Things that work

Things that DO NOT work Posting the CAPTCHA answer and response Posting the CAPTCHA ‘id’ and response POST /captcha HTTP/1.0

answer=kbpsh&response=kbpsh....

Using HTML to display the CAPTCHA ‘word’ Using HTML to display a mathematical equation to solve Please type in these letters: kbpsh

Shopping Cart Troubles Usual Shopping Process

Shopping Cart Troubles My Shopping Process

Add To Cart Contents After Payment Processed

Flash Accepts User Input Image Loader Flash loaded by HTML page HTML page sets parameters

Can Be Set Via URL Parameters

private var imgPath:String; imgPath = "http://localhost/sample.jpg" : img = this.loaderInfo.parameters.img; img_holder = new Image(imgPath);

Flash Movie Host On Your Site, Loading Images From Attackers Site

Cross System Data Truncation Forgotten Password Feature Page accepts email address and checks it is valid strEmail = Request.Form("txtemail") If strEmail <> "" Then objQRY.ClearParameters

objQRY.AddParameter "@email", trim(strEmail)

Calls A Stored Procedure

set rsLogin = objQRY.ReturnRS("spUserMatch")

Cross System Data Truncation Forgotten Password Feature Stored procedures does a user lookup CREATE PROCEDURE [dbo].[spUserMatch] @email varchar(100) = null ...

Truncates Input To 100 Characters

Cross System Data Truncation Forgotten Password Feature If user exists, send email with new password Set Mailer = Server.CreateObject("SMTPsvg.Mailer") Mailer.Subject = "New Password" Mailer.BodyText = strBody Mailer.Recipient = strEmail

Attacker Receives Copy Of Email Uses The Original Input (Non Truncated) <100 spaces>;

Cookie Data Serialisation Object Serialised Base64 encoded and stored as cookie // create map java.util.HashMap map = new java.util.HashMap(); map.put("UserId", UserId); map.put("email", email); // Serialise and B64 it String info = java.net.URLEncoder.encode(new String(org.apache.commons.codec.binary.Base64.encode

Base64(buffer.toByteArray()),"UTF-8"),"UTF-8"); // Store it in cookie org.apache.cocoon.environment.http.HttpCookie cookie = new org.apache.cocoon.environment.http.HttpCookie("SESSI ON", info);

Cookie Data Serialisation Object Is Stored Insecurely In Cookie Base64 is not encryption Cookie Data Can Be Decoded And modified And recoded And sent back Application Deserialises It And trusts it And attacker gains access as another userID

Lets Not Leave Out PHP Execute System() With User Supplied Input This was for real.... In a ‘security’ appliance used by .mil

if ($_GET["cmd"] == "TERMEND") { $sid = $_GET["param"]; $cmd = "/var/www/htdocs/utt/Queue.pl

delete_message_queue $sid"; system($cmd);

Did I Mention That It Was Unauthenticated Access

Cookies Well, This Sure Looks Useful void CheckLoginCount() { HttpCookie cookie = Request.Cookies["LoginAttempts"]; } if (cookie != null) { int attempts = cookie.Value; if (attempts >= 5) Redirect("~/AccessDenied.aspx”); }

More Cookies Remember Me Functionality User selects remember me Application generates random token Stores token in cookie, and in database $token = substr(md5(uniqid(rand(), true)), 0, 49 - strlen($this->ID)); $this->RememberLoginToken = $token; Cookie::set('rem_me', $this->ID . ':' . $token);

More Cookies Remember Me Functionality User selects to logout Application sets token to null Stores null in cookie, and in database $this->RememberLoginToken = null; Cookie::set('rem_enc', null);

More Cookies Remember Me Functionality If the user doesn’t logout they use the autologin feature Application loads user based on cookie value Application checks the $tokens match list($uid, $token) = explode(':', Cookie::get(‘rem_me'), 2); $a_uid = Convert::raw2sql($uid); $user = DataObject:: get_one(“User", “User.ID = '$a_uid'"); if($user && $user->RememberLoginToken != $token) { $member = null; }

What Happens If $token is empty (null)

Evil Users Never Trust User Supplied Input

No really, users are evil And Hands Leap Out Of Matrix Style Backgrounds

Input Validation Input Validation Is The Key No I didn’t say ‘silver bullet’ Properly implemented can prevent most app vulns Validate At Input Validate all input to ensure if conforms to the required format Validate All Input Text strings, Cookie values, HTTP headers File data, Path names, URL values, Currency Data from databases, 3rd parties, web services

Client Site Validation Should only be used to reduce browser requests Never rely on client side validation for security Backend Validation Validate the data Ensure the user is authorised to access data records Should not matter what values the user sends

Data Normalisation Data Comes In Many Forms “this is data” %74%68%69%73%20%69%73%20%64%61%74%61 this is 0;data “ThIs iS dAtA” Many paths to the same location /help.jsp?page=user/welcome.htm

/help.jsp?page=user/../admin/welcome.htm

/help.jsp?page=user\..\admin/welcome.htm

/help.jsp?page=user\/\/..//\\/admin/welcome.htm

/help.jsp?page=help.jsp

Data Decoding or Normalisation Depending On Application Decode or reject Detect Encoded Data Decode the data and compare to original Decode Recursively To Its Lowest Form Concatenation of paths Multiple layers of encoding Formalise Decoding Order To prevent unintended decoding later in the application

Data Decoding And Validation FAIL MS Extended Unicode vulnerability /scripts/..%c0%af..%c0%afwinnt/system32/cmd.exe?/c+dir MS Double Decode vulnerability /scripts/..%255c..%255cwinnt/system32/cmd.exe?/c+dir NGINX Source Code Disclosure http://www.example.com/file.php%20

Conforms Ensure Data Conforms To Required Format Check length, type, min() max() values Alphanumeric only Must be a valid date Reject Bad Data Do not attempt to fix it up Easily leads to confusion Use Data Whitelists Checks against a list of known good values Easier to know which values are good input The recommended approach

Santise Data For Use Data Will Be Used In Different Place SQL, XML, Output, Log files Requires Different Sanitisation Remove meta chars Remove special characters Remove Linefeeds Use Standard Formalised Reusable Code Blocks Most languages contain these OWASP supplies some Homebrew stuff should be well tested and documented at the start of development

When Filtering Goes Wrong This Is Not Filtering If (imageurl = “/web.config”) exit() And Yes, XSS without