GET /index.php HTTP/1.1 Host: User- agent: Mozilla/4.0
|
|
|
- Francine Clarke
- 5 years ago
- Views:
Transcription
1 State management GET /index.php HTTP/1.1 Host: User- agent: Mozilla/4.0 HTTP/ OK Date: Thu, 17 Nov :54:10 GMT Server: Apache/ (Debian) Content- Length: 285 Set- Cookie: sessionid=528fa623; path=/; Expires=Wed, 09 Mar :00:00 GMT <html><body> <a href="mission.php">mission statement</a> <a href="press.php">press releases</a> GET /mission.php HTTP/1.1 Host: User- agent: Mozilla/4.0 Cookie: sessionid=528fa623 CSCI 470: Web Science Keith Vertanen Copyright 2013
2 Overview The state management problem For now, assume a single web server Possible solu8ons IP address Query string Hidden form fields Cookies State management in PHP 2
3 The state management problem HTTP protocol Designed as a stateless, request/response protocol No provisions for sessions spanning mul8ple request/response cycles GET /products.html HTTP/ 1.1 Host: User- agent: Mozilla/4.0 HTTP/ OK Date: Thu, 17 Nov :54:10 GMT Server: Apache/ (Debian) Last- Modified: Wed, 14 Sep :04:27 GMT Content- Length: 285 GET /checkout.html HTTP/1.1 Host: User- agent: Mozilla/4.0 <html> 3
4 The goal of session- ness We want web apps to behave like desktop apps Series of query/responses made to appear as an one ongoing user experience e.g. We don't want to re- login on every page Problem 1: How to uniquely ID a session? What exactly do we mean by "session"? Person Person + computer Person + computer + browser Person + computer + browser + browser tab Problem 2: Where to store the session data? On the client, on the server, on the page? 4
5 Op8on 1: IP address Iden8fying a session Web server could use the IP address of the requestor Not very reliable, broken by: NAT - Different users on same net look like same user Anonymity services such as Tor 5
6 Iden8fying a session Op8on 2: Put something in the URLs First hit to server, just plain URL Server adds to every returned link e.g. h\p://myserver.com/index.php?id=528fa623 GET /index.html HTTP/1.1 Host: User- agent: Mozilla/4.0 HTTP/ OK Date: Thu, 17 Nov :54:10 GMT Server: Apache/ (Debian) Content- Length: 285 <html><body> <h1><blink>welcome to Montana Tech.</blink></h1> <a href="mission.php?id=528fa623">mission statement</ a> <a href="press.php?id=528fa623">press releases</a> <a href="alumninews.php?id=528fa623">alumni news</a> 6
7 Iden8fying a session Op8on 2: Put something in the URLs First hit to server, just plain URL Server adds to every returned link e.g. h\p://myserver.com/index.php?id=528fa623 Advantages: Will work, can't be disabled Could support independent sessions in same browser Disadvantages: User can easily see/change/delete the ID Bookmark and use much later, no built- in expira8on Only lives as long as the browser window Leaks ID to log files on web server, firewalls, other web sites via HTTP REFERER field, to friends via ing link 7
8 Iden8fying a session Op8on 3: Use hidden form fields First hit to server, add ID to hidden field in returned form User submits form, hidden ID passed to server GET /index.html HTTP/1.1 Host: User- agent: Mozilla/4.0 HTTP/ OK Date: Thu, 17 Nov :54:10 GMT Server: Apache/ (Debian) Content- Length: 285 <html><body> <form action="submit.php" method="post"> <input type="text" name="username" value="" /> <input type="hidden" value="528fa623" /> </form> 8
9 Iden8fying a session Op8on 3: Use hidden form fields First hit to server, add ID to hidden field in returned form User submits form, hidden ID passed to server Advantages: Will work, can't be disabled Using POST Not as obvious as embedding in URL string Doesn't appear in bookmarks, log files, etc. Could support independent sessions in same browser Disadvantages: More complicated web pages Everything becomes a form submission 9
10 Cookies Op8on 4: Browser Cookies Introduced in Netscape, 1994 e- commerce app, needed to implement a shopping cart Name/value pairs originally sent from server Stored in browser (if cookies enabled) User can delete Expire ager session or ager elapsed 8me Browser makes HTTP request to par8cular site Sends any cookies marked for that domain Server can use cookie to ID session They cannot carry malware They can have privacy implica8ons 10
11 Anatomy of a cookie GET /index.php HTTP/1.1 Host: User- agent: Mozilla/4.0 HTTP/ OK Date: Thu, 17 Nov :54:10 GMT Server: Apache/ (Debian) Content- Length: 285 Set- Cookie: sessionid=528fa623; path=/; Expires=Wed, 09 Mar :00:00 GMT <html><body> <a href="mission.php">mission statement</a> <a href="press.php">press releases</a> GET /mission.php HTTP/1.1 Host: User- agent: Mozilla/4.0 Cookie: sessionid=528fa623 11
12 Domain Cookie a\ributes Defaults to domain of page that set cookie Browser only sends cookie back to this domain All hosts at a domain, leave off first part:.mtech.edu Cannot be different from page sent from HTTP/ OK Date: Thu, 17 Nov :54:10 GMT Server: Apache/ (Debian) Content- Length: 285 Set- Cookie: sessionid=528fa623; path=/; Expires=Wed, 09 Mar :00:00 GMT <html><body> 12
13 Path Cookie a\ributes Defaults to path of page that set cookie Browser only sends cookie back to pages below the path If path is "/products/" only sent to pages in products directory of web site HTTP/ OK Date: Thu, 17 Nov :54:10 GMT Server: Apache/ (Debian) Content- Length: 285 Set- Cookie: sessionid=528fa623; path=/; Expires=Wed, 09 Mar :00:00 GMT <html><body> 13
14 Expires Cookie a\ributes If not set, delete when browser closes Specifies date and 8me of expira8on Max- Age DOW, DD, MON, YYYY HH:MM:SS GMT Alternate to Expires, seconds in future HTTP/ OK Date: Thu, 17 Nov :54:10 GMT Server: Apache/ (Debian) Content- Length: 285 Set- Cookie: sessionid=528fa623; path=/; Expires=Wed, 09 Mar :00:00 GMT <html><body> 14
15 Secure Cookie a\ributes If present, browser only sends if on secure page Server probably should only set on secure page! H\pOnly Use cookies via HTTP protocol only e.g. Can't access via JavaScript Avoid a cross- site scrip8ng a\ack stealing cookies HTTP/ OK Date: Thu, 17 Nov :54:10 GMT Server: Apache/ (Debian) Content- Length: 285 Set- Cookie: sessionid=528fa623; path=/; Expires=Wed, 09 Mar :00:00 GMT; Secure; HttpOnly <html><body> 15
16 Third party cookies Cookies are sent only to server semng them Except a site can link external images e.g. banner ads Most browsers default to allowing 3 rd - party cookies 16
17 Storing session data Now that we have a session ID, where to store other session data? On the client: In the URL string In hidden form fields In browser cookies On the server, using session ID as key: In shared memory In a disk file In a database 17
18 Cookie- only state Complete state in client- side cookies No server- side state, great for scalability! Limits to the amount of data (browser dependent) Only one session per browser Only works if cookies enabled Users can delete or muck with cookies HTTP/ OK Date: Thu, 17 Nov :54:10 GMT Server: Apache/ (Debian) Content- Length: 285 Set- Cookie: products=343984,545454,98983;username=bob; path=/; Expires=Wed, 09 Mar :00:00 GMT <html><body> 18
19 PHP session support PHP sessions Provides a unique session ID Done via cookies and/or URL fallback Stores name/value pairs according to session ID Defaults to using a temp file in /tmp Works for a single server Mul8ple servers requires a shared store: Database (e.g. MySQL) Shared memory cache (e.g. memcached) Shared file system 19
20 Star8ng a PHP session Using PHP sessions Assume for now cookies are enabled Every PHP script runs session_start() func8on You must do this before any other output on the page! Sets a unique ID the first 8me Returns the same ID every other 8me ID is available using session_id() func8on <??> session_start(); echo "<p>your session ID is ". session_id(). "</p>"; 20
21 Using PHP sessions Storing sessions variables Make sure session is started at top of page Use $_SESSION superglobal to get/set values <??> session_start(); $_SESSION["product1"] = "Snickers"; $_SESSION["price1] = "1.25"; echo "Product added."; First page that sets two session variables. <??> session_start(); echo "Product: ". $_SESSION["product1"]. "<br />"; echo "Price: ". $_SESSION["price1]. "<br />"; Second page that shows what is currently stored in the session variables. 21
22 Using PHP sessions What if cookies not enabled? If cookie value not available, constant SID set Append SID to GET parameters of every link on page session_start() loads from GET instead of cookie Session variables work as normal BUT: Turned off in PHP by default to guard against exploits <a href="order.php?<? echo SID;?>">Order form</a> <a href="order.php?phpsessid=738feaw23872">order form</a> 22
23 Summary Forcing state onto stateless HTTP protocol Find a way to unique track session Using URLs Using hidden form fields Using cookies Store state somewhere Client- side Server- side 23
WEB APPLICATION ENGINEERING II
WEB APPLICATION ENGINEERING II Lecture #5 Umar Ibrahim Enesi Objectives Gain understanding of how Cookies and Sessions Work Understand the limitations of Sessions and Cookies Understand how to handle Session
Lecture 9a: Sessions and Cookies
CS 655 / 441 Fall 2007 Lecture 9a: Sessions and Cookies 1 Review: Structure of a Web Application On every interchange between client and server, server must: Parse request. Look up session state and global
Chapter 9. Managing State Information. Understanding State Information (continued) Understanding State Information 10/29/2011.
Chapter 9 Managing State Information PHP Programming with MySQL 2 nd Edition Objectives In this chapter, you will: Learn about state information Use hidden form fields to save state information Use query
Server-Side Web Programming: Python (Part 1) Copyright 2017 by Robert M. Dondero, Ph.D. Princeton University
Server-Side Web Programming: Python (Part 1) Copyright 2017 by Robert M. Dondero, Ph.D. Princeton University 1 Objectives You will learn about Server-side web programming in Python Common Gateway Interface
INTERNET ENGINEERING. HTTP Protocol. Sadegh Aliakbary
INTERNET ENGINEERING HTTP Protocol Sadegh Aliakbary Agenda HTTP Protocol HTTP Methods HTTP Request and Response State in HTTP Internet Engineering 2 HTTP HTTP Hyper-Text Transfer Protocol (HTTP) The fundamental
Multimedia im Netz Online Multimedia Winter semester 2015/16. Tutorial 03 Minor Subject
Multimedia im Netz Online Multimedia Winter semester 2015/16 Tutorial 03 Minor Subject Ludwig- Maximilians- Universität München Online Multimedia WS 2015/16 - Tutorial 03-1 Today s Agenda Quick test Server
CS105 Perl: Perl CGI. Nathan Clement 24 Feb 2014
CS105 Perl: Perl CGI Nathan Clement 24 Feb 2014 Agenda We will cover some CGI basics, including Perl-specific CGI What is CGI? Server Architecture GET vs POST Preserving State in CGI URL Rewriting, Hidden
Excerpts of Web Application Security focusing on Data Validation. adapted for F.I.S.T. 2004, Frankfurt
Excerpts of Web Application Security focusing on Data Validation adapted for F.I.S.T. 2004, Frankfurt by fs Purpose of this course: 1. Relate to WA s and get a basic understanding of them 2. Understand
Produced by. Mobile Application Development. Higher Diploma in Science in Computer Science. Eamonn de Leastar
Mobile Application Development Higher Diploma in Science in Computer Science Produced by Eamonn de Leastar (edeleastar@wit.ie) Department of Computing, Maths & Physics Waterford Institute of Technology
Jeff Offutt. SWE 432 Design and Implementation of Software for the Web. Web Applications
Introduction to Web Applications Jeff Offutt http://www.cs.gmu.edu/~offutt/ SWE 432 Design and Implementation of Software for the Web Web Applications A web application uses enabling technologies to 1.
last time: command injection
Web Security 1 last time: command injection 2 placing user input in more complicated language SQL shell commands input accidentally treated as commands in language instead of single value (e.g. argument/string
Web Focused Programming With PHP
Web Focused Programming With PHP May 20 2014 Thomas Beebe Advanced DataTools Corp (tom@advancedatatools.com) Tom Beebe Tom is a Senior Database Consultant and has been with Advanced DataTools for over
Introduc)on to Computer Networks
Introduc)on to Computer Networks COSC 4377 Lecture 3 Spring 2012 January 25, 2012 Announcements Four HW0 s)ll missing HW1 due this week Start working on HW2 and HW3 Re- assess if you found HW0/HW1 challenging
HTTP Protocol and Server-Side Basics
HTTP Protocol and Server-Side Basics Web Programming Uta Priss ZELL, Ostfalia University 2013 Web Programming HTTP Protocol and Server-Side Basics Slide 1/26 Outline The HTTP protocol Environment Variables
CNIT 129S: Securing Web Applications. Ch 3: Web Application Technologies
CNIT 129S: Securing Web Applications Ch 3: Web Application Technologies HTTP Hypertext Transfer Protocol (HTTP) Connectionless protocol Client sends an HTTP request to a Web server Gets an HTTP response
CPET 499/ITC 250 Web Systems. Topics
CPET 499/ITC 250 Web Systems Chapter 13 Managing State Text Book: * Fundamentals of Web Development, 2015, by Randy Connolly and Ricardo Hoar, published by Pearson Paul I-Hai, Professor http://www.etcs.ipfw.edu/~lin
FIREFOX MENU REFERENCE This menu reference is available in a prettier format at
FIREFOX MENU REFERENCE This menu reference is available in a prettier format at http://support.mozilla.com/en-us/kb/menu+reference FILE New Window New Tab Open Location Open File Close (Window) Close Tab
Managing State. Chapter 13
Managing State Chapter 13 Textbook to be published by Pearson Ed 2015 in early Pearson 2014 Fundamentals of Web http://www.funwebdev.com Development Section 1 of 8 THE PROBLEM OF STATE IN WEB APPLICATIONS
Web Programming 4) PHP and the Web
Web Programming 4) PHP and the Web Emmanuel Benoist Fall Term 2013-14 Berner Fachhochschule Haute cole spcialise bernoise Berne University of Applied Sciences 1 PHP a language for Web applications Presentation
PHP State Maintenance (Cookies, Sessions, Hidden Inputs)
PHP State Maintenance (Cookies, Sessions, Hidden Inputs) What is meant by state? The Hypertext Transfer Protocol (HTTP) is stateless. This means that each time a browser requests a page, a connection from
COMP519 Web Programming Lecture 28: PHP (Part 4) Handouts
COMP519 Web Programming Lecture 28: PHP (Part 4) Handouts Ullrich Hustadt Department of Computer Science School of Electrical Engineering, Electronics, and Computer Science University of Liverpool Contents
How to clear a web browsers cache, cookies and history last updated on 8/28/2013
How to clear a web browsers cache, cookies and history last updated on 8/28/2013 About cache, cookies, and history Each time you access a file through your web browser, the browser caches (i.e., stores)
Form Processing in PHP
Form Processing in PHP Forms Forms are special components which allow your site visitors to supply various information on the HTML page. We have previously talked about creating HTML forms. Forms typically
Introduction. Server-side Techniques. Introduction. 2 modes in the PHP processor:
Introduction Server-side Techniques PHP Hypertext Processor A very popular server side language on web Code embedded directly into HTML documents http://hk2.php.net/downloads.php Features Free, open source
1-1. Switching Networks (Fall 2010) EE 586 Communication and. September Lecture 10
EE 586 Communication and Switching Networks (Fall 2010) Lecture 10 September 17 2010 1-1 Announcement Send me your group and get group ID HW3 (short) out on Monday Personal leave for next two weeks No
Unraveling the Mysteries of J2EE Web Application Communications
Unraveling the Mysteries of J2EE Web Application Communications An HTTP Primer Peter Koletzke Technical Director & Principal Instructor Common Problem What we ve got here is failure to commun cate. Captain,
Introduction to Ethical Hacking
Introduction to Ethical Hacking Summer University 2017 Seoul, Republic of Korea Alexandre Karlov Today Some tools for web attacks Wireshark How a writeup looks like 0x04 Tools for Web attacks Overview
CSCI-1680 WWW Rodrigo Fonseca
CSCI-1680 WWW Rodrigo Fonseca Based partly on lecture notes by Sco2 Shenker and John Janno6 Administrivia HW3 out today Will cover HTTP, DNS, TCP TCP Milestone II coming up on Monday Make sure you sign
Lecture 3. HTTP v1.0 application layer protocol. into details. HTTP 1.0: RFC 1945, T. Berners-Lee HTTP 1.1: RFC 2068, 2616
Lecture 3. HTTP v1.0 application layer protocol into details HTTP 1.0: RFC 1945, T. Berners-Lee Lee,, R. Fielding, H. Frystyk, may 1996 HTTP 1.1: RFC 2068, 2616 Ascii protocol uses plain text case sensitive
Common Websites Security Issues. Ziv Perry
Common Websites Security Issues Ziv Perry About me Mitnick attack TCP splicing Sql injection Transitive trust XSS Denial of Service DNS Spoofing CSRF Source routing SYN flooding ICMP
PIC 40A. Lecture 19: PHP Form handling, session variables and regular expressions. Copyright 2011 Jukka Virtanen UCLA 1 05/25/12
PIC 40A Lecture 19: PHP Form handling, session variables and regular expressions 05/25/12 Copyright 2011 Jukka Virtanen UCLA 1 How does a browser communicate with a program on a server? By submitting an
Sessions. Mendel Rosenblum. CS142 Lecture Notes - Sessions
Sessions Mendel Rosenblum How do we know what user sent request? Would like to authenticate user and have that information available each time we process a request. More generally web apps would like to
Settings for UPlan PC Users
UPlan operates best with certain browser and screen resolution settings. This job aid will walk you through how to set these. I. UPlan IE 11 Settings (page 1) II. UPlan Firefox Settings (page 4) III. Firefox
CSCI 136: Fundamentals of Computer Science II Keith Vertanen Copyright 2012
Web clients in Java CSCI 136: Fundamentals of Computer Science II Keith Vertanen Copyright 2012 The World Wide Web History Main components: URLs, HTTP Protocol, HTML Web support in Java Overview Connecting
Web Standards. Web Technologies. Web Standards. URI and URL
Web Technologies Claudio Fornaro ver. 1.2 1 Web Standards At its core, the Web is made up of three standards: the Uniform Resource Identifier (URI), which is a universal system for referencing resources
Lecture 7: Dates/Times & Sessions. CS 383 Web Development II Wednesday, February 14, 2018
Lecture 7: Dates/Times & Sessions CS 383 Web Development II Wednesday, February 14, 2018 Date/Time When working in PHP, date is primarily tracked as a UNIX timestamp, the number of seconds that have elapsed
Persistence & State. SWE 432, Fall 2016 Design and Implementation of Software for the Web
Persistence & State SWE 432, Fall 2016 Design and Implementation of Software for the Web Today What s state for our web apps? How do we store it, where do we store it, and why there? For further reading:
CN Assignment I. 1. With an example explain how cookies are used in e-commerce application to improve the performance.
CN Assignment I 1. With an example explain how cookies are used in e-commerce application to improve the performance. In an e-commerce application, when the user sends a login form to the server, the server
Some things to watch out for when using PHP and Javascript when building websites
Some things to watch out for when using PHP and Javascript when building websites Les Hatton 10 Sep 2003 1 PHP PHP is a C-like language which evolved from Perl scripts originally produced by Rasmus Lerdorf
Creating a Bookmark/Link for the Portal(my.cuw.edu)
Here are the links to each guide on this PDF Internet Explorer EDGE Firefox Chrome Safari Items to Note Always remember to click the log out button on the Portal when you are finished with your session.
The HTTP Protocol HTTP
The HTTP Protocol HTTP Copyright (c) 2013 Young W. Lim. Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or any later
CSCI-1680 WWW Rodrigo Fonseca
CSCI-1680 WWW Rodrigo Fonseca Based partly on lecture notes by Scott Shenker and John Jannotti Precursors 1945, Vannevar Bush, Memex: a device in which an individual stores all his books, records, and
(Frequently Asked Questions)
(Frequently Asked Questions) Aptech Ltd. Version 1.0 Page 1 of 9 Table of Contents S# Question 1. How do you create sub domains using PHP? 2. What is the difference between echo and print statements in
Saving State on the WWW
Saving State on the WWW The Issue Connections on the WWW are stateless Every time a link is followed is like the first time to the server it has no memory for connections Why Bother To Fix This? By saving
Real Life Web Development. Joseph Paul Cohen
Real Life Web Development Joseph Paul Cohen joecohen@cs.umb.edu Index 201 - The code 404 - How to run it? 500 - Your code is broken? 200 - Someone broke into your server? 400 - How are people using your
Web basics: HTTP cookies
Web basics: HTTP cookies Myrto Arapinis School of Informatics University of Edinburgh November 20, 2017 1 / 32 How is state managed in HTTP sessions HTTP is stateless: when a client sends a request, the
Computer Networks. Wenzhong Li. Nanjing University
Computer Networks Wenzhong Li Nanjing University 1 Chapter 8. Internet Applications Internet Applications Overview Domain Name Service (DNS) Electronic Mail File Transfer Protocol (FTP) WWW and HTTP Content
Web basics: HTTP cookies
Web basics: HTTP cookies Myrto Arapinis School of Informatics University of Edinburgh February 11, 2016 1 / 27 How is state managed in HTTP sessions HTTP is stateless: when a client sends a request, the
Application Level Protocols
Application Level Protocols 2 Application Level Protocols Applications handle different kinds of content e.g.. e-mail, web pages, voice Different types of content require different kinds of protocols Application
Networking and Internet
Today s Topic Lecture 13 Web Fundamentals Networking and Internet LAN Web pages Web resources Web client Web Server HTTP Protocol HTML & HTML Forms 1 2 LAN (Local Area Network) Networking and Internet
How is state managed in HTTP sessions. Web basics: HTTP cookies. Hidden fields (2) The principle. Disadvantage of this approach
Web basics: HTTP cookies Myrto Arapinis School of Informatics University of Edinburgh March 30, 2015 How is state managed in HTTP sessions HTTP is stateless: when a client sends a request, the server sends
BEGINNER PHP Table of Contents
Table of Contents 4 5 6 7 8 9 0 Introduction Getting Setup Your first PHP webpage Working with text Talking to the user Comparison & If statements If & Else Cleaning up the game Remembering values Finishing
The HTTP protocol. Fulvio Corno, Dario Bonino. 08/10/09 http 1
The HTTP protocol Fulvio Corno, Dario Bonino 08/10/09 http 1 What is HTTP? HTTP stands for Hypertext Transfer Protocol It is the network protocol used to delivery virtually all data over the WWW: Images
CSCD 330 Network Programming Spring 2018
CSCD 330 Network Programming Spring 2018 Lecture 4 Application Layer Reading: Chapter 2 Some Material in these slides from J.F Kurose and K.W. Ross All material copyright 1996-2017 1 Chapter 1: Network
Web Programming Paper Solution (Chapter wise)
Introduction to web technology Three tier/ n-tier architecture of web multitier architecture (often referred to as n-tier architecture) is a client server architecture in which presentation, application
CS 410/510: Web Basics
CS 410/510: Web Basics Basics Web Clients HTTP Web Servers PC running Firefox Web Server Mac running Chrome Web Clients Basic Terminology HTML JavaScript Terminology Web page consists of objects Each object
Lecture 6: More Arrays & HTML Forms. CS 383 Web Development II Monday, February 12, 2018
Lecture 6: More Arrays & HTML Forms CS 383 Web Development II Monday, February 12, 2018 Lambdas You may have encountered a lambda (sometimes called anonymous functions) in other programming languages The
Proxying. Why and How. Alon Altman. Haifa Linux Club. Proxying p.1/24
Proxying p.1/24 Proxying Why and How Alon Altman alon@haifux.org Haifa Linux Club Proxying p.2/24 Definition proxy \Prox"y\, n.; pl. Proxies. The agency for another who acts through the agent; authority
WEB SECURITY p.1
WEB SECURITY 101 - p.1 spritzers - CTF team spritz.math.unipd.it/spritzers.html Disclaimer All information presented here has the only purpose to teach how vulnerabilities work. Use them to win CTFs and
Session 8. Reading and Reference. en.wikipedia.org/wiki/list_of_http_headers. en.wikipedia.org/wiki/http_status_codes
Session 8 Deployment Descriptor 1 Reading Reading and Reference en.wikipedia.org/wiki/http Reference http headers en.wikipedia.org/wiki/list_of_http_headers http status codes en.wikipedia.org/wiki/_status_codes
HashCookies A Simple Recipe
OWASP London Chapter - 21st May 2009 HashCookies A Simple Recipe Take a cookie Add some salt Add a sequence number John Fitzpatrick Full paper at http://labs.mwrinfosecurity.com Structure What are hashcookies
s642 web security computer security adam everspaugh
s642 computer security web security adam everspaugh ace@cs.wisc.edu review memory protections / data execution prevention / address space layout randomization / stack protector Sandboxing / Limit damage
Web Engineering. Basic Technologies: Protocols and Web Servers. Husni
Web Engineering Basic Technologies: Protocols and Web Servers Husni Husni@trunojoyo.ac.id Basic Web Technologies HTTP and HTML Web Servers Proxy Servers Content Delivery Networks Where we will be later
Scalability of web applications
Scalability of web applications CSCI 470: Web Science Keith Vertanen Copyright 2014 Scalability questions Overview What's important in order to build scalable web sites? High availability vs. load balancing
Developing Online Databases and Serving Biological Research Data
Developing Online Databases and Serving Biological Research Data 1 Last Time HTML Hypertext Markup Language Used to build web pages Static, and can't change the way it presents itself based off of user
Cookie Security. Myths and Misconceptions. David Johansson OWASP London 30 Nov. 2017
Cookie Security Myths and Misconceptions David Johansson OWASP London 30 Nov. 2017 About Me David Johansson (@securitybits) Security consultant with 10 years in AppSec Helping clients design and build
CS 142 Winter Session Management. Dan Boneh
CS 142 Winter 2009 Session Management Dan Boneh Sessions A sequence of requests and responses from one browser to one (or more) sites Session can be long (Gmail - two weeks) or short without session mgmt:
UNIT-VI CREATING AND USING FORMS
UNIT-VI CREATING AND USING FORMS To create a fully functional web application, you need to be able to interact with your users. The common way to receive information from web users is through a form. Forms
Chapter 10 Web-based Information Systems
Prof. Dr.-Ing. Stefan Deßloch AG Heterogene Informationssysteme Geb. 36, Raum 329 Tel. 0631/205 3275 dessloch@informatik.uni-kl.de Chapter 10 Web-based Information Systems Role of the WWW for IS Initial
Abusing Windows Opener to Bypass CSRF Protection (Never Relay On Client Side)
Abusing Windows Opener to Bypass CSRF Protection (Never Relay On Client Side) Narendra Bhati @NarendraBhatiB http://websecgeeks.com Abusing Windows Opener To Bypass CSRF Protection Narendra Bhati Page
Master Calendar Integrated Authentication Configuration Instructions. Dean Evans & Associates, Inc.
Master Calendar Integrated Authentication Configuration Instructions Dean Evans & Associates, Inc. Copyright Copyright 2013 Dean Evans & Associates, Inc. All rights reserved. No part of this document may
magento_1:full_page_cache
magento_1:full_page_cache https://amasty.com/docs/doku.php?id=magento_1:full_page_cache For more details see the extension page. Speed up your Magento using cache to the full. Decrease pages time load
Java servlets CSCI 470: Web Science Keith Vertanen Copyright 2013
Java servlets CSCI 470: Web Science Keith Vertanen Copyright 2013 Overview Dynamic web content genera2on (thus far) CGI Web server modules Server- side scrip2ng e.g. PHP, ASP, JSP Custom web server Java
5/19/2015. Objectives. JavaScript, Sixth Edition. Saving State Information with Query Strings. Understanding State Information
Objectives JavaScript, Sixth Edition When you complete this chapter, you will be able to: Save state information with query strings, hidden form fields, and cookies Describe JavaScript security issues
Attacks Against Websites. Tom Chothia Computer Security, Lecture 11
Attacks Against Websites Tom Chothia Computer Security, Lecture 11 A typical web set up TLS Server HTTP GET cookie Client HTML HTTP file HTML PHP process Display PHP SQL Typical Web Setup HTTP website:
REST Easy with Infrared360
REST Easy with Infrared360 A discussion on HTTP-based RESTful Web Services and how to use them in Infrared360 What is REST? REST stands for Representational State Transfer, which is an architectural style
PHP. MIT 6.470, IAP 2010 Yafim Landa
PHP MIT 6.470, IAP 2010 Yafim Landa (landa@mit.edu) LAMP We ll use Linux, Apache, MySQL, and PHP for this course There are alternatives Windows with IIS and ASP Java with Tomcat Other database systems
Application Security through a Hacker s Eyes James Walden Northern Kentucky University
Application Security through a Hacker s Eyes James Walden Northern Kentucky University waldenj@nku.edu Why Do Hackers Target Web Apps? Attack Surface A system s attack surface consists of all of the ways
Web Programming with PHP
We know that we can use HTML to build websites, but websites built using pure HTML suffer from a serious limitation. Imagine we want to create a website that displays the current time in Cambridge, MA,
CS 161 Computer Security
Nick Weaver Fall 2018 CS 161 Computer Security Homework 3 Due: Friday, 19 October 2018, at 11:59pm Instructions. This homework is due Friday, 19 October 2018, at 11:59pm. No late homeworks will be accepted
WEB SECURITY WORKSHOP TEXSAW Presented by Solomon Boyd and Jiayang Wang
WEB SECURITY WORKSHOP TEXSAW 2014 Presented by Solomon Boyd and Jiayang Wang Introduction and Background Targets Web Applications Web Pages Databases Goals Steal data Gain access to system Bypass authentication
COSC 2206 Internet Tools. The HTTP Protocol
COSC 2206 Internet Tools The HTTP Protocol http://www.w3.org/protocols/ What is TCP/IP? TCP: Transmission Control Protocol IP: Internet Protocol These network protocols provide a standard method for sending
Client Side Scripting. The Bookshop
Client Side Scripting The Bookshop Introduction This assignment is a part of three assignments related to the bookshop website. Currently design part (using HTML and CSS) and server side script (using
Lecture 7b: HTTP. Feb. 24, Internet and Intranet Protocols and Applications
Internet and Intranet Protocols and Applications Lecture 7b: HTTP Feb. 24, 2004 Arthur Goldberg Computer Science Department New York University artg@cs.nyu.edu WWW - HTTP/1.1 Web s application layer protocol
Web, HTTP and Web Caching
Web, HTTP and Web Caching 1 HTTP overview HTTP: hypertext transfer protocol Web s application layer protocol client/ model client: browser that requests, receives, displays Web objects : Web sends objects
Web Security: Vulnerabilities & Attacks
Computer Security Course. Web Security: Vulnerabilities & Attacks Type 2 Type 1 Type 0 Three Types of XSS Type 2: Persistent or Stored The attack vector is stored at the server Type 1: Reflected The attack
Penetration Test Report
Penetration Test Report Feb 12, 2018 Ethnio, Inc. 6121 W SUNSET BLVD LOS angeles, CA 90028 Tel (888) 879-7439 ETHN.io Summary This document contains the most recent pen test results from our third party
WEB SECURITY: WEB BACKGROUND
WEB SECURITY: WEB BACKGROUND CMSC 414 FEB 20 2018 A very basic web architecture Client Server Browser Web server (Private) Data Database DB is a separate entity, logically (and often physically) A very
Princess Nourah bint Abdulrahman University. Computer Sciences Department
Princess Nourah bint Abdulrahman University Computer Sciences Department 1 And use http://www.w3schools.com/ PHP Part 3 Objectives Creating a new MySQL Database using Create & Check connection with Database
CS 361S - Network Security and Privacy Spring Project #1
CS 361S - Network Security and Privacy Spring 2014 Project #1 Due: 11:00am CST, February 27, 2014 Submission instructions Follow the instructions in the project description. If you are submitting late,
Avoiding Web Application Flaws In Embedded Devices. Jake Edge LWN.net URL for slides:
Avoiding Web Application Flaws In Embedded Devices Jake Edge LWN.net jake@lwn.net URL for slides: http://lwn.net/talks/elce2008 Overview Examples embedded devices gone bad Brief introduction to HTTP Authentication
High Availability/ Clustering with Zend Platform
High Availability/ Clustering with Zend Platform David Goulden Product Manager goulden@zend.com Copyright 2007, Zend Technologies Inc. In this Webcast Introduction to Web application scalability using
Information Security CS 526 Topic 8
Information Security CS 526 Topic 8 Web Security Part 1 1 Readings for This Lecture Wikipedia HTTP Cookie Same Origin Policy Cross Site Scripting Cross Site Request Forgery 2 Background Many sensitive
SECURING APACHE : ATTACKS ON SESSION MANAGEMENT
SECURING APACHE : ATTACKS ON SESSION MANAGEMENT In this part of the series, we are going to concentrate on attacks on session management. Application-level attacks on the session is about obtaining or
CS 5450 HTTP. Vitaly Shmatikov
CS 5450 HTTP Vitaly Shmatikov Browser and Network Browser OS Hardware request reply website Network slide 2 HTML A web page includes Base HTML file Referenced objects (e.g., images) HTML: Hypertext Markup
Advanced Web Technology 10) XSS, CSRF and SQL Injection
Berner Fachhochschule, Technik und Informatik Advanced Web Technology 10) XSS, CSRF and SQL Injection Dr. E. Benoist Fall Semester 2010/2011 1 Table of Contents Cross Site Request Forgery - CSRF Presentation
World Wide Web, etc.
World Wide Web, etc. Alex S. Raw data-packets wouldn t be much use to humans if there weren t many application level protocols, such as SMTP (for e-mail), HTTP & HTML (for www), etc. 1 The Web The following
This FAQ is only applicable for hostings ordered after 23/6/2010
Webhosting FAQ This FAQ is only applicable for hostings ordered after 23/6/2010 1. How do I access my Webhosting control panel?... 1 2. On which server is my hosting set up (IP)?... 4 3. How do I install
Development of Web Applications
Development of Web Applications Principles and Practice Vincent Simonet, 2013-2014 Université Pierre et Marie Curie, Master Informatique, Spécialité STL 6 Practical Aspects Vincent Simonet, 2013-2014 Université
CSE 154 LECTURE 21: COOKIES
CSE 154 LECTURE 21: COOKIES Regular expressions in (PDF) regex syntax: strings that begin and end with /, such as "/[AEIOU]+/" function preg_match(regex, string) preg_replace(regex, replacement, string)