Web Application Security

Web application layers

1. Data :Original data: Text, images, files
2. Database : Access, SQL Server, MySQL, ORACLE
3. Code : Perl, php, servelet, jsp, asp
4. Webserver : Apache, IIS, Websphere, Weblogic, Netscape Enterprise
5. User interface Code : Html, Forms, Javascript, Coldfusion
6. Browser
7. Input

Any layer is potentially open to attack!

Top 10 Reason :

• – Unvalidated input
• – Broken access control
• – Broken authentication and session management
• – Cross site scripting
• – Buffer overflows
• – Injection flaws
• – Improper error handling
• – Insecure storage
• – Denial of service
• – Insecure configuration management

Unvalidated input:
– Never trust input from a user
– Malicious user can tamper with anything and try to:

• Cause errors to occur and give up info
• Buffer overflow
• Modify parameters

– Common attacks:

• Modifying URL
• SQL Injection
• Cross Site Scripting
• Session hijacking with cookie modification

Broken access control
Types of attacks:
– Insecure ID (guess IDs)
– Forced browsing past access control checks

• “/client” is checked for access control
• “/client/client1/data” is not
• If someone guesses the full URL….

– Path traversal (../../../)
– File permissions (OS permission + web server permission)
– Client side caching

Authentication and Session Management
– Two main issues, credential management and session hijacking
– Flawed credential management functions:

• Password changes (expiry, etc)
• Forgot my password

– All account management functions should require authentication first

Web applications need to keep track of users
HTTP does not offer session management
Web application must take care of this by session IDs stored in either:

• – Cookies
• – Embedded in the URL
• – Embedded in dynamic web page

Authentication and Session Management: “Session Hijacking”
How is your session ID being generated?
– Time based?
– Sequential?
How do you protect it?
– Integrity with hash?
– Encryption?
– Encode it with easily reversible scheme?
– Timeouts for length of session ID?

Buffer overflows
– Corrupt execution stack of web application
– Cause application to execute arbitrary code
– Very common problem
– Keep your apps and OS patched!

Improper error handling
– Debug messages that can help attacker gain information that can be leveraged into a compromise
– Turn your debug off!
– Personalize error messages to ensure no information is given

Insecure configuration management
– 90%* of breakins can be stopped by properly configuring your web server!
– Don’t do default installations!

Insecure configuration management: Default directories
Dot dot sequence (../../) directory traversal:
– /../../winnt/system32/cmd.exe?/c dir +
Unicode directory traversal
– /..%5c..%5cwinnt/system32/cmd.exe?/c dir +
– /cgi-bin/..%c1%1c..%c1%1c../winnt/system32/cmd.exe?/c +dir
Unicode %5c..%5c=\..\
Unicode %c1%c1..%c1%c1=\..\


How to stop Web application attacks

• – Error message customization
• – Restricted access to sensitive information
• – Patch Web servers
• – Remove the sensitive page from Google
• – Regularly perform application test
• – Deploy a web application firewall
• – Deploy IPS that will analyze application level

Internationalization, Localization & Globalization

Internationalization (i18n)

Internationalization is the process of planning, designing and implementing a “culturally and technically” neutral product, which can easily be localized for various cultures.
Internationalization needs to be addressed in the earliest product planning stages.

i18n stands for the word “Internationalization” The number 18, represents the number of letters found between the “i” and the “n” in the word “Internationalization”.

Localization (l10n)
Localization involves taking a product and making it linguistically and culturally appropriate to the target locale (country/region and language) where it will be used and sold.

It is the adaptation of a system for a particular locale.

This includes localizing

• Measurements (inches to centimeters),
• Degrees (Fahrenheit to Celsius),
• Currencies (US dollar to Indian Rupees),
• Date formats (mm/dd/yyyy to dd/mm/yyyy),
• Regional spelling (color to colour),
• Number format (comma or period to separate thousands)

and other culturally dependent information.

Globalization (g11n)
Globalization addresses the business issues associated with taking a product global.
In the globalization of high-tech products this involves integrating localization throughout a company, after proper internationalization and product design, as well as marketing, sales, and support in the world market.

Globalization in the broadest sense encompasses both internationalization and localization, as well as putting into place the requisite materials, financial, and personnel resources in a global market to support your product or service on a local level.

so, g11n = i18n + l10n, :)

Reference :
http://teck.in/internationalization-localization.html