Web Security Overview Quiz

Lecture 08: Web Security

• The lecture focuses on web security, covering issues relevant to web servers, browsers, and user interactions.
• Prerequisites for the lecture include URL, HTTP, and HTML knowledge.
• Software like Apache2 web server, PHP7, MySQL, and sendmail are required.
• Programming languages such as PHP, Perl, Python, JavaScript, and CGI scripts are used in web development.
• Resources for further study include PHP comparisons, manuals, tutorials, MySQL documentation, PDO tutorials, Modsecurity projects, JavaScript tutorials, and OWASP resources for application security.
• Topics outlined include XSS attacks (server-side injection), SQL injection attacks, Slowloris attacks, mod-security, client-side XSS, cookie theft using XSS, and heap spray exploits.

Prerequisites

• URL, HTTP, and HTML knowledge are needed.
• Apache2 web server installed on an Ubuntu machine.
• Apache2 server is enabled with PHP7.
• MySQL database management system used as database backend.
• A driver to enable PHP communication with MySQL.
• Sendmail program running on the server.

Languages

• PHP
• Perl
• MySQL
• Python
• JavaScript
• CGI scripts

Resources

• PHP vs. NodeJS comparison and benchmarks (2018)
• PHP Manual
• PHP Tutorial
• MySQL Documentation
• PDO tutorials (addressing PHP delusions)
• Modsecurity Project
• JavaScript Tutorial
• OWASP Foundation (Open Source Foundation for Application Security)

Outline

• XSS attack with server-side injection
• SQL Injection Attack
• Slowloris Attack
• mod-security
• Client-side XSS
• Cookies and XSS for stealing cookies
• Heap Spray Exploit

Web Security

• Web security addresses issues specific to how web servers display content to browsers, how browsers interact with servers, and how users interact with browsers.
• The World Wide Web, web servers initially offered only static content.
• Now, dynamic content is common, often tied to a database server.
• Middleware (often PHP scripts) is frequently used for this purpose, particularly with Apache and MySQL.

XSS Attack with Server-Side Injection

• This type of attack injects malicious code, often PHP, during upload processes.
• The injected code isn't visible in the browser's source.
• The goal might be to download a spam file from a third-party source as soon as the page loads.
• A diagram illustrates the attack flow, showing the attacker's web hosting provider injecting the script into the web pages uploaded by users.

XSS Attack with Server-Side Injection (Details)

• Specific details are provided about the web servers, clients, and email providers involved.
• Example code snippets showing the injected PHP code demonstrate how the attack works.

SQL Injection Attack

• PHP and MySQL work together to manage web server databases. The "php7.0-mysql" package allows for direct database connections via a PHP Data Objects (PDO) based driver.
• A MySQL database (Manager_db) with user accounts (Operator1, Operator2, Operator3) and a Maintenance_Schedule table are setup for illustration.
• The initial table setup shows each operator's schedules relating to specific equipment.

SQL Injection Attack (Details)

• An attacker could insert malicious code to modify or delete data (delete all tables) in the database.
• An important factor is that the SQL syntax places commands and data on equal footing.

Security against SQL Injection

• To prevent this, user inputs need careful filtering and restricted command access.
• PDO (PHP Data Objects) based drivers offer consistent API usage across diverse database systems. They often include built-in security measures against SQL Injection.

Kak's Code (Lecture 27)

• Specific file names (RetrieveFromMySQL.html, RetrieveFromMySQL.php) are listed for code.

The Slowloris Attack

• Developed by Robert Hansen in 2009.
• The attack involves sending incomplete HTTP requests to a web server.
• This keeps many TCP connections open, overwhelming the server's capacity.

The Slowloris Attack: Example 1, 2, and 3

• Illustrations of client-side scripts (ClientSocketFetchDocs.py, TestHTTPServerWithNoCRLF.py) and server-side scripts (CheckNetstat.sh, RepeatedAttack.sh, TerminateLoris.sh) used in the attack demonstrate the attack's method.

SlowPost Attack

• Similar to Slowloris but uses POST requests instead of GET requests.

Kak's Code (Lecture 28)

• Specific file names (WealthTracker.html) for the relevant code are listed.

XSS for Stealing Cookies

• Third parties can steal cookies via XSS attacks. JavaScript is used in these attacks.

• Example steps for a cookie-stealing attack are given, showing how to bring up the JavaScript console, and the required commands are illustrated to steal cookies.

• The web server named 'Collector.cgi' is part of the attack and stores stolen cookies.

The Heap Spray Exploit

• This exploit uses JavaScript to execute shell commands by exploiting how script engines manage memory.

Heap Spray References

• References to documentation on the heap spray technique are provided.

Web Vulnerabilities

• Historical security issues with browsers' interactions with servers (e.g., Samy worm).

Browser Vulnerabilities

• Vulnerabilities like JavaScript and the DOM (Document Object Model) are discussed.
• Another common technique (e.g. using <iframe>) is addressed, as well as the potential for another web page to be embedded within the target page.

Web Application Security

• The OWASP (Open Web Application Security Project) is mentioned as a notable resource.
• Tools like W3af for testing web applications for vulnerabilities (SQL injection, cross-site scripting, remote file inclusion) are discussed.

Reference

• A PDF file reference (for subverting AJAX) is listed.

Test your knowledge on web security concepts, including dynamic content, common attacks, and functionalities of web servers. This quiz covers various critical topics about safeguarding web applications and understanding vulnerabilities. Challenge yourself with matching terms and answering specific questions!