Web Application Hacking 101

Explore how cookies and session IDs identify users, and learn to secure cookies using attributes like secure, domain, and expires to prevent session hijacking and cross-site scripting.

Learn how session management uses random session IDs stored in cookies, transmitted over SSL, with proper timeouts and session invalidation on login and logout to prevent session hijacking.

Explore reflected cross-site scripting, a non-persistent attack where a malicious payload reflects from the server in a single http response after a crafted link, executing in the victim’s browser.

Learn how stored cross-site scripting injects malicious scripts into web pages, stores them in the database, and executes on users' browsers to steal cookies and hijack sessions.

Learn to mitigate cross-site scripting attacks by enforcing whitelist input filtering, performing strong server-side validation, and applying output sanitization and encoding to neutralize scripts, while using secure cookie attributes.

Explore dom-based cross-site scripting by showing how a malicious name input alters the document object model and executes a payload in the victim’s browser, and learn client-side sanitization.

Learn how clickjacking, or ui redress, uses transparent frames to hijack clicks and trigger actions, and how frame busting and x-frame-options prevent framing.

Test web applications for clickjacking by loading them in an iframe with a testing tool, verify x-frame-options and frame busting protections, as shown with a utility app and Facebook.

Explore attacking flash applications in the browser by covering flash basics, action script versions, inputs via embedded or object tags, and unsafe functions plus global variables.

Decompile flash files to access source code and identify flash receivers, then use Flair, Estabrooks, and SWF scan tools to analyze vulnerabilities for white-box testing of web applications.

Discover how cross-site scripting arises in flash applications by abusing global variables and the JavaScript context, enabling attackers to load payloads, steal cookies, and compromise user data.

Learn how cross-site flashing lets flash content load from another domain, risking credential theft, UI changes, and bypassed access controls through malicious swf loaded with a load movie.

Analyze how flash applications mishandle user-supplied data, enabling HDMI injection to inject content and modify the UI, including fake login pages and JavaScript actions.

Phishing through flash redirects shows how a flash button leads to spoofed sites to steal credentials, disguising links and routing via a get url value.

Analyze the impact of Flash attacks such as phishing and cross scripting and outline mitigations for embedding Flash, script access and networking controls, data validation, and using updated Flash versions.

Explore XPath basics to query and navigate XML documents using root, child, and descendant nodes. Learn XPath syntax, predicates, location steps, and common functions for precise data extraction.

This lecture introduces XPath injection, showing how user input can alter XML queries on login pages, and demonstrates blind and standard techniques with a focus on server-side input validation.

Learn the basics of XSLT, the extensible stylesheet language for transforming XML documents. Explore the template match element, select, and apply template to format XML data.

Explore XSLT injection and its risk of cross-site scripting and code execution by transforming external Excel data with malicious access files. Learn mitigations like strict input validation and file whitelisting.

Master XML basics: understand it as a markup language that describes data, not its display; learn root and child elements, attributes, nesting, and DTDs with PC data and CD data.

Explore XML CDATA injection techniques to bypass markup filters and deliver cross-site scripting payloads, demonstrating browser execution and medium-risk impact in web applications.

Learn about XML external entity injection (ex-im) and how external entities access local or remote files, enabling attackers to read sensitive data and creating high-risk impact.

Explore how XML entity expansion attacks exploit doctype declarations and DTD entities to trigger massive recursive expansions, overwhelming server resources and causing denial of service.

Learn the basics of web services, including service oriented architecture, SOAP messages, WSDL, and UDD, and how a service consumer and provider exchange data.

Explore web services attacks across application specific, axemen, and soft categories, including sql injection, os command injection, and file upload abuses. Apply encryption and strong session management to deter threats.

Explore how web service clients interpret wsdl files to interact with web services, perform manual security testing, and test operations like get user, create user, update user, and delete user.

Demonstrate SQL injection in web services by injecting payloads into login requests to bypass authentication and expose vulnerable queries. Learn to test web service endpoints and read SQL syntax errors.

Learn to identify command injection in web services requests, where unsafe user input triggers OS commands, with demonstrations of local host commands and DNS lookups.

Demonstrate how a SOAP array can trigger a denial of service by memory exhaustion and how strict schema validation, including a defined maximum element count in XML schema, mitigates it.

Learn how soap action header manipulation lets attackers bypass authentication by misrouting requests to view user while executing delete user operations, and how to mitigate by validating header and body.