Securing Web Applications
Min Song IS/CS698
Application Security
Applications are part of your security perimeter.
FIREWALL
Web Application
BUSINESS
INTERNET Partner Integration
2
Application Security
Attackers won‟t attack your firewall. They‟ll attack your applications.
FIREWALL
Web Application
BUSINESS
INTERNET Partner Integration
3
Application Security
…or they‟ll walk through the door (developers, administrators, users)
FIREWALL
Web Application
BUSINESS
INTERNET Partner Integration
4
Application Security
…or maybe just listen at the door (wireless, newsgroups, job ads)
FIREWALL
Web Application
BUSINESS
INTERNET
Information Leaks
Partner Integration
5
Web Application Exploits
Footprinting URL Manipulation Cross-Site Scripting (XSS) SQL Injection Session Hijacking Error Exploitation
6
Footprinting
CNN mentions your website Instant traffic jam Database gets overloaded and goes down Web application can‟t get a connection (Developer couldn‟t do much about it, so the code lets it bubble up to the server) The user sees a big, ugly Tomcat error message with all the gory details
7
Footprinting in Action
Pointy-haired boss:
Finds it annoying and unprofessional Calls you in to interpret technical mumbojumbo
Learns which server versions are running Learns the name of JavaServer Pages (JSPs) and other code components Learns details about the database structure and naming
Knowledgeable user:
8
Footprinting in Action
Attacker:
Looks up server vulnerabilities Tries accessing default server config pages
Tries to cause other kinds of errors to collect more information Tries SQL injection attack Uses information to appear “in-the-know” during social engineering attack
9
Footprinting – Flavors
Errors (default application server behavior prints out all the ugly details) HTTP Response Headers “Powered by” logos Distinctive URL patterns Default stylesheets/skins Press releases Job ads Newsgroup or message board postings
10
Footprinting – Fixes
Configure default server-level error pages Test what happens when: Resources are unavailable Pages are not found Bugs cause unhandled exceptions Don‟t give details about errors the user can‟t fix (where possible, don‟t even admit that they‟re unexpected) Don‟t give out specific product/version information, either in error messages or advertisements
11
URL Manipulation
User gets an email notification with an invitation to visit her online profile at: http://www.acme.com/profile?userid=2249 Cuts and pastes the link into the browser Accidentally leaves off the 9 http://www.acme.com/profile?userid=224 Gets a page with somebody else‟s personal information
12
URL Manipulation in Action
Pointy-Haired Boss:
Gets confused Starts worrying about his own privacy
Knowledgeable user:
Removes her own personal info immediately Gets curious and looks through the other person‟s information Tries a few more IDs to see what happens
13
URL Manipulation in Action
Attacker:
Looks for other URLs on the site that can be manipulated Finds admin functionality that shouldn‟t be available Writes a script to scrape confidential information
Tries to guess other people‟s usernames and passwords based on their personal details (username, birthday, etc.) Uses personal info to impersonate others Calls users and poses as company representative who is looking at the same profile screen and needs to confirm username and password Asks company for ransom Uses email addresses to launch cross-site scripting attacks against users
14
URL Manipulation – Flavors
Manipulating cookies Manipulating form data Both POSTs and GETs Hidden form fields