application security overview
DESCRIPTION
TRANSCRIPT
Application Security
Asanka Fernandopulle
Senior Software Engineer99X Technology
Dilan Warnakulasooriya
Information Security Engineer99X Technology
04/10/2023 99X Technology(c) 1
Basics of Application Security
• HTTP and HTTPS
• Symmetric key• Asymmetric key• Session key• Analyzing a certificate• Sniffing HTTP and HTTPS• Calomel plugin
04/10/2023 99X Technology(c) 2
Basics of Application Security
• Man in the middle
• Analyzing browser requests• Analyzing server response• https communication
• https and s-http
04/10/2023 99X Technology(c) 3
Basics of Application Security
• What OWASP does
• Builders , Breakers and Defenders
04/10/2023 99X Technology(c) 4
Web Application penetration testing
• Basic web testing methodology
• Vulnerability, Threat and Exploit
• Developer level application security overview - Asanka
04/10/2023 99X Technology(c) 5
Web Application penetration testing
• Application Security frameworks
• Before development begins• During definition and design• During development• During deployment• Maintenance and operations
04/10/2023 99X Technology(c) 6
Web Application penetration testing
• Web application security review frameworks
• Samurai WTF• Websecurify• Wapiti• Skiffish• Acunetix• Webscarab• W3af
04/10/2023 99X Technology(c) 7
Secure Authentication
• Authentication bypass techniques
• Direct page request• Parameter modification• Session ID prediction• Sql injection
Session predictability - webscarab/burpsuite
04/10/2023 99X Technology(c) 9
Secure Authentication
• Bypass authentication matrix
• Basic authentication• Multi-Level login 1• Multi-Level login 2
04/10/2023 99X Technology(c) 10
Secure Authentication
• Password remember
• Password strength• Forgot password
• Browser cache management
04/10/2023 99X Technology(c) 11
Secure Authentication
• Parameter tampering
• Bypass HTML Field restrictions• Exploit hidden fields• Bypass client side JavaScript validation
• Coding controls for Parameter Tampering
04/10/2023 99X Technology(c) 12
Secure Authentication
• Access control flaws
• Using an Access control matrix• Bypass a path based access control scheme• Bypass data layer access control
04/10/2023 99X Technology(c) 13
Injections
• SQL injection classes
• In band• Out of band• Inferential
04/10/2023 99X Technology(c) 14
Injections
• Techniques to exploit sql injections
• Union operator• Boolean• Error based• Out of band• Time delay
04/10/2023 99X Technology(c) 15
Injections
• Standard SQL injection testing
• SELECT * FROM Users WHERE Username='$username' AND Password='$password'
• Numeric sql injection
04/10/2023 99X Technology(c) 16
Injections
• Union Exploitation technique
• Xpath injection• String sql injection
04/10/2023 99X Technology(c) 17
Injections
• Boolean Exploitation technique
• Sql injection : stage 1 : String sql injection
• Stage 3 : Numeric sql injection
04/10/2023 99X Technology(c) 18
Injections
• Error based Exploitation technique
• Modify data with sql injection
• Add data with sql injection
04/10/2023 99X Technology(c) 19
Injections
• Time delay Exploitation technique
• Stored procedure Exploitation technique
• Automated Exploitation technique
04/10/2023 99X Technology(c) 21
Injections
• How developers work on SQL injection
• Automate your injection
• sqlmap
04/10/2023 99X Technology(c) 22
Session Management
• Session management techniques
• Session management vulnerability
• insufficient session id length• Session fixation• Session variable overloading
04/10/2023 99X Technology(c) 23
Session Management
• Check your cookies
• Cookie collection• Cookie reverse engineering• Cookie manipulation
• Hijack a session
• Hijack a session• Spoof an authentication cookie• Session fixation
04/10/2023 99X Technology(c) 24
Cross Site Scripting
• Scripting types
• Reflected cross site scripting (non-persistent XSS)• Stored cross site scripting (second-order XSS)• DOM based cross site scripting (type 0 xss)
04/10/2023 99X Technology(c) 27
Cross Site Scripting
• Reflected cross site scripting (non-persistent XSS)
• Testing for reflected XSS
• Reflected xss
04/10/2023 99X Technology(c) 28
Cross Site Scripting
• Bypass XSS filters
• Tag Attribute Value • Different syntax or enconding • Bypassing non-recursive filtering
04/10/2023 99X Technology(c) 29
Cross Site Scripting
• Stored cross site scripting (second-order XSS)
• XSS attack scenario
• Stored XSS
04/10/2023 99X Technology(c) 30
Cross Site Scripting
• Testing for Stored cross site scripting
• Input forms • Analyze HTML code• Exploitation framework• File upload
04/10/2023 99X Technology(c) 31