net security topics
TRANSCRIPT
.NET Security TopicsXSS, SQL Injection, CSRF, ClickJacking, Secure File Handling, Odds & Ends for .NET
Cross-site Scripting (XSS) Definitions
Examples
Mitigation strategies
Mitigation examples
Definitions
Cross-site Scripting (XSS) Occurs when a web application gathers malicious data from a user
(untrusted source). The data is usually gathered in the form of a hyperlink or form submission, database, or cookie which contains malicious content within it.
Malicious data is generally in the form of Javascript or HTML
Types are DOM-based, “stored” (persistent) and “reflected” (non-persistent)
Examples
Cross-site Scripting (XSS) http://en.wikipedia.org/wiki/Cross_site_scripting#Exploit_scenarios
<SCRIPT type="text/javascript"> var adr = '../evil.php?cakemonster=' + escape(document.cookie); </SCRIPT>
<body onload=alert('test1')>
<b onmouseover=alert('Wufff!')>click me!</b>
<img src="http://url.to.file.which/not.exist" onerror=alert(document.cookie);>
<IMG SRC=jAvascript:alert('test2')>
<META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgndGVzdDMnKTwvc2NyaXB0Pg">
Mitigations
Cross-site Scripting (XSS) Explicitly set character set encoding (meta charset)
Identify special characters
Encode all dynamic output (htmleditformat)
Filter special characters in dynamic elements (blacklist –not preferable)
Stronger data validation (whitelist/positive – preferable)
Never count on client side validation (it can be turned off)
Use HttpOnly cookies
Use secure cookies whenever possible
No one thing will mitigate all threats, it will require use of multiple techniques
XSS Defense Code
Show the code
SQL Injection Definitions
Examples
Mitigation strategies
Mitigation examples
Definitions
SQL Injection (from Wikipedia) Technique often used to attack data driven applications by including
portions of SQL statements in an entry field in an attempt to get the website to pass a newly formed rogue SQL command to the database (e.g., dump the database contents to the attacker).
The vulnerability happens when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and unexpectedly executed.
SQL injection is mostly known as an attack vector for websites but can be used to attack any type of SQL database.
In operational environments, it has been noted that applications experience an average of 71 attempts an hour
Examples
SQL Injection http://en.wikipedia.org/wiki/SQL_injection#Examples
http://www.mydomain.com/products/products.asp?productid=123 or 1=1
http://www.mydomain.com/products/products.asp?productid=123; DROP
TABLE Products
Mitigations
SQL Injection Never trust input data. Validate everything
Avoid dynamic SQL built with string concatenation
Prefer stored procedures 0r ORM
If dynamic SQL, used parameterized commands
Sensitive/confidential data should be encrypted
Limit connection privilege (no DBO or SA)
SQL Injection Defense Examples
Show the code snips
Cross-site Request Forgery (CSRF) Definition
Examples
Mitigation strategies
Definition
Cross-site Request Forgery (CSRF) Attack which forces an end user to execute unwanted actions on a
web application in which he/she is currently authenticated.
Embed HTML in malicious site that preys on users authenticated on other sites.
Submitting unauthorized data to your application from other servers (untrusted)
Not easy to make a successful attack, but that doesn’t mean we shouldn’t protect ourselves
Examples
Cross-site Request Forgery (CSRF) <img
src="http://bank.example/withdraw?account=bob&amount=1000000&for=mallory">
Million-dollar dream home example
Mitigation
General mitigation strategy Per request tokens (nonce) to url/form
Referrer checking (less desirable – spoofing)
Other General Principles That Apply
Good practices Log detected exploit attempts and notify someone
Lock out attacker
Be careful about exposing error data, it can be extremely helpful to an attacker
CSRF Defense Show the code
ClickJacking
OWASP Definition:
Clickjacking, also known as a "UI redress attack", is when an attacker uses multiple transparent or opaque layers to trick a user into clicking on a button or link on another page when they were intending to click on the the top level page. Thus, the attacker is "hijacking" clicks meant for their page and routing them to other another page, most likely owned by another application, domain, or both.
Using a similar technique, keystrokes can also be hijacked. With a carefully crafted combination of stylesheets, iframes, and text boxes, a user can be led to believe they are typing in the password to their email or bank account, but are instead typing into an invisible frame controlled by the attacker.
Examples
For example, imagine an attacker who builds a web site that has a button on it that says "click here for a free iPod". However, on top of that web page, the attacker has loaded an iframe with your mail account, and lined up exactly the "delete all messages" button directly on top of the "free iPod" button. The victim tries to click on the "free iPod" button but instead actually clicked on the invisible "delete all messages" button. In essence, the attacker has "hijacked" the user's click, hence the name "Clickjacking".
One of the most notorious examples of Clickjacking was an attack against the Adobe Flash plugin settings page. By loading this page into an invisible iframe, an attacker could trick a user into altering the security settings of Flash, giving permission for any Flash animation to utilize the computer's microphone and camera.
Clickjacking also made the news in the form of a Twitter worm. This clickjacking attack convinced users to click on a button which caused them to re-tweet the location of the malicious page, and propagated massively.
Recently, clickjacking attacks abusing Facebook's "Like" functionality has grown significantly. Attackers can trick logged-in Facebook users to arbitrarily like fan pages, links, groups, etc
Defenses –Browser
NoScript
Defenses –Coding against
Javascript code to make sure current frame is the top level window (Ok, but not great, not going to show it)
Browser response headers (Good, and will get better)
Response Headers
X-FRAME-OPTIONS
Response header that newer browsers recognize, which controls framing behavior
https://www.owasp.org/index.php/Clickjacking#Defending_with_response_headers
Be sure to read the limitations, specifically the stuff about proxies, and know that not all options are currently supported (ALLOW-FROM only IE8+).
Code example (ASP.NET).
ClickJackingResources
https://www.owasp.org/index.php/Clickjacking
http://en.wikipedia.org/wiki/Clickjacking
http://nakedsecurity.sophos.com/2010/05/31/viral-clickjacking-like-worm-hits-facebook-users/
http://ha.ckers.org/blog/20081007/clickjacking-details/
http://blogs.msdn.com/b/sdl/archive/2009/02/05/clickjacking-defense-in-ie8.aspx
http://blogs.msdn.com/b/ieinternals/archive/2010/03/30/combating-clickjacking-with-x-frame-options.aspx
http://www.enhanceie.com/test/clickjack/
ClickJackingDefense
Show the code
Secure File Upload Principles
Whitelist what you accept
Validate file format and other attributes
Upload to safe location outside the webroot
Image Resizing Show the code
Odds & Ends -Tips
Be careful in what you include in error messages that get thrown to a browser
Sanitize log input (don’t XSS your log database)
Cigital SecureAssist plugin for VS.
Visual Studio Code Analysis (general code quality issues)
Resources
OWASP http://www.owasp.org/index.php/Cross-site_scripting http://www.owasp.org/index.php/Top_10_2007-A1 http://www.owasp.org/index.php/SQL_Injection http://www.owasp.org/index.php/CSRF
CERT http://www.cert.org/tech_tips/malicious_code_mitigation.html
Wikipedia http://en.wikipedia.org/wiki/Cross_site_scripting http://en.wikipedia.org/wiki/SQL_injection http://en.wikipedia.org/wiki/Cross-site_request_forgery
XSS Cheat Sheet http://ha.ckers.org/xss.html
http://blog.stevensanderson.com/2008/09/01/prevent-cross-site-request-forgery-csrf-using-aspnet-mvcs-antiforgerytoken-helper/
http://msdn.microsoft.com/en-us/magazine/hh708755.aspx http://weblogs.asp.net/scottgu/archive/2010/04/06/new-lt-gt-
syntax-for-html-encoding-output-in-asp-net-4-and-asp-net-mvc-2.aspx
Resources
http://cheesewz.tumblr.com/post/87099308919/springpad-is-dead
https://docs.google.com/spreadsheets/d/1CV4bQDpaGbXUSHdnWwQUxzsu4fVdn2vzBWO72Y3Hk1s/edit?usp=sharing
http://html5sec.org/
http://blogs.microsoft.co.il/blogs/sasha/archive/2013/05/06/attacking-web-applications.aspx
https://www.sans.org/course/secure-coding-net-developing-defensible-applications
http://www.pluralsight.com/training/Courses