvalidated redirects (espMVC 1 & 2) Secure & HttpOnly cookies Obvious cross site scripting vulnerabilities Obvious SQL injection Missing best practice headers Allowing caching of secure pages Autocomplete on password pages (!!) Application errors being disclosed and different error pages Directory traversals Missing XSRF protection Things they (should) pick up…
- 10.
- 11. You’re using asalted hash, right? How many iterations?
- 12. Action: Check ifyou’re using 1000+ iterations on your password hashing. If not, plan to migrate. // use this helper or use Rfc2898DeriveBytes directly System.Web.Helpers.Crypto.HashPassword(passwordToHash);
- 13. Learning #4 –It’s game over once you have fallen for XSS (those alert boxes are scary)
- 14.
- 15. Learning #5 –Do not rely on Request validation. Not even a little bit.
- 16. Action: Validate inputusing white lists not black lists. Apply blanket validation to model binding (unless set otherwise)
- 17. Learning #6 -Encode your output, especially with JavaScript. Be wary with 3rd party libraries.
- 18. Action: Review encodinganywhere you’re passing variables between server and JavaScript/Urls/Css System.Web.HttpUtility.UrlEncode System.Web.Security.AntiXss.AntiXssEncoder.CssEncode System.Web.HttpUtility.JavaScriptStringEncode
- 19. Action: Review anywhereyou’re accessing parameters (such as the URL fragment) from JS
- 20. Action:Tighten up encodingusing AntiXSS – uses whitelist rather than blacklist <httpRuntime encoderType="System.Web.Security.AntiXss.AntiXssEncoder, System.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />
- 21. Learning #7 -Be especially wary of file uploads if you’re supporting IE 8 (or earlier)
- 22. Action: Ensure Content-Dispositionis always set
- 23. Action: Ensure youwhite list both file extension and mime types
- 24. Action: Use X-Content-Type-Optionsto disable mime type sniffing in IE <system.webServer> <httpProtocol> <customHeaders> ... <add name="X-Content-Type-Options" value="nosniff" /> </customHeaders> </httpProtocol> </system.webServer>
- 25. Action: Use Content-Security-Policy-Report-Only headerto monitor JavaScript usage and then Content-Security-Policy to restrict (and enforce best practice!) <add name="Content-Security-Policy" value="default-src 'self'; script-src 'self' https://apis.google.com; report- uri http://loghost.example.com/reports.jsp" />
- 26. Learning #8 –Don’t forget about your emails
- 27. # Learning 9– Have a reliable strategy for preventing cross site request forgeries Hint: ScatteringValidateAntiForgeryToken at random on your actions doesn’t count!
- 28.
- 29.
- 30. Action: ApplyValidateAntiForgeryToken toall non-GET requests. Fail secure. https://gist.github.com/jamescrowley/a6e53957c8c0778f5e12
- 31. Learning #10 -Forward Secrecy and SSL best practices are easier than you might think (but it’s a moving target)
- 32. Demo: If you’renot running HTTPS…
- 33. Action: Scan yourcurrent setup for configuration & Heartbleed https://www.ssllabs.com/ https://filippo.io/Heartbleed/
- 34. Action: Get yourciphers in order, enable ECDHE for forward secrecy
- 35. Action: Apply Strict-Transport-Securityheader (with a long age) <add name="Strict-Transport-Security" value="max- age=31536000" />
- 36. Wrapping up Go hackyour own application Run ZED Attack Proxy / SkipFish Pass on your knowledge
- 37. Thanks for listening –any questions? Tweet me: @jamescrowley Blog: www.jamescrowley.co.uk PS FundApps is hiring! Get in touch
- 38.
- 39. Books The Browser Hacker'sHandbook The Web Application Hacker's Handbook: Finding and Exploiting Security Flaws
- 40. Best Practices Troy Hunt- http://www.troyhunt.com/ “Don’t do this, do that” from the ASP.NETTeam - http://bit.ly/1fXzIH2 (article) and http://vimeo.com/68390507 (video) OWASP - https://www.owasp.org/index.php/Category:OWASP_.NET_Project
- 41. Security news &resources OWASP - https://www.owasp.org/index.php/Main_Page Microsoft security response - @msftsecresponse / microsoft.com/msrcblog SANS - http://www.sans.org/security-resources/ CVE - http://cve.mitre.org/
- 42.
- 43. Other tools toprotect yourself… Vulnerability scanning Skipfish, WebInspect, QualysGuard… Web Application Firewalls Snort, Imperva, Cloudflare, ModSecurity… PCI Scanning HackerGuardian, QualsysGuard…