WebSec

Question 1

Cross-Site Request Forgery

Answer 1

1. user logs into bank and gets a session cookie
2. user visits another malicious website that does CSRF:
   e.g:
   form name=”transfer”
   action=”http://bank.com/Transfer.php”
   input name=”recipient” value=”badguy” /input name=”amount” value=”100000”> /form
   script document.transfer.submit(); /script
3. browser send cookie and payment fulfilled

Question 2

Anti-CSRF Token

Answer 2

• includes with every form a random token

- server process only with valid right token

Question 3

Referrer Validation

Answer 3

• check if it’s right URL

- > still head might be suppressed

Question 4

Double Submit Cookies

Answer 4

• gives user 2 cookies
• session and anti-CSRF cookie
• sends anti-CSRF cookie in hidden form field
• > cookie tossing is possible; if attack controls subdomain he might set token value

Question 5

Custom Request Header

Answer 5

• makes a costume XMLHttpRequest headers

- > applications would have to be changed significantly

Question 6

Cross-site Scripting (XSS)

Answer 6

Server Client
Reflected user must visit malicious link
no change to server

Question 7

XSS Mitigation

Answer 7

• use safe library’s
• sanitise input
• detect client side XSS by paterns

Question 8

HttpOnly Cookies

Answer 8

• sends over HTTP(S) cookie which then can’t be accessed by document.cookie

Question 9

Content Security Policy (CSP)

Answer 9

• CSP controls what/from where content can be added
• CSP by default disables inline script and style attributes

e.g.
script-src ‘self’: Only allow JavaScript per files from same origin
img-src ‘self’ img.com: Only allow images from same origin and img.com

Question 10

Command Injection in PHP

Answer 10

e. g.
http: //victim.com/calc.php?number=5 -> 5 user input
http: //victim.com/calc.php?number=5; system(‘rm .’);

Question 11

SQL Injection

Answer 11

e.g.
normal:
SELECT pizza, toppings, quantity, order_day
FROM orders
WHERE userid=4123 AND order_month=10
malicious:
SELECT pizza, toppings, quantity, order_day
FROM orders
WHERE userid=4123 AND order_month=0 OR 1=1

Question 12

Blind SQL Injection

Answer 12

• if feedback from DB table is invisible to attacker

- has to use side channel to learn result

Question 13

Preventing SQL Injection

Answer 13

• use prepared statements
• most times problem is that user code is interpreted as programming code
• use placeholders to guaranteed to be data