1 of 23

Web Security Architecture 102

Presenter: Hu Xiaoyu, Software Engineer @ VMware

​

2 of 23

Web Security 102

Presentation Outline

  • SSL
  • Authentication
    • Basic HTTP Authentication
    • Basic Form-based Authentication and Cookie
    • OAuth
  • Authorization
  • Password Handling
  • Injection
  • Path Traversal
  • …

3 of 23

Web Security 102

SSL: Secure Sockets Layer

Provide transport layer encryption to prevent sniffing and MITM attack.

​

​

4 of 23

Web Security 102

Basic HTTP Authentication

Basic HTTP Authentication uses HTTP header for authentication, well-supported, and easy to use.

Typical workflow:

  • Client makes first request.
  • Server response with HTTP/1.1 401 Unauthorized WWW-Authenticate: Basic Realm="Access to the staging site".
  • Client requests GET / HTTP/1.1 Authorization: Basic <base64 of username:password>

It requires every request to carry the credentials in plaintext (base64), and requires https to protect it from sniffing or MITM attack.

​

5 of 23

Web Security 102

Form Based Authentication

Typical Workflow:

  • Web client: POST /login with FORM of username + password.
  • Web backend: checks username and password,
    • If successful, sets cookie on web client.
    • If not, returns 401 Unauthenticated.
  • Web client: visits protected resources.
  • If resources returns 401, redirects to /login.

6 of 23

Web Security 102

Form Based Authentication

Cookie:

  • Cookie settings
  • CORS
  • CSRF token

7 of 23

Web Security 102

OAuth

8 of 23

Web Security 102

OAuth

Example workflow:

  • User tries to login your application, submits request to application.
  • Application contacts third-party service, redirects to google login.
  • User logins with Google’s authentication page, then redirects to original application with token.
  • Application gets the token, and requests in the background to verify the token.
  • Application approves user’s login, and uses the token to access protected resources (bearer token).

​

9 of 23

Web Security 102

OAuth

Demo:

https://synapse-trial.uc.r.appspot.com/

​

10 of 23

Web Security 102

Bearer Token

A token in the HTTP “Authorization” header for authentication with application or resource server.

It’s an encrypted token not meaningful to clients.

​

11 of 23

Web Security 102

Bearer Token

A token in the HTTP “Authorization” header for authentication with application or resource server.

It’s an encrypted token not meaningful to clients.

​

12 of 23

Web Security 102

Password Storage

What is password salting:

https://websitesecuritystore.com/blog/what-is-password-salting/

If passwords are saved in plaintext, or as a not well-protected hash, it’s viable to use “rainbow table” attack to map all passwords to their hashes.

​

13 of 23

Web Security 102

Password Storage

Add “salt”: a certain length randomly generated text for more entropy, and saves hashes that are never directly mapped to the hash of the original password.

Use existing libraries. (e.g. bcrypt)

14 of 23

Web Security 102

Password Storage

​

​

For example, with input password abc123xyz, cost 12, and a random salt, the output of bcrypt is the string

​

$2a$12$R9h/cIPz0gi.URNNX3kh2OPST9/PgBkqquzi.Ss7KIUgO2t0jWMUW

\__/\/ \____________________/\_____________________________/

Alg Cost Salt Hash

15 of 23

Web Security 102

Password Storage

Circa 2012:

16 of 23

Web Security 102

Password Storage

Circa 2013:

17 of 23

Web Security 102

Password Storage

Circa 2013:

18 of 23

Web Security 102

Authorization

Authentication (Authn): Decides who you are.

​

Authorization (Authz): Decides what you can do.

​

​

19 of 23

Web Security 102

Injection

Hello my name is Kevin, people also call me ';DROP table users;--

​

​

​

INSERT INTO COMMENTS

where comment='Hi My name is Kevin, people also call me ';DROP table users;--';

20 of 23

Web Security 102

Injection

Command Injection

​

User input for filename: 'videoname.mp4 && rm -rf /videos/;'

​

Server-side execution:

​

​

bash -c 'video_converter videoname.mp4 && rm -rf /videos/*;'

21 of 23

Web Security 102

Injection

  • YAML/JSON parser
  • Pickling
  • Template files
  • Python eval
  • …

​

22 of 23

Web Security 102

Path Traversal

By sending request to directories outside of web service root directory.

​

http://some_site.com.br/get-files?file=../../../../etc/passwd

http://some_site.com.br/../../../../etc/shadow

​

**Mitigation**:

​

- Chroot jails.

- Least permission available for service. (It’s almost always wrong to run with root.)

- Normalize user input.

- Whitelist paths available to the service, validate user input.

23 of 23

Web Security 102

Thank you!

Keep learning…

​

​

​

​

​

​

​

​

​

Contact me:

​