Mission :- Understand / Learn / Practice OWASP Web Security Vulnerabilities https://www.owasp.org/index.php/Top102013-Top_10 In this session, Attendees will perform hands-on exercises to get a better understanding of the OWASP top ten security threats.
3.
WHO AM I
I' m Next-Gen Exploratory Testy
Student of Information Security field
Researcher & Reader in free time
Member of
Crowd Tester (AKA. Bug bounty Hunter)
Proficient at Functional, Usability , Accessibility & Compatibility Testing
Love to develop nasty code & Hack it :)
Works as Quality Analyst at
AKA. Bug Wrangler
Null Open Security Co mmunity
passbrains.com
4. DISCLAIMER
This presentation is intended for educational purpose only and I cannot be held liable for
any kind of damages done, whatsoever to your machine, or any other damages.
Don't try this attack on any other system without having context knowledge or permission,
this may harm someone directly or indirectly.
Feel free to use this presentation for practice or education purpose.
^ I hope - You gotcha ^
5. AGENDA
No Revision of Part - 1
Understand New Attacks
Self exploratory exercise
Learn + Hack
Q & A
6. FOR SOCIAL MEDIA
Twitter handle
@ @null0x00 Abhinav_Sejpal
Hashtag for this session
# #Nullhumla nullblr
12. OBJECTIVES FOR THIS SESSION
BUILD SECURITY AWARENESS FOR WEB
APPLICATION
LEARN WAY TO DISCOVER SECURITY
VULNERABILITIES
LEARN BASIC OF SECURE WEB APPLICATION VIA
OWASP TOP 10
13. LET'S BEGIN OUR JOURNEY
OF
TOP 10 WEB APPLICATION SECURITY
HAZARDS
* We won't talk about Injection & XSS *
14. for:
Setup the Test Lab
Install XAMPP
Acronym
X (to be read as "cross", meaning )cross-platform
Apache HTTP Server
MySQL
PHP
Perl
15. TARGETED APPLICATION
Client Side language : HTML & Javascript
Server side Language: PHP
DB : MYSQL
Why PHP ? - Any answer Here?
Why MySQL? MySQL is Girlfriend of PHP <3
16. PHP IS USED BY 82.2% OF ALL THE WEBSITES AS SERVER-SIDE
PROGRAMMING LANGUAGE.
http://w3techs.com/technologies/overview/programming_lang
18. 2013 Server-side Programming Language of the Year
Don't Mind Power of PHP > Facebook & yahoo
http://w3techs.com/blog/entry/web_technologies_of_the_year
19. It's a free, open source web application provided to allow
security enthusiast to pen-test and hack a web application.
V.2X developed by aka
PLAY GROUND
MUTILLIDAE
Jeremy Druin webpwnized.
24. CSRF AKA. XSRF
THE ATTACKER EXPLOITS THE TRUST A WEBSITE
HAS AGAINST A USER’S BROWSER.
Permission fakingstealing
Disruption of the normal sequence of the site
25. DEMO #1
Login ID - admin
password - adminpass
HTTP GET Request
http://127.0.0.1/xampp/mutillidae/index.php?do=logout
27. UNDERSTANDING
Logout page was a simple HTTP GET that required no
confirmation
Every user who visited that page would immediately be
logged out - that's CSRF in action.
Yes it's not dangerous but annoying
28.
29. SO WHAT DO YOU THINK,
IT'S ALL ABOUT CLICK ?
ssh, No!!
Would you like to write CSRF exploit without click ??
30. IMAGE TAG
<img style="display:none;" src="your Request">
Image tag does not require clicking the link compared Tag-
A requires clicking on the link to activate the HTTP request
Can we try Demo 1 with Image tag ?
31.
32. <img src=
>
CSRF GET Request with Image Tag
<html>
<title> CSRF Demo 1 </title>
http://127.0.0.1/xampp/mutillidae/index.php?
do=logout
</html>
33. THE NATURE OF BROWSERS IS TO SEND HTTP REQUESTS TO VISUAL OBJECTS SUCH AS PICTURE OR REMOTE FILES (CSS, JS,
ETC.) EVEN WHILE LOADING THE PAGE WITHOUT THE USER'S PERMISSIONS.
Iframe tag
<iframe src="your Request"></iframe>
Java Script code
<script> var X= new Image();
X.src = "URL";
</script>
Can we try Demo 1 with Iframe & JS ?
38. : Solution Available :
http://127.0.0.1/xampp/CSRF Attack/Add New Blog Entry -
CSRF POST.html
39. DOES IT EASY TO CREATE CSRF HTTP REQUEST ?
No - you should try out
~ ~CSRF Finder Firefox add-on
* One Click POC *
* Hybrid automation *
Thank you - Piyush Pattanayak
54. So, Let's Learn about Web App DB structure
Passwords are stored in plain text.
oh really -- ':(
OWASP #A6
55. Password is protected, when stored using encryption
algorithm. Are you sure?
http://www.md5online.org/
56. YOU MAY ALSO TRY OUT HASH BUT PASSWORD SALT IS A
RECOMMENDED SOLUTION SO FAR.
P ASSWORD POLICY SHOULD BE APPLIED NICELY AND SHOULD NOT BE WEAKER.
-- * --
SECURITY & BUSINESS LOGIC SHOULD BE APPLIED FOR CHANGING PASSWORD.
CHANGE PASSWORD DOESN'T ASK FOR CURRENT PASSWORD - LOL
78. Can you verify that - your website SSL Cert isn't vulnerable
to Heart bleed attack?
Google - SSL Heart bleed Fix verification script
https://lastpass.com/heartbleed/
90. IF YOU ARE PLANNING TO HOST YOUR OWN
SERVER
this talk matters for you
"SECURING A LINUX WEB SERVER IN 10 STEP S"
BY A KASH MAHAJAN
https://www.youtube.com/watch?v=ort9qxzu3h0
98. YES - I'M DONE!
Feel free to write me at bug.wrangler at outlook.com
99. WE NEED YOU!
Attend Null Meets-up & give presentations.
Share your ideas & leanings.
Talk to our community champions & gain from leanings.
Your feedback helps us to build a good community.
Looking forward to your ongoing support.
HTTP://NULL.CO.IN/
Say 'Hello' @null0x00
100. - Twitter Folks -
@ , @ , @
#Nullblr Leads & Champions
Big thank you to @ ,@ & you All.
CREDITS
TroyHunt yog3sharma @ Lavakumark HaiderMQ
null0x00 ru94mb
101. INDIAN HACKERS/INFOSEC GUYS & GROUPS YOU
SHOULD BE FOLLOWING IN TWITTER
Thank-you http://garage4hackers.com/ community