welcome back
we are joined all the way from germany
by andreas to give us a rundown on web
security for newcomers
uh andreas is a professional software
engineer since 2011 uh both as an
engineer and a manager for both national
german and international companies
he wrote his first line of code around
2006 and in the last few years has been
working as a freelance consultant
andres is also a lecturer at
universities for software engineering
testing architecture and web security
andreas considers himself a full stack
developer but prefers the back end
his primary programming language is
python followed by javascript and
typescript
and
andres really wants to hear your
questions for the end of the session so
we can answer them live so don't forget
to get them into the list because we're
a little behind you and we'll miss them
if you're not quick
over to you andreas
okay yeah thank you very much i can just
empathize really ask your questions it's
for newcomers so
yeah just ask them and i'm happy to
to answer them um if i can but probably
i should be able to do so
okay so i'm not doing some slides
because sometimes i think
it can be a little bit boring so i
reworked it and now it's a web page
it's not publicly because it's full of
security bugs and we're just
investigating the security bugs i put in
there
and yeah let's see if we kind can find
solutions for them
they we are starting with like i think
every webpage has a very simple search
bar
you maybe you wouldn't think they could
go so many things wrong but we will see
about a few things which can go wrong
from a security perspective so i'm maybe
just searching a little bit welcome
pycon
australia
and well we have no search results but
we have like it says like well here what
what i searched and i also added a
little bit of javascript in here so a
little bit sba feeling if we are like
when i was changing the search query
it's also changing uh directly here so
like welcome
from germany it is changing here it's a
very very simple
feature which we have on web pages
unfortunately
um as i mentioned before it's there are
security concerns we have to address
here so imagine you're sharing this link
with somebody else because i'm using a
query param uh you cannot see that here
i see ah okay i'm using a query
parameter here it's um in the url it's
just like if we look into the the form
here it's quite simple you see it as a
form with the methods action get
you cannot see ah
oh that's damn i never thought about
that okay i'm sorry we cannot see the
we cannot see the uh developer toolbar
but okay you just have to believe me
it's with a get method
and somebody shares this with you
and when somebody shares this with you
and it's an evil person something like
that can happen
um right now it's just the javascript a
lot but it could be a lot of more things
for example it could be a whole phishing
attack yeah right now the attacker it
used my search form very very simple was
just displaying that there are no search
results but an attacker can use this to
run a phishing attack because like as
soon as he or she can execute
javascript on my web page he could
actually just say well i'm deleting the
whole html
element in the truncate the body in the
html and just put their own forms in
there and grab the user data yeah
imagine something like that happening in
your online banking i wouldn't be so
happy about that to lose all my money
there
very very simple
let's have a look at how this could
happen actually yeah
um
what happened is
which is i'm just realizing that you
cannot see it but let's have a look into
the um
source code i hope you can see this
view source
change yes great
let's have a look into the search code
uh what was happening here because like
um what was
if you want to switch to full screen oh
no no no it's fine we um i just found a
workaround with the view source we can
use this so
you can see here like i'm returning what
was like what was share what the user
entered into the search bar
and i just
displaying it here and here it is empty
i just wrote it in here that is empty
but if we look into the
source code in the html it's actually
not empty
there is a script in it
and what the attacker did was actually
quite easy he just entered into this
very nice search form
script
for me it's like i prepared it with evil
js
but it could be anything else i'm just
entering this one here
clicking on search and now it's
happening in here i could enter anything
i want there and it's just
executing it here yeah script tag
alert
this is
worrying
and
it's appearing in there unlike the alert
it's a very
well let's say it's very nice from the
attacker just to do a javascript alert
but as i said it can be used for
phishing attacks as well
it can be used for phishing attacks as
well
the problem is
well actually it's called non-persistent
xss
the problem is
we can put into the http request which
is behind every browser and direction
what you're doing is actually a http
request
and when we're using the http request
the data the user entered there directly
and returning it in our response for
example like i did i just returned it
and the template in here and just said
whatever the user entered i will return
in here
then it will be or executed in there
that's quite bad as i said like
most common vectors than the phishing
attacks it and it's valid for everything
so like if you're using url parameters
or you're using forms
it can be it can be even a user agent i
have seen it once that an attack was
done via an user agent yeah so
that's quite bad and it cannot just
happen if you're just doing it as a
back-end developer
yeah you're just returning in the
template it can be also done when you're
using the http request data so for
especially the url parameters
and you're just using some little bit of
javascript
you want to display it like i did before
with this little bit of spa feeling even
then
uh we still have actually the same
result
there's one thing which is very very
evil
which is the inner html property in
javascript so every html element
you can
set some inner html well at least if
it's a block element and
put in there a very nice shortcut you do
not have to create the elements by hand
if you're using vanilla.js and so on but
it is really a security concern because
we can just enter some script text in
there and then
uh well we are open for this
vulnerability here
however there is a very very simple
solution to that usually i would ask if
we are like in impressing so like if
anybody has an idea but i'm just going
to spoil it in here the solution is
escaping and of course do not use inner
html
if we are escaping
if we are escaping this then the reason
we are seeing here is not like empty and
directly the html element but
the very
let's say the very evil characters like
these how is it called um
greater in smaller sign these greater
and smaller signs they're going to be
escaped into html entities and they're
no longer valid html code so it's really
about when a user is entering some of
the
data what we do not want is that we are
using the user content directly
as
valid html so we are escaping it and in
this way we make sure that this cannot
happen
just a little bit so that you go out
with the
you go out with uh of this talk and you
have some new password you can put into
the next uh pull request um let's say
the back end side is called
non-persistent xss and the front and
side is dom based xss it's
actually it's still the same it's still
a cross site scripting attack
but a different name none it's called
non-persistent on the back-end side
because it uses the http request
so
it is like it's not stored anywhere this
attack it's really just working with
this one request if i'm changing the
requests
by changing the url parameters it's a
different uh one so it's not persistent
and the frontend part is called dom
based because with inner html we are
manipulating the dom
xss it's
the name for it i never mentioned it i'm
so sorry
um cross-site scripting
um so like we're actually my evil js is
not from my sides but from a different
side so it's a cross-site scripting
attack
okay
usually any questions already so i would
really like because like the next one
would be like a little bit of different
still the search form but a little bit
different so maybe there are already
some questions for this part or dom
based or non-persistent xss
doesn't seem so okay i will just
continue
okay so i will just continue a little
bit
um well we are not doing the exercise
it's um all whenever i'm when i'm doing
a workshop here i also have some little
exercises and stuff like that but today
we're just going on the theoretical part
here um the next thing i'm doing in here
is like okay
um my product owner he wants me to add
the google tag manager snippet
and it's just like a script text so i'm
just gonna add it and i'm done with the
ticket and can move on with some more
interesting stuff hopefully and yeah
well let's go to the
to the page which is now tracked by the
google tag manager
well now i have a problem
now it says i'm an evil google tag
manager and it also says it's
persistently happening well let's see
i'm just reloading this page i'm not
using the link maybe the link maybe the
link is maybe it's an evil link
oh sorry maybe it's an evil link so i'm
not going to i'm not going to i'm not
going to use this links and i'll go
directly to the page to make sure
i'm not going i'm not going to do the
same thing so i'm going to execute it
and say okay well i'm going to do this
one
now it's happening again it's not the
link something else is happening
and what is happening here is and
persistent xss attack as you said like
it's so there's no dom based
manipulation you cannot we don't know
that but i'm gonna
tell you it's not and it's not a
non-persistent xss attack because like
even if i change the http request
it's still going to happen
what happened here is actually a typo
yeah if you look very
are you seeing my alert actually i hope
so
what was happening in here is
it was a google tag manager with the q
so instead of the
g it should be it was a queue and
if you think this is not gonna happening
uh it is actually quite often there are
a couple of stories where like these
simple typos really were uh
yeah patrick um yeah i saw that as well
i just checked i'm really sorry um
this takes away a lot of the experience
with the alert messages i'm so sorry i
did not experience that
earlier damn it
maybe maybe
maybe we should switch over to the uh to
the full screen could you change that
for me please
because i'm not sure if i can
can i
oh yes i can great
so guys now it's looking a little bit
more different let me reload the page
and now you can see hopefully
um the
uh the
messages in here so you see here now if
the
alert message in here now i'm an evil
google tag manager
uh persistently
and it's just happening that this typo
was is calling this js
and in the in the past there were some
attacks with these typos so for example
we had some problems with npm packages
where
there was
i'm sorry i just forgot the one name
there was one package there was one with
the dash and one without a dash maybe
somebody knows you can put it into the
shed but um
just blank in my memory right now
there was one with the dash and one
without a dash
one of the ones i i still cannot say
which one is the correct one and which
one was the malicious one but
let's say the dash one was the malicious
one you would not know them yeah it's
this exactly the same name this just a
dash you would just take this mpm
package and use and you have an xss
attack so you have to be very very
careful if you're using third-party
software that you're using the correct
one which is also safe
which means like never trust anybody
you you cannot trust your user's input
at all we have seen this with the
non-persistent and with the dom based
xss
but we can we cannot even trust some
open source software because even them
are vulnerable
for
xss attacks well
at least the social factor
and human mistakes
this kind of excess s is called
persistent xss because it's not based on
the request or the dom
but the malicious code is stored
somewhere it in this case it will be
stored in the version control but it can
also be stored in the database
and then it's delivered to users again
without escaping yeah that's the most
important one is without escaping if i
would escape it um would not happening
well with persistence a little bit more
wrong
um i want to share a little anecdote
about a very nice attack what's actually
like a two-star attack there was
a customer of mine they had an
e-commerce system which was a little bit
of old
and they had some vulnerability so the
attacker managed to get access to the
database we will look into that how he
how that was possible that he got access
to the database uh in a minute
but
uh more importantly
in this database there was a very nice
field it was for the product owner to
add some of these snippets to add the
google tag manager snippet or some of
his web tracking tools whatever he's
doing for web analytics and what the
attacker did
they
used this field
they put a lot of blank lines into it
and then they put this google tag
manager with a queue so actually i took
it from them
and this google tag manager with the
queue was hosted on a russian on the
russian server and they did a phishing
attack on our checkout
which was really really bad for us
because um the phishing attack was like
they created a pop-up directly over the
credit card iframe
so the users entered the credit card
data and they thought oh well i'm just
entering my credit card data everything
is fine i'm not on a malicious domain
anything everything was fine it was just
some javascript in there from
something from somewhere else they
entered it they have shown an error
while you did a mistake entering your
credit card data the user
very very
um nice oh well i'm gonna try it again
but they closed
their malicious pop up and then they
entered the correct data in the correct
iframe so there was no way so the users
they did not complain that there was
something like like a phishing attack
because they were not able to detect it
and we didn't realize that the attacker
grabbed the credit card data
so this was really a very very bad
situation because if you're in europe i
don't know actually about australia i'm
very very happy shared in the chat about
some data protection regulations in
australia maybe you have something
similar but in europe it is with the
gdpr
um which is like after fighting for over
two years now
um you have within 48 hours you have
to
write a very formal document put it to
the authority so this for every for
every city for every state
there is a date an official data
protection officer and you have to write
him a very formal letter explaining oh
we realized we had
uh we had like a data breach there might
be some customer data and then you have
to fill out like what customer data
payment data etc and so on and if you're
lucky they say well you did you you
solved the issue everything is fine you
will get a warning but if you're like an
internet company who is like doing a lot
of your revenue with this with your
e-commerce system so which means you
have tech knowledge you can get a
penalty
and the worst thing is it is not the
company you're working for but it's like
your
mother company so
for example your investor if you're like
a startup it could be also your investor
who has to pay like this penalty and it
can be
up to i think it's up to 10
of the
one year
gross revenue so it is a very high
penalty they can put for you just to be
vulnerable for
attacks
there's one project i want to i want to
share with you which is called the open
the ovap it's the open web application
security project
o vasp and overapps or wasp
they
have a lot of information and
documentation about all possible web
security problems so for example they
have a very extensive xss prevention
cheat you see it here like it's a very
very long one on very detailed
what you can do um everything against it
um to be honest you can
never trust data except in a lot of
locations fun fact there are no allowed
locations anyway and then
always end code
always
if it's html elements attributes
javascript data even in css it is
possible for me it's some black magic
but um even for me some black magic but
it's like you could do an xss attack
with css because there are this url
fields where you can load from somewhere
else so even with that you have to be
very very sensitive and you have to
always escape the data in there
um
sanitize your html markup which is
actually almost the same like escaping
which means like okay clean it up make
sure
that
there are no malicious element that if
somebody is allowed
to to enter html sanitize it make sure
it's just maybe in a headline and a
strong text but especially no script
talks or anything like that
um this is very very bad actually their
augmentation number seven avoid
javascript urls which is like with html5
and this very modern routing and react
and angular actually they say this is
vulnerable for xss attacks it's actually
the same angle like we have seen with
the search field right you have the url
i could try to put
some script tech into the url and the
router would just
show it and execute it would be very
very bad well
on the other hand the react and angular
developers i'm pretty sure
that they are
very familiar with xss and how to avoid
it and they're going to take care of
that fortunately for us but still it's
from a security perspective it is an
angle
you have to keep in mind prevent dom
based xss this there's something very
very interestingly um react is calling
this inner is renaming this in html
property they call it dangerously set in
html just to make it very very visible
that this is um open for xss attacks
then there are some some more things
some bonus rules but i'm not going to go
into that one because i see
that i'm running
completely out of time i'm just talking
about xsas
let's have a look at the second
attack which can do which is
which has almost the same
almost the same solution for it so which
is i have again a search field but this
time i'm gonna filter the articles i
have three
three pairs of shoes i'm i'm selling
here so
all of them are very stylish and
comfortable but the first one or the
second one is a premium on this or the
last one and what i can do is i can just
filter them
and from the database it says okay only
the products within e and this
highlighted attribute are going to be
shown i think everybody has done
something like that very simple oh
there's a form i'm gonna grab the data
in there and build my sql statement
around it
problem is
what i could do is run an sql injection
attack
and i have prepared this one here and
what i did is here i just added this one
and this is not supposed to happening
yeah because i just add a product in
here which doesn't cost anything which
is actually quite nice for me as a user
when i'm using this sql injection attack
but i could also use it to read the data
i could also use it to truncate the
database which would really be bad
because while we are developers we all
know that most companies they
well most companies i have seen at least
they have a very poor backup system
or not sure on are not able to do any
recovery in time when the database is
truncated apart from the data loss you
have anyway at least for one day
so
um that's actually quite bad
and what is happening in here is
if
can you i hope you can oh yeah you're
now screwing my you're now seeing my
screen so you can see it what is
happening in here is you see it actually
in the url uh because i did this again
as a getform
this
percent 27 it's the com it's like the
the quote sign and then i'm closing it
yeah because you know it's a filter so
it's somewhere in the where statement so
i'm closing the the parameter which
should be used here
saying oh well quote semicolon sql
statement ended then i am injecting
mysql statement so it's an insert into
products with the values you can see
them here
yeah you have to be a little bit trained
with this 20 percent percent 20 in
percent 21 but let's skip to the to the
end
and saying this is until here it's all
of the insert you can say it here so
like product was added this is the last
property
we can see it in here so it worked and
then i'm just like opening again the
statement so that it still works so
nobody knows i sneaked in
on this sql statement into the middle
which was right now just this little
adding the product and this is an sql
injection attack
problem
every time you're using again user
generated data user data
in your sql statements you're not
vulnerable for xss attack in this case
but sql injection actually at the same
side of the storybot database instead of
html site
so what you can do is actually the same
escaping
so if you're using um something like sql
alchemy for example for an orm object
relational mapper you're not writing the
sql statements your own any longer and
this is the best you can actually do
because these kind of libraries they are
doing the escaping for you
yes you just have to say okay this is
the value and they're doing the escaping
and in case of escaping it would be like
they would use this whole statement i
injected in here as the search term yeah
if i would have implemented this in here
um which means actually
escaping use rm but also which i could
actually add here do not write sql
statements on your own unless you
absolutely have to do that
yeah
just use the library for scale
statements and
make sure that the
content is
escaped
and in some other languages is called
also binding parameters
it's depending on the library you're
using but do not use user content
directly for anything without escaping
it
so if i have to nail down my talk to one
thing
it is like escape everything you get
from a user and you're using
nevertheless where it is
um i'm so sorry i talked so much about
xsl that we didn't come to csrf which is
actually a very very nice topic but i
guess i will just do it the next time
and
thank you very much
what about some questions
i guess somebody wanted to ask a
question but you see muted
ah
that's the second time i've done that to
myself today
happens to all of us all the time
it does it wouldn't be a virtual
conference if someone wasn't muted on
the stream
so because we're running short of time
i'll pull this one in again uh do modern
web frameworks make these mistakes
easier to avoid eg by handling safe and
unsafe data separately yes for example
django is doing a very very good job i
love jungle i love the architecture i
love the security stuff definitely
they're doing it much more simpler but
still
you should know about that because what
actually most of my job is telling
experience about locals why they are
doing this for example csf tokens why
are you using csrf tokens asked with the
developer most of them it's something
with security but um
yeah i think it's very important to know
the reasons behind but they make it
simpler
yeah yeah
i think they also do help you catch a
lot of um
a lot of the easy mistakes that someone
else has already thought about so they
help you out on that front although be
careful some of them definitely make it
easier for you to make a mistake
it depends it really depends so for
example if you have like uh let's put
another very
famous python framework in this flask
which is like actually the complete
opposite from a framework perspective
compared with jungle really huge flask
very very simple you have to think about
these kind of attacks on your own there
if you're not using um special libraries
who have the security already
incorporated so
um yeah be careful but i think like
at least a lot of xss attacks are very
very
um covered by template engines for
example right so i know one good php
library to be honest
um i'm not so much of a php fan although
i had to program in it so but i love the
trick templating engine because they
they they say i'm always escaping i
don't care what you want as a developer
i'm always escaping if you want to
unescape it you have to do some extra
work to get it unescaped but then i'm
telling you this is not secure and i and
i get i think they they gave a warning
in the past so um that's really really
nice there's some libraries who really
emphasize the security concern and say
okay if you do that use you're really
open for security attacks like react is
doing it with dangerously set in html
yeah excellent
well i guess you'll just have to take
your csrf into the hallway track and
have a chat with everyone there
thank you very much and it's been fun
doing debugging from halfway across the
earth while you're live on stream
thank you very much i'm sorry for the
technical problems
i didn't
it had to happen eventually
yeah i thought my website was broken
with all the bugs but
it was the screen sharing
perfect we will be back at half past
four australian eastern time
so we'll see you all shortly