CS166 Final project

FINAL PROJECT
SAN JOSE STATE UNIVERSITY
CS166 SPRING 2017
KAYA OTA

CONTENT
1. Behind the scene
tour of this site.
2. SQL Injection
3. XSS (Cross Site
Scripting)
4. Cookie Stealing
5. Protocol
1. Authentication
6. CSRF

BEHIND THE SCENE TOUR OF THIS SITE

ENTRY URL FOR CS166 BLOG
• Prevented codes are running at:
• http://ec2-34-208-99-244.us-west-
2.compute.amazonaws.com:8080/CS166_Final_Project/Project_Code
/prevented/index.html
• The given codes are running at:
2.compute.amazonaws.com:8080/CS166_Final_Project/Project_Code
/attackable/index.html

HOW TO BUILD THIS SITE
• Download source code from the git hub:
https://github.com/28kayak/CS166_Final_Project.git
• Set up AWS windows server with the following security group.

HOW TO BUILD THIS SITE
• Set up XAMPP with Tomcat and
Maria DB.
• Check Windows server side of fire
wall's setting. (image on the left)
• Tomcat entry is on port 8080.

SQL TABLE – LOGIN –
• Use Maria DB
• Login table contains user information
• Fullname – user’s name
• User – user ID
• Pass – password
• Random – salt for the password
Fullname User pass role Random

SQL TABLE –BLOG–
• Blog table contains posts for the blog.
• Title is title of the post
• Content is the articles in the post
• ID is the post id and is the primary key
title content id

SQL INJECTION – OVERVIEW –
• A type of injection attack
• A SQL injection attack is by “injection” of SQL query via input
data from the client to the application.
• When SQL succeed the followings could happen
• Read sensitive data
• Modify DB data
• Run administrative operation

SQL INJECTION – THREAD MODELING –
• SQL Injection lets attackers to spoof identity, and temper data in
database.
• SQL Injection lets cause repudiation issues
• Voiding transaction
• Changing balance
• SQL injection is common with PHP and ASP
• Because these older functional interfaces are widely used.
• Nature of programmatic interface available
• J2EE and ASP.NET application are less likely to have easily
exploited SQL injection.

SQL INJECTION – PREVENTION –
I. Use prepared statement / parameterized queries
I. Prepared statement force the developers to first define all SQL code
and then pass the required parameters later to the query.
II. This allows DB to distinguish between code and data, independent
from user-input.

String user = request.getParameter( "user" );
String pass = request.getParameter( "pass" );
String sqlStr = "SELECT fullname FROM login WHERE user='" + user + "' and pass = sha2('"+
pass + "', 256)";
String sqlStr = "SELECT count(*) FROM login WHERE user=? and pass = sha2(?, 256)";
PreparedStatement stmt = con.prepareStatement(sqlStr);
stmt.setString(1,name);
stmt.setString(2,pwd);
ResultSet rs = stmt.executeQuery();
No Use of Prepared
Statement
Use of Prepared
Statement

II. Use Stored Procedure
I. Not always safe from SQL Injection
II. Certain Stored Procedures have the similar effect as use of
parameterized query
III. It requires to build SQL query with parameters that are automatically
parametrized unless the developer does something out of norm.

SQL INJECTION – DEMONSTRATION –
• Not Preventing Site
2.compute.amazonaws.com:8080/CS166_Final_Project/Project_Code/att
ackable/login_form.html
• Preventing Site
• Running here

XSS – CROSS SITE SCRIPTING –

XSS – OVERVIEW –
• A type of injection attack
• Injects malicious script into benign and trusted website.
• Occurs when an attacker users a web application to send
malicious code
• Generally in the form of a browser side script to different end
user.

XSS – THREAD MODELING –
• XSS lets attackers do the followings
• Identity Thrift (fraud)
• Redirect traffic by altering URL
• Session Hijacking
• Storing sensitive information in JavaScript variables

XSS – PREVENTION –
• Never accepts to insert untrusted data except in allowed location
• Deny all – do not put untrusted data into your html document unless it is
within one of the slot of defined in rule #1
• Most importantly, never accept actual JavaScript code
from an untrusted data and then run it.
•Escape XML sequences
• Using Escape sequences
• http://www.avajava.com/tutorials/lessons/how-do-i-
escape-a-string-for-xml.html

SCREEN SHOT FOR XSS
ATTACKED PREVENTED

XSS –DEMONSTRATION–
• Demonstration running at
2.compute.amazonaws.com:8080/CS166_Final_Project/Project_Code/att
ackable/login_form.html

CSRF (CROSS SITE REQUEST FORGERY)

CSRF –OVERVIEW–
• CSRF is a type of attacks
• Force user to run unwelcome action on web-applications where
he/she is authorized currently.
• Whereby, HTTP requests are transmitted from a user that the web
site trusts or has
authenticated (e.g., via HTTP redirects or HTML forms).
• CSRF can be caused by:
• Building an exploit URL or Script
http://bank.com/transfer.do?acct=MARIA&amount=100000
Attacker can monaurally change
values to request the service.

CSRF –THREAD MODEL–
• Impact: user may access resource on behalf of the attacker.
• User may upload private image to attacker’s server.
• When using 3rd party login, the user may associate with his
client account with attacker’s identity at an identity provider.

CSRF –PREVENTION–
• Use synchronized token pattern
• Never use get method in html form

REFERENCE
• https://www.owasp.org/index.php/SQL_Injection
• https://tools.ietf.org/html/rfc6819#section-4.4.1.8

CS166 Final project

Recommended

More Related Content

What's hot (20)

Similar to CS166 Final project (20)

More from Kaya Ota (14)

Recently uploaded (20)

CS166 Final project