GoConqr has a new look! Let us know what you think.

Sign up free

Flashcards

Software and Web Security

HRYN red Uni Second Level Uni English 55 cards

Cards in this deck (55)

  1. 1Challenge of many types of data and ways data can be input ito a comptersystem or applicationChallenge of many types of data and ways data can be input into a computer system or application: data may be unknown, untrusted or insecure and may be malicious – trust nothing! Malicious input can be interpreted and processed as part of a normal query or command that generates some output. Can be difficult to detect a malicious user who is trying to attack a system or application. Improper handling or not checking data input before processing is a leading contributor of critical vulnerabilities existing in systems and applications.
  2. 2Injection attackInjection attack – attacker to input some malicious data into an application. Malicious input gets injected into a command or query statement which is the interpreted and processed by an application.
    One of top web application security risks. Very dangerous to legacy systems
    Injection attacks also refer to: SQL injection, Cross-site scripting, format string
  3. 3Legacy systemLegacy system – a system often based on outdated technologies but critical to data to day operations
  4. 4OWASP Open Web Application Security ProjectOWASP – Open Web Application Security Project – non-profit foundation that works to impove the security of software.
  5. 5Negative impacts of injection attacks 5- Data theft
    - Data loss
    - Loss of data integrity
    - Denial of service
    - Full system compromise
  6. 6SQLSQL Structured Query Languate – programming language for storing and processing information in a relational database
    Db.session.execute(‘SQL statment’ + __) ie
    Hackers can use SQL injection on an application if it has dynami database queries that use user supplied input and stirng concatenation.
  7. 7TO avoid SQL injection vulnerabilities application code should 2- prevent malicious SQL from being included in executed queries ie input validation
    - Avoid using dynamic queres with string concatenation ie prepared statemetns with paramterised queries
  8. 8Cross-Sit3e Scripting XSS attacksCross-Site Scripting (XSS) attacks – another type of injection attack in which malicious scripts are injected into vulnerable web applications. Malicous script is included with dynamic content delivered as markup text ie HTML to a victims browser following a request by the victim to the web application. XXS attacks take advantage of the fact that browsers cannot distinguish between legitimate and malicious markup but rather execute what they receive. So rather than attacking a victim directly can exploit a vulnerability in web application the vitim visits and gets application to deliver malicious script.
  9. 9XSS attacks occur when 2- Data fron am untrusted source is entered into a web application, most frequently via a web request (from submission or paramterised URL)
    - Data is included in dynamic content that is sent to a web user whithout being validated for malicious content
  10. 10The malicious content sent to the web browser often takes form of a segment of JS but may also include HTML, Flash… Variety of attacks based on XSS include: 3- Transmitting private data, like cookies or other session info to the hacker
    - Redirecting genuine users to web content controlled by the hacker
    - Performing other malicious operations on a genuine user’s machine under guise of vulnerable site
  11. 11Hackers can inject scripts into and executed on an application that use user supplied input. To avoid XXS vulnerabilities, application code should: 2- Prevent malicious script type input from being included in executed queries ie input validation
    - Ensure input is interpreted as text instead of code ie automatic encoding and escaping functions
  12. 12Flask framework has buildt in automatic encoding and escaping. {{ }} Format Strings – to insert values into a string of text. Typically 3 components for this:- Format Function: a function which converts a primitive variable into a readable string ie printf
    - Format String: a String argument of a format function which contains text and format parameters
    - Format String Parameter: defines type of conversion of the format function ie %x
  13. 13Can be exploited if the Format function doesn’t have an argument (and prints user input directy). Format String parameter like %x could be inserted into the printed String which is subsequently parsed by the Format function. The %x in the input data is evaluated as a command (Format String Attack). Will give user data from database. Hacker can also launch a format String attack to execute code or cause an exception. To avoid: 3- Specify a format string as part of program not as input
    - If possible, make format string a constant and extract all variable parts ie user input as other arguments to format function
    - Include input validation
  14. 14Input validation / data validationInput validation / data validation – proper checking or testing of any input supplied by a user or another system. Automated testing of all parameters, headers, URL, cookies, JSON, SOAP and XML data inputs is strongly encouraged. Input validation can employ whitelisting or blacklisting.
  15. 15Whitelisting BlacklistingWhitelisting defines allowed data while everything else is denied by default
    Blacklisting defines unallowed data while everything else is allowed by default
  16. 163 disadvantages of blacklisting- Need to know all bad inputs which may be ever changing/updating
    - Usually preferable to use whitelisting
    - Whitelisting may deny genuine data whilst getting blacklisting wrong may allow malicious data – better to deny genuine data than allow malicious data
  17. 17out of bounds read out of bounds writeout of bounds read – occurs when program reads data past the end or before the beginning of the intended buffer (ie an array)
    out of bounds write – occurs when a program writes data past the end or before the beginning of the intended buffer.
  18. 18Bounds checkingBounds checking – method of detecting whether a variable is within some bounds before it is used – commonly used to check that a variable used as an array index is within the bounds of the array (index check). A failed bounds check usually generates some kind of exception signal. Some languages such as C and C++ have no bounds checking. No bounds checking gives rise to Buffer Overflow attacks
  19. 19Buffer Overflow attacksBuffer Overflow attacks – forces a program to put more data in a buffer than it can hold and therefore put the extra data in a memory area past a buffer (out of bound write). This can corrupt or overwrite existing data, crash program or cause execution of malicious code (eg out of bounds read)
  20. 20real lie buffer overflow attacksReal life buffer overflow attacks: SQL Slammer, hearbleed, morris worm, whatsapp VoIP
  21. 21When does integer overflow or wraparound occur?Integer overflow or wraparound occurs when an integer value is incrememnted to a value that is too large to store in the associated representation – value may wrap around to become a very small or negative number. May be intented in circumstances that rely on wrapping but can have security consequences if wrap around is unexpected – if inteer overflow can be triggered using user-supplied inputs. This becomes security-critical when result is used to control looping, making a security decision or determine offset or size in behaviours such as memory allocation, copyting, concatenation…
  22. 22Hardcoding dataHardcoding Data - data can be directly embedded into the source code of a program as opposed to obtaining data from external sources or generating it at runtime. Usually represents unchanging pieces of info such as physical constants, version numbers and static text elements. Usually can only be modified by editing the source code and recompiling the executable.
    Can facilitate the fast delivery of code
  23. 234 disadvantages of hardcoding data- can be considered an anti-pattern: requires source code to be changed any time input data or desired format changes, when it might be more convenient to end user to change detail by some means outside the program
    - Can be hard to adapt: file paths make hard to adapt to another location
    - Can be hard to internationalise
    - can raise security vulnerabilities: may be sensitive or provide info that could be used to attack a system
  24. 24Softcoded dataSoftcoded data – typically dynamic data like user input, HTTP server responses, or configuration files determined at runtime.
  25. 25Software Reverse EngineeringSoftware Reverse Engineering – reversing a program’s machine code back into the source code it was written in using program language statement.
  26. 26Revese engineering Usually done to retrieve source code of a program because: 6- source code lost
    - study how program performs certain operations
    - improve performance of program
    - fix a bug
    - identify malicious content in a program such as a virus
    - adapt a program written for use with one microprocessor for use with another
  27. 27Example of reverse engineering toolExample of reverse engineering tool: Java Decompiler (JD) Project: JD-GUI is a graphical tool for displaying source code of java class files.
  28. 28hackers search for hardcoded sensitive dataSource code of web pages easily accessible to authroised users: right click – view page source. Hackers search for hardcoded sensitive data such as username/password pairs or secret keys also may be able to understand how a web application behaves and check for vulnerabilities.
  29. 29If malicious input data is accepted and goes on to cause unwanted to unexpected hebavior or even cause application to crash: 3- input data may request a web page that doesn’t exit
    - input data may be a request that is not understood/cannot be handled
    - input data may corrupt an application resource
  30. 30error handlers can help in recovery without actual termination of a program or application. Error messages may be created and displayed in different ways: 2- externally-generated: external environment such as language interpreter handles error and constructs its own message whose contents are not under direct control by programmer
    - self-generated: source code explicity constructs error message and delivers it
  31. 31Automatically generated error messages may include sensitive info about their environment, users, or associated ata – may be useful for launching more serious attacks: 2- directory traversal attack: error messages may give away exact location fo target files and number of ./ needed in path traversal
    - SQL Injection: error messages may reveal database query logic code and reveal innovative ways to attack the application
  32. 32Error pages with fixed messages are automatically generated for: 3- Client side errors (ie 404 request page not found)
    - Server side errors (500 internal server error)
    - No control over what information is shown
  33. 33Time of check to time of user TOCTOUTime-of-Check to Time-of-Use (TOCTOU) – class of software vulnerabilities that arise from race conditions (2 program processes, or threads, attempt to access same resource at same time)
  34. 34It starts with the race condition between concurrent processes: 2 (p- Time-of-check: system checks a certain condition or state to make a decision or perform an action ie file existence check is performed to determine whether a file can eb safely accessed or modified
    - Time-of-use: system sues result of previous check to perform an action based on assumption that the condition or state remains unchanged
  35. 35when do TOCTOU vulnerabilities occur?TOCTOU vulnerabilities occur when there is a time gap between the checking of a system’s state (Time of Check) and the use of the results of that time (Time of use). During this interval a hacker can alter the state of the system, leading to unauthroised access, integrity violations… This alteration is possible because the system assumes the resource’s state remains unchanged between check and use phases. TOCTOU vulnerabilities make it difficult to ensure consistent and secure operations.
  36. 36Protecting against TOCTOU attacks requires a combination of measures ie: 5 and describe each- Transactions: implement transactional file systems to ensure atomicity of operations, preventing race condtions. (Transaction – a series of operations that either all occur (if all correct) or none occur (if one or more is corrupt)
    - File descriptor tracking: utilize libraries that track file descriptors to maintain the integrity of file operations.
    o File descriptor – a unique identifier or reference that the os assigns to a file when it is opened and uses it to keep track of tile and perform operations on it
    - Minimize time gaps: reduce time interval between checking a condition and using the result to limit the attack window
    - Implement File Locking: apply file locking mechanism to ensure resource consistency
    - Effective User ID Management: for set user id on execution use seteuid() to switch to the appropriate user ID before performing sensitive operations. Setuid – security tool that permits users to access certain resources with escalated privileges
  37. 37Web Application firewall QAFWAF – Web Application firewall – enforces rules that monitor, filter and block incoming client requests based on defined criteria. Work by inspecting all layers of incoming requests before they reach web application. As requests flow through WAF, checked against configured ruleset to identify attacks. These rules are configured to look for suspicious patterns, payloads or behaviour in web traffic. If malicious activity is detected the WAF execture the defined action like blocking the malicious request.
  38. 38WAF rules consists of conditions and actions: what do each mean?- Conditions: specifiy what to look for in the request, such as pattern in URL, headers or body
    - Actions: define what the WAF should do if conditions met like blocking request or logging alert
  39. 39Comprehensive WAFs will inspect various parts of a client request including: 6- Headers: info about request such as user-agent, refere and host
    - Request methods: GET, POST, PUT, DELETE…
    - URI: part of request that identifies resouces like /login or /posts
    - Query Strings; part of URL that comes after the ?, often containing parameters
    - Post Data: data sent in body of POST requests, often containing submitted data
    - Cookies: small pieces of data stored on client’s computer by web browser for session tracking…
  40. 40WAF rules are defined based on conditions (specific patterns or criteria) enabling them to: 5- Match string patterns like detecting DROP TABLE
    - Look for anomalies such as substantial request sizes
    - Check for presence or absence of specific headers
    - User regular expressions to match complex patterns
    - Limit requests from a single IP address to prevent DDoS or brute-force attacks
  41. 41Detecting SQL InjectionDetecting SQL Injection: WAF rules can be defined to llook for patterns and signatures of SQL injection attacks in incoming client/user requests. These rules are used to help block SQL injection attempts by scanning user inputs, URLs, headers and POST data for potentially malicious SQL syntax and commands.
  42. 42Common patterns these rules look for 6- Suspicious SQL keywords like SELECT, UNION, DROP, INSERT, AND, OR…
    - Illegal cahracters like ;, ‘’, `…
    - Comments used to terminate queres like /**/
    - Tautologies that evaluate to true, like ‘OR 1=1’
    - Code for conitional errors like converting a String to an int
    - Calls to intenal functions like sleep() (suspended execution) or benchmark() (execute a function x-times)
  43. 43WAF rules to look for patterns and signautures of path traversal attacks in incoming client/user requests – help block path traversal attempts by scanning request URL paths and query strings for potentially malicious URL syntax. Common patterns these rules look for: 5-Suspicious sequences like ../../ to traverse folders
    • Requests with /etc/paths to access system files
    • Encoded variants of traversal sequences like %2e%2e%2f, %2e%2e/ and ..%2f
    • Use of null bytes or encoded null bytes (%00) to break out of paths (terminate a string prematurely)
    • Attempts to access sensitive files like /etc/passwd (user password files) or .htaccess (web server config files)
  44. 44WAF rules to look for patterns and signatures of cross site scripting (XSS) attacks in inomcong client/user reuqests – help block XXS attempts by scanning user inputs, URLs and POST data for potentially malicious script syntax and commonads Common patterns these rules look for: 5• Script tags like and <iframe> (HTML element that loads another HTML page within the existing page).
    • Common script functions like alert() (displays a pop-up box with a given message).
    • Script protocols like JavaScript:
    • Script encoding/obfuscation (disguising malicious code in another form).
    • DOM-based XSS vectors (alter the Document Object Model (DOM) which represents the objects that make up the structure
    and content of web pages)
  45. 45Once rule condition is checked, WAF takes predefined action depending on outcome: 4- Allow: let request pass through
    - Block: stop request from reaching application
    - Count: record match but don’t block or allow (useful for monitoring or testing new rules)
    - Log: record request details for further analysis
  46. 46Most data transmission between clients and servers over networks is managed by TCP/IP protocol suite - describe TCP and IPTCP establishes and maintains connectiosn untila client and server have finished communicating (sending requests/responses) Transmission Control protocol
    IP is used to route and address pakcets which are treated independently across networks to correct destination. Internet Protocol
  47. 47HTTP HypertextHypertext Transfer Protocol HTTP is also part of TCP/IP protocol suite. HTTP describes what data a data transmission contains enabling A client or server to read and process data once arrives.
    Data transmitted between clients and servers in form of Hypertext documents form which HTTP gets its name. Hypertext is structured text that uses logical links/hyperlinks between nodes containing text. Hypertext doc can be manipulated using HTML Hypertext Markup Language.
  48. 48Examples of Data Interception: 4 and describe- Man-in-the-Middle attack: hacker positions themselves between sender and receiver – allows them to intercept data transmissions, modify content or impersonate one or both parties involved. Involves: victim (ie client), entity (ie server) with which victim is trying to transmit data, MITM (Man In the Middle) who is intercepting vitims data transmissions. Victim isn’t aware of the man in the middle.
    - SSLStrip: hacker targets HTTPS communication protocol Tricks users into connecting to insecure HTTP websites instead of intended secure HTTS sites allowing hacker to intercept and manipulate traffic
    - Evil twin attacks: hacker set up rougue Wi-Fi access points that mimic legitimate networks. Unsuspecting users connect to them allowing hacker to intercept and manipulate their data.
    - DNA spoofing: a hacker tampres with DNS to redirect users to harmful websites or intercept their communication. DNS responses are altered to users think they are visiting a trusted website when they are actually interacting with the hacker’s server
  49. 49HTTPSHTTPS – secure data transmission and primary protocol used to transmit data between servers and clients over internet. – Extension of HTTP – uses same methods to transfer data. HTTPS more secure as uses encryption. HTTPS encrypts requests and resonese before transmission and decrypts them once arrived. HTTPS protects against MITM attacks.
    HTTPS uses TLS (Transport Layer Security) encryption on top of the HTTP protocol. Any web application using HTTPS therefore employing TLS encryption. TLS cn be used to encrypt other communications such as emails, messaging and VoIP. TLS – evolved from SSL.
  50. 503 main properties of TLS Protocol provides:- Confidentiality: hides data being transferred from 3rd parties
    - Integrity: verifies that data has not been forged or tampered with
    - Authentication: ensures parties exchanging information are who they claim to be
  51. 51TLS connection initiated using a sequence known as the TLS handshake – when a user navigates to a web page that uses TLS, TLS handshake begins between user’s device (client) and web server During TLS Handshare, client and web server: 4- Specifiy which version of TLS will use
    - Decide on which cipher suites (encryption methods) will use
    - Authenticate the identity of server using server’s TLS certificate
    - Generate session keys for encrypting messages between them after handshake is complete
    Client encrypts a pre-master key with server’s public key and sends it to the server which decrypts the pre-master key with its private key – client and server hten use pre-master key to compute a shared secret key for encrypting data transmissions.
  52. 52TLS Certificates give some examples of CA'sTLS Certificates: for web application to use TLS must have a TLS Certificate installed on its host sever – issued by CA (Certificate Authroity) to owner of web applications domain name. Certificate contains info about: who owns domain name and server’s public encryption key. (importatnt for validating server’s identity)
    Certificates signed by a CA and recognised to be trusted. Padlock symbol in browser’s search bar indicates signed and verified TLS certificate being used. Certificates from a CA come at a cost for commercial user. Over 100 CA’s ie Rapid, Google Trust Services, DigiCert, GeoTrust…
    Approach for application development involves creating locatl TLS Certificates: quick approach uses dummy certificates. More through uses self-signed certificates.
  53. 53HTTP HeadersHTTP Headers: before data sent, HTTP used to wrap data in information defining nature of request being sent – defined by HTTP headers. HTTP Header – field of an HTTP request or response that passes additional context and metadata about request ore response. Ie indicate media format
  54. 54Security HeadersEasiest ways to secure a web application is to include HTTP security headers - subset of HTTP headers that are specific to security
    Security headers are exchanged between a client (ie web browser) and server to specify security configuration of HTTP transmissions. Provide extra layer of security by restricting behaviours permitted by browsers and servers once a web application is running. Improve resilience of a web application againg common attacks ie XSS.
  55. 55CSP Content Security PolicyCSP Content Security Policy – security header header. Default is set to strict which blocks content like external CSS and inline scripts. Custom CSP defines what blocked content sources allowed (whitelisting) csp {}.

Information

Description
Uni Uni Second Level (Security Programming) Flashcards on Software and Web Security, created by HRYN red on 19/12/2024.
Created by
HRYN red
Views
2
Rating

Feedback

What is it about?

What do you think of the new look?

How do you like it?