WEB 2.0 SECURITY: THREATS AND SOLUTIONS

By Y. JOKAA

COMMON INJECTION ATTACKS HOW INJECTION ATTACKS WORK SQL INJECTION CHOOSING APPROPRIATE SQL INJECTION CODE XPATH INJECTION COMMAND INJECTION DIRECTORY TRAVERSAL ATTACKS XXE (XML EXTERNAL ENTITY) ATTACKS LDAP INJECTION BUFFER OVER? OWS TESTING FOR INJECTION EXPOSURES AUTOMATED TESTING WITH ISEC’S SECURITYQA TOOLBAR SUMMARY CROSS-SITE SCRIPTING WEB BROWSER SECURITY MODELS SAME ORIGIN/DOMAIN POLICY COOKIE SECURITY MODEL PROBLEMS WITH SETTING AND PARSING COOKIES USING JAVASCRIPT TO REDUCE THE COOKIE SECURITY MODEL TO THE SAME ORIGIN POLICY FLASH SECURITY MODEL RE? ECTING POLICY FILES THREE STEPS TO XSS STEP 1: HTML INJECTION CLASSIC RE? ECTED AND STORED HTML INJECTION FINDING STORED AND RE? ECTED HTML INJECTIONS RE? ECTED HTML INJECTION IN REDIRECTORS HTML INJECTION IN MOBILE APPLICATIONS HTML INJECTION IN AJAX RESPONSES AND ERROR MESSAGES HTML INJECTION USING UTF-7 ENCODINGS HTML INJECTION USING MIME TYPE MISMATCH USING FLASH FOR HTML INJECTION STEP 2: DOING SOMETHING EVIL STEALING COOKIES PHISHING ATTACKS ACTING AS THE VICTIM XSS WORMS STEP 3: LURING THE VICTIM OBSCURING HTML INJECTION LINKS MOTIVATING USER TO CLICK HTML INJECTIONS TESTING FOR CROSS-SITE SCRIPTING REFERENCES AND FURTHER READING CASE STUDY: BACKGROUND FINDING SCRIPT INJECTION IN MYSPACE WRITING THE ATTACK CODE IMPORTANT CODE SNIPPETS IN SAMY SAMY’S SUPPORTING VARIABLES AND FUNCTIONS THE ORIGINAL SAMY WORM PART II NEXT GENERATION WEB APPLICATION ATTACKS ? CROSS-DOMAIN ATTACKS WEAVING A TANGLED WEB: THE NEED FOR CROSS-DOMAIN ACTIONS USES FOR CROSS-DOMAIN INTERACTION SO WHAT’S THE PROBLEM? CROSS-DOMAIN IMAGE TAGS CROSS-DOMAIN ATTACKS FOR FUN AND PRO? T CROSS-DOMAIN POSTS CSRF IN A WEB 20 WORLD: JAVASCRIPT HIJACKING MALICIOUS JAVASCRIPT AND AJAX MALICIOUS JAVASCRIPT XSS PROXY BEEF PROXY VISITED URL ENUMERATION JAVASCRIPT PORT SCANNER BYPASS INPUT FILTERS MALICIOUS AJAX XMLHTTPREQUEST AUTOMATED AJAX TESTING SAMY WORM YAMMER VIRUS NET SECURITY GENERAL FRAMEWORK ATTACKS REVERSING THE NET FRAMEWORK XML ATTACKS FORCING THE APPLICATION SERVER TO BECOME UNAVAILABLE WHEN PARSING XML MANIPULATING APPLICATION BEHAVIOR THROUGH XPATH INJECTION XPATH INJECTION IN NET SQL INJECTION BY DIRECTLY INCLUDING USER DATA WHEN BUILDING AN SQLCOMMAND CROSS-SITE SCRIPTING AND ASPNET INPUT VALIDATION BYPASSING VALIDATION BY DIRECTLY TARGETING SERVER EVENT HANDLERS DEFAULT PAGE VALIDATION DISABLING ASPNET’S DEFAULT PAGE VALIDATION OUTPUT ENCODING XSS AND WEB FORM CONTROLS CAUSING XSS BY TARGETING ASPNET WEB FORM CONTROL PROPERTIES MORE ON CROSS-SITE SCRIPTING VIEWSTATE VIEWSTATE IMPLEMENTATION GAINING ACCESS TO SENSITIVE DATA BY DECODING VIEWSTATE USING ERROR PAGES TO VIEW SYSTEM INFORMATION ATTACKING WEB SERVICES DISCOVERING WEB SERVICE INFORMATION BY VIEWING THE WSDL FILE CASE STUDY: CROSS-DOMAIN ATTACKS CROSS-DOMAIN STOCK-PUMPING SECURITY BOUNDARIES PART III AJAX ? AJAX TYPES, DISCOVERY, AND PARAMETER MANIPULATION TYPES OF AJAX CLIENT-SERVER PROXY CLIENT-SIDE RENDERING AJAX ON THE WIRE DOWNSTREAM TRAF? C UPSTREAM TRAF? C AJAX TOOLKIT WRAP-UP FRAMEWORK METHOD DISCOVERY MICROSOFT ASPNET AJAX (MICROSOFT ATLAS) GOOGLE WEB TOOLKIT DIRECT WEB REMOTING XAJAX SAJAX FRAMEWORK IDENTI? CATION/METHOD DISCOVERY EXAMPLE FRAMEWORK WRAP-UP PARAMETER MANIPULATION HIDDEN FIELD MANIPULATION URL MANIPULATION HEADER MANIPULATION EXAMPLE MANIPULATION WRAP-UP UNINTENDED EXPOSURE EXPOSURE WRAP-UP COOKIES THE UGLY THE BAD COOKIE FLAGS COOKIE WRAP-UP AJAX FRAMEWORK EXPOSURES INSTALLATION PROCEDURES UNINTENDED METHOD EXPOSURE DEBUG MODE COMMON EXPOSURES DOJO TOOLKIT SERIALIZATION SECURITY JQUERY CASE STUDY: WEB 20 MIGRATION EXPOSURES WEB 20 MIGRATION PROCESS INTERNAL METHODS DEBUG FUNCTIONALITY HIDDEN URLS FULL FUNCTIONALITY PART IV THICK CLIENTS ? ACTIVEX SECURITY OVERVIEW OF ACTIVEX ACTIVEX FLAWS AND COUNTERMEASURES ALLOWING ACTIVEX CONTROLS TO BE INVOKED BY ANYONE NOT SIGNING ACTIVEX CONTROLS MARKING ACTIVEX CONTROLS SAFE FOR SCRIPTING (SFS) MARKING ACTIVEX CONTROLS SAFE FOR INITIALIZATION (SFI) PERFORMING DANGEROUS ACTIONS VIA ACTIVEX CONTROLS BUFFER OVER? OWS IN ACTIVEX OBJECTS ALLOWING SFS/SFI SUBVERSION ACTIVEX ATTACKS AXENUM AND AXFUZZ AXMAN