Advanced web security topics
blog.georgovassilis.com
Advanced web security topics
1–10 of 15 posts
Re: Advanced web security topics
#2Author here; I collected uncommon topics affecting web application security, such has extracting a page's content with CSS injection.
Re: Advanced web security topics
#3Author here; I collected uncommon topics affecting web application security, such has extracting a page's content with CSS injection.
Looks like a good read, I think I'll enjoy it.
Thanks!
Re: Advanced web security topics
#4>Stealing web page content by tricking the browser to load the private page as CSS
This exploit is not practical in Firefox. Attempting to read cssRules on an external stylesheet will throw a "SecurityError: The operation is insecure".
Chrome mitigates this via Cross-Origin Read Blocking.
> Phishing with target=_blank links
For defense in depth, you'll probably want to use CSP's disown-opener to fix this globally (rather than trying to make sure all elements are covered) IMO.
Re: Advanced web security topics
#5It's a nice mix of issues. Web security (client/server-side) is a big field, and keep changing. We need a lot of awareness.
If you like this kind of web security focused articles, our security researchers publish (almost weekly) very basic to advanced web security topics in our blog : https://www.netsparker.com/blog/web-security/ Some of them are very specific like;
PHP Type Juggling Vulnerabilities: https://www.netsparker.com/blog/web-security/php-type-juggli...
and some of them are 101 kind of coverage such as HTTP Response Splitting: https://www.netsparker.com/blog/web-security/crlf-http-heade...
Re: Advanced web security topics
#6Author here; I collected uncommon topics affecting web application security, such has extracting a page's content with CSS injection.
[deleted]
Re: Advanced web security topics
#7While I love reading these kinds of articles, I suspect they’re not the most important thing for most developers trying to build secure websites.
My rationale is that a list of attacks and issues like this requires you to reason backwards from attacks to what a safe approach would be. This is incredibly hard work that most people are not ready to do.
Instead, what you need is for someone to present a set of up to date best practices that you can implement. Here’s one stab at one for the specific topic of file uploads: https://twitter.com/olemoudi/status/1023976897661870083 (not vouching for this particular list per se—I don’t know if it’s missing things, but it seems like it’s on the right track).
Re: Advanced web security topics
#8Author here; I collected uncommon topics affecting web application security, such has extracting a page's content with CSS injection.
Thanks for your sharing
Re: Advanced web security topics
#9> The exploited weakness here was that the website could be tricked into serving a user-contributed image with an HTML MIME type by appending the right suffix to the URL file name.
This vulnerability irritates me. Does the server not even know what resources it owns? Is this practice something that is due to dynamically typed langs/practices?
It feels like the problems that plagued SQL inection before we decided to use parameterized queries
Re: Advanced web security topics
#10While I love reading these kinds of articles, I suspect they’re not the most important thing for most developers trying to build secure websites. My rationale is that a list of attacks and issues like this requires you to reason backwards from attacks to what a safe approach would be. This is incredibly hard work that most people are not ready to do. Instead, what you need is for someone to present a set of up to dat…
Agreed! I think the most important security topics have been well covered elsewhere like code injection, session fixation, CSRF. I wanted to talk about unusual attacks which, however, are relevant to many web applications and most developers (count me in!) were not aware of at the time.