Security Training for Web Developers

# OWASP Juice Shop

## What is OWASP Juice Shop?
						<ul>
							<li class="fragment fade-in">Intentionally insecure web application</li>
							<li class="fragment fade-in">Developed for security training</li>
							<li class="fragment fade-in">Includes all Web Application Security Risks from OWASP Top 10</li>
						</ul>

## Architecture
						<img data-src="images/juiceshop_arc.png">
						<ul>
							<li class="fragment fade-in">JavaScript Application</li>
							<li class="fragment fade-in">Written in Node.js, Express and Angular</li>
							<li class="fragment fade-in">SQLite as database</li>
						</ul>

## Main page of OWASP Juice Shop
						<img data-src="images/juiceshop_home.png">

## Score board
						<img data-src="images/juiceshop_scoreboard.png" style="width:75%">

## Challenges
						<ul>
							<li class="fragment fade-in">OWASP Juice Shop contains several hacking challenges</li>
							<li class="fragment fade-in">Challenges belong to different vulnerability categories</li>
							<li class="fragment fade-in">Challenges have different difficulties</li>
							<li class="fragment fade-in">Solved challenges are tracked on the score board</li>
						</ul>

# Security Tools

## Web Development Tools
						<img data-src="images/firefox.png" style="width:25%">
						<img data-src="images/chrome.png" style="width:25%">

### Inspector / Elements
						Shows HTML source code. Might reveal hidden or commmented out elements
						<img data-src="images/firefox.png" style="width:8%">
						<img data-src="images/firefox_inspector.png" style="width:50%"> 
						<img data-src="images/chrome.png" style="width:8%">
						<img data-src="images/chrome_inspector.png" style="width:50%">

### Console
						Shows HTTP requests like GET and POST 
						Reveals construction of session token and JSON data
						<img data-src="images/firefox.png" style="width:8%">
						<img data-src="images/firefox_console.png" style="width:50%"> 
						<img data-src="images/chrome.png" style="width:8%">
						<img data-src="images/chrome_console.png" style="width:50%">

### Debugger / Sources
						Shows business logic that could include hidden indexes, functions or algorithms 
						<img data-src="images/firefox.png" style="width:8%">
						<img data-src="images/firefox_debugger.png" style="width:50%"> 
						<img data-src="images/chrome.png" style="width:8%">
						<img data-src="images/chrome_debugger.png" style="width:50%">

### Storage / Application
						Allows manipulation of active session 
						<img data-src="images/firefox.png" style="width:8%">
						<img data-src="images/firefox_storage.png" style="width:50%"> 
						<img data-src="images/chrome.png" style="width:8%">
						<img data-src="images/chrome_storage.png" style="width:50%">

## [OWASP Zed Attack Proxy](https://github.com/zaproxy/zaproxy/wiki/Downloads)
						<img data-src="images/zap.png">
						<ul>
							<li class="fragment fade-in">Open Source Web Application Security Scanner</li>
							<li class="fragment fade-in">Written in JavaScript</li>
							<li class="fragment fade-in">Available for Windows, Linux and Mac OS X</li>
						</ul>

### Features
						<ul>
							<li class="fragment fade-in">Automated scanner to detect security vulnerabilities</li>
							<li class="fragment fade-in">Fuzzer</li>
							<li class="fragment fade-in">Forced Browsing</li>
							<li class="fragment fade-in">Web Indexing</li>
						</ul>

### Automated scan of OWASP Juice Shop
						<img data-src="images/zap2.png" style="width:75%">

## [Postman](https://www.getpostman.com/apps)
						<img data-src="images/postman-logo.png" style="width:25%">
						Tool for API development

### Features
						<ul>
							<li class="fragment fade-in">Sending HTTP requests with custom variables</li>
							<li class="fragment fade-in">Saving responses</li>
							<li class="fragment fade-in">Automate testing with Collections</li>
							<li class="fragment fade-in">API Monitoring</li>
						</ul>

### Sending a GET request to OWASP Juice Shop
						<img data-src="images/postman.png" style="width:65%">

### Sending a POST request to OWASP Juice Shop
						<img data-src="images/postman2.png" style="width:65%">

# Broken Access Control
						<img data-src="images/bac.jpeg" style="width:50%">

## Issue

<ul>
						 <li class="fragment fade-up">Security flaws caused by fragile implemented access rights</li>
						 <li class="fragment fade-up">The decision whether an user is allowed to call a certain resource depends on factors like the confidentiality of the requested source and the role of the requesting user</li>
						</ul>

## Impact
						<ul>
						 <li class="fragment fade-up">Unauthorized users are able to take over the administration</li>
						 <li class="fragment fade-up">Unauthorized users can obtain, manipulate or delete important and sensitive data</li>
						</ul>

## Access Control Models
						<ul>
							<li class="fragment fade-in">Discretionary Access Control (DAC)</li>
							<li class="fragment fade-in">Role Based Access Control (RBAC)</li>
							<li class="fragment fade-in">Mandatory Access Control (MAC)</li>
							<li class="fragment fade-in">Attribute-based Access Control (ABAC)</li>
						</ul>

## Discretionary Access Control (DAC)

Authorization based on user
						Access control is defined for every single user

## Role Based Access Control (RBAC)

Authorization based on group permissions
						User is part of a group

## Role Based Access Control (RBAC)
						### Group examples
						<ul>
							<li class="fragment fade-in">Standard user</li>
							<li class="fragment fade-in">Network administrator</li>
							<li class="fragment fade-in">System administrator</li>
							<li class="fragment fade-in">Webmaster</li>
						</ul>

## Mandatory Access Control (MAC)
						<img data-src="images/bac_mac.gif" style="width:40%">

Authorization based on permissions and resource sensivity
						System administrator defines the secrecy level of resources

## Attribute-based Access Control (ABAC)
						TODO

<h2 style="color:#ff0000">Challenge time</h2>

Browse to the [Github Repository](https://github.com/nt-ca-aqe/thesis-ahs/tree/master/Challenge%201:%20Broken%20Access%20Control) and solve the challenges in the Broken Access Control 						section.

## Prevention
						TODO

## Implementation in Spring Boot
						<img data-src="images/spring_rbac1.png" style="width:70%">
						By clicking on Administration Section, the user is forwarded to Login

## Implementation in Spring Boot
						<img data-src="images/spring_rbac2.png" style="width:80%">
						A login with user standarduser of role USER won't show administration section

## Implementation in Spring Boot
						<img data-src="images/spring_rbac3.png" style="width:80%">
						This leads to a permission denied site with error code 403

## Implementation in Spring Boot
						 <pre><code>
@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

@Autowired
    private AuthenticationEntryPoint authEntryPoint;

@Override
    protected void configure(HttpSecurity http) throws Exception {

http.httpBasic().authenticationEntryPoint(authEntryPoint);

http.authorizeRequests().antMatchers("/", "/login", "/logout", "/css/**").permitAll();

http.authorizeRequests().antMatchers("/userInfo").access("hasAnyRole('ROLE_USER', 'ROLE_ADMIN')");

http.authorizeRequests().antMatchers("/admin").access("hasRole('ROLE_ADMIN')");

http.authorizeRequests().and().exceptionHandling().accessDeniedPage("/403");

http.authorizeRequests().and().formLogin()//
 .loginProcessingUrl("/j_spring_security_check")
 .loginPage("/login")//
 .defaultSuccessUrl("/userInfo")//
 .failureUrl("/login?error=true")//
 .usernameParameter("username")//
 .passwordParameter("password")
 .and().logout().logoutUrl("/logout").logoutSuccessUrl("/logoutSuccessful");
 }
}
						 </code></pre>

## Implementation in Spring Boot
						Permissions are defined in class WebSecurityConfig
						This class defines, which role a user needs to access a certain site
						Examples for Roles are:
						<ul>
							<li class="fragment fade-in">ROLE_USER</li>
							<li class="fragment fade-in">ROLE_ADMIN</li>
						</ul>

# Broken Authentication
						<img data-src="images/brokenauth1.png">

## Issue

Insufficient conception of identity and access control
						The consequences are insecure session management and authentication

## Impact

Attackers are able to:
						<ul>
							<li class="fragment fade-in">obtain sensitive data (passwords, credit card information)</li>
							<li class="fragment fade-in">overtake sessions of another users</li>
							<li class="fragment fade-in">perform identity theft</li>
							<li class="fragment fade-in">gain access to administrator accounts</li>
						</ul>

## Brute-force attack

<img data-src="images/brokenauth_bruteforce2.jpg" style="width:45%">
						The Brute-force attack is an automated process with the intention of determining passwords

## Brute-force attack
						<img data-src="images/brokenauth_bruteforce3.png">
						By testing random strings or number combinations, the attacker tries to gain access to an account or a server

## Brute-force attack
						<img data-src="images/brokenauth_bruteforce5.png" style="width:45%">
						Attackers use public lists with often used, as unsecure considered passwords. Examples are:
						<ul>
							<li class="fragment fade-in">password</li>
							<li class="fragment fade-in">admin</li>
							<li class="fragment fade-in">abc123</li>
						</ul>

## Brute-force attack
						<img data-src="images/brokenauth_bruteforce4.jpg" style="width:45%">
						Brute-force attacks can be executed with security tools like OWASP ZAP

## Brute-force attack
						<img data-src="images/brokenauth_bruteforce.gif">
						As you can see in the illustration, OWASP ZAP is testing different password combinations

# Session Hijacking
						<img data-src="images/brokenauth_sessionhij1.png">

<h2 style="color:#ff0000">Challenge time</h2>

Browse to the [Github Repository](https://github.com/nt-ca-aqe/thesis-ahs/tree/master/Challenge%202:%20Broken%20Authentication) and solve the challenges in the Broken Authentication section.

## Prevention
						### Implement password validation
						Do not allow registration with weak passwords
						<ul>
							<li class="fragment fade-in">without defining a minimum length</li>
							<li class="fragment fade-in">without uppercase</li>
							<li class="fragment fade-in">without digit characters</li>
							<li class="fragment fade-in">without special characters</li>
						</ul>
						Also, list every reason for validation failure

## Prevention
						### Prevent Brute-force attacks
						Block user login after too many attempts
						<ul>
							<li class="fragment fade-in">Lock the attacked user account</li>
							<li class="fragment fade-in">Block the attacking IP address</li>
						</ul>

## Prevention
						### Use generic error messages
						<img data-src="images/wrong.png" style="width:17%">
						<img data-src="images/brokenauth_login_wrong.png" style="width:37%">
						<img data-src="images/right.png" style="width:17%">
						<img data-src="images/brokenauth_login_right.png" style="width:37%">

## Prevention
						### Use multi-factor authentication
						<img class="fragment fade-in" data-src="images/brokenauth_multifactor.png" style="width:70%">

## Prevention
						### Implement a secure password reset mechanism
						<ul>
							<li class="fragment fade-in">Use at least two different security questions</li>
							<li class="fragment fade-in">Lock the user account if security questions are answered wrong several times</li>
							<li class="fragment fade-in">Send the link for password resetting within an email or SMS</li>
						</ul>

## Prevention
						### Session Management
						Assign a generic identifier to the Session ID
						<img data-src="images/wrong.png" style="width:5%">
						PHPSESSID
						<img data-src="images/right.png" style="width:5%">
						id
						Session ID might contain information about used technologies or user accounts

## Prevention
						### Session Management
						Let Web Application Frameworks handle Session Management
						<img class="fragment fade-in" data-src="images/brokenauth_javaee.png" style="width:20%">
						<img class="fragment fade-in" data-src="images/brokenauth_aspnet.png" style="width:20%">

## Prevention
						### Session ID handling
						<ul>
							<li class="fragment fade-in">Session ID should at least have a length of 128 bits</li>
							<li class="fragment fade-in">Don't pass Session ID in the URL</li>
							<li class="fragment fade-in">Use HTTPS and TLS for entire session to protect the Session ID</li>
						</ul>
						<img class="fragment fade-in" data-src="images/brokenauth_https.png" style="width:25%">

## Implementation in Spring Boot
						User tries a registration with password "abc"
						<img data-src="images/spring_password1.png" style="width:70%">

## Implementation in Spring Boot
						Password validation prints every failure reason
						<img data-src="images/spring_password2.png" style="width:70%">

## Implementation in Spring Boot
						 <pre><code>
 private boolean isPasswordValid(final String password, Errors errors) {
 final PasswordValidator validator = new PasswordValidator(Arrays.asList(
 new LengthRule(8, 30),
 new UppercaseCharacterRule(1),
 new DigitCharacterRule(1),
 new SpecialCharacterRule(1)));
 final RuleResult result = validator.validate(new PasswordData(password));
 for (int i = 0; i < result.getDetails().size(); i++) {
 errors.rejectValue("password", result.getDetails().get(i).getErrorCode());
 }
 if (result.isValid()) { 
 return true;
 }
 return false;
 }

</code></pre>

## Implementation in Spring Boot
						Passwort validator checks if the given password has:
						<ul>
							<li class="fragment fade-in">between 8 and 30 characters</li>
							<li class="fragment fade-in">at least one uppercase character</li>
							<li class="fragment fade-in">at least one digit character</li>
							<li class="fragment fade-in">at least one special character</li>
						</ul>

# Injection

## Issue
						Untrusted data with malicious is sent to an interpreter as part of a command or query.
						The interpreter executes the manipulated query

## Impact
						Disclosure to unauthorized parties
						Data loss or manipulation
						Denial of access

## SQL Injection

<h2 style="color:#ff0000">Challenge time</h2>

Browse to the [Github Repository](https://github.com/nt-ca-aqe/thesis-ahs/tree/master/Challenge%203:%20Injection) and solve the challenges in the Injection section.

## Prevention of SQL Injection
						Prepared Statements
						Stored Procedures
						White List Input Validation
						Escaping All User-Supplied Input

## Prepared Statements
						 <pre><code>
						<?php
						$pdo = new PDO('mysql:host=localhost;dbname=test', 'username', 'password');
						if(isset($_GET['id'])) {
						$id = $_GET['id'];
						} else {
						die("Bitte eine ?id übergeben");
						}
						$statement = $pdo->prepare("SELECT * FROM users WHERE id = ?");
						$statement->execute(array($id));
						while($row = $statement->fetch()) {
						echo $row['firstname']." ".$row['lastname']." ";
						echo "E-Mail: ".$row['email']." ";
						}
						?>
						 </code></pre>

## Stored Procedures
						 <pre><code>
						CREATE PROCEDURE SelectAllUsers
						AS
						SELECT * FROM Users
						GO;
						EXEC SelectAllUsers;
						 </code></pre>

## White List Input Validation
						 <pre><code>
						String tableParam;
						switch(PARAM):
						case "Value1": tableParam = "Drinks";
						break;
						case "Value2": tableParam = "Meals";
						break;
						default	: throw new InputValidationException("unexpected value provided for table param");
						 </code></pre>

## Escaping All User-Supplied Input
						TODO