Tech IT Easy x DevTalk : "Secure Your Coding with OWASP"
- 1. Secure Coding the bare minimum ā understand the problem
- 2. Introduction ā¢ Andi R Djunaedi ā¢ Software Engineer at blibli.com since March 2014 ā¢ https://www.linkedin.com/in/andird ā¢ https://github.com/andirdju ā¢ https://github.com/bliblidotcom
- 3. Overview ā understand the problem ā¢ Theory ā¢ Code ā¢ Web application -> weāll talk about this ā¢ Operating System ā¢ Network ā¢ Other? ā¢ Importance ā¢ Practice, get your laptop, pc or whatever ā¢ How it works
- 4. Theory - Code ā¢ Web Applications ā¢ OWASP Top 10 List - new list every 3 years ā¢ https://www.owasp.org/index.php/Top_10_2013-Top_10 ā¢ https://www.owasp.org/index.php/Top_10_2010-Main ā¢ Top 3 - Samples ā¢ SQL Injection ā¢ Arbitrary SQL query execution ā¢ Session Fixation ā¢ Assume otherās Identity ā¢ Cross Site Scripting ā¢ Arbitrary client code (javascript, html) execution
- 5. Importance ā Non Security ā¢ Performance ā¢ poor user experience ā¢ redesign, refactor, make it faster ā¢ Code coverage ā¢ buggy, spent more time on fixing bug ā¢ stop the leak ā¢ When ā¢ next iteration
- 6. Importance ā Security ā¢ How to fix security incidents ??? ā¢ Personal/Financial data stolen ā¢ Data deleted ā¢ When ā¢ NOW !!!
- 7. Practice ā Understand the problem ā¢ Run bad web app ā¢ OWASP Top 3 Sample ā¢ SQL Injection ā¢ Session Fixation ā¢ Cross Site Scripting ā¢ Exercise
- 8. Run ā web app ā¢ Git, Jdk 8, Maven ā¢ https://github.com/bliblidotcom/sample-basic-secure-coding ā¢ In memory H2 database ā¢ Embedded server ā¢ mvn spring-boot:run ā¢ http://localhost:8080
- 9. Get your laptop ā SQL Injection ā¢ Demo ā Valid use case is only find one record by id ā¢ Read all records ā¢ Insert new records ā¢ Delete all records
- 10. Get your laptop ā Session Fixation ā¢ Demo - session info only known to the user ā¢ Bad person(A) create new session ā¢ Persuade unsuspecting person(B) via phishing ā¢ Bad person(A) get session information of other person(B)
- 11. Get your laptop ā Cross Site Scripting ā¢ Demo ā valid use case only displays list of data ā¢ Can be done via the same SQL injection ā¢ Html ā¢ Add html form ā¢ Javascript ā¢ Add pop up ā¢ Add redirect
- 12. Whatās Next ā¢ Crack the other API ā¢ it have similar problems ā¢ Fix the exploit ā¢ Donāt repeat yourself by creating custom solutions ā¢ SQL named parameter ā¢ Regenerate session id ā¢ Content escaping