Transcript OWASP AppSec US 09 Highlights Ofer Maor CTO, Hacktics OWASP Israel Dec 2009 http://www.webappsec.org/ Copyright © 2009 - The OWASP Foundation Permission is granted to copy, distribute and/or modify.

OWASP AppSec US 09
Highlights
Ofer Maor
CTO, Hacktics
OWASP
Israel
Dec 2009
http://www.webappsec.org/
Copyright © 2009 - The OWASP Foundation
Permission is granted to copy, distribute and/or modify this document under the
terms of the Creative Commons Attribution-ShareAlike 2.5 License. To view this
license, visit http://creativecommons.org/licenses/by-sa/2.5/
The OWASP Foundation
http://www.owasp.org/
Introduction
OWASP AppSec US 09– Held in DC, Nov 2009
2 Training Days, 2 Conference Days (+ Summit)
60 Lectures presented in the Conference
Today: 30 Minutes Summary!
Metrics & Statistics (By Chris Wysopal)
2009 Trends (By Ryan Barnett)
OWASP Top 10 2010 RC1 (By Dave Wichers)
Additional OWASP Projects
 OWASP Enterprise Security API (By Jeff Wiliams)
 OWASP Live CD (By Matt Tesauro)
 Learning by Breaking (By Chuck Willis)
OWASP Israel – Dec 2009
2
Web Application Security
Testing Statistics
Source:
Application security metrics from the organization
on down to the vulnerabilities
Presented By:
Chris Wysoapl, Veracode
OWASP Israel – Dec 2009
3
WASC Web Application Security Statistics
Project 2008
 Purpose
 Collaborative industry wide effort to pool together sanitized
website vulnerability data and to gain a better understanding
about the web application vulnerability landscape.
 Ascertain which classes of attacks are the most prevalent
regardless of the methodology used to identify them. MITRE
CVE project for custom web applications.
 Goals
 Identify the prevalence and probability of different vulnerability
classes.
 Compare testing methodologies against what types of
vulnerabilities they are likely to identify.
OWASP Israel – Dec 2009
4
Project Team
 Project Leader
 Sergey Gordeychik
 Project Contributors
 Sergey Gordeychik, Dmitry Evteev (POSITIVE TECHNOLOGIES)
 Chris Wysopal, Chris Eng (VERACODE)
 Jeremiah Grossman (WHITEHAT SECURITY)
 Mandeep Khera (CENZIC)
 Shreeraj Shah (BLUEINFY)
 Matt Lantinga (HP APPLICATION SECURITY CENTER)
 Lawson Lee (dns – used WebInspect)
 Campbell Murray (ENCRIPTION LIMITED)
OWASP Israel – Dec 2009
5
Summary
 12186 web applications with 97554 detected
vulnerabilities
 more than 13%* of all reviewed sites can be
compromised completely automatically
 About 49% of web applications contain vulnerabilities of
high risk level detected by scanning
 manual and automated assessment by white box method
allows to detect these high risk level
vulnerabilities with probability up to 80-96%
 99% of web applications are not compliant with
PCI DSS standard
* Web applications with Brute Force Attack, Buffer Overflow, OS Commanding, Path Traversal,
Remote File Inclusion, SSI Injection, Session Fixation, SQL Injection, Insufficient Authentication,
Insufficient Authorization vulnerabilities detected by automatic scanning.
OWASP Israel – Dec 2009
6
Compared to 2007 WASS Project
Number of sites with SQL Injection fell by 13%
Number of sites with Cross-site Scripting fell
20%
Number of sites with different types of
Information Leakage rose by 24%
Probability to compromise a host automatically
rose from 7 to 13 %.
OWASP Israel – Dec 2009
7
Probability to detect a vulnerability
OWASP Israel – Dec 2009
8
% of total vulnerabilities
OWASP Israel – Dec 2009
9
Manual vs. Automatic – Top Vulnerabilities *
Vulnerability Class
Content Spoofing
Credential/Session Prediction
Cross Site Scripting
CSRF
HTTP Response Splitting
Path Traversal
Predictable Resource Location
Session Fixation
SQL Injection
Information Leakage
Insufficient Authentication
Insufficient Authorization
Notes:
Manual Tests
19.75%
7.27%
56.73%
6.89%
11.45%
7.26%
13.94%
6.56%
19.47%
40.41%
11.66%
13.27%
Existing Tools
0.21%
0.09%
37.66%
0.02%
0%
0.54%
0.14%
0.03%
11.65%
72.68%
0.14%
0.13%
1. Not part of Chris’s Lecture
2. Based on Partial Participation of Automatic Tools (as well as
Manual Assessment Providers)
OWASP Israel – Dec 2009
10
Web Application Security Trends
January – June 2009
Source:
The Web Hacking Incidents Database (WHID)
Report: January – June 2009
Presented By:
Ryan Barnett, Breach Security
OWASP Israel – Dec 2009
11
OWASP Israel – Dec 2009
12
OWASP Israel – Dec 2009
13
OWASP Israel – Dec 2009
14
OWASP Top 10 2010
Source:
OWASP Top 10 2010 rc1
Presented By:
Dave Wichers, Aspect Security
OWASP Israel – Dec 2009
15
What’s Changed?
It’s About Risks, Not Just Vulnerabilities
• New title is: “The Top 10 Most Critical Web Application Security Risks”
OWASP Top 10 Risk Rating Methodology
• Based on the OWASP Risk Rating Methodology, used to prioritize Top 10
2 Risks Added, 2 Dropped
• Added: A6 – Security Misconfiguration
• Was A10 in 2004 Top 10: Insecure Configuration Management
• Added: A8 – Unvalidated Redirects and Forwards
• Relatively common and VERY dangerous flaw that is not well known
• Removed: A3 – Malicious File Execution
• Primarily a PHP flaw that is dropping in prevalence
• Removed: A6 – Information Leakage and Improper Error Handling
• A very prevalent flaw, that does not introduce much risk (normally)
OWASP Israel – Dec 2009
Mapping from 2007 to 2010 Top 10
OWASP Top 10 – 2007 (Previous)
OWASP Top 10 – 2010 (New)
A2 – Injection Flaws
A1 – Injection
A1 – Cross Site Scripting (XSS)
A2 – Cross Site Scripting (XSS)
A7 – Broken Authentication and Session Management
A3 – Broken Authentication and Session Management
A4 – Insecure Direct Object Reference
= A4 – Insecure Direct Object References
A5 – Cross Site Request Forgery (CSRF)
= A5 – Cross Site Request Forgery (CSRF)
<was T10 2004 A10 – Insecure Configuration
Management>
+ A6 – Security Misconfiguration (NEW)
A10 – Failure to Restrict URL Access
<not in T10 2007>
A7 – Failure to Restrict URL Access
+ A8 – Unvalidated Redirects and Forwards (NEW)
A8 – Insecure Cryptographic Storage
A9 – Insecure Cryptographic Storage
A9 – Insecure Communications
A10 – Insufficient Transport Layer Protection
A3 – Malicious File Execution
A6 – Information Leakage and Improper Error Handling
-
<dropped from T10 2010>
<dropped from T10 2010>
OWASP Israel – Dec 2009
OWASP Top 10 Risk Rating Methodology
Threat
Agent
?
1
2
3
XSS Example
Attack
Vector
Weakness
Prevalence
Weakness
Detectability
Technical Impact
Easy
Widespread
Easy
Severe
Average
Common
Average
Moderate
Difficult
Uncommon
Difficult
Minor
2
1
1
2
1.3
*
2
Business
Impact
?
2.6 weighted risk rating
OWASP Israel – Dec 2009
A6 – Security Misconfiguration
Web applications rely on a secure foundation
• All through the network and platform
• Don’t forget the development environment
Is your source code a secret?
• Think of all the places your source code goes
• Security should not require secret source code
CM must extend to all parts of the application
• All credentials should change in production
Typical Impact
• Install backdoor through missing network or server patch
• XSS flaw exploits due to missing application framework patches
• Unauthorized access to default accounts, application functionality or data,
or unused but accessible functionality due to poor server configuration
OWASP Israel – Dec 2009
A6 – Avoiding Security Misconfiguration
 Verify your system’s configuration management
 Secure configuration “hardening” guideline
 Automation is REALLY USEFUL here
 Must cover entire platform and application
 Keep up with patches for ALL components
 This includes software libraries, not just OS and Server applications
 Analyze security effects of changes
 Can you “dump” the application configuration
 Build reporting into your process
 If you can’t verify it, it isn’t secure
 Verify the implementation
 Scanning finds generic configuration and missing patch problems
OWASP Israel – Dec 2009
A8 – Unvalidated Redirects and Forwards
Web application redirects are very common
• And frequently include user supplied parameters in the destination URL
• If they aren’t validated, attacker can send victim to a site of their
choice
Forwards (aka Transfer in .NET) are common too
• They internally send the request to a new page in the same application
• Sometimes parameters define the target page
• If not validated, attacker may be able to use unvalidated forward to
bypass authentication or authorization checks
Typical Impact
• Redirect victim to phishing or malware site
• Attacker’s request is forwarded past security checks, allowing
unauthorized function or data access
OWASP Israel – Dec 2009
Unvalidated Redirect Illustrated
Attacker sends attack to victim via email or webpage
Bus. Functions
E-Commerce
Knowledge Mgmt
Communication
Victim clicks link containing unvalidated
parameter
Transactions
Application redirects
victim to attacker’s site
Accounts
2
3
Administration
From: Internal Revenue Service
Subject: Your Unclaimed Tax Refund
Our records show you have an
unclaimed federal tax refund. Please
click here to initiate your claim.
Finance
1
Custom Code
Request sent to vulnerable
site, including attacker’s
destination site as parameter.
Redirect sends victim to
attacker site
http://www.irs.gov/taxrefund/claim.jsp?year=2006
& … &dest=www.evilsite.com
Evil Site
4
Evil site installs malware on
victim, or phish’s for private
information
OWASP Israel – Dec 2009
Unvalidated Forward Illustrated
1
Attacker sends attack to vulnerable page they have access to
Request sent to
vulnerable page which
user does have access to.
Redirect sends user
directly to private page,
bypassing access control.
2
Application authorizes
request, which continues
to vulnerable page
public void sensitiveMethod(
HttpServletRequest request,
HttpServletResponse response) {
try {
// Do sensitive stuff here.
...
}
catch ( ...
Filter
public void doPost( HttpServletRequest request,
HttpServletResponse response) {
try {
String target = request.getParameter( "dest" ) );
...
request.getRequestDispatcher( target
).forward(request, response);
}
catch ( ...
3
Forwarding page fails to validate
parameter, sending attacker to
unauthorized page, bypassing access
control
OWASP Israel – Dec 2009
A8 – Avoiding Unvalidated Redirects and
Forwards
 There are a number of options
1. Avoid using redirects and forwards as much as you can
2. If used, don’t involve user parameters in defining the target URL
3. If you ‘must’ involve user parameters, then either
a) Validate each parameter to ensure its valid and authorized for the current user, or
b) (preferred) – Use server side mapping to translate choice provided to user with actual
target page
 Defense in depth: For redirects, validate the target URL after it is calculated to
make sure it goes to an authorized external site
 ESAPI can do this for you!!

See: SecurityWrapperResponse.sendRedirect( URL )

http://owasp-esapi-java.googlecode.com/svn/trunk_doc/org/owasp/esapi/filters/
SecurityWrapperResponse.html#sendRedirect(java.lang.String)
 Some thoughts about protecting Forwards
 Ideally, you’d call the access controller to make sure the user is authorized
before you perform the forward (with ESAPI, this is easy)
 With an external filter, like Siteminder, this is not very practical
 Next best is to make sure that users who can access the original page are ALL
authorized to access the target page.
OWASP Israel – Dec 2009
OWASP ESAPI
(Enterprise Security API)
Source:
Don’t Write Security Code!
(The OWASP Enterprise Security API)
Presented By:
Jeff Williams, Aspect Security
OWASP Israel – Dec 2009
25
Reality Check










Financial
Government
Technology
Banking
Healthcare
Insurance
Publishing
Retail
Utilities
Education
90% of applications
are vulnerable
Applications average 20
serious vulnerabilities
OWASP Israel – Dec 2009
26
http://www.owasp.org/index.php/ESAPI
OWASP ESAPI Project Charter…
To ensure that
strong simple security controls
are available to every developer
in every environment
OWASP Israel – Dec 2009
27
Before
After
OWASP Israel – Dec 2009
28
Project
Scorecard
Authentication




Identity




Access Control


*


Input Validation



*



Output Escaping






Canonicalization






Encryption





Random Numbers





Exception Handling






Logging






Intrusion Detection




Security
Configuration




WAF





OWASP Israel – Dec 2009
29
Select ESAPI Early Adopters
Many unnamed
financial orgs…
OWASP Israel – Dec 2009
30
Better Input Validation
// validate request against developer-defined patterns
ValidationErrorList errorList = new ValidationErrorList();
String name = ESAPI.validator().getValidInput(
"Name", form.getName(), “UserName", 255, false, errorList);
Integer weight = ESAPI.validator().getValidInteger(
“UserWeight", form.getWeight(), 1, 10000, false, errorList);
request.setAttribute(“VERROR”, errorList );
…
// get validation errors and update web page
ValidationErrorList errors =
(ValidationErrorList)request.getAttribute(“VERROR");
// update page
OWASP Israel – Dec 2009
31
Stamping Out XSS
Rule #1: HTML Element Content
ESAPI.encoder.encodeForHTML(input)
Rule #2: HTML Common Attributes
ESAPI.encoder.encodeForHTMLAttribute(input)
Rule #3: HTML Javascript Data Values
ESAPI.encoder.encodeForJavaScript(input)
Rule #4: HTML Style Property Values
ESAPI.encoder.encodeForCSS(input)
Rule #5: HTML URL Attributes
ESAPI.encoder.encodeForURL(input)
Use these in components and developers won’t even know!
OWASP Israel – Dec 2009
32
Rich Content
String input = request.getParameter( "input" )
String safeMarkup = ESAPI.validator()
.getValidSafeHTML( "input", input, 2500, true );
…
<%=safeMarkup%>
OWASP Israel – Dec 2009
33
Stopping Insecure Direct Object References
// setup a map and store somewhere safe - like the session!
Set fileSet = new HashSet(); fileSet.addAll(...);
AccessReferenceMap map = new AccessReferenceMap( fileSet );
...
// create an indirect reference to send to browser
String ref = map.getIndirectReference( file1 );
String href = "esapi?file=" + ref );
...
// get direct reference
String ref = request.getParameter( "file" );
File file = (File)map.getDirectReference( ref );
OWASP Israel – Dec 2009
34
Identity Everywhere
// check the current user’s credentials
User user = ESAPI.authenticator().login();
// display their last login time
User user = ESAPI.authenticator().getCurrentUser() ;
out.println( “Login: “ + user.getLastLoginTime() );
// rotate their session id
ESAPI.httpUtilities().changeSessionIdentifier();
// kill their session and session cookie
ESAPI.authenticator().logout;
You can rotate your session without losing
the contents
OWASP Israel – Dec 2009
35
ESAPI Web App Firewall (WAF)
Critical Application?
PCI requirement?
3rd party application?
Legacy application?
Incident response?
attacker
user
WAF
ESAPI
Virtual patches
Authentication rules
URL access control
Egress filtering
Attack surface reduction
Real-time security
OWASP Israel – Dec 2009
36
Documentation
 Javadoc
 http://owasp-esapijava.googlecode.com/svn/trunk_d
oc/index.html
 Banned APIs
 http://www.owasp.org/index.php/
ESAPI_Secure_Coding_Guideline
 Release Notes
 http://www.owasp.org/images/d/d
0/JavaEEESAPI_2.0a_ReleaseNotes.doc
 Install Guide
 http://www.owasp.org/images/4/4
c/JavaEE-ESAPI_2.0a_install.doc
OWASP Israel – Dec 2009
37
OWASP Live CD
Source:
OWASP Live CD
An open environment for web application security
Presented By:
Brad Causey
OWASP Israel – Dec 2009
38
General goals going forward
Showcase great OWASP projects
Provide the best, freely distributable application
security tools/documents
Ensure that the tools provided are easy to use
as possible
Continue to document how to use the tools and
how the modules were created
Align the tools with the OWASP Testing Guide v3
to provide maximum coverage
Awesome training environment
OWASP Israel – Dec 2009
39
Where are we now?
Current Release
AppSecDC Nov 2009 DOH!
Previous Releases
AppSecEU May 2009
AustinTerrier Feb 2009
Portugal Release Dec 2008
SoC Release Sept 2008
Beta1 and Beta2 releases during the SoC
Overall downloads = 330,081
(of 2009-10-05)
~5,094 GB of bandwidth since launch (Jul 2008)
Most downloads in 1 month = 81,607 (Mar 2009)
OWASP Israel – Dec 2009
40
Available Tools: 26 'Significant'
OWASP Tools:
Web Scarab
a tool for performing all types of
security testing on web apps and
web services
Web Goat
an online training environment for
hands-on learning about app sec
CAL9000
a collection of web app sec testing
tools especially encoding/decoding
JBroFuzz
a web application fuzzer for
requests being made over HTTP
and/or HTTPS.
WSFuzzer
a fuzzer with HTTP based
SOAP services as its main target
Wapiti
audits the security of web apps by
performing "black-box" scans
DirBuster
a multi threaded Java app to brute
force directory and file names
SQLiX
a SQL Injection scanner, able to
crawl, detect SQL-i vectors
OWASP Israel – Dec 2009
41
Available Tools: 26 'Significant'
Other Proxies:
Burp Suite
Scanners:
SQL-i:
sqlmap
w3af
Paros
Grendel
Scan
Spike Proxy
Nikto
Others:
SQL Brute
Metasploit
Httprint
Maltego CE
Duh:
Rat Proxy
namp
Zenmap
Fierce Domain
Scanner
Firefox
netcat
Wireshark
tcpdump
OWASP Israel – Dec 2009
42
Where are we going?
The cool fun stuff ahead
Project Tindy
Project Aqua Dog
Builder vs Breaker
Auto-update installed tools
Website update
OWASP Education Project
Minor release tweaks
Crazy Pie in the Sky idea
OWASP Israel – Dec 2009
43
Project Tindy & Aqua Dog
Project Tindy
OWASP Live CD installed to a
virtual hard drive
Persistence!
VMware, Virtual Box & Paralles
Project Aqua Dog
OWASP Live CD on a USB drive
VM install + VM engine + USB drive
= mobile app sec platform
Currently testing
Qemu is the current VM engine
OWASP Israel – Dec 2009
44
What have you done for me lately?
For Testers / QA testers
Wide array of tools, preconfigured and ready to go
Nice “jump kick” to keep in your laptop bag
Great platform to test or learn the tools
For App Sec Professionals
Both dynamic and static tool coverage
Ability to customize the the job your on
For Trainers
Ready to go environment for students
Ability to customize for the class
OWASP Israel – Dec 2009
45
How can you get involved?
Join the mail list
 Announcements are there – low traffic
Post on the AppSecLive.org forums
Download an ISO or VM
 Complain or praise, suggest improvements
 Submit a bug to the Google Code site
Create deb package of a tool
 How I create the debs will be documented, command by
command and I'll answer questions gladly
Suggest missing tools, docs or links
Do a screencast of one of the tools being used on the
OWASP Live CD
OWASP Israel – Dec 2009
46
Learn More
OWASP Site:
http://www.owasp.org/index.php/Category:OWASP_Live_CD_Projec
t
or just look on the OWASP project page (release quality)
http://www.owasp.org/index.php/Category:OWASP_Project
or Google “OWASP Live CD”
Download & Community Site:
http://AppSecLive.org
Previously: http://mtesauro.com/livecd/
OWASP Israel – Dec 2009
47
Learning by Breaking
Source:
Learning by Breaking
A New Project for Insecure Web Apps
Presented By:
Chuck Willis, MANDIANT
OWASP Israel – Dec 2009
48
Problem
Was looking for web applications with
vulnerabilities where I could:
Test web application scanners
Test manual techniques
Test source code analysis tools
Look at the code that implements the vulnerabilities
Modify code to fix vulnerabilities
Test web application firewalls
OWASP Israel – Dec 2009
49
Option – WebGoat
It is a great learning tool, but
It is a training environment, not a real
application
Same holds for other “artificial” applications
OWASP Israel – Dec 2009
50
Option – Proprietary “Free” Apps
Realistic applications with vulnerabilities
Often closed source, which prevents some uses
Can conflict with one another
Can be difficult to install
Licensing restrictions
OWASP Israel – Dec 2009
51
Solution
Create a set of broken, open source applications
Put them all on a VMWare Virtual Machine
Donate it to OWASP
Profit?
OWASP Israel – Dec 2009
52
Intentionally Broken Apps
OWASP WebGoat version 5.3 (Java)
OWASP Vicnum version 1.3 (Perl)
Mutillidae version 1.3 (PHP)
Damn Vulnerable Web Application version 1.06
(PHP)
OWASP Israel – Dec 2009
53
Intentionally Broken Apps
OWASP CSRFGuard Test Application version 2.2 (Java)
Mandiant Struts Forms (Java/Struts)
Simple ASP.NET Forms (ASP.NET/C#)
Simple Form with DOM Cross Site Scripting
(HTML/JavaScript)
LOOKING FOR DONATIONS!
OWASP Israel – Dec 2009
54
Old Versions of Real Applications
phpBB 2.0.0 (PHP, released April 4, 2002)
WordPress 2.0.0 (PHP, released December 31,
2005)
Yazd version 1.0 (Java, released February 20,
2002)
LOOKING FOR IDEAS!
OWASP Israel – Dec 2009
55
Where are the vulnerabilities?
Don’t have a master list of vulnerabilities (yet)
Counting on the community to contribute
Experimenting with using the issue tracker at
Google Code to allow the community to
contribute vulnerabilities as they are found
May move to wiki page(s) on the OWASP site
OWASP Israel – Dec 2009
56
What’s in a name?
Tentatively called “OWASP Broken Web
Applications Project”
I’m open to suggestions
OWASP Israel – Dec 2009
57
The Future
Establish as an OWASP project
Wiki page
Mailing list
Update project for collaboration
Create and maintain documentation
Push content to Google Code
Incorporate additional broken apps
The larger, the better
Would like more real / realistic applications
Adobe Flash (could use some help here)
Ruby on Rails?
OWASP Israel – Dec 2009
58
More Information and Downloads
More information can be found at
http://code.google.com/p/owaspbwa/
Version 0.9 of the VM has been released!
Linked from the blog at mandiant.com
I have a few CDs of the VM for anyone who
wants them
OWASP Israel – Dec 2009
59
Thank You!
Questions?
OWASP Israel – Dec 2009
60