Web Applications
Free Webinar
Alonso Eduardo Caballero Quezada
Consultant in Ethical Hacking, Forensic Computing & GNU / Linux
Website: http://www.ReYDeS.com
e-mail: ReYDeS@gmail.com
Thursday, November 5, 2015
Presentation
Alonso Eduardo Caballero Quezada is EXIN Ethical Hacking Foundation
Certificate, LPI Linux Essentials Certificate, Brainbench Certified Network
Security (Master) , Computer Forensics (US) & Linux Administration
(General), IT Master Certificate of Achievement in Network Security
Administrator, Hacking Countermeasures, Cisco CCNA Security,
Information Security Incident Handling and Digital Forensics.
He has been an Instructor in the OWASP LATAM Tour Lima, Peru in 2014, and
Lecturer in PERUHACK 2014. He has more than twelve years of
experience in the area and for eight years he has worked as a Consultant
Independent Instructor in the areas of Ethical Hacking & Computing
Forensic. He belonged for many years to the international security group
RareGaZz and the Peruvian Security Group PeruSEC. He has taught
face-to-face and virtual courses in Ecuador, Spain, Bolivia and Peru,
also presenting constantly at exhibitions focused on
Ethical Hacking, Forensic Computing, GNU / Linux and Free Software.
@Alonso_ReYDeS [19659002] http://bit.ly/2Smw5lJ
pe.linkedin.com/in/alonsocaballeroquezada/
Most Common Vulnerabilities in Web Applications
What do attackers typically look for when evaluating a
application? Web?. The problems are usually copious, but they can
be grouped into a few categories.
"Open Web Application Security Project" – OWASP has done a great
job in documenting with a general consensus the vulnerabilities of
security in most critical web applications.
His "Top Ten Project" is very interesting, which provides a regularly updated list
of security issues in web applications.
The examples below show some of these
OWASP categories .
1. Cross-Site Scripting (XSS)
2. Injection Flaws (SQLi)
3. Cross-Site Request Forgery (CSRF)
* OWASP – http://www.owasp.org
Cross-Site Scripting
Cross-Site Scripting attacks rely on validation deficiencies
/ exit in web applications. However, unlike
other types of attack, the goal of XSS is not the application itself,
but the other users of the vulnerable application.
For example, a malicious user can publish a message in a
web application "Guest Book" with an executable content. When
another user visualizes this message, the browser will interpret the code and
will execute it, giving control to the attacker over the system of the second
user. Therefore the load of an XSS attack typically affects the
end-user application.
A properly executed XSS can be devastating to a
web application, as well as to the reputation of the organization. A
XSS may generate account hijacking and sessions or cookie theft.
OWASP describes XSS attacks in good technical detail.
* XSS OWASP – http://bit.ly/1fKcTJ6. php / XSS
SQL Injection
Modern web applications rely on dynamic content. This is
achieved by retrieving updated data from a Database or an
external service. In response to a request for a web page, the
application will generate a query, sometimes incorporating portions
of the request within the query.
If the application is not careful in the way it builds the query,
an attacker can alter the query, modifying how it is
processed by the external service.
These injection failures can be devastating , because the service
sometimes relies completely on the web application, and almost always
hidden "safe" behind some firewalls.
One of the most popular platforms for storing web data is SQL,
] and many web applications are based entirely on scripts
front-end which simply query a SQL database, either
either on the same web server or on a separate back-end system.
SQL Injection (Cont.)
One of the most efficient mechanisms to do this is the technique
called SQL Injection. While the injection failures affect
any type of external devices, SQL Injection is by far the most prevalent and popular
failures.
A SQL Injection is related to raw SQL queries
inside an application to perform an unexpected action. Some
times, existing queries are simply edited to achieve the
same results – SQL is easily manipulated by the location of
even a single character in a selected location with success, causing
pretty malicious behavior query. Some of the characters
commonly used for these input validation attacks
include the single quote ('), double hyphen (-), and semicolon (;). All
these with a special meaning in SQL.
OWASP describes SQL Injection attacks in good technical detail.
* SQL Injection OWASP – http://bit.ly/1iLOzY3 [19659002] Cross Site Request Forgery
CSRF vulnerabilities have been known for a decade, but
have recently been recognized as quite a serious issue.
The concept of a CSRF is simple: a web application provides the
users a persistent session authentication, in this way there is no
need to authenticate again each time a page is requested.
But if an attacker can convince the user's web browser to
send a request to a website, he can take advantage of the persistent
session to perform actions instead of the victim. The result is
a variety of situations: password change for an account,
money transfer, merchandise purchase, and more.
A CSRF is easy to exploit. An attacker inserts an "image" tag
into a web page, when the victim loads the page, his
browser will send the GET request to load the link inserted in
this tag.
OWASP describes with good technical detail CSRF attacks.
* CSRF OWASP – http://bit.ly/1g9Lu1M
Chacking Virtual Course Web Applications
More Information: http: // www .reydes.com / d /? q = Curso_de_Hacking_Aplicaciones_Web
E-mail: caballero.alonso@gmail.com / Website: http://www.reydes.com
Virtual Courses
All Virtual Courses Dictations are available on Video.
Virtual Course on Ethical Hacking
http://bit.ly/2Ace0zJ
Virtual Course on Hacking Web Applications
http: // www .reydes.com / d /? q = Course_of_Hacking_Applications_Web
Virtual Course of Forensic Computing
http://bit.ly/2ShZSfm Forensic
More Contents
Videos of 30 Free Webinars on Ethical Hacking, Hacking
Web Applications and Forensic Computing
http://bit.ly/2ePHBEk
Slides used in Free Webinars.
http://bit.ly/2AhVMwx
Published articles and documents
http://bit.ly/2SklNlW ? q = node / 2
My Blog on topics of my interest.
http://bit.ly/2AiNiFv
Demonstrations
.
Vulnerabilities in
Web Applications
Free Webinar
Alonso Eduardo Caballero Quezada
Consultant in Ethical Hacking, Forensic Computing & GNU / Linux
Website: http://www.ReYDeS.com
e-mail: ReYDeS@gmail.com
Thursday November 5, 2015
from Nettech Post http://bit.ly/2St06QZ
No hay comentarios:
Publicar un comentario