SOPH LAB IN APPLIED COMPUTING
OWASP Top 10 Pt. 2
By Li-Wey Lu
Agenda
Homework
Quiz
OWASP Top 10
Next Week
Homework
Homework – Due Next Week
Find three vulnerabilities in CandyPal (http://10.15.1.10:9090)
Vulnerabilities must fall under the risks discussed during lecture
Provide the following per vulnerability:
Name
Image
Description
Quiz
Quiz – Answers
Q1. What does OWASP stand for?
A1. Open Web Application Security Project
Q2. Which of the OWASP Top 10 was removed from 2017’s list?
A2. Cross-Site Request Forgery
Q3. What is Session Fixation an example of?
A3. Broken Authentication
Q4. DTD stands for Document Type Description.
A4. False
Q5. There is more than one type of injection attack.
A5. True
OWASP Top 10
OWASP Top 10 – Risks
Injection
Broken Authentication
Sensitive Data Exposure
XML External Entities
Broken Access Control
Security Misconfiguration
Cross-Site Scripting
Cross-Site Request Forgery
Insecure Deserialization
Using Components with Known Vulnerabilities
Unvalidated Redirects and Forwards
Insufficient Logging & Monitoring
OWASP Top 10 – Cross-Site Scripting (Overview)
When an attacker gets their JavaScript to execute on a victim’s browser
OWASP Top 10 – Cross-Site Scripting (Examples)
Reflected XSS – Payload in HTTP request comes back in HTTP response body
Stored XSS – Payload is stored in the application’s database and returned in an HTTP response body
DOM-Based XSS – Normal JavaScript comes from the HTTP response body and retrieves the payload from the URL to place on the page
OWASP Top 10 – Cross-Site Scripting (Labs)
Lab 1 – Reflected XSS
Lab 2 – Stored XSS
Lab 3 – DOM-Based XSS (Try Different Browsers)
Lab 4 – XSS in Tag Attributes
Lab 5 – POST XSS
Discussion – Remediation
OWASP Top 10 – Cross-Site Request Forgery (Overview)
When an attacker gets a victim’s browser to perform an action with their session
OWASP Top 10 – Cross-Site Request Forgery (Examples)
Victim is logged into an application
Attacker sends an email containing a link to victim
Link leads to the application’s logout endpoint
Victim clicks on the link and gets logged out
OWASP Top 10 – Cross-Site Request Forgery (Labs)
Lab 1 – CSRF to XSS Chained Attack
Discussion – Remediation
Discussion – SOP & CORS
Lab 2 – Steal Comments
OWASP Top 10 – Insecure Deserialization (Overview)
Serialization is the process of converting an object into a format that can be stored or transferred
Deserialization is the process of converting serialized data back into an object
Insecure Deserialization occurs when untrusted input gets deserialized
OWASP Top 10 – Insecure Deserialization (Examples)
Application A serializes objects and sends them to Application B
Application B does not authenticate Application A
An attacker makes direct requests to Application B with serialized data
Attacker’s serialized data gets deserialized and the object’s functions are executed
OWASP Top 10 – Insecure Deserialization (Labs)
Lab 1 – PHP Object Injection
Discussion – Remediation
OWASP Top 10 – Using Components with Known Vulnerabilities (Overview)
Self explanatory
Just because an application is using a component with known vulnerabilities does not mean it is exploitable
OWASP Top 10 – Using Components with Known Vulnerabilities (Examples)
OWASP Top 10 – Unvalidated Redirects and Forwards (Overview)
Redirect is when someone sends you elsewhere for an answer
Forward is when someone answers you after asking elsewhere
Rest is self explanatory
OWASP Top 10 – Unvalidated Redirects and Forwards (Examples)
An attacker borrows the reputation of a trusted domain to then send a victim somewhere malicious
An attacker gets an application to retrieve resources from a malicious server to achieve XSS
An attacker gets an application to communicate with a malicious server to steal credentials
OWASP Top 10 – Unvalidated Redirects and Forwards (Labs)
Lab 1 – Unvalidated Redirect
Lab 2 – Server Side Request Forgery (Credentials)
Lab 3 – Server Side Request Forgery (XSS)
Discussion – Remediation
OWASP Top 10 – Insufficient Logging & Monitoring (Overview)
Self explanatory
OWASP Top 10 – Insufficient Logging & Monitoring (Examples)
Users authenticating
Impersonation functionality
Payment functionality
Password reset functionality
Brute force attempts
Malicious traffic
Etc.
Next Week
Next Week
Topic:
Security Training Platforms Pt. 1
Assignments:
Week 4 Homework
Week 4 Quiz