week02

COMP6443

Thanks Lachlan+Andrew for some of the slides

Good Faith Policy

We expect a high standard of professionalism from you at all times while you are taking any of our courses. We expect all students to act in good faith at all times.

TLDR: Don’t be a dick

sec.edu.au/good-faith-policy

Admin

  • Challenges
  • Create report groups (will do later)
  • Correction: Points to not necessarily indicate difficulty

Challenges

  • Flags for approximately a CR
    • Sales flag
    • 3 Blogs
    • Files
    • Support
  • Due Sunday 3/3

Content

  • HTTP + TLS
  • Authentication
    • Sessions
    • Tokens (JWT, Flask, Express etc)
    • Cookies
  • Authorization
    • Permission control
  • IDOR

Authentication

  • Verifying that your identity is authentic
  • Factors of authentication are something you
    • Know (e.g. Password)
    • Are (e.g. Biometric)
    • Have (e.g. Hardware Key + Cookie)
  • Status Code 401 Unauthorized
    • When no valid authentication is sent

Authentication

Cookies

  • Cookies are used for session persistence
  • Usually authentication data + other data
    • Session
    • Authentication Token
    • Ad tracking (still identification)
  • Set (and stored) by the server and sent to the client
  • Stored by the client and sent to the server
  • Target for hackers, why?

Authentication

How 2 Hax Cookies

  • Cookies are used as authentication
  • Can be stolen using:
    • Cross-site scripting (XSS)
    • MITM attacks
    • Cross-site request forgery (CSRF)
  • Can be forged (baked)
    • Poor implementation (e.g. incremental/plaintext)
    • Unsigned

Authentication

  • Expiry
  • HttpOnly (prevents XSS)
  • Secure (prevents MITM)
  • SameSite (prevents CSRF)

Authorization

  • Controlling who has access to what (policy)
  • Principle of least privilege
  • Used with authentication to restrict access
  • Status Code 403 Forbidden

IDOR

Insecure Direct Object Reference Vulnerability

  • Examples of an object
    • Users
    • Pages
    • Groups
  • Attackers can access/modify objects
  • Can be exploited when lacking authn/authz
  • Often due to deterministic ids

Preventing IDOR

  • Use non-deterministic ids (e.g. UUIDs)
  • Strong authorisation policies
    • Restrict access
    • Constantly verify

Tools

Note: There will always be better tools, go find them

Questions?

  • Did I miss something?
  • More depth?