1. Caleb Sima Chief Technologist – Application Security Center Exploiting Web Security Vulnerabilities

5. Web Applications Breach the Perimeter Internet DMZ Trusted Inside Corporate Inside HTTP(S) IMAP FTP SSH TELNET POP3 Firewall only allows PORT 80 (or 443 SSL) traffic from the Internet to the web server. Any – Web Server: 80 Firewall only allows applications on the web server to talk to application server. Firewall only allows application server to talk to database server. IIS SunOne Apache ASP .NET WebSphere Java SQL Oracle DB2

6. Web Application Vulnerabilities Platform Administration Application Known Vulnerabilities Extension Checking Common File Checks Data Extension Checking Backup Checking Directory Enumeration Path Truncation Hidden Web Paths Forceful Browsin g Application Mapping Cookie Manipulation Custom Application Scripting Parameter Manipulation Reverse Directory Transversal Brute Force Application Mapping Cookie Poisoning/Theft Buffer Overflow SQL Injection Cross-site scripting Web application vulnerabilities occur in multiple areas.

8. SQL INJECTION AND BLIND SQL INJECTION

12. Massive Automation

14. CROSS-SITE SCRIPTING ATTACKS

15. Simple XSS Checking

16. Fill in the forms

17. User input is reflected back

18. Let’s try some javascript

19. Bingo!

22. Let’s view the profile and see what happens

23. Success!

24. Does it execute in a displayed list of results?

25. Yes it does.

26. Create an external JS file 1. Attacker creates exploit profile 2. Victim executes date search 3. Headline is viewed. Exploited 4. Victim requests attack payload 5. Payload delivered. 6. Victim sends cookie to attacker Dating Website Attack Server

33. The Result Victim browser Evil profile on profile.myspace.com Victim profile on www.myspace.com 1 Caleb Victim becomes “carrier” and can now infect others, worm propagates

37. Welcome to the Age of User Generated Content

39. What we do Enterprise Application Security Assurance Assessment Management Platform (AMP) Source Code Validation QA/Integration Testing Production Assessment DevInspect QAInspect WebInspect Plan Requirements Design Build Production Test Enterprise Security Assurance & Reporting