Web Security: A Hands-on Approach

Learn the cross-site request forgery attack, its exploitation and vulnerabilities, and implement countermeasures while hands-on practicing in a seed lab using a containerized social network site.

Explore cross-site request forgery (CSRF), how browsers attach cookies to requests, and how session cookies enable hijacking. Examine an inside home scenario with private IP devices vulnerable to such attacks.

Explains csrf attacks on get requests, using url parameters and image tricks, contrasts get and post methods, and demonstrates defenses in a social network lab.

Learn how CSRF attacks target POST services by forging hidden form submissions to modify a victim's profile, using a malicious page to trigger POST requests and inspect traffic.

Explore CSRF and how browsers attach cookies across sites; implement defenses with session tokens and same-site cookies (lax and strict) to verify legitimate requests.

This lecture guides you through cross-site request forgery concepts with review questions and hands-on labs, discussing how IDs, random values, and cookie or token approaches influence cross-site request forgery attacks.

Examine cross-site scripting attacks as a form of code injection and view a live demo and lab. Learn defenses, including content security policy, to counter these threats.

Explore how cross-site scripting injects code into user data, either reflected or stored, so JavaScript runs in the victim’s browser and can deface pages or alter server data.

Learn how a profile injection attack auto-adds a friend by exploiting session tokens and timestamps in Ajax requests, and why server-side defenses beat client-side countermeasures.

Demonstrates how to modify a victim’s profile by crafting a form payload and submitting via ajax, using hidden fields, tokens, and user IDs, while stressing the crucial profile-ownership check.

Examine how a self-propagating XSS worm spreads across social networks by copying its payload into profiles, propagating to others through the DOM and getElementById techniques.

Identify the fundamental problems of mixing code and data from untrusted input. Explore countermeasures that separate code from data and use sandboxed iframes with restricted privileges.

Explore how content security policy (CSP) labels code by origin to prevent mixing data and code, defend against cross scripting attack, and control inline versus linked scripts via header policies.

Explore how cross-site scripting generalizes from trusted web data to hybrid mobile apps. See how CSP defends against code injected from outside sources like QR codes, wifi, and SMS.

Explore cross-site request versus cross-site scripting, their attack patterns, and countermeasures like tokens and content security policy (CSP) to defend web apps.

Explore sql injection concepts and ethical considerations, then learn to defend with prepared statements while practicing in a containerized web application–database lab that demonstrates the attack surface.

Set up a MySQL database in a container, initialize it with a root password and seed data, and perform create, insert, and select queries with where conditions.

Demonstrates sql injection against a login form's select statement, showing how crafted input, comments, and logical operators can bypass passwords and access accounts.

The lecture demonstrates sql injection to modify user records, including salary, via crafted update statements, and discusses input handling, quoting, and single-statement api constraints.

Explore how various code injection attacks share a core problem: mixing untrusted data with trusted code and breaking the code-data boundary in SQL, scripting, and system calls.

Learn how prepared statements separate code and data to prevent injection attacks, and how parameter binding with placeholders improves security and performance.

Review questions in the labs challenge you to understand SQL injection and demonstrate how prepared statements prevent code injection. It covers escaping, hashing effects, and why prepared statements secure databases.

Explore the clickjacking attack, how iframes work, and how the content security policy defends against it, in a hands-on lab setting up three web servers for experiments.

Learn how iframes embed pages from other sites using the source attribute, explore sizing, overlapping, borders, and transparency, and understand how the click juking attack influences their use.

This lecture demonstrates clickjacking attacks using transparent iframes, showing how layered iframes trick users into clicking a top invisible element that performs actions like liking a post or adding friends.

Explore a variant of clickjacking that uses a small, seamless iframe to overlay a login or like button, deceiving users into submitting credentials to an attacker.

Explore defenses against clickjacking in web security by applying iframe policies and header-based controls. Implement X-Frame-Options and CSP frame-ancestors to specify trusted origins that may embed your pages.

Explore iframe security features that enforce the same-origin policy, control parent-child and sibling access, and leverage sandbox options to isolate content, block scripts, and manage top navigation.

Explore how click juking uses transparent, overlapping iframes to visually confuse users and steal credentials. Discover defenses from old-fashioned JavaScript methods to CSFP method, plus sandbox features and iframe policies.