Web 2.0 Hacking

Web Application Security Assessments: Beyond the Automated Scanners Presented by: Blake Turrentine, [email_address] Date: August 25, 2008 Locale: DHS Conference and Workshops, Baltimore, MD

Scanning Today’s Web 2.0 Technology

Beyond the Browser: Desktop Widgets

The Security Process ,[object Object],[object Object],[object Object],[object Object],[object Object]

Types of Testing Techniques ,[object Object],[object Object],[object Object]

Types of Automated Scanners ,[object Object],[object Object],[object Object],[object Object],[object Object]

[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Today’s Automated Scanners

[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Problems with Automated Scans

[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],More Problems With Automated Scans

[object Object],[object Object],[object Object],[object Object],[object Object],Approaching a Better Solution: Taking a Closer Look

[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Application Profiling

[object Object],[object Object],Examining Known Vectors

[object Object],[object Object],[object Object],[object Object],Client Side: Why scanners have difficulties in handling Advance JavaScript

[object Object],[object Object],Client Side: Why scanners can’t handle Applets

[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Server Side: Input/output of content is getting more complex

[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Server Side: Scanners Lack of Filter Enumeration and Evasion

[object Object],[object Object],Complexity of analysis in Web Services

[object Object],[object Object],[object Object],[object Object],[object Object],Difficulties in Testing Application Logic

[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Sophistication in Combining Attacks Vectors

[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Most Scanners Don’t Look for Infestation CSRF

[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Infestation Detection

[object Object],[object Object],[object Object],[object Object],[object Object],Difficulties in Fuzzing Analysis

[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Closing Remarks

Demonstration: ,[object Object]

Webmail Application Test: Combining Server & Client Attack Vectors

Webmail Application Test: IE Recognizes File as a HTML

Webmail Application Test: Session Cookie is Displayed

GMail Web Application Test: Screenshot of Attached file

GMail Web Application Test: IE Recognizes File as an HTML

GMail Web Application Test: Javascript Fires

Yahoo Mail Web Application Test: Creating an Email

Yahoo Mail Web Application Test: Contents of ‘Instructions.doc’

Yahoo Mail Web Application Test: Screenshot of Attached File

Yahoo Mail Web Application Test: Norton AV Scans File Before Download

Yahoo Mail Web Application Test: Javascript Fires

Yahoo Mail Web Application Test: Redirection to Another Site

Web 2.0 Hacking

Recommandé

Recommandé

Contenu connexe

Tendances

Tendances (20)

En vedette

En vedette (8)

Similaire à Web 2.0 Hacking

Similaire à Web 2.0 Hacking (20)

Dernier

Dernier (20)

Web 2.0 Hacking