Survey
* Your assessment is very important for improving the workof artificial intelligence, which forms the content of this project
Download OWASP_ellak-Greece
Transcript
Detecting Web Application Vulnerabilities Using Open Source Means OWASP Konstantinos Papapanagiotou Committee Member OWASP Greek Chapter [email protected] 3rd Free / Libre / Open Source Software (FLOSS) Conference Copyright © The OWASP Foundation 27/5/2008 Permission is granted to copy, distribute and/or modify this document under the terms of the OWASP License. The OWASP Foundation http://www.owasp.org What is OWASP? The Open Web Application Security Project Worldwide, free and open community Mission: improve application software security Information and awareness Documentation Guidelines Forums, mailing lists, conferences, local chapters Practical aspects Open Source Tools Non-profit, charitable organization Members: VISA, Deloitte, Unisys, Foundstone, … OWASP 2 The Greek Chapter Created in 2005 but active since early 2007 Mission: raise security awareness in Greece Activities: Translation of OWASP documentation Mailing list Monthly newsletter Participation in working groups and conferences Software tools: Web Vulnerability Scanner ~60 members http://www.owasp.gr Soon: http://blog.owasp.gr OWASP 3 Outline Motivation: The need for web security Terminology OWASP Top10: 10 most important vulnerabilities Detection Tools OWASP Web Scarab WVS (Web Vulnerability Scanner) Conclusions OWASP 4 Web Security Rapid growth of the Internet in the last 2-3 years Increase of population and bandwidth Dynamic web sites Hacker trends have changed Used to be: viruses, worms, defacements Now: phishing, zombie networks, web application security Weakest links End-users Developers OWASP 5 Web Application Vulnerabilities Some vocabulary Threats Vulnerabilities Exploits Attacks Patching… Web Applications: new category of applications Widely available Can access local resources New code – old code OWASP 6 Tackling the problem Security is not a one-off project Secure Development Lifecycle: 1. 2. 3. 4. 5. 6. 7. Getting informed, raise awareness Secure design and implementation Product Launch Vulnerability detection Patching Monitoring Keep the track Not a end-user or developer only matter OWASP 7 Step 1: Awareness - The OWASP Top 10 Document that lists the 10 most important web vulnerabilities Aim: educate developers, designers, architects and organizations about the consequences of the most common web application security vulnerabilities. Provides: Brief description basic methods for protection 2007: second version OWASP 8 The Vulnerabilities A1 - Cross Site Scripting (XSS) User supplied data are sent to web browser without validating or encoding that content. Result: can allow script execution that can lead to user sessions hijacking, web site defacement, etc. A2 - Injection Flaws (e.g. SQL injection) User supplied data are sent to an interpreter as part of a command or query. Result: the interpreter is tricked into executing unintended commands or changing data. OWASP 9 The Vulnerabilities (2) A3 - Malicious File Execution (e.g. remote file inclusion (RFI) Can allow attackers to include hostile code and data Result: up to total server compromise. Target: PHP, XML and any framework which accepts filenames or files from users. A4 - Insecure Direct Object Reference Reference to an internal implementation object (file, directory, database record, key, etc) as a URL or form parameter is accidentally exposed by the developer. Result: Attackers can manipulate those references to access other objects without authorization. OWASP 10 The Vulnerabilities (3) A5 - Cross Site Request Forgery (CSRF) Forces a logged-on victim's browser to send a preauthenticated request to a vulnerable web application, which then forces the victim's browser to perform a hostile action to the benefit of the attacker. A6 - Information Leakage and Improper Error Handling Unintentional leak of information regarding configuration, internal workings, or privacy violation Result: Attackers use this weakness to steal sensitive data, or conduct more serious attacks. OWASP 11 The Vulnerabilities (4) A7 - Broken Authentication and Session Management Account credentials and session tokens are often not properly protected. Result: Attackers compromise passwords, keys, or authentication tokens to assume other users' identities. A8 - Insecure Cryptographic Storage Web applications rarely use cryptographic functions properly to protect data and credentials. Result: can lead to identity theft, credit card fraud, etc. OWASP 12 The Vulnerabilities (5) A9 - Insecure Communications Applications frequently fail to encrypt network traffic when it is necessary to protect sensitive communications. A10 - Failure to Restrict URL Access Frequently, an application only protects sensitive functionality by preventing the display of links or URLs to unauthorized users. Result: Attackers can use this weakness to access and perform unauthorized operations by accessing those URLs directly. OWASP 13 Step 2: Detection – OWASP WebScarab Framework for analysing applications that communicate using HTTP and HTTPS. Written in Java for portability Operates as an intercepting proxy The operator can review and modify requests created by the browser before they are sent to the server He can also review and modify responses returned from the server before they are received by the browser. Several modes of operation and plugins OWASP 14 Step 2: Detection – OWASP WebScarab (2) Target Groups: Developers can debug otherwise difficult problems Security specialists can identify vulnerabilities in the way that the application has been designed or implemented. http://www.owasp.org/index.php/Category:OWA SP_WebScarab_Project Under Development: OWASP Web Scarab Next Generation Complete rewrite New user interface OWASP 15 Step 2: Detection – WVS Web Vulnerability Scanner Started off as a university student project Goal: test a web site or application (not the server in the back end) Target group: security specialists, penetration testers, developers Functional but still under development Beta version at: http://www.owasp.gr (http://www.owasp.org/images/6/65/WVS_beta-0.2.1.zip) OWASP 16 WVS – Design and Implementation Three tier architecture: Vulnerability database SQLite Data retrieval API Update API Communication API Communication with server (GET, POST, etc) Presentation Level Plaintext output, graphical interface, html, etc Multi-threaded User-specified OWASP 17 WVS – Advantages Less false negatives “Paranoid scanning” User-enabled Retrieves the site’s structure Makes all possible checks in the entire site Less false positives Static sites: MD5 hash checking Future work: dynamic sites Portability Use of open and portable technologies (SQLite, libcurl, etc) Future work: POSIX threads OWASP 18 WVS – Future Work Eliminate false positives in dynamic sites Enhance Portability POSIX threads Java implementation (?) Sophisticated checks for XSS and SQL injection Fuzzing algorithms Other suggestions… OWASP 19 Conclusions Web Application Security is a continuous process Developers have the skills Are not always well informed Organizations Follow deadlines Worry about security after release End users Low awareness OWASP Continuous effort to raise awareness OWASP 20 Q&A http://www.owasp.gr http://www.owasp.org OWASP 21
