CSC662

COMPUTER SECURITY

WEB APPLICATION
SECURITY

These slides are prepared from Prof Pavel Laskov‘s lecture slide Version 2.0

MODERN THREAT LANDSCAPE

The majority of modern vulnerabilities are found

in web applications.

1
 WEB APPLICATION
VULNERABILITIES
3,462/2,029 web/non-web application
vulnerabilities were discovered by
Symantec in 2008
Average exposure time: 60 days
12,885 site-specific XSS vulnerabilities
were submitted to XSSed in 2008
Only 3% of site-specific vulnerabilities were
fixed by the end of 2008

WEB APPLICATION: USER’S VIEWS

HTTP: a simple stateless protocol.

Client-side operations:
open a TCP connection on port 80
send a request
Server-side operations
establish a TCP connection request
process an HTTP request
send an HTTP reply

2
WEB APPLICATION: TECHNICAL
INFRASTRUCTURE

Additional requirements:
Traffic filtering
Load balancing
Performance improvement

WEB APPLICATION: SOFTWARE

INSTRUMENTATION

3
WEB APPLICATION THREATS

HTTP PROTOCOL

Simple protocol for transfer of hyperlinked

content
Request/response
Stateless
Clear-text

4
HTTP REQUEST STRUCTURE

Initial request line:

Method (GET, POST, etc.)
Resource specified by URI
Protocol version
Header lines: key/value pairs, e.g.
Accept-language: <language>
Body (arbitrary byte stream, separated by
CR LF)
Uploaded files
Form data

HTTP METHODS
Get
retrieves a resource Get /cgi-bin/birthday.pl?
form parameters in Month=june&day=27 HTTP/1.0
URI
safe, no side-effects

POST
sends data to a POST /script.cgi HTTP/1.0
server User-Agent: HTTPYool/1.0
form parameters in Content-Type: ...
body Content-Length: 32
<CR><LF>
potential side-effects
Name=pavel&surname=laskov

5
UNIFORM RESOURCE IDENTIFIER
(URI)
Syntax:
<scheme>://<authority><path>?<query>#<fragment>
Special characters can be hex-encoded
%0A = newline
%20 or + = space
%2B = +
Examples:
ftp://ftp.ietf.org/rfc/rfc1808.txt
http://ida.first.fhg.de/~laskov
http%3A%2F%2F//ida%2Efirst%2Efhg%2Ede%2F%7Elaskov
mailto:pavel.laskov@uni-tuebingen.de

HTTP RESPONSE STRUCTURE

Initial response line

Protocol version
Status code
Status message
Header lines (same as request)
Body (arbitrary byte stream, separated by
CR LF)
Requested resources in HTML

6
HTTP BASIC AUTHENTICATION

Goal: allow a browser send login credentials

Method
Concatenate user name and password
separated by the colon
Encode using base64
Send in clear text

HTTP DIGEST AUTHENTICATION

Server receives a (method:URI) request
Server denies access and returns a nonce as a challenge.
Client asks a user for credentials
Client calculates:
H1 = MD5(username:realm:password)
H2 = MD5(method:URI)
Client sends msg = MD5(H1:nonce:H2) to a server
Server knows password’ for the user and computes:
H1’ = MD5(username:realm:password’)
H2 = MD5(method:URI)
Server compares MD5(H1’:nonce:H2) with msg.

7
SESSION MANAGEMENT AND
COOKIES
Cookie is a set of name/value pairs stored in a
browser
Cookie usage:
authentication
state maintenance (e.g. “shopping cart”)
user preference tracking
Cookie attributes:
name
value
expiration date
the path and domain the cookie is valid for

PERSISTENT AUTHENTICATION
USING COOKIES

8
 MAIN PROBLEM OF XSS

Any web application that returns user input without

filtering is a potential XSS vulnerability!
Allows execution of arbitrary Javascript in user’s
browser.
Why would a user do this?
Inadvertently click on an emailed link
Click on an infected image
Leave a mouse on an image infected with an
“onMouseOver” tag.

BASIC XSS SCENARIO

9
WHAT IS “CROSS-SITE” IN XSS?

“Injection” of Javascript in a browser is actually

perfectly legal, but...
Typically Javascript is allowed to only access
resources from the same site that has injected it
into a browser.
In a XSS attack, Javascript does not originate
from a web server but is dynamically injected into
it via a user request following a reflection from a
third-party, a “cross-site”.

SAMY WORM
Inject Javascript into a user profile using
document.body.innerHTML
Get the list of user’s heros by using a GET on a user profile
Add Samy as a field by performing XML-HTTP on the
addFriends page
Any user who visits an infected user’s page will gets profile
infected with Javascript and his friends list infected with
Samy
Eventually about 1,000,000 MySpace profiles were infected.
More technical details and hacks at:
http://web.archive.org/web/20060208182348/namb.la/popular/tech.html

10
CROSS-SITE REQUEST FORGING:
AN EXAMPLE
Why does every online bank request you to sign
off?
User logs in to bank.com and does not sign off.
Session cookie remains in browser stats.
User accidentally visits a malicious site with the
following content:
<form name= F action=http://bank.com/PayBill.php>
<input name=recipient value=badguy>...</form>
<script> document.F.submit(); </script>
Browser sends user request including the existing
authorization credentials.

XSRF: MAIN SCENARIO

11
 OWASP’S TOP TEN
In January 2004, the Open Web Application Security Project (OWASP)
released a paper entitled, “The Ten Most Critical Web Application
Security Vulnerabilities”
OWASP Top Ten 19 Sins
A1 Unvalidated Input Sin 4, “SQL Injection”; Sin 5, “Command Injection”;
Sin 7, “Cross-Site Scripting”
A2 Broken Access Control Sin 14, “Improper File Access”
A3 Broken Authentication and Session Sin 9, “Use of Magic URLs and Hidden Form Fields”
Management
A4 Cross Site Scripting (XSS) Flaws Sin 7, “Cross-Site Scripting”
A5 Buffer Overflows Sin 1, “Buffer Overruns”; Sin 2, “Format String
Problems”; Sin 3, “Integer Overflows”
A6 Injection Flaws Sin 4, “SQL Injection”; Sin 5, “Command Injection”
A7 Improper Error Handling Sin 6, “Failing to Handle Errors”
A8 Insecure Storage Sin 12, “Failing to Store and Protect Data Securely”
A9 Denial of Service This is the outcome of an attack, not a coding
defect. Many DoS attacks are mitigated through
infrastructure, such as firewalls and use of quotas.
A10 Insecure Configuration Management This is an infrastructure issue

KEY POINTS

Security of web applications crucially

depends on sanitisation of user input.
The latter is easier said than done.
Typical attacks, such as XSS and XSRF, can
be highly automatic and result in serious
compromised.

12
Thank You

13