pizza roulette - owasp€¦ · 05/02/2018 · ie 7/ vista ie8/xp no ie r ie 11 'win 7...
TRANSCRIPT
![Page 1: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently](https://reader033.vdocuments.mx/reader033/viewer/2022060803/60876ec79bfb8e18785300fa/html5/thumbnails/1.jpg)
Pizza RouletteCatherine McIlvride and Fiona Sasse
![Page 2: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently](https://reader033.vdocuments.mx/reader033/viewer/2022060803/60876ec79bfb8e18785300fa/html5/thumbnails/2.jpg)
![Page 3: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently](https://reader033.vdocuments.mx/reader033/viewer/2022060803/60876ec79bfb8e18785300fa/html5/thumbnails/3.jpg)
![Page 4: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently](https://reader033.vdocuments.mx/reader033/viewer/2022060803/60876ec79bfb8e18785300fa/html5/thumbnails/4.jpg)
Starting Point
![Page 5: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently](https://reader033.vdocuments.mx/reader033/viewer/2022060803/60876ec79bfb8e18785300fa/html5/thumbnails/5.jpg)
![Page 6: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently](https://reader033.vdocuments.mx/reader033/viewer/2022060803/60876ec79bfb8e18785300fa/html5/thumbnails/6.jpg)
![Page 7: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently](https://reader033.vdocuments.mx/reader033/viewer/2022060803/60876ec79bfb8e18785300fa/html5/thumbnails/7.jpg)
![Page 8: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently](https://reader033.vdocuments.mx/reader033/viewer/2022060803/60876ec79bfb8e18785300fa/html5/thumbnails/8.jpg)
![Page 9: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently](https://reader033.vdocuments.mx/reader033/viewer/2022060803/60876ec79bfb8e18785300fa/html5/thumbnails/9.jpg)
![Page 10: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently](https://reader033.vdocuments.mx/reader033/viewer/2022060803/60876ec79bfb8e18785300fa/html5/thumbnails/10.jpg)
![Page 11: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently](https://reader033.vdocuments.mx/reader033/viewer/2022060803/60876ec79bfb8e18785300fa/html5/thumbnails/11.jpg)
Pretending to know
what we are doing
![Page 12: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently](https://reader033.vdocuments.mx/reader033/viewer/2022060803/60876ec79bfb8e18785300fa/html5/thumbnails/12.jpg)
Just a little
frustrated
![Page 13: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently](https://reader033.vdocuments.mx/reader033/viewer/2022060803/60876ec79bfb8e18785300fa/html5/thumbnails/13.jpg)
We tried!!!
![Page 14: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently](https://reader033.vdocuments.mx/reader033/viewer/2022060803/60876ec79bfb8e18785300fa/html5/thumbnails/14.jpg)
Risk Profiles
![Page 15: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently](https://reader033.vdocuments.mx/reader033/viewer/2022060803/60876ec79bfb8e18785300fa/html5/thumbnails/15.jpg)
![Page 16: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently](https://reader033.vdocuments.mx/reader033/viewer/2022060803/60876ec79bfb8e18785300fa/html5/thumbnails/16.jpg)
![Page 17: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently](https://reader033.vdocuments.mx/reader033/viewer/2022060803/60876ec79bfb8e18785300fa/html5/thumbnails/17.jpg)
![Page 18: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently](https://reader033.vdocuments.mx/reader033/viewer/2022060803/60876ec79bfb8e18785300fa/html5/thumbnails/18.jpg)
The following is a
depiction of the events
that occurred on the
night of 4th October
2017
![Page 19: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently](https://reader033.vdocuments.mx/reader033/viewer/2022060803/60876ec79bfb8e18785300fa/html5/thumbnails/19.jpg)
![Page 20: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently](https://reader033.vdocuments.mx/reader033/viewer/2022060803/60876ec79bfb8e18785300fa/html5/thumbnails/20.jpg)
![Page 21: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently](https://reader033.vdocuments.mx/reader033/viewer/2022060803/60876ec79bfb8e18785300fa/html5/thumbnails/21.jpg)
OWASP Top 10A1 Injection
A2 Broken Authentication and Session Management
A3 Sensitive Data Exposure
A4 XML External Entity (XXE)
A5 Broken Access Control
A6 Security Misconfiguration
A7 Cross Site Scripting
A8 Insecure Deserialization
A9 Using Components with Known Vulnerabilities
A10 Insufficient Logging & Monitoring
![Page 22: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently](https://reader033.vdocuments.mx/reader033/viewer/2022060803/60876ec79bfb8e18785300fa/html5/thumbnails/22.jpg)
![Page 23: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently](https://reader033.vdocuments.mx/reader033/viewer/2022060803/60876ec79bfb8e18785300fa/html5/thumbnails/23.jpg)
A3 Sensitive Data Exposure
![Page 24: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently](https://reader033.vdocuments.mx/reader033/viewer/2022060803/60876ec79bfb8e18785300fa/html5/thumbnails/24.jpg)
A2 Broken Authentication and Session Management
A10 Insufficient Logging & Monitoring
![Page 25: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently](https://reader033.vdocuments.mx/reader033/viewer/2022060803/60876ec79bfb8e18785300fa/html5/thumbnails/25.jpg)
A7 Cross Site Scripting
![Page 26: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently](https://reader033.vdocuments.mx/reader033/viewer/2022060803/60876ec79bfb8e18785300fa/html5/thumbnails/26.jpg)
Using order numbers to bring up other people's details
A5 Broken Access Control
![Page 27: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently](https://reader033.vdocuments.mx/reader033/viewer/2022060803/60876ec79bfb8e18785300fa/html5/thumbnails/27.jpg)
OWASP Top 10A1 Injection
A2 Broken Authentication and Session Management
A3 Sensitive Data Exposure
A4 XML External Entity (XXE)
A5 Broken Access Control
A6 Security Misconfiguration
A7 Cross Site Scripting
A8 Insecure Deserialization
A9 Using Components with Known Vulnerabilities
A10 Insufficient Logging & Monitoring
![Page 28: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently](https://reader033.vdocuments.mx/reader033/viewer/2022060803/60876ec79bfb8e18785300fa/html5/thumbnails/28.jpg)
Things we learnt!!
![Page 29: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently](https://reader033.vdocuments.mx/reader033/viewer/2022060803/60876ec79bfb8e18785300fa/html5/thumbnails/29.jpg)
Keep It Simple Stupid
KISS
![Page 30: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently](https://reader033.vdocuments.mx/reader033/viewer/2022060803/60876ec79bfb8e18785300fa/html5/thumbnails/30.jpg)
Time!!!
![Page 31: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently](https://reader033.vdocuments.mx/reader033/viewer/2022060803/60876ec79bfb8e18785300fa/html5/thumbnails/31.jpg)
Mentorship is a must
![Page 32: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently](https://reader033.vdocuments.mx/reader033/viewer/2022060803/60876ec79bfb8e18785300fa/html5/thumbnails/32.jpg)
So what now…..
![Page 33: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently](https://reader033.vdocuments.mx/reader033/viewer/2022060803/60876ec79bfb8e18785300fa/html5/thumbnails/33.jpg)
![Page 34: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently](https://reader033.vdocuments.mx/reader033/viewer/2022060803/60876ec79bfb8e18785300fa/html5/thumbnails/34.jpg)
![Page 35: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently](https://reader033.vdocuments.mx/reader033/viewer/2022060803/60876ec79bfb8e18785300fa/html5/thumbnails/35.jpg)
![Page 36: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently](https://reader033.vdocuments.mx/reader033/viewer/2022060803/60876ec79bfb8e18785300fa/html5/thumbnails/36.jpg)
![Page 37: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently](https://reader033.vdocuments.mx/reader033/viewer/2022060803/60876ec79bfb8e18785300fa/html5/thumbnails/37.jpg)
![Page 38: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently](https://reader033.vdocuments.mx/reader033/viewer/2022060803/60876ec79bfb8e18785300fa/html5/thumbnails/38.jpg)
Massive Thanks To Kevin!
![Page 39: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently](https://reader033.vdocuments.mx/reader033/viewer/2022060803/60876ec79bfb8e18785300fa/html5/thumbnails/39.jpg)