AN E-GOVERNANCE WEB SECURITY AUDIT Deven Pandya 1, Dr. N. J. Patel 2 1 Research Scholar, Department of Computer Application
|
|
- Frederica Hoover
- 6 years ago
- Views:
Transcription
1 AN E-GOVERNANCE WEB SECURITY AUDIT Deven Pandya 1, Dr. N. J. Patel 2 1 Research Scholar, Department of Computer Application 2 HOD, Department of Computer Application, Ganpat University Kherva, Gujarat, India ABSTRACT: Web Security is an important aspect in E-Governance since Government provides services to the citizen and manage all transactions using web portals develop for this purpose. Citizen s trust and privacy of data are key factors of E-Governance success. Vulnerabilities in E- governance web applications leads to the breach in trust and privacy of the citizens. Government sites although passed through security audit procedures still contains residual vulnerabilities which invites threats like denial of service, password cracking, SQL injection, cross site scripting. Paper discussed and analysed vulnerabilities found in 26 selected E- Governance websites/web applications with representation from 26 out of 27 Departments in the State of Gujarat, India. The paper depicts major vulnerabilities their severity level and impact on information resource. In all paper help us to understand web security in Gujarat E- Governance context. Keywords: Information Security, Web Security, Vulnerability, Security Audit, E-Governance [1] INTRODUCTION E-Governance is the application of Information and Communication Technology (ICT) for providing government services, exchange of information communication transactions, integration of various stand-alone systems and services between Government-to-Citizens (G2C), Government-to-Business (G2B), and Government-to-Government (G2G) as well as back office procedures and communications within the entire government frame work [1]. Information security, sometimes abbreviated to InfoSec, is the practice of defending information from unauthorized access, use, disclosure, disruption, alteration, perusal, inspection, recording or destruction. It is a general term that can be used regardless of the form the data may take (e.g. electronic, physical) [2]. Information security is important for successful E-Governance implementation. Maintaining privacy and security of an individual s personal data that he/she provides to obtain government services is a severe hindrance in implementing e-governance. [3] Apart from E- Government implementation, effective Information Security is important from State and National security perspective. Threats like Cyber terrorism, hackers, Advance Persistent Threats applying spear-phishing targeting a specific individual or small group of people within the Government organization to obtain sensitive information are the major source of concern for any Government agency. Figure 1 depicts some of the recent Government website hacking news reported by media. In India, it is mandatory for each Government websites/web 99
2 An E-Governance Web Security Audit application to undergo security audit from enlisted agencies and clear the same before hosting and after addition of new module. Apart from this each Department must formulate a security policy to address various security issues related to website/web application [4] Government of Gujarat has also made security audit compulsory on each instance of website update or every six month whichever is earlier for all the organizations through Computer Emergency Response Team India enlisted security auditors. [5] [2] WEB SECURITY AUDIT Figure: 1. A Govt. website hacking news in Media Vulnerability scanners are effective tools for web security auditing and finding vulnerabilities in the web application or web site. We have utilized Accunetix web vulnerability scanner for web security audit. Total 26 Websites/Web Applications pertaining to 26 out of 27 Departments of Government of Gujarat were surveyed and scanned for vulnerabilities. According to the 2013/2014 Web Application Vulnerability Scanners Benchmark [6], Acunetix is confirmed as one of the leaders in web application scanning with a 100% detection accuracy and 0% false positives for Reflected Cross-Site Scripting and SQL Injection vulnerabilities, together with a leading WIVET (Web Input Vector Extractor Teaser) assessment score. WIVET (Web Input Vector Extractor Teaser) is a project that measures how well a scanner is able to crawl an application, and how well it can find input vectors by presenting a collection of challengers that contain links, parameters and input delivery methods that the crawling process should locate and extract. [7] The websites/web Application was chosen in such a way that it represent each Department listed on official website of Government of Gujarat. [8] The web site/ web applications within the department was selected from three sources 1. E-Governance coffee Table book published by Science and Technology Department Government of Gujarat and 2. NIC Gujarat official website [9] 3. Based on random selection in case website/web application not listed in 1 or 2.The web sites/ web applications were scanned for parameters like Vulnerability, Vulnerability severity, Vulnerability type, Asset information and Threat impact. The detailed analysis has been conducted to evaluate E-Governance web security in Gujarat. 100
3 [3] WEB SECURITY ANALYSIS We have categorized Vulnerability severity in four severity levels High-H, Medium-M, Low-L and Informational-I according to the likelihood of the malicious user can actually exploit the vulnerability and cause harm to website/web application. Table1 depicts Vulnerabilities found in E-Governance websites/web applications in Gujarat. Other parameter depicted in Table are Severity Level, Impact on Information Security attributes like Confidentiality-C, Integrity-I and Availability-A. Percentage column depicts vulnerability found in number of websites/web applications. In each severity level group we have chosen vulnerabilities with presence in more than 10% websites/web applications. Table: 1. Vulnerability Severity and Impact on CIA SR. No Vulnerability Severity Level Impact on CIA % Website V1 Cross Site Scripting H C, I 33.33% V2 Proxy accepts CONNECT requests H C 26.67% V3 ASP.NET Padding Oracle Vulnerability H C,I 13.33% V4 Microsoft IIS tilde directory enumeration H C 13.33% V5 Application error message M C 24.39% V6 HTML form without CSRF Protection- Cross Site Request forgery M C,I 17.07% V7 User credentials are sent in clear text M C 14.63% V8 ASP.NET error message M C 12.20% V9 Session Cookie without Secure flag set L C 25.00% V10 OPTIONS method is enabled L C 15.63% V11 Broken Links I 20.00% V12 Password type input with autocomplete enabled I C 17.50% V13 Typical login page I C 13.89% V14 Possible internal IP address disclosure I C 12.50% V15 Error page Web Server version disclosure I C 11.11% As shown in Chart1 among High Severity group vulnerabilities V1 appeared in 33.33% websites/web applications while V2 appeared in 26.67% websites followed by vulnerabilities V3 & V4 found in 13.33% sites each. V1-Cross Site Scripting (XSS) is vulnerability which allow an attacker to send harmful code to another user. Since user browser cannot identify trusted or non-trusted scripts, it allows harmful script to run in user context and gain unauthorized access to the session or cookies that browser retains. The possible impact of V1 is stealing the session cookie and take over the account, impersonating the user to gain unauthorized access. V1 will mainly affect Confidentiality and Integrity of the information resource. The possible prevention is careful coding since XSS flaws can be difficult to identify and the best way to find flaws is to perform a security scan of the code and search for all places where input from an HTTP request could 101
4 An E-Governance Web Security Audit probably result in the HTML output. [10] V2- Proxy accepts CONNECT requests vulnerability may allow attacker to bypass firewall and connect arbitrary ports like 23(telnet), 25(send mail) using proxy. Solution to this vulnerability is changing proxy configuration which deny CONNECT request generated by Non Valid users or hosts. It will allow possible information disclosure and affect confidentiality of information resource. [11] V3-ASP.NET Padding Oracle Vulnerability exists with the fact that ASP.net use encryption to hide sensitive data, however vulnerability in ASP.Net encryption implementation allow an attacker to decrypt and tamper with the data or file like view state data or web config file on target serve.v3 exists in all version of asp.net. V3 affects confidentiality and integrity of website due to unauthorized information disclosure and modification of data. As per the Microsoft Security bulletin MS10-070, they have issued patch MS and workaround to prevent from this vulnerability being exploited. [12] V4-Microsoft IIS tilde directory enumeration is vulnerability where it is possible to identify short names of files and directories which have an 8.3 file naming scheme similar to Windows by using some paths in several versions of Microsoft IIS. This vulnerability allow sensitive information disclosure and it affects confidentiality of Information Resource. To avoid this error it is recommended to deploy IIS with 8.3 names disabled. [13] [14] [15] Chart: 1. Vulnerability with Severity Group East West North 0 1st Qtr 2nd Qtr 3rd Qtr 4th Qtr From the Chart1 among the medium severity group vulnerability V5- Application error message score highest with 24.39% followed by V6- Cross Site Request forgery with 17.07% 102
5 and V7- User credentials are sent in clear text with 14.63% and V8- ASP.NET error message with 12.20% website count. Under V5 vulnerability page having error/warning message may disclose sensitive information. This sensitive information can be utilized by attacker to launch further attacks on target website. Since V5 disclose sensitive information it affect confidentiality attribute of CIA triad. The solution to this vulnerability is rewriting code that displays wordy error messages that display sensitive information to the user with new simple error messages and avoid including file location, system information and user account information etc. in error message. [16] [17]. V6 -Cross-Site Request Forgery, also known as a one-click attack or session riding and abbreviated as CSRF or XSRF, is an attack which forces an end user to execute undesirable actions on a web application in which they are currently authenticated. CSRF specifically act on state changing request like transferring funds, changing user address etc. In CSRF attack using social engineering, an attacker may trick the users of a web application into performing actions of the attacker's choosing. Successful CSRF may result in state changing request for normal user or it can compromise entire application if victim is administrative account. [18] CSRF can affect confidentiality and integrity of information resource. The most popular prevention available against CSRF is appending challenge Token with each request. Important point in using token is, it must be associated with the user session otherwise attacker may be able to fetch the valid token and utilize it for attack. Apart from user session association it is essential that token must be valid for limited time period only. [19] V7- User credentials are sent in clear text vulnerability affects confidentiality since User credentials are transmitted over an unencrypted channel. User credentials information should always be transferred via an encrypted channel (HTTPS) to avoid being intercepted by malicious users. Under V8-ASP.net error message vulnerability, attacker can possibly generate an ASP.NET error message by requesting a specially crafted URL. The message contains the complete stack trace and Microsoft.NET Framework Version. The error messages may reveal sensitive information. This information can be used to launch further attacks.v8 vulnerability affects the confidentiality of the information resource. It can be prevented by adjusting web.config to enable custom errors for remote clients. Set customerrors mode to Off or RemoteOnly. We have identified two vulnerabilities under low severity group and five vulnerabilities under informational severity group. This groups are comparatively less harmful than the medium and high severity groups. As per chart1 in low severity group V9- Session Cookie without Secure flag set score highest with 25.00% followed by V10-Option method is enable with 15.63%. V9-Session Cookie without secure flag may affect confidentiality since cookie can be access over non-secure channels. When secure flag is set for cookies, Browser allows cookies to be accessed over secure SSL channels only. It is an important security protection for session cookie. To protect the session cookie we should set the secure flag for cookie. V10- Option method is enable indicates that HTTP OPTIONS method is enabled on web server. Enabling this option on webserver provides a list of the methods that are supported by the web server. The OPTIONS method may expose sensitive information that may help a malicious user to prepare more advanced attacks. As prevention it is recommended to disable OPTIONS Method on the web server. It affects the confidentiality of the information resource. Under informational severity group V11-Broken links refers to any link that should take you to a document, image or webpage, that actually results in an error. The page was linked from the website but it is inaccessible. The only problem with V11 is, it affects navigation in the website. To overcome this either remove the links to this file or make it accessible. In V12- Password type input with autocomplete enabled when a new name and password is entered in a form and the form is submitted, the browser asks if the password should be saved. Thereafter when the form is displayed, the name and password are filled in automatically or are completed as the 103
6 An E-Governance Web Security Audit name is entered. An attacker with local access could obtain the clear text password from the browser cache.v12 affects confidentiality due to possible sensitive information disclosure. To prevent from V12 password autocomplete should be disabled in sensitive applications. V13- Typical login page is vulnerability listed in Google Hacking Database (GHDB) under category Pages contains login portal This login pages are front doors to the websites and it can reveal operating system and software of a target. [20] It affects confidentiality of the information resource.v14-possible internal IP address disclosure is a vulnerability revealing internal network IP address scheme which might be utilize by attacker to launch further attacks. In a way this vulnerability disclose sensitive information and affect confidentiality of the information resource. It can be prevented by not allowing internal IP to be displayed to the user. In vulnerability V15- Error page Web Server version disclosure, by requesting a page that doesn't exist, an error page was returned. This error page contains the web server version number and a list of modules enabled on this server. This information can be used to conduct further attacks. V15 affects confidentiality of the Information resource due to disclosure of sensitive information. It can be prevented by setting up custom error page 404 in website hosted on apache server. [21] [6] CONCLUSION Web security is crucial for E-Governance website/web application projects since Citizen s trust and privacy of data are key factors of E-Governance success. Although it is mandatory for all Government organizations to host their websites/web applications in public domain after proper security audit it is evident from the analysis that high impacting vulnerabilities like Cross Site Scripting and Proxy accepts CONNECT requests etc. appeared in more than 26% websites/web applications. High impacting vulnerabilities like ASP.NET Padding Oracle Vulnerability and Microsoft IIS tilde directory enumeration appeared in more than 13% websites/web applications. Medium impacting vulnerabilities like cross site request forgery, user credential sent in clear text etc. appeared in more than 14% websites/web applications. These vulnerabilities mainly affects confidentiality and integrity of information resource. Regular auditing of websites/web application is required to remove or restrained the constantly emerging threats and keep E-Governance services secure and safe. 104
7 REFERENCES [1] "E-Governance Definition," Wikipedia, [Online]. Available: [2] "Information Security Definition," Wikipedia, [Online]. Available: [Accessed January 2015]. [3] P. Mittal and A. Kaur, "E-Governance - A challenge for India," International Journal of Advanced Research in Computer Engineering & Technology (IJARCET), vol. 2, no. 3, March [4] "Guidelines for Indian Government Websites," Department of Administrative Reforms and Public Grievances, Government of India, [5] "Guidelines for Registration, Hosting and periodic security audit of Government Websites," Science and Technology Department of Government of Gujarat, Gandhinagar, [6] S. Chen, "Security Tools Benchmarking," [Online]. Available: [7] "Web Application Scanner Comparison," Acunetix, [Online]. Available: [8] "Government of Gujarat Official Website," Government of Gujarat, [Online]. Available: [9] "NIC Gujarat," National Informatics Center Gujarat, [Online]. Available: [10] "OWASP-Cross Site Scripting," Open Web Application Security Project, [Online]. Available: [11] "Proxy Accepts Connect Requests," Acunetix, [Online]. Available: [12] "MS Patch," Microsoft Corporation, [Online]. Available: [13] "IIS ShortName Scanner," GitHUB, Inc., [Online]. Available: ShortName-Scanner. [14] "Microsoft IIS tilde vulnerability," Detectify, [Online]. Available: [15] "Microsoft_IIS_Tilde_Character_Vulnerability," [Online]. Available: ature.pdf. [16] "Security Innovation Appsec. Blog," Security Innovation, Inc., [Online]. Available: Disclosure-in-Error-Messages. [17] "Common Weakness Enumeration Community Dictionary," MITRE Corporation, [Online]. Available: 105
Application vulnerabilities and defences
Application vulnerabilities and defences In this lecture We examine the following : SQL injection XSS CSRF SQL injection SQL injection is a basic attack used to either gain unauthorized access to a database
More informationProvide you with a quick introduction to web application security Increase you awareness and knowledge of security in general Show you that any
OWASP Top 10 Provide you with a quick introduction to web application security Increase you awareness and knowledge of security in general Show you that any tester can (and should) do security testing
More informationCHAPTER 8 CONCLUSION AND FUTURE ENHANCEMENTS
180 CHAPTER 8 CONCLUSION AND FUTURE ENHANCEMENTS 8.1 SUMMARY This research has focused on developing a Web Applications Secure System from Code Injection Vulnerabilities through Web Services (WAPS-CIVS),
More informationOWASP Thailand. Proxy Caches and Web Application Security. OWASP AppSec Asia October 21, Using the Recent Google Docs 0-Day as an Example
Proxy Caches and Web Application Security Using the Recent Google Docs 0-Day as an Example Tim Bass, CISSP Chapter Leader, Thailand +66832975101, tim@unix.com AppSec Asia October 21, 2008 Thailand Worldwide
More informationGUI based and very easy to use, no security expertise required. Reporting in both HTML and RTF formats - Click here to view the sample report.
Report on IRONWASP Software Product: IronWASP Description of the Product: IronWASP (Iron Web application Advanced Security testing Platform) is an open source system for web application vulnerability testing.
More informationEasyCrypt passes an independent security audit
July 24, 2017 EasyCrypt passes an independent security audit EasyCrypt, a Swiss-based email encryption and privacy service, announced that it has passed an independent security audit. The audit was sponsored
More informationComputer Forensics: Investigating Network Intrusions and Cyber Crime, 2nd Edition. Chapter 3 Investigating Web Attacks
Computer Forensics: Investigating Network Intrusions and Cyber Crime, 2nd Edition Chapter 3 Investigating Web Attacks Objectives After completing this chapter, you should be able to: Recognize the indications
More informationCopyright
1 Security Test EXTRA Workshop : ANSWER THESE QUESTIONS 1. What do you consider to be the biggest security issues with mobile phones? 2. How seriously are consumers and companies taking these threats?
More informationAcunetix Website Audit. 31 October, Developer Report. Generated by Acunetix WVS Reporter (v9.0 Build )
3 October, 204 Developer Report Generated by Acunetix WVS Reporter (v9.0 Build 2040422) Scan of http://testasp.vulnweb.com:80/ Scan details Scan information Start time 3/0/204 2:55:02 Finish time 3/0/204
More informationAndrew Muller, Canberra Managing Director, Ionize, Canberra The challenges of Security Testing. Security Testing. Taming the Wild West
Andrew Muller, Canberra Managing Director, Ionize, Canberra The challenges of Security Testing Advancing Expertise in Security Testing Taming the Wild West Canberra, Australia 1 Who is this guy? Andrew
More informationRobust Defenses for Cross-Site Request Forgery Review
Robust Defenses for Cross-Site Request Forgery Review Network Security Instructor:Dr. Shishir Nagaraja Submitted By: Jyoti Leeka October 16, 2011 1 Introduction to the topic and the reason for the topic
More informationSecuring Your Web Application against security vulnerabilities. Alvin Wong, Brand Manager IBM Rational Software
Securing Your Web Application against security vulnerabilities Alvin Wong, Brand Manager IBM Rational Software Agenda Security Landscape Vulnerability Analysis Automated Vulnerability Analysis IBM Rational
More informationSecurity Penetration Test of HIE Portal for A CUSTOMER IMPLEMENTION. Services provided to: [LOGO(s) of company providing service to]
Security Penetration Test of HIE Portal for A CUSTOMER IMPLEMENTION Services provided to: [LOGO(s) of company providing service to] Version V1.0 V1 February 13 th, 2014 Prepared By: Denis Calderone TBG
More informationWeb Application Security. Philippe Bogaerts
Web Application Security Philippe Bogaerts OWASP TOP 10 3 Aim of the OWASP Top 10 educate developers, designers, architects and organizations about the consequences of the most common web application security
More informationWeb Application Whitepaper
Page 1 of 16 Web Application Whitepaper Prepared by Simone Quatrini and Isa Shorehdeli Security Advisory EMEAR 6 th September, 2017 1.0 General Release Page 2 of 16 1. Introduction In this digital age,
More informationSolutions Business Manager Web Application Security Assessment
White Paper Solutions Business Manager Solutions Business Manager 11.3.1 Web Application Security Assessment Table of Contents Micro Focus Takes Security Seriously... 1 Solutions Business Manager Security
More informationTHREAT MODELING IN SOCIAL NETWORKS. Molulaqhooa Maoyi Rotondwa Ratshidaho Sanele Macanda
THREAT MODELING IN SOCIAL NETWORKS Molulaqhooa Maoyi Rotondwa Ratshidaho Sanele Macanda INTRODUCTION Social Networks popular web service. 62% adults worldwide use social media 65% of world top companies
More informationAttacks Against Websites. Tom Chothia Computer Security, Lecture 11
Attacks Against Websites Tom Chothia Computer Security, Lecture 11 A typical web set up TLS Server HTTP GET cookie Client HTML HTTP file HTML PHP process Display PHP SQL Typical Web Setup HTTP website:
More informationEthical Hacking and Countermeasures: Web Applications, Second Edition. Chapter 3 Web Application Vulnerabilities
Ethical Hacking and Countermeasures: Web Chapter 3 Web Application Vulnerabilities Objectives After completing this chapter, you should be able to: Understand the architecture of Web applications Understand
More informationDell SonicWALL Secure Mobile Access 8.5. Web Application Firewall Feature Guide
Dell SonicWALL Secure Mobile Access 8.5 Copyright 2016 Dell Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. Dell, the Dell logo,
More informationW e b A p p l i c a t i o n S e c u r i t y : T h e D e v i l i s i n t h e D e t a i l s
W e b A p p l i c a t i o n S e c u r i t y : T h e D e v i l i s i n t h e D e t a i l s Session I of III JD Nir, Security Analyst Why is this important? ISE Proprietary Agenda About ISE Web Applications
More information1 About Web Security. What is application security? So what can happen? see [?]
1 About Web Security What is application security? see [?] So what can happen? 1 taken from [?] first half of 2013 Let s focus on application security risks Risk = vulnerability + impact New App: http://www-03.ibm.com/security/xforce/xfisi
More informationThe Top 6 WAF Essentials to Achieve Application Security Efficacy
The Top 6 WAF Essentials to Achieve Application Security Efficacy Introduction One of the biggest challenges IT and security leaders face today is reducing business risk while ensuring ease of use and
More informationKenna Platform Security. A technical overview of the comprehensive security measures Kenna uses to protect your data
Kenna Platform Security A technical overview of the comprehensive security measures Kenna uses to protect your data V3.0, MAY 2017 Multiple Layers of Protection Overview Password Salted-Hash Thank you
More informationAguascalientes Local Chapter. Kickoff
Aguascalientes Local Chapter Kickoff juan.gama@owasp.org About Us Chapter Leader Juan Gama Application Security Engineer @ Aspect Security 9+ years in Appsec, Testing, Development Maintainer of OWASP Benchmark
More informationAttacks Against Websites 3 The OWASP Top 10. Tom Chothia Computer Security, Lecture 14
Attacks Against Websites 3 The OWASP Top 10 Tom Chothia Computer Security, Lecture 14 OWASP top 10. The Open Web Application Security Project Open public effort to improve web security: Many useful documents.
More informationAn analysis of security in a web application development process
An analysis of security in a web application development process Florent Gontharet Ethical Hacking University of Abertay Dundee MSc Ethical Hacking 2015 Table of Contents Abstract...2 Introduction...3
More informationCurso: Ethical Hacking and Countermeasures
Curso: Ethical Hacking and Countermeasures Module 1: Introduction to Ethical Hacking Who is a Hacker? Essential Terminologies Effects of Hacking Effects of Hacking on Business Elements of Information Security
More informationP2_L12 Web Security Page 1
P2_L12 Web Security Page 1 Reference: Computer Security by Stallings and Brown, Chapter (not specified) The web is an extension of our computing environment, because most of our daily tasks involve interaction
More informationOWASP Top 10 The Ten Most Critical Web Application Security Risks
OWASP Top 10 The Ten Most Critical Web Application Security Risks The Open Web Application Security Project (OWASP) is an open community dedicated to enabling organizations to develop, purchase, and maintain
More informationOWASP Top 10 Risks. Many thanks to Dave Wichers & OWASP
OWASP Top 10 Risks Dean.Bushmiller@ExpandingSecurity.com Many thanks to Dave Wichers & OWASP My Mom I got on the email and did a google on my boy My boy works in this Internet thing He makes cyber cafes
More informationRiskSense Attack Surface Validation for Web Applications
RiskSense Attack Surface Validation for Web Applications 2018 RiskSense, Inc. Keeping Pace with Digital Business No Excuses for Not Finding Risk Exposure We needed a faster way of getting a risk assessment
More informationINNOV-09 How to Keep Hackers Out of your Web Application
INNOV-09 How to Keep Hackers Out of your Web Application Michael Solomon, CISSP PMP CISM Solomon Consulting Inc. www.solomonconsulting.com What is a Web Application? Any access to your data via the Internet
More informationDetecting XSS Based Web Application Vulnerabilities
Detecting XSS Based Web Application Vulnerabilities M.S.Jasmine M.Tech (ISCF).Student, Department of Information Technology SRM University, TamilNadu,India jasmine.srakj@gmail.com Kirthiga Devi Assistant
More informationHacker Academy Ltd COURSES CATALOGUE. Hacker Academy Ltd. LONDON UK
Hacker Academy Ltd COURSES CATALOGUE Hacker Academy Ltd. LONDON UK TABLE OF CONTENTS Basic Level Courses... 3 1. Information Security Awareness for End Users... 3 2. Information Security Awareness for
More informationSecurity and Privacy. SWE 432, Fall 2016 Design and Implementation of Software for the Web
Security and Privacy SWE 432, Fall 2016 Design and Implementation of Software for the Web Today Security What is it? Most important types of attacks Privacy For further reading: https://www.owasp.org/index.php/
More informationCOMP9321 Web Application Engineering
COMP9321 Web Application Engineering Semester 2, 2017 Dr. Amin Beheshti Service Oriented Computing Group, CSE, UNSW Australia Week 9 http://webapps.cse.unsw.edu.au/webcms2/course/index.php?cid=2465 1 Assignment
More informationWeb Security. Thierry Sans
Web Security Thierry Sans 1991 Sir Tim Berners-Lee Web Portals 2014 Customer Resources Managemen Accounting and Billing E-Health E-Learning Collaboration Content Management Social Networks Publishing Web
More informationCOMP9321 Web Application Engineering
COMP9321 Web Application Engineering Semester 2, 2016 Dr. Amin Beheshti Service Oriented Computing Group, CSE, UNSW Australia Week 9 http://webapps.cse.unsw.edu.au/webcms2/course/index.php?cid=2445 1 Assignment
More informationAdvanced Web Technology 10) XSS, CSRF and SQL Injection
Berner Fachhochschule, Technik und Informatik Advanced Web Technology 10) XSS, CSRF and SQL Injection Dr. E. Benoist Fall Semester 2010/2011 1 Table of Contents Cross Site Request Forgery - CSRF Presentation
More informationTest Harness for Web Application Attacks
IJSRD National Conference on Advances in Computer Science Engineering & Technology May 2017 ISSN: 2321-0613 Test Harness for Web Application Attacks Kishan Chudasama 1 Mr. Girish Khilari 2 Mr. Suresh Sikka
More informationSECURITY TESTING. Towards a safer web world
SECURITY TESTING Towards a safer web world AGENDA 1. 3 W S OF SECURITY TESTING 2. SECURITY TESTING CONCEPTS 3. SECURITY TESTING TYPES 4. TOP 10 SECURITY RISKS ate: 2013-14 Few Security Breaches September
More informationCIS 4360 Secure Computer Systems XSS
CIS 4360 Secure Computer Systems XSS Professor Qiang Zeng Spring 2017 Some slides are adapted from the web pages by Kallin and Valbuena Previous Class Two important criteria to evaluate an Intrusion Detection
More informationWhy bother? Causes of data breaches OWASP. Top ten attacks. Now what? Do it yourself Questions?
Jeroen van Beek 1 Why bother? Causes of data breaches OWASP Top ten attacks Now what? Do it yourself Questions? 2 In many cases the web application stores: Credit card details Personal information Passwords
More informationWeb Application & Web Server Vulnerabilities Assessment Pankaj Sharma
Web Application & Web Server Vulnerabilities Assessment Pankaj Sharma Indian Computer Emergency Response Team ( CERT - IN ) Department Of Information Technology 1 Agenda Introduction What are Web Applications?
More informationWeb insecurity Security strategies General security Listing of server-side risks Language specific security. Web Security.
Web Security Web Programming Uta Priss ZELL, Ostfalia University 2013 Web Programming Web Security Slide 1/25 Outline Web insecurity Security strategies General security Listing of server-side risks Language
More informationCSWAE Certified Secure Web Application Engineer
CSWAE Certified Secure Web Application Engineer Overview Organizations and governments fall victim to internet based attacks every day. In many cases, web attacks could be thwarted but hackers, organized
More informationCompTIA Security+ Malware. Threats and Vulnerabilities Vulnerability Management
CompTIA Security+ Lecture Six Threats and Vulnerabilities Vulnerability Management Copyright 2011 - VTC Malware Malicious code refers to software threats to network and systems, including viruses, Trojan
More informationPenetration Testing following OWASP. Boyan Yanchev Chief Technology Ofcer Peter Dimkov IS Consultant
Penetration Testing following OWASP Boyan Yanchev Chief Technology Ofcer Peter Dimkov IS Consultant За Лирекс Penetration testing A method of compromising the security of a computer system or network by
More informationCSCD 303 Essential Computer Security Fall 2018
CSCD 303 Essential Computer Security Fall 2018 Lecture 17 XSS, SQL Injection and CRSF Reading: See links - End of Slides Overview Idea of XSS, CSRF and SQL injection is to violate security of Web Browser/Server
More informationOWASP March 19, The OWASP Foundation Secure By Design
Secure By Design March 19, 2014 Rohini Sulatycki Senior Security Consultant Trustwave rsulatycki@trustwave.com Copyright The Foundation Permission is granted to copy, distribute and/or modify this document
More informationCSCD 303 Essential Computer Security Fall 2017
CSCD 303 Essential Computer Security Fall 2017 Lecture 18a XSS, SQL Injection and CRSF Reading: See links - End of Slides Overview Idea of XSS, CSRF and SQL injection is to violate the security of the
More informationFinding Vulnerabilities in Web Applications
Finding Vulnerabilities in Web Applications Christopher Kruegel, Technical University Vienna Evolving Networks, Evolving Threats The past few years have witnessed a significant increase in the number of
More informationInformation Security CS 526 Topic 11
Information Security CS 526 Topic 11 Web Security Part 1 1 Readings for This Lecture Wikipedia HTTP Cookie Same Origin Policy Cross Site Scripting Cross Site Request Forgery 2 Background Many sensitive
More informationCPET 499/ITC 250 Web Systems Chapter 16 Security. Topics
CPET 499/ITC 250 Web Systems Chapter 16 Security Text Book: * Fundamentals of Web Development, 2015, by Randy Connolly and Ricardo Hoar, published by Pearson Paul I-Hai, Professor http://www.etcs.ipfw.edu/~lin
More informationTIBCO Cloud Integration Security Overview
TIBCO Cloud Integration Security Overview TIBCO Cloud Integration is secure, best-in-class Integration Platform as a Service (ipaas) software offered in a multi-tenant SaaS environment with centralized
More informationSecurity Testing White Paper
Security Testing White Paper Table of Contents 1. Introduction... 3 2. Need for Security Testing... 4 3. Security Testing Framework... 5 3.1 THREAT ANALYSIS... 6 3.1.1 Application Overview... 8 3.1.2 System
More informationInformation Security CS 526 Topic 8
Information Security CS 526 Topic 8 Web Security Part 1 1 Readings for This Lecture Wikipedia HTTP Cookie Same Origin Policy Cross Site Scripting Cross Site Request Forgery 2 Background Many sensitive
More informationCIS 700/002 : Special Topics : OWASP ZED (ZAP)
CIS 700/002 : Special Topics : OWASP ZED (ZAP) Hitali Sheth CIS 700/002: Security of EMBS/CPS/IoT Department of Computer and Information Science School of Engineering and Applied Science University of
More informationSOLUTION BRIEF. Enabling and Securing Digital Business in API Economy. Protect APIs Serving Business Critical Applications
Enabling and Securing Digital Business in Economy Protect s Serving Business Critical Applications 40 percent of the world s web applications will use an interface Most enterprises today rely on customers
More informationCOMP9321 Web Application Engineering
COMP9321 Web Application Engineering Web Application Security Dr. Basem Suleiman Service Oriented Computing Group, CSE, UNSW Australia Semester 1, 2016, Week 8 http://webapps.cse.unsw.edu.au/webcms2/course/index.php?cid=2442
More informationApplication Security Introduction. Tara Gu IBM Product Security Incident Response Team
Application Security Introduction Tara Gu IBM Product Security Incident Response Team About Me - Tara Gu - tara.weiqing@gmail.com - Duke B.S.E Biomedical Engineering - Duke M.Eng Computer Engineering -
More informationApplication Security Approach
Technical Approach Page 1 CONTENTS Section Page No. 1. Introduction 3 2. What is Application Security 7 3. Typical Approaches 9 4. Methodology 11 Page 2 1. INTRODUCTION Page 3 It is a Unsafe Cyber world..
More informationRKN 2015 Application Layer Short Summary
RKN 2015 Application Layer Short Summary HTTP standard version now: 1.1 (former 1.0 HTTP /2.0 in draft form, already used HTTP Requests Headers and body counterpart: answer Safe methods (requests): GET,
More informationApplication Security through a Hacker s Eyes James Walden Northern Kentucky University
Application Security through a Hacker s Eyes James Walden Northern Kentucky University waldenj@nku.edu Why Do Hackers Target Web Apps? Attack Surface A system s attack surface consists of all of the ways
More informationVULNERABILITIES IN 2017 CODE ANALYSIS WEB APPLICATION AUTOMATED
AUTOMATED CODE ANALYSIS WEB APPLICATION VULNERABILITIES IN 2017 CONTENTS Introduction...3 Testing methods and classification...3 1. Executive summary...4 2. How PT AI works...4 2.1. Verifying vulnerabilities...5
More informationIs Browsing Safe? Web Browser Security. Subverting the Browser. Browser Security Model. XSS / Script Injection. 1. XSS / Script Injection
Is Browsing Safe? Web Browser Security Charlie Reis Guest Lecture - CSE 490K - 5/24/2007 Send Spam Search Results Change Address? Install Malware Web Mail Movie Rentals 2 Browser Security Model Pages are
More informationTesting and Comparing Result Scanning Using Web Vulnerability Scanner
Copyright 2015 American Scientific Publishers Advanced Science Letters All rights reserved Vol.,1936-6612, 2015 Printed in the United States of America Testing and Comparing Result Scanning Using Web Vulnerability
More informationSecurity Testing. - a requirement for a secure business. ISACA DAY in SOFIA. Gabriel Mihai Tanase, Director, Cyber Services KPMG in CEE
Gabriel Mihai Tanase, Director, Cyber Services KPMG in CEE Cyber Security Services Security Testing - a requirement for a secure business ISACA DAY in SOFIA Agenda No Agenda Some minimum theory More real
More informationOWASP Top 10. Copyright 2017 Ergon Informatik AG 2/13
Airlock and the OWASP TOP 10-2017 Version 2.1 11.24.2017 OWASP Top 10 A1 Injection... 3 A2 Broken Authentication... 5 A3 Sensitive Data Exposure... 6 A4 XML External Entities (XXE)... 7 A5 Broken Access
More informationWeb Security 2 https://www.xkcd.com/177/ http://xkcd.com/1323/ Encryption basics Plaintext message key secret Encryp)on Func)on Ciphertext Insecure network Decryp)on Func)on Curses! Foiled again! key Plaintext
More informationWeb Applications Penetration Testing
Web Applications Penetration Testing Team Members: Rahul Motwani (2016ME10675) Akshat Khare (2016CS10315) ftarth Chopra (2016TT10829) Supervisor: Prof. Ranjan Bose Before proceeding further, we would like
More informationHP 2012 Cyber Security Risk Report Overview
HP 2012 Cyber Security Risk Report Overview September 2013 Paras Shah Software Security Assurance - Canada Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject
More information01/02/2014 SECURITY ASSESSMENT METHODOLOGIES SENSEPOST 2014 ALL RIGHTS RESERVED
01/02/2014 SECURITY ASSESSMENT METHODOLOGIES SENSEPOST 2014 ALL RIGHTS RESERVED Contents 1. Introduction 3 2. Security Testing Methodologies 3 2.1 Internet Footprint Assessment 4 2.2 Infrastructure Assessments
More informationCOPYRIGHTED MATERIAL. Contents. Part I: The Basics in Depth 1. Chapter 1: Windows Attacks 3. Chapter 2: Conventional and Unconventional Defenses 51
Acknowledgments Introduction Part I: The Basics in Depth 1 Chapter 1: Windows Attacks 3 Attack Classes 3 Automated versus Dedicated Attacker 4 Remote versus Local 7 Types of Attacks 8 Dedicated Manual
More informationHacker Attacks on the Horizon: Web 2.0 Attack Vectors
IBM Software Group Hacker Attacks on the Horizon: Web 2.0 Attack Vectors Danny Allan Director, Security Research dallan@us.ibm.com 2/21/2008 Agenda HISTORY Web Eras & Trends SECURITY Web 2.0 Attack Vectors
More informationC1: Define Security Requirements
OWASP Top 10 Proactive Controls IEEE Top 10 Software Security Design Flaws OWASP Top 10 Vulnerabilities Mitigated OWASP Mobile Top 10 Vulnerabilities Mitigated C1: Define Security Requirements A security
More informationMobile Payment Application Security. Security steps to take while developing Mobile Application s. SISA Webinar.
Mobile Payment Application Security Security steps to take while developing Mobile Application s About SISA Payment Security Specialists PCI Certification Body (PCI Qualified Security Assessor) Payment
More informationINF3700 Informasjonsteknologi og samfunn. Application Security. Audun Jøsang University of Oslo Spring 2015
INF3700 Informasjonsteknologi og samfunn Application Security Audun Jøsang University of Oslo Spring 2015 Outline Application Security Malicious Software Attacks on applications 2 Malicious Software 3
More informationSecurity Solutions. Overview. Business Needs
Security Solutions Overview Information security is not a one time event. The dynamic nature of computer networks mandates that examining and ensuring information security be a constant and vigilant effort.
More informationSecurity Course. WebGoat Lab sessions
Security Course WebGoat Lab sessions WebGoat Lab sessions overview Initial Setup Tamper Data Web Goat Lab Session 4 Access Control, session information stealing Lab Session 2 HTTP Basics Sniffing Parameter
More informationRBS NetGain Enterprise Manager Multiple Vulnerabilities of 11
RBS-2018-004 NetGain Enterprise Manager Multiple Vulnerabilities 2018-03-22 1 of 11 Table of Contents Vendor / Product Information 3 Vulnerable Program Details 3 Credits 3 Impact 3 Vulnerability Details
More informationYour Turn to Hack the OWASP Top 10!
OWASP Top 10 Web Application Security Risks Your Turn to Hack OWASP Top 10 using Mutillidae Born to Be Hacked Metasploit in VMWare Page 1 https://www.owasp.org/index.php/main_page The Open Web Application
More informationLecture Overview. IN5290 Ethical Hacking
Lecture Overview IN5290 Ethical Hacking Lecture 6: Web hacking 2, Cross Site Scripting (XSS), Cross Site Request Forgery (CSRF), Session related attacks Universitetet i Oslo Laszlo Erdödi How to use Burp
More informationLecture 6: Web hacking 2, Cross Site Scripting (XSS), Cross Site Request Forgery (CSRF), Session related attacks
IN5290 Ethical Hacking Lecture 6: Web hacking 2, Cross Site Scripting (XSS), Cross Site Request Forgery (CSRF), Session related attacks Universitetet i Oslo Laszlo Erdödi Lecture Overview How to use Burp
More informationAuthentication and Password CS166 Introduction to Computer Security 2/11/18 CS166 1
Authentication and Password CS166 Introduction to Computer Security 2/11/18 CS166 1 CIA Triad Confidentiality Prevent disclosure of information to unauthorized parties Integrity Detect data tampering Availability
More informationApplication Layer Attacks. Application Layer Attacks. Application Layer. Application Layer. Internet Protocols. Application Layer.
Application Layer Attacks Application Layer Attacks Week 2 Part 2 Attacks Against Programs Application Layer Application Layer Attacks come in many forms and can target each of the 5 network protocol layers
More informationKishin Fatnani. Founder & Director K-Secure. Workshop : Application Security: Latest Trends by Cert-In, 30 th Jan, 2009
Securing Web Applications: Defense Mechanisms Kishin Fatnani Founder & Director K-Secure Workshop : Application Security: Latest Trends by Cert-In, 30 th Jan, 2009 1 Agenda Current scenario in Web Application
More informationDomino Web Server Security
Domino Web Server Security What you don t know can cost you Andrew Pollack, President Northern Collaborative Technologies andrewp@thenorth.com http://www.thenorth.com Special thanks to Howard Greenberg
More informationOpenID Security Analysis and Evaluation
University of British Columbia OpenID Security Analysis and Evaluation San-Tsai Sun, Kirstie Hawkey, Konstantin Beznosov Laboratory for Education and Research in Secure Systems Engineering (LERSSE) University
More informationAuthentication Security
Authentication Security Hui Zhu Copyright 2005 www.ebizsec.com Agenda Authentication Components Authentication Hacking Consideration for Authentication Security Principle for Authentication Security Case
More informationSECURITY & PRIVACY DOCUMENTATION
Okta s Commitment to Security & Privacy SECURITY & PRIVACY DOCUMENTATION (last updated September 15, 2017) Okta is committed to achieving and preserving the trust of our customers, by providing a comprehensive
More informationWeb Application Penetration Testing
Web Application Penetration Testing COURSE BROCHURE & SYLLABUS Course Overview Web Application penetration Testing (WAPT) is the Security testing techniques for vulnerabilities or security holes in corporate
More informationEFFECTIVE VULNERABILITY MANAGEMENT USING QUALYSGUARD 1
EFFECTIVE VULNERABILITY MANAGEMENT USING QUALYSGUARD 1 EFFECTIVE VULNERABILITY MANAGEMENT USING QUALYSGUARD ICTN 6823 BOYD AARON SIGMON EAST CAROLINA UNIVERSITY EFFECTIVE VULNERABILITY MANAGEMENT USING
More informationAcunetix Website Audit. 31 October, Developer Report. Generated by Acunetix WVS Reporter (v9.0 Build )
3 October, 204 Developer Report Generated by Acunetix WVS Reporter (v9.0 Build 2040422) Scan of http://testaspnet.vulnweb.com:80/ Scan details Scan information Start time 3/0/204 3:23:47 Finish time 3/0/204
More informatione-commerce Study Guide Test 2. Security Chapter 10
e-commerce Study Guide Test 2. Security Chapter 10 True/False Indicate whether the sentence or statement is true or false. 1. Necessity refers to preventing data delays or denials (removal) within the
More informationAUTHENTICATION. Do You Know Who You're Dealing With? How Authentication Affects Prevention, Detection, and Response
AUTHENTICATION Do You Know Who You're Dealing With? How Authentication Affects Prevention, Detection, and Response Who we are Eric Scales Mandiant Director IR, Red Team, Strategic Services Scott Koller
More informationCombating Common Web App Authentication Threats
Security PS Combating Common Web App Authentication Threats Bruce K. Marshall, CISSP, NSA-IAM Senior Security Consultant bmarshall@securityps.com Key Topics Key Presentation Topics Understanding Web App
More informationepldt Web Builder Security March 2017
epldt Web Builder Security March 2017 TABLE OF CONTENTS Overview... 4 Application Security... 5 Security Elements... 5 User & Role Management... 5 User / Reseller Hierarchy Management... 5 User Authentication
More informationOPEN WEB APPLICATION SECURITY PROJECT OWASP TOP 10 VULNERABILITIES
OPEN WEB APPLICATION SECURITY PROJECT OWASP TOP 10 VULNERABILITIES What is the OWASP Top 10? A list of the top ten web application vulnerabilities Determined by OWASP and the security community at large
More information