Application security [appsec]

Application security [appsec]

• 1.
  Application Security [Appsec] By judyNgure Twitter@judy_infosec
• 2.
  What is Appsec Beforewe get to understand application security lets understand the most common components of any application Application User interface Application Database Web Server Application server Server sideClient side Internet
• 3.
  Appsec Application security involvesthe process of protecting all this components that affect the application one way or the other. So what type of vulnerabilities do you need to protect your application against: (This is where OWASP top 10 (https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project) comes in handy) - Injections (SQL , XSS, XML ) - Session hijacking - Unauthorized access - Broken Authentication - XML External Entities (XEE) - Security Misconfiguration - Insecure Deserialization - Using Components With Known Vulnerabilities - Insecure communication
• 4.
  So what runs: Application user interface Html, javascript css The user interface runs the following programming languages. When the users send a request E.g if a web application has a submit button the language used to display a submit button is html, however the language used to send the submit request is different. At this end javascript can be manipulated if not properly coded USER
• 5.
  servers Web Server Application server Http request GET request Application logic Onthis end security issues are populated during the http requests and during application logic process e.g A post request is used to include new data into the web server and end user can introduce data that shouldn't be submitted. Reflected XSS tests use this logic to test using scripts.
• 6.
  So What doesan Appsec engineer need to secure? - Files - Directories - Protocols - Ports - Registry - Accounts - Patches - Updates - Services
• 7.
  Web headers ⦿ Theydefine HTTP requests to and from the server. ⦿ They include but not limited to: › Methods used › Resources consumed › Sender and destination information › Type of content being sent/received
• 8.
  Methods ⦿ While makinga request, certain methods are used to do this. They determine the type of request and response to be received from a server. › PUT › DELETE › GET › TRACE › POST etc...
• 9.
  Status codes ⦿ Dependingon the request, a web server may respond differently using certain codes, dubbed ‘status codes’. › 100 - informational › 200 - ok/success › 300 - redirection › 400 - client error › 500 - server error
• 10.
  Common web vulnerabilities formodern web apps With new technologies, comes new attack vectors... › Server-Side Request Forgery (SSRF) › XML external entities (XXE) › Cross site scripting (XXS) › Information disclosure › Server Side Template injection
• 11.
  SSRF ⦿ Is anattack where in an attacker is able to send a crafted request from a vulnerable web application. SSRF is usually used to target internal systems behind firewalls that are normally inaccessible to an attacker from the external network. ⦿ E.g.
• 12.
  SSRF (cont...)