10th Sept 2009 - Lab 5: Web Application Security

The top 10 web application vulnerabilities are:

• Cross site scripting
• Injection flaws
• Malicious file execution
• Insecure direct object reference
• Cross site request forgery
• Information leakage and improper error handling
• Broken authentication and session management
• Insecure crypto storage
• Insecure comms
• Failure to restrict URL access

Today, in this lab session, we are going to see, learn and perform real attacks against a web application. That mean we are going to hack to the web browser by using above method. Simulation toolkit that used for today is WebGoat and WebScarab.

WebGoat is toolkit that can create a de-facto interactive teaching environment for web application security. WebScarab is designed to be a tool for anyone who needs to expose the workings of an HTTP(S) based application, whether to allow the developer to debug or to allow a security specialist to identify vulnerabilities in the way that the application has been designed or implemented.

WebGoat and WebScarab provided by OWASP community and be can be downloaded from http://www.owasp.org

After complete setup the WebGoat and WebScarab, first, we were using the Cross site scripting (XSS) attack to phishing attack. XSS is a vulnerability that can happen when a web application accept any input and sends it to a web browser without validate or encoding the content. When it is not validate, attacker can execute script in the victim's browser and can cause web defacement.

Next, we were trying in the Injections flaw. Injection flaw like SQL injection will cause web application to run an SQL code that was not intended by the application. For an example a web application might have a query statement as below:

The attacker can manipulate this statement by adding

In which it returns all the data from the table user.

In the end of the lab, we are trying the Malicious File execution. It is another web application vulnerabilities caused by failing to control application input. In this attack, attacker will manipulate the web application to become the attacker remote terminal to execute command line instructions such as directory list, dir or displaying network configuration, ipconfig. It will become more dangerous if the attacker manipulate this vulnerability by executing command that can create a backdoor to your server.

In order to prevent such vulnerability, the web application must strongly validate user input, strong output encoding, do not use "blacklist" validation and etc.

9th Sept 2009 - Lecture 4: Program Security

Today, Mr. Zaki is going to teach the new lecture. It is lecture 4: Program Security. This lecture is all about how to secure program and type of malicious code. Malicious code is an unanticipated or undesired effect in programs that generated for the intended of damage. Damage could be in form of modification/destruction, stolen data, unauthorized access, damage on system, or other forms not intended by users.

There are many type of malicious code such as virus, Trojan or worm. Below table show that the type of malicious code and it characteristics:

Next, Mr. Zaki is explaining about the type of viruses. Virus can have many types such as parasitic virus, memory-resident virus, boot sector virus, stealth virus and polymorphic virus. Each of the viruses has it own harm. For example, boot sector virus is a virus that can infect the boot sector of a disk, and spreads when the OS boots up.

Then, Mr. Zaki is explaining what are trapdoors and the Salami Attack. Trapdoors are often caused by programmers leaving debug routines in the code. Or failure to check array bounds which lets code overrun the array bounds and gets placed on the stack. While Salami Attack refer to the simple fact, that when dealing with real numbers the computer has a fixed size and will perform rounding or truncation. There will always be those programmers that will try to conceal the small amounts on the hope that humans will not notice.

In the end of the lecture, Mr. Zaki explains the way to prevent virus infection. For example:

• Use only commercial software acquired from reliable, well established vendors
• Test all new software on an isolated computer
• Do not put a floppy disk in the machine unless it has been scanned first
• Scan any downloaded files before they are run