Pascarello_Investigating JavaScript and Ajax Security

Investigating JavaScript and Ajax Security Presented By: Eric Pascarello

Background on Eric Pascarello ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

What we are going to investigate ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

One thing everyone must do: Use Common Sense!

Quick Intro to Ajax ,[object Object],[object Object],[object Object],[object Object]

Ajax Security Makes a lot of news because of: ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Adaptive Path’s Original Diagram

The Real Life Diagram Of Ajax How to explain Ajax to your non-geek friends ,[object Object]

The Non-Ajax Solution ,[object Object],[object Object],[object Object],[object Object]

The Ajax Solution ,[object Object],[object Object],[object Object],[object Object]

The “Ajax Engine” ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

The XHR Object ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

XHR Object Methods Assigns header to be sent with a request setRequestHeader("label", "value") Transmits the request send(content) The heart and soul! Sets destination URL, method, and other optional attributes open("method", "URL"[, asyncFlag[, "userName"[, "password"]]]) Returns value of a specified header label getResponseHeader("headerLabel") Returns all header (labels/value) sets getAllResponseHeaders() Stops the current request abort() Description Method

XHR open() ,[object Object],[object Object],[object Object]

send(parameters) ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

XHR Object Properties String message accompanying the status code statusText Numeric code returned by server, such as 404 for "Not Found" or 200 for "OK" status DOM-compatible document object of data returned from server process responseXML String version of data returned from server process responseText Object status integer readyState Event handler for an event that fires at every state change onreadystatechange Description Property

onreadystatechange ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

readyState values ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

status ,[object Object],[object Object],[object Object],[object Object],[object Object]

Basic Example of code ,[object Object],[object Object],[object Object],[object Object],[object Object]

I CAN VIEW THE SOURCE ,[object Object],[object Object],[object Object],[object Object],[object Object]

Before We Surrender to Fear ,[object Object],[object Object]

What is Different? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Major Cause Of Security Concerns ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Major Cause Of Security Concerns ,[object Object],[object Object],[object Object],[object Object]

Grandma is a Hacker ,[object Object],[object Object],[object Object],[object Object]

Business Logic Security ,[object Object],[object Object],[object Object],[object Object],[object Object]

The First Get Some Common Sense Award Goes To: ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

So You Think Your Form Is Safe? ,[object Object],[object Object],[object Object],[object Object],[object Object]

Hidden Fields Are Editable? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Who Needs ServerSide Validation When We Have ClientSide Checks? ,[object Object],[object Object],[object Object]

Simple Scripted Attacks On A Server ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Is This A Vulnerability? YES or NO

What is your browser telling others about you? ,[object Object],[object Object],[object Object]

So with some JavaScript we can test where you been ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Let Us Now Look AT XSS ,[object Object],[object Object],[object Object],[object Object],[object Object]

The Second Get Some Common Sense Award Goes To: ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Biggest Offenders in XSS ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Test For JavaScript Injection ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Cross Site Scripting Cheat Sheet Esp: for filter evasion ,[object Object],[object Object],[object Object]

Combine Visited Links with XSS ,[object Object],[object Object],[object Object],[object Object],[object Object]

What can be done? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Real Life JavaScript Injections with Ajax! ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

The code of Samy ,[object Object]

Samy Injection Highlight ,[object Object],[object Object]

Yahoo gets attacked! ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

JavaScript Port Scanning? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

JSON Injection ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Other Injections ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Same Domain Policy Workaround: Proxy!

What is bad about this? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Other Tools ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Quick Summary ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Questions ,[object Object],[object Object],[object Object],[object Object],[object Object]

Pascarello_Investigating JavaScript and Ajax Security

Recommandé

Recommandé

Contenu connexe

Tendances

Tendances (19)

En vedette

En vedette (20)

Similaire à Pascarello_Investigating JavaScript and Ajax Security

Similaire à Pascarello_Investigating JavaScript and Ajax Security (20)

Plus de amiable_indian

Plus de amiable_indian (20)

Dernier

Dernier (20)

Pascarello_Investigating JavaScript and Ajax Security