1. COMP9321 Web Application Engineering Semester 2, 2017
Dr. Amin Beheshti
Service Oriented Computing Group, CSE, UNSW Australia
Week 9
COMP9321, 17s2, Week 9

2. Assignment 1 Marks on GradeBook Assignment 2 Due: end of Mid Semester Break: Sunday, Oct , 23:59:00
Assignment 3 Released
Course Noticeboard
COMP9321, 17s2, Week 9

3. Introduction to Web Application Security
Acknowledgements
This presentation contains material prepared by Halvard Skogsrud, Senior Software Engineer, Thoughtworks, Inc. Sydney, Australia and from the Open Web Application Security Project (OWASP)
COMP9321, 17s2, Week 9

4. Introduction to Web Application Security
Warning
The objective of this presentation is to show you common security loopholes appearing in Web applications. However, it is not meant to encourage you to attack web applications. Such actions are both a breach of the law in most countries, and of the CSE policy. Hence, by attempting any of the techniques presented in this lecture, you may be prosecuted by law enforcement and face expulsion from the university.
COMP9321, 17s2, Week 9

5. Securing your Web Application
COMP9321, 17s2, Week 9

6. Securing your Web Application: Threats!
COMP9321, 17s2, Week 9

7. Securing your Web Application: Threats!
COMP9321, 17s2, Week 9

8. Securing your Web Application: Threats!
COMP9321, 17s2, Week 9

9. Securing your Web Application: Threats!
COMP9321, 17s2, Week 9

10. Securing your Web Application: Requirements!
COMP9321, 17s2, Week 9

11. SQL Injection
COMP9321, 17s2, Week 9

12. SQL Injection SQL injection: is a code injection technique.
used to attack data-driven applications
How: a malicious SQL statements are inserted into an entry field for execution.
COMP9321, 17s2, Week 9

13. SQL Injection SQL injection: is a code injection technique.
used to attack data-driven applications
How: a malicious SQL statements are inserted into an entry field for execution.
COMP9321, 17s2, Week 9

14. SQL Injection: What is wrong?
COMP9321, 17s2, Week 9

15. SQL Injection: What is wrong?
COMP9321, 17s2, Week 9

16. SQL Injection: What is wrong?
Google(comment in sql)
COMP9321, 17s2, Week 9

17. SQL Injection: What is wrong?
COMP9321, 17s2, Week 9

18. SQL Injection: Summary!
COMP9321, 17s2, Week 9

19. SQL Injection: Prevention!!
To keep malicious inputs contained, any inputs written to the database need to be encoded.
SQL encoding: ' OR 1=1 --' is encoded to \ \'\ OR\ 1\=1\ \-\-'
Example:
COMP9321, 17s2, Week 9

20. SQL Injection: Prevention!!
COMP9321, 17s2, Week 9

21. Cross Site Scripting (XSS)
COMP9321, 17s2, Week 9

22. Cross Site Scripting (XSS)
is a type of computer security vulnerability typically found in web applications.
XSS enables attackers to inject client-side script into web pages viewed by other users.
A cross-site scripting vulnerability may be used by attackers to bypass access controls such as the same-origin policy.
COMP9321, 17s2, Week 9

23. Cross Site Scripting (XSS)
is a type of computer security vulnerability typically found in web applications.
XSS enables attackers to inject client-side script into web pages viewed by other users.
A cross-site scripting vulnerability may be used by attackers to bypass access controls such as the same-origin policy.
Same-origin policy is an important concept in the web application security model.
Under the policy, a web browser permits scripts contained in a first web page to access data in a second web page, but only if both web pages have the same origin.
COMP9321, 17s2, Week 9

24. Cross Site Scripting (XSS)
is a type of computer security vulnerability typically found in web applications.
XSS enables attackers to inject client-side script into web pages viewed by other users.
A cross-site scripting vulnerability may be used by attackers to bypass access controls such as the same-origin policy.
Same-origin policy is an important concept in the web application security model.
Under the policy, a web browser permits scripts contained in a first web page to access data in a second web page, but only if both web pages have the same origin.
e.g., a combination of URI scheme, hostname, and port number.
COMP9321, 17s2, Week 9

25. Cross Site Scripting (XSS): What is wrong?
COMP9321, 17s2, Week 9

26. Cross Site Scripting (XSS): What is wrong?
Suppose the victim is given this URL by the attacker (
COMP9321, 17s2, Week 9

27. Cross Site Scripting (XSS): What is wrong?
Suppose the victim is given this URL by the attacker (
The web page would then be injected with the following script:
COMP9321, 17s2, Week 9

28. Cross Site Scripting (XSS): Summary!
COMP9321, 17s2, Week 9

29. Cross Site Scripting (XSS): Summary!
What is the worst an attacker can do with JavaScript?
Malicious JavaScript has access to all the same objects the rest of the web page has, including access to cookies.
JavaScript can read and make arbitrary modifications to the browser’s DOM (within the page that JavaScript is running).
JavaScript can use XMLHttpRequest to send HTTP requests with arbitrary content to arbitrary destinations.
JavaScript in modern browsers can leverage HTML5 APIs such as accessing a user’s geolocation, webcam, microphone and even the specific files from the user’s file system.
COMP9321, 17s2, Week 9

30. Cross Site Scripting (XSS): Prevention!!
COMP9321, 17s2, Week 9

31. Cross Site Scripting (XSS): Prevention!!
COMP9321, 17s2, Week 9

32. Cross Site Request Forgery (CSRF)
COMP9321, 17s2, Week 9

33. Cross Site Request Forgery (CSRF)
also known as a one-click attack or session riding 
abbreviated as CSRF or XSRF
is a type of malicious exploit of a website whereby unauthorized commands are transmitted from a user that the website trusts
COMP9321, 17s2, Week 9

34. Cross Site Request Forgery (CSRF)
also known as a one-click attack or session riding 
abbreviated as CSRF or XSRF
is a type of malicious exploit of a website whereby unauthorized commands are transmitted from a user that the website trusts
Exploit: is a piece of software, a chunk of data, or a sequence of commands that takes advantage of a bug or vulnerability in order to cause unintended or unanticipated behavior to occur on computer software…
COMP9321, 17s2, Week 9

35. Cross Site Request Forgery (CSRF)
also known as a one-click attack or session riding 
abbreviated as CSRF or XSRF
is a type of malicious exploit of a website whereby unauthorized commands are transmitted from a user that the website trusts
Exploit: is a piece of software, a chunk of data, or a sequence of commands that takes advantage of a bug or vulnerability in order to cause unintended or unanticipated behavior to occur on computer software…
Such behavior frequently includes things like gaining control of a computer system, allowing privilege escalation, or a denial-of-service attack.
COMP9321, 17s2, Week 9

36. Cross Site Request Forgery (CSRF)
COMP9321, 17s2, Week 9

37. Cross Site Request Forgery (CSRF)
COMP9321, 17s2, Week 9

38. Cross Site Request Forgery (CSRF): Prevention!!
A CAPTCHA is a type of challenge-response test used in computing to determine whether or not the user is human.
COMP9321, 17s2, Week 9

39. Unvalidated Input
COMP9321, 17s2, Week 9

40. Unvalidated Input
COMP9321, 17s2, Week 9

41. Unvalidated Input
COMP9321, 17s2, Week 9

42. Unvalidated Input: Summary
COMP9321, 17s2, Week 9

43. Unvalidated Input: Prevention!
COMP9321, 17s2, Week 9

44. Broken Authentication
COMP9321, 17s2, Week 9

45. Broken Authentication
Google(SHA-1)
COMP9321, 17s2, Week 9

46. Fixing Authentication: How To?!
Google(MITM)
COMP9321, 17s2, Week 9

47. Fixing Authentication: Salting Passwords!
In cryptography, a salt is a random data that is used as an additional input to a one-way function that hashes a password or passphrase.
The primary function of salts is to defend against dictionary attacks versus a list of password hashes and against pre-computed rainbow table attacks.
e.g. the salt and the password can be concatenated and processed with a cryptographic hash function, and the resulting output (but not the original password) can be stored with the salt in a database.
COMP9321, 17s2, Week 9

48. Fixing Authentication: Salting Passwords!
Why add Salt?
If each password is simply hashed, identical passwords will have the same hash:
There are two drawbacks:
Due to the birthday paradox, the attacker can find a password very quickly especially if the number of passwords in the database is large.
In probability theory, the birthday problem or birthday paradox concerns the probability that, in a set of n randomly chosen people, some pair of them will have the same birthday. See:
COMP9321, 17s2, Week 9

49. Fixing Authentication: Salting Passwords!
Why add Salt?
If each password is simply hashed, identical passwords will have the same hash. There are two drawbacks:
Due to the birthday paradox, the attacker can find a password very quickly especially if the number of passwords in the database is large.
An attacker can use a list of precomputed hashes to break passwords in seconds.
A rainbow table is a precomputed table for reversing cryptographic hash functions, usually for cracking password hashes. See:
COMP9321, 17s2, Week 9

50. Fixing Authentication: Salting Passwords!
In order to solve these problems, a salt can be concatenated to the password before the digest operation.
A salt is a random number of a fixed length. This salt must be different for each stored entry. It must be stored as clear text next to the hashed password.
In this configuration, an attacker must handle a brute force attack on each individual password. The database is now birthday attack/rainbow crack resistant.
…consists of systematically checking all possible keys or passwords until the correct one is found.
In the worst case, this would involve traversing the entire search space.
COMP9321, 17s2, Week 9

51. Fixing Authentication: Salting Passwords!
COMP9321, 17s2, Week 9

52. Fixing Authentication: Salting Passwords!
COMP9321, 17s2, Week 9

53. Fixing Authentication: Salting Passwords!
COMP9321, 17s2, Week 9

54. Session Management
COMP9321, 17s2, Week 9

55. Session Management: Problem or Solution?!
COMP9321, 17s2, Week 9

56. Session Management: Problem or Solution?!
COMP9321, 17s2, Week 9

57. Session Management: Problem or Solution?!
Set-Cookie: <name>=<value>[; <Max-Age>=<age>] [; expires=<date>][; domain=<domain_name>]
[; path=<some_path>][; secure][; HttpOnly]
COMP9321, 17s2, Week 9

58. Transport Layer Security
COMP9321, 17s2, Week 9

59. Transport Layer Security (e.g. HTTPS)
COMP9321, 17s2, Week 9

60. Transport Layer Security (e.g. HTTPS)
Google(Secure Sockets Layer , SSL)
Google(Certification Authority , CA)
COMP9321, 17s2, Week 9

61. HTTPS: Basics…
COMP9321, 17s2, Week 9

62. HTTPS: Public-Key Cryptography
COMP9321, 17s2, Week 9

63. HTTPS: Shared-Key Cryptography
COMP9321, 17s2, Week 9

64. HTTPS: Hashing
COMP9321, 17s2, Week 9

65. HTTPS: Certificates
COMP9321, 17s2, Week 9

66. HTTPS: Signatures
COMP9321, 17s2, Week 9

67. HTTPS: How to? … Limitations?!
Follow the steps at:
COMP9321, 17s2, Week 9

68. Example
COMP9321, 17s2, Week 9

69. Application Layer Security
COMP9321, 17s2, Week 9

70. References http://www.owasp.org
COMP9321, 17s2, Week 9

71. COMP9321, 17s2, Week 9