Cross Site Request Forgery and Same Origin Policy

There has definitely been an increase in the number of conversations around XSS and CSRF.  If you are looking to understand the basics of this attack, this is an excellent article....

Same-Origin Policy Part 1: Why we’re stuck with things like XSS and XSRF/CSRF

OWASP 2008 NYC

The agenda for OWASP 2008 in New York has been posted.

OWASP Agenda

Should be a great show!

PHPCharset Encoder

This tool helps you encoding arbitrary texts to and from 65 kinds of charsets. Also some encoding functions featured by JavaScript are provided.

http://h4k.in/encoding/index.php

Microsoft Source Code Analyzer for SQL Injection tool

[RIP]The Microsoft Source Code Analyzer for SQL Injection tool is a static code analysis tool that helps you find SQL injection vulnerabilities in Active Server Pages (ASP) code. This article describes how to use the tool, the warnings that are generated by the tool, and the limitations of the tool. See the tool Readme document for more information.

[ Download ] 

Chronology of Data Breaches

This is a very interesting site which I feel provides some great information.  [RIP]  The Privacy Rights Clearinghouse (PRC) is a nonprofit consumer organization with a two-part mission -- consumer information and consumer advocacy. It was established in 1992 and is based in San Diego, California. It is primarily grant-supported and serves individuals nationwide.

http://www.privacyrights.org/ar/ChronDataBreaches.htm#CP

Coolest thing since sliced cheese

If you're using Outlook, this is a really nice tool.  Finally....a tool that actually helps with email!

http://www.xobni.com/

LifeCycle Security

A friend of mine [and group of renegade badasses] has started a new security conference based around Web Application Security.  If you are going to be at Blackhat next month, be sure to get hooked up for this show.  Also...if you are a member of OWASP, please feel free to use this invitation for free admission.

++++++++++++++++++++++

We would like to make a special offer to you and the people at OWASP as our way of thanking you for your support of our Lifecycle Security (web application security)Conference which we are holding the day after Blackhat-Vegas on August 8-9, 2008 at the Las Vegas Ceasar's Palace.

 

FREE ADMISSION (normal price is $350) for the first 100 people who register by sending an email to freeoffer@LifeCycleSecurity.com with:

 

• Name:
• Company:
• Address:
• E-mail:

 

We plan to open this up to other lists later in the week, but we want to give OWASP members "first shot" at the free admission.  (There are only 100 free admission tickets.)  Our goal is to create a community where Application Security professionals can share information on an on-going basis.

 

We have Ounce, Proactive, Price Waterhouse, Modsecurity, Microsoft, Safe Channel, OWASP and Verizon involved in our Penetration Testing, Policy/Compliance/Solutions and a Vendor Tracks.

 

Thanks once again for your support.

 

Dennis

Introducing HP Scrawlr

Interesting posting from the folks at HP Security Labs. Not sure if this is as capable as other SQL injectors already out there, but worth a look. Interesting note that they are packaging the Intelligent Engines on the backend with this tool.

[rip from HP blog site]

Scrawlr, developed by the HP Web Security Research Group in coordination with the MSRC, is short for SQL Injector and Crawler. Scrawlr will crawl a website while simultaneously analyzing the parameters of each individual web page for SQL Injection vulnerabilities. Scrawlr is lightning fast and uses our intelligent engine technology to dynamically craft SQL Injection attacks on the fly. It can even provide proof positive results by displaying the type of backend database in use and a list of available table names. There is no denying you have SQL Injection when I can show you table names!

• Technical details for Scrawlr
• Identify Verbose SQL Injection vulnerabilities in URL parameters
• Can be configured to use a Proxy to access the web site
• Will identify the type of SQL server in use
• Will extract table names (verbose only) to guarantee no false positives
• Scrawlr does have some limitations versus our professional solutions and our fully functional SQL Injector tool
• Will only crawls up to 1500 pages
• Does not support sites requiring authentication
• Does not perform Blind SQL injection
• Cannot retrieve database contents
• Does not support JavaScript or flash parsing
• Will not test forms for SQL Injection (POST Parameters)

You can download Scrawlr by visiting the following link:

https://download.spidynamics.com/products/scrawlr/

A Risk Management-Based Approach to Web Application Security

At the end of the day, it all comes down to the Software Development Life Cycle (SDLC).  All vulnerabilities, big or small, can be traced back to a few lines of code written by a Developer who was hoping to achieve a bit of functionality.  According to Gartner, “By 2009, 80 percent of companies will have suffered an application security incident”.  The significance of this statement is astounding, due to the fact that most organizations rely heavily on their web presence for daily e-survival. 

While the majority of organizations have yet to merge their development and security processes, the move towards producing secure Web Applications is absolutely critical.  Unfortunately, most Development, Quality Assurance and Information Security teams operate in isolated communities and are rarely driven by the sentiment that security is fundamental for all parties involved.  Ultimately, the goal for any organization is to exist with a strong, well-defined process to the SDLC; however, development of such a program can be quite overwhelming - even for the most mature organizations.

Risk Management provides a structured process for identifying, assessing and quantifying risk for an environment.  By applying a Risk Management-based approach, your organization will be able to kick-start its program and achieve success through a more palatable set of goals.

Through this approach, several significant variables are quantified in an effort to understand the threat against your Web Application infrastructure.  These variables include:

1. Asset Value (AV)
2. Vulnerability Severity (VS)
3. Likelihood of Threat (TH)
4. Applied Countermeasures (CM)
5.  Weighted Value for severity of vulnerabilities (WV)

The end-result of this program is to achieve an overall Risk Score (RS), which will aid in measuring compliance for your security policy and posture.  

[ Download Paper ] 

Web Security 101

Over the past few weeks, I've read several posts from folks around the industry on how to secure web applications and I've read many interesting viewpoints. In my opinion, there are seven basic ideas that I believe any security professional should carry with them for web applications.

1. Test Everything!

   The first concept for every security professional is to test everything. There is no amount of testing that can be accomplished -- test and simply keep testing. Just because you ran one scan with some tool and reviewed the results....testing should not end. What was once a very secure application could absolutely be compromised tomorrow.

2. Secure the foundation

   Web Applications are nothing more than applications running on an Operating System so as such, it is still absolutely critical to secure the environment that they live in.

3. Encrypt your data

   Use of data encryption may be utilized in a number of areas within your architecture. Whether you are using SSL certificates to data encryption on the database to the file system. I'm not sure I have the ability to recommend the "type" of encryption, but use of encryption is highly recommended.

4. Input Validation

   With Application Security vulnerabilities, the majority of the vulnerabilites lie with poor input validation. Using input validation with all areas of the application is absolutely critical. If you have the ability to discover tools that will perform Input Analysis on your application prior to going live, I would highly recommend employing them. For those not familiar with Input Analysis techniques, these are solutions that will search for any component of your application where input is taken in (controls, form fields, etc) and assists with the validation of those points.

5. Strong Authentication

   Authentication is key to applications and the use of strongly authenticated users or sessions is necessary. If strong authentication is not always an option, at the very least, please encourage your users (or security policy) to use strong passwords.

6. Control Access to the Application

   As discussed in our AJAX post, validation of data is a very difficult aspect of security around your web application. The idea that we are able to validate every single request to your web application is sometimes difficult, however, it's my recommendation to your best with this.

7. Session Management

   Session Management is yet another very serious aspect of securing your web application. Points of weakness for many web applications is found when developers make some great attempt to start creating their own session management schemes.  Three words that I have for you: 1) Cryptographically Strong, (2) Random, (3) strong protection.

Again, these are only a few thoughts that I'm throwing around here ....there are a thousand other things that could be considered so please don't consider this the almighty list [no flames, please].