Web Application Security
ISACA Bangalore Chapter Aug 2007
Runa Dwibedi
In a recent application security audit
An adversary could:
View bank statements of any user
Siphon off funds easily
Login without a password
Deny access to all users
Hijack active sessions
Steal encryption keys
This morning…
The HTTP Protocol
Attacks on Input Validation
Insecurities in Session Management
Threats at the browser
Authentication Weaknesses
Threat Modeling
Attacks on Input Validation
Attacks on Input Validation
Client-side validation
Breach business rules
SQL Injection
XPATH Injection
Input Validation - Audit Checklist
Is input validated at server?
Are inputs checked with business rules?
Is the filter a white list?
Are SQL queries pre-compiled?
Are XPATH queries pre-compiled?
References – SSL & Encryption
• SSL Basics, RSA Security,
http://www.rsasecurity.com/standards/ssl/basics.html
• The pros and cons of securing Web services with
SSL, Jack Loftus,
http://searchwebservices.techtarget.com/qna/0,289202,
sid26_gci995388,00.html
• Understanding SSL, Shalini Gupta,
http://palisade.paladion.net/issues/2005Sep/understandi
ng-ssl/
• Encrypting data in Databases, Priyali Vibhute,
http://palisade.paladion.net/issues/2005Jun/database-
encryption/
References - SQL Injection
• SQL Injection Walkthrough, Securiteam,
http://www.securiteam.com/securityreviews/5DP0N1P76
E.html
• Introduction to SQL Injection Attacks,
Integrigy,
http://www.integrigy.com/info/IntegrigyIntrotoSQLInjectio
nAttacks.pdf
• Best Practices in Input Validation, Roshen
Chandran,
http://palisade.paladion.net/issues/2004Dec/input-
validation/
References - XML Injection
• XML Tutorial, W3Schools,
http://www.w3schools.com/xml/
• XPATH Tutorial, W3Schools,
http://www.w3schools.com/xpath/
• Mitigating XPath Injection Attacks in .NET,
Oleg Tkachenko,
http://www.tkachenko.com/blog/archives/00038
5.html
References - XML Injection
• XPath injection in XML databases, Runa
Dwibedi,
http://palisade.paladion.net/issues/2005Jul/xpath
-injection/
• Blind XPath Injection, Amit Klein,
http://www.watchfire.com/resources/blind-xpath-
injection.pdf
Insecurities in Managing
Sessions
Insecurities in Managing Sessions
Predictable session tokens
Transmitting tokens
On Logout
Session timeout
On Login
Cross Site Scripting
Session Management - Audit Checklist
Are session tokens random?
Do session tokens use cookies?
Are session tokens sent over SSL?
Are sessions invalidated on logout?
Is session timeout duration acceptable?
Are session tokens changed on login?
Are special characters escaped?
References - Session Management
• Web-based Session Management, Gunter Ollmann,
http://www.technicalinfo.net/papers/WebBasedSessi
onManagement.html
• Securing your session with Page Tokens, Sangita
Pakala,
http://palisade.paladion.net/issues/2005Aug/page-
tokens/
• Transmitting Session IDs, Salil Aroskar,
http://palisade.paladion.net/issues/2005Jul/quiz/
References - Cross Site Scripting
• The Cross Site Scripting FAQ, CGISecurity,
http://www.cgisecurity.net/articles/xss-faq.shtml
• HTML Code Injection and Cross-site scripting,
Gunter Ollmann,
http://www.technicalinfo.net/papers/index.html#Pap
er6
• Cross Site Scripting, Are your web applications
vulnerable?, Kevin Spett,
http://www.spidynamics.com/whitepapers/SPIcross-
sitescripting.pdf
Threats at the Browser
Threats at the Browser
The browser cache
History
Browser memory
The Refresh button
Threats at the Browser - Audit
Checklist
Has cache-control: no-store been set?
Are the links in History safe?
Are passwords stored as hashes?
Are passwords sent as salted hashes?
Is redirection used during login?
References - Cache
• Caching Tutorial for Web Authors and Webmasters,
Mark Nottingham http://www.mnot.net/cache_docs/
• HTTP/1.1: Caching in HTTP,
www.w3.org/Protocols/rfc2616/rfc2616-sec13.html
References - Passwords in memory
• Discovering passwords in the memory,
Abhishek Kumar,
http://paladion.net/papers/Discovering_Passwor
ds_In_Memory.pdf
• Passwords - In Memory Still Green, Sangita
Pakala,
http://palisade.paladion.net/issues/2004Aug/pas
swords-in-memory/
• WinHex – http://www.x-ways.net/winhex/index-
m.html
References - Browser Refresh
• Stealing Passwords via Browser Refresh,
Karmendra Kohli,
http://paladion.net/papers/Stealing_passwords_via_
browser_refresh.pdf
Insecurities in Authentication
Authentication - Forgot
Password
Best Practice
1. Ask a hint/custom question
2. Display a CAPTCHA
3. Send a short lived link to the user’s
registered email ID
4. Allow the user to reset the password over
SSL
5. Invalidate the link after one use
Authentication - Audit Checklist
Is “Forgot Password” question non-trivial?
Is the “Reset link” short-lived?
Is the new password exchanged over SSL?
References – Forgot Password
• Using Secret Questions, Mark Burnett,
http://www.owasp.org/columns/mburnett/questions
.html
The Attack of the Bots
Bots
Bots flood the server
With fake requests in public pages
Comments page
Registration at Free e-mail sites
Support query page
How can we stop them?
Pose a question that is easy for humans to
answer but difficult for computers
Enter Captchas!
“Completely Automated Public Turing Test to Tell
Computers and Humans Apart”
Types of CAPTCHAs
Image
Display a distorted text image
Knowledge
Pose a question “ What is the color of the sky?”
Arithmetic
Pose a question “ What is 34 +15?”
How to implement a CAPTCHA
Use readily available classes
Jcaptcha for Java
http://jcaptcha.sourceforge.net/main.html
BotDetect for .Net
http://www.lanapsoft.com/products.html
Authen-Captcha for Perl
http://search.cpan.org/dist/Authen-Captcha/
Build your own classes
Common Mistakes
Small set of images
Image File-names always map to same word
All the mappings can be discovered by attacker
Small set of images, dynamic filenames
Attacker can brute force till the correct word is
submitted
Best Practices
1. Dynamically generate an image
2. Send it to client with random token
3. Accept user input along with token
4. Compare user input with correct word for
token
5. Invalidate the token after one use
Do public forms have CAPTCHAs?
References - CAPTCHA
• PWntcha, http://sam.zoy.org/pwntcha/
• LanAp BotDetect,
http://www.lanapsoft.com/products.html
Audit Logs
Audit logs
An audit trail of activities enable us to trace
back fraud
Application layer activities are not logged by
system and web server logs
So, application should maintain own audit
trail
Access to logs should be controlled
The activities to be logged
Login and logout of users
Critical transactions (eg. fund transfer across
accounts)
Failed login attempts
Account lockouts
Violation of policies
Are audit logs detailed?
References – Logging and Audit Trails
• Application Logs - Security Best Practices, Dipesh
Rawal,
http://palisade.paladion.net/issues/2004Oct/security
-logging/
Threat Modeling
Threat Modeling
A structured technique to identify threats and
the security controls required to counter them
Across the SDLC
Threat
Modeling
SRS Design Development Testing Deployment
Evaluate against
Threat model
Phase1:Threat Profile
Is a list of all the possible threats to the
application
For example, for an online banking application,
some of the threats would be –
- An adversary steals the password of other users
- An adversary transfers fund from others account
to his own account
Phase2: Threat Trees
Identify security controls for each threat in the
threat profile
The 3 ways of compromising user password
would be –
- Access password
- Steal password from database
- Guess password
References - General
• Application Security FAQ, OWASP,
http://www.owasp.org/documentation/appsec_faq.
html
• HTTP/1.1: Header Field Definitions from RFC
2616,
http://www.w3.org/Protocols/rfc2616/rfc2616-
sec14.html
References - Books
• Writing Secure Code, Michael Howard, David
LeBlanc, Microsoft Press
• Secure Coding: Principles & Practices, Mark G.
Graff, Kenneth R. van Wyk, O’Reilly
• How to Break Software Security, James A.
Whittaker, Herbert H. Thompson, Addison Wesley
• Code Complete, Steve McConnell, Microsoft Press
• HTTP Developer's Handbook, Chris Shiflett, Sam’s
Publishing
• Threat Modeling, Frank Swiderski and Window
Snyder, Microsoft Press
References – Mailing List
• Security Focus Web Application Security -
http://www.securityfocus.com/archive/107
• Web Application Security Consortium Mailing List -
http://www.webappsec.org/lists/websecurity/archive
• Secure Coding Mailing List -
http://www.securecoding.org/list/
• Secure Programming Mailing List,
http://www.securityfocus.com/archive/98
Thank You
