Web Application Security

It's about web security , but this article contains many lies that we are saying or thinking about  and never try to make sure that we are not going to fall in it. These lies about web security . 1- The Lock icon is lighting on , it's ok it's amazing that everyone looks for the lock int he browser bar to believe that this site so secure, it's a big lie . you are not safe .  the lock in the browser bar doesn't mean that you are fully secure , it's only the SSL , means that the data are transferred in secure way .  but the agent(Hacker) who get the info can use it easily. Note : some Hackers are very good at faking SSL certificate or buying one . 2- Website Reputation  It's not true that if you don't visit websites of ill repute , you are in all clear ,No No! Wrong answer.  more than 83% of malware hosting sites are trusted. 3- Don't underestimate the information in your computer . This is the most dangerous poin...

Posted by  Drupal Security Team  on  October 15, 2014 at 4:02pm Advisory ID: DRUPAL-SA-CORE-2014-005 Project:  Drupal core Version: 7.x Date: 2014-Oct-15 Security risk:  25/25 ( Highly Critical ) AC:None/A:None/CI:All/II:All/E:Exploit/TD:All Vulnerability: SQL Injection Description Drupal 7 includes a database abstraction API to ensure that queries executed against the database are sanitized to prevent SQL injection attacks. A vulnerability in this API allows an attacker to send specially crafted requests resulting in arbitrary SQL execution. Depending on the content of the requests this can lead to privilege escalation, arbitrary PHP execution, or other attacks. This vulnerability can be exploited by anonymous users. Update:  Multiple exploits have been reported in the wild following the release of this security advisory, and Drupal 7 sites which did not update soon after the advisory was released may be compromised. See this follow-...

It seems Google makes a new mistake by launching its new security key (2-step verification)  one of the steps is USB device .  The question  :how come can i plug USB into my mobile (I-Phone , I-Pad , Samsung Galaxy , ....) !  Do Google know the difficulties while you are holding a USB on your hand all the time .  so You can't access  your  account if it's not in your hands. or it's damaged ?  This solution is hopeless , I think it's designed for small audience. As someone says : Can you convince the Bank Manager while you are putting the USB Device into the bank PC, that you are securing your PC , not stealing the bank data, or not transferring amounts of money to other account . or what else .  You know , This way is not quietly good , If I have many accounts on Google and other websites ,I need many  USB devices to verify myself.  That's of course , not good at all.

Fake Data (Honey Data) By using honey data , it could help to identify attacks that are not triggered by error messages.  Honey data is data (e.g. Passwords, Credit card numbers,…) in tables which is never used by the application (Fake Ones). If someone from anywhere is accessing this kind of data , alert will be raised. Creation a table or tables containing unused data with juicy names (e.g. PASSWORD, CREDITCARD, SALARY).   Such interesting data is often the target of attackers.    During the attack, attackers are often accessing the view ALL_TAB_COLUMNS (Oracle) or INFORMATION_SCHEMA.COLUMNS (MySQL) to get the column names of interesting data.

When doing Audit on any table on the the database , the default auditing is DB. SQL > show parameters audit_trail NAME                                 TYPE        VALUE ------------------------------------ ----------- ------------------------------ audit_trail                          string      DB in this case , when you do audit on some table. SQL> audit all on scott.emp by access; Audit succeeded SQL> update emp set sal=sal*0.95 where job='MANAGER'; 3 rows updated. if you want to know the statement made these changes, you will receive nothing on the sql_text field while you are selecting the audit_trial table.

Heartbleed , what and how ?  Heartbleed is a bug in software commonly used to encrypt sensitive data between Web servers and Web browsers. The bug allows anyone on the Internet to compromise secret keys that Web servers use to encrypt traffic, which allows attackers to eavesdrop on all communication between the Web server and its users – even communication that was encrypted and supposed to be private. The Heartbleed vulnerability in OpenSSL has sent just about everyone who uses the Web for fun or profit gibbering madly in search of a solution, creating fertile ground for spammers, scammers and marketing types. The OpenSSL Software Project has issued a fix , and recommends upgrading immediately to OpenSSL 1.0.1g, or to recompile OpenSSL and disable the Heartbeat functionality that caused the vulnerability. "Be skeptical of unsolicited advice, especially advice that warns of dire consequences for inaction," warned Easy Solutions' Ingevaldson. ...

Search Google about Dork List 2013 SQL Injection Here are some from the list is :       http://tutsql.blogspot.com/2013/06/dork-list.html       http://securitypedia.blogspot.com/p/dork-list-2013_7588.html     -- choose one way of them to google it like : inurl:newsdetail.php?id=

Web sites store ever-increasing amounts of information about their users, users’ habits, connections, photos, inances, and more. These massive datastores present appealing targets for attackers who wish to cause damage or make money by maliciously accessing the information. While credit cards often spring to to mind at the mention of SQL injection any information has value to the right buyer. In an age of organized hacking, attackers will gravitate to the information with the greatest value via the path of least resistance. Here we examine an attack directed solely against the web site and its database: SQL injection. A single SQL injection attack can extract the records for every user of the web site, regardless of whether that user is logged in, currently using the site, or has a secure browser.

HTML injection and cross-site scripting (XSS) is an ideal vulnerable to exploitfor attackers across the spectrum of sophistication and programming knowledge. Exploits are easy to write, requiring no more tools than a text editor—or sometimes just the browser’s navigation bar—and a cursory knowledge of JavaScript, unlike buffer overlow exploits that call for more esoteric assembly, compilers, and debugging. XSS also offers the path of least resistance for a payload that can affect Windows, OSX, Linux, Internet Explorer, Safari, and Opera alike. The web browser is a universal platform for displaying HTML and interacting with complex web sites. When that HTML is subtly manipulated by a few malicious characters, the browser becomes a universal platform for exposure. With so much personal data stored in web applications and accessible through URLs, there’s no need for attackers to make the extra effort to obtain “root” or “administrator” access on a victim’s system. The reason for targ...

The following is example of secure software controls that should be considered through the life cycle of a software development project. Depending on the type of organizations, some or all of these controls should be factored. Military organizations generally have stringent controls that need to be built in than civilian organizations. Security in the Systems Development Life Cycle Requirements Gathering Business Partner Engagement Identify Policies & Standards Identify Regulatory & Legal Requirements Identify Privacy Requirements Identify Compliance Requirements Develop C,I, A* Goals & Objectives Develop Procurement Requirements Perform Risk Assessment Design Use and Abuse Case Modeling Secure Design Review Secure Architecture Review Threat & Risk Modeling Generate Security Requirements Generate Security Test Cases Develop...

   Insufficient Transport Layer Protection  Authenticating over non-­‐SSL. Obviously bad Sending session IDs over non-­‐SSL Session hijacking Firesheep Not sending everything over SSL JavaScript injection Insecure Cryptographic Storage Obviously bad  Storing passwords in plaintext.  Still bad  Using unsalted hashes. Using raw hash function (MD5,SHA1,etc). Better but not great  Using a keyed hash function (HMAC-SHA1). Best Using a slow function (PBKDF2,bcrypt,scrypt).  Cross-Site Request Forger y  Confused deputy problem.  Classic example  Filelocker doesn’t have any CSRF protection. Joe is a Filelocker admin. I get Joe to visit a specially crafted form. Joe’s browser submits form along  with  his cookies. I not have admin  <form method="POST" action="[path to filelocker]/admin_interface/grant_user_permission?format=json"> <input type="hidden" name="us...

Most Important People Security (Increase Expenses) Developers (Increase Profits) Executives (Increase Profits) Sales (Increase Profits) Business Development (Increase Profits)

 Definition - What does Smurf Attack mean? A smurf attack is a type of denial of service attack in which a system is flooded with spoofed ping messages. This creates high computer network traffic on the victim’s network, which often renders it unresponsive. Smurfing takes certain well-known facts about Internet Protocol and Internet Control Message Protocol (ICMP) into account. ICMP is used by network administrators to exchange information about network state, and can also be used to ping other nodes to determine their operational status. The smurf program sends a spoofed network packet that contains an ICMP ping. The resulting echo responses to the ping message are directed toward the victim’s IP address. Large number of pings and the resulting echoes can make the network unusable for real traffic. Techopedia explains Smurf Attack The following steps lead to a smurf attack: Huge numbers of ICMP requests a...

  Filter Input & Escape Output, always.  Use prepared statements, filter your query params.  Disable magic_quotes, register_globals, allow_url_fopen.  Give minimum permissions to daemons, processes, people.  Regenerate your session id’s and use tokens.  Use common sense.

Some jquery methods are unsafe, particularly .append() and the jquery selector $('') which can also create nodes $('<img>') will generate a img node. Only a few jquery methods should be passed unescaped input Safe methods .text() .attr() .prop() .val() Unsafe methods .html() $() .append*() .wrap*() .prepend*() .before() .after() .insert*()

Attack Get the data from the storage(cookie,passwd,etc). Storage your xss shellcode Unlimit the path.  Defense Don’t store sensitive data in local storage. Don't use local storage for session identifiers. Stick with cookies and use the HTTP Only and Secure flags.

Three Principles: Defense in Depth - Redundant safegaurds are valuable. Least Privilege - grant as little freedom as possible.  Least complicated - Complexity breeds mistakes.  (From Shiflett's Evolution of Web Security)   Trust Nothing, Assume Nothing Server Side Security  Install Suhosin patch.  Be smart about your passwords.  Disable register globals, magic quotes,etc.  Never run PHP/Apache/Nginx/etc as administrator.  Keep up with Patches.

Phishing - Getting information by simply asking for it. Baiting - Leaving infected media (USB Stick, CD’s, wireless networks, etc) that compromises a system. Tailgating - Entering a secured area by following someone.  Social Engineering - Tips  Don’t give out privileged information, ever.  Know who you’re talking to, ask to call them back, etc.  Common Sense helps a lot.  Never take anything for granted.  Don’t pick up disks/usb sticks/etc & insert them into your computer (PC, Mac,or even Linux)

SQL injection is  serious business , but you shouldn't be overwhelmed by the thought of defending against it. Follow these simple steps to keep attackers' eyes and fingers out of your databases. Ensure that only generic, nondescriptive error message or HTTP 500 pages are displayed to users. Never give away database metadata like table names or application source code snippets in error messages.  Validate simple input types like credit card numbers or postal codes with regular expression. If the input doesn't match the expected value, return an error to the user ( a generic, nondescriptive error!) and don't execute the database query. Always check to make sure that the input matches a good , valid pattern ( for example , whitelist pattern matching) rather than whether it matches a bad,invalid pattern(for example,blacklist matching). Whitelist validation defenses are usually much more resilient to newly discovered attack techniques.  If the input is a date or numer...