This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Spain/Agenda Chapter Meeting
Barcelona, 13 de junio de 2014
AGENDA de la jornada:
 |
10:00h - 10:05h | Bienvenida Josep Maria Ribes. Director d'Enginyeria de La Salle Campus Barcelona. |
 |
10:05h - 10:15h | Introducción a la jornada Vicente Aguilera Díaz. vicenteaguileradiaz.com OWASP Spain Chapter Leader. Socio y Director Dpto. Auditoría en Internet Security Auditors. |
| 10:15h - 11:15h | TBD . |
|
| 11:15h - 11:45h | TBD . |
|
 |
11:45h - 12:45h | On Breaking PHP-based Cross-Site Scripting Protection Mechanisms In The Wild Ashar Javed. Research Assistant. Ruhr University Bochum, Germany. Cross-Site Scripting (XSS) attacks are at number one in Open Source Vulnerability Database (OSVDB) and according to a recent report by Trustwave, 82% of web applications are vulnerable to XSS flaws. PHP---Hypertext Preprocessor is by far the most popular server-side web programming language. In this paper, we perform security analysis of PHP-based XSS protection mechanisms available in the wild. The analysis includes PHP's built-in functions (11 common examples of using PHP's built-in functions in the wild), 10 popular customized solutions powering thousands of PHP files on GitHub and 8 commercially used open-source web applications' frameworks like CodeIgniter (in use on hundreds of thousands of web applications), htmLawed (its Drupal module has been downloaded more than 19000 times), HTML Purifier (integrated in a another popular PHP framework named Yii), Nette (in use on a website of the president of The Czech Republic), PHP Input Filter (more than 1500 PHP files on GitHub are using it), PEAR's HTML Safe (powering more than 100 PHP files), CakePHP (in use on more than 20K PHP files) and Laravel PHP framework (winner of best PHP framework of the year 2013) etc. This paper shows how a motivated attacker can bypass these XSS protection mechanisms. We show XSS bypasses for modern and old browsers and report other issues that we found in these protection mechanisms. The developers of CodeIgniter, htmLawed, HTML Purifier and Nette have acknowledged our findings and our suggestions have been implemented in top-notch frameworks like CodeIgniter, htmLawed and Nette. |
| 12:45h - 13:15h | TBD . |
|
| 14:30h - 15:30h | TBD . |
|
| 15:30h - 16:00h | TBD . |
|
| 16:00h - 17:00h | TBD . |
|
| 17:00h - 17:30h | TBD . |
|
| 17:30h - 18:00h | Mesa redonda (ponentes e invitados) . |
Si desea participar como ponente, consulte la sección Call for Papers.
Twitter: @OWASPSpain
Hashtag de la jornada: #OWASPSpain8
