Difference between revisions of "Guide:Frontispiece"

Revision as of 11:34, 18 May 2006 (view source) Weilin Zhong (talk | contribs) ← Older edit		Revision as of 11:54, 18 May 2006 (view source) Weilin Zhong (talk | contribs) (→‎Frontispiece) Newer edit →
Line 5:		Line 5:
	February 2006		February 2006
−
−	== Frontispiece ==
−
−	Dedication
−	To my fellow procrastinators and TiVo addicts, this book proves that given enough “tomorrows,” anything is possible.
−	Andrew van der Stock
−
−	Copyright and license
−	© 2001 – 2006 OWASP Foundation.
−	The Guide is licensed under the Free Documentation License, a copy of which is found in the Appendix. PERMISSION IS GRANTED TO COPY, DISTRIBUTE, AND/OR MODIFY THIS DOCUMENT PROVIDED THIS COPYRIGHT NOTICE AND ATTRIBUTION TO OWASP IS RETAINED.
−	Editors
−	The Guide has had several editors over various editions, all of whom have contributed immensely as authors, project managers, and editors over the lengthy period of the Guide’s gestation.
−	Guide 2.x series editors:
−
−	Andrew van der Stock
−	Adrian Wiesmann
−
−
−	Authors and Reviewers
−	The Guide would not be where it is today without the generous gift of volunteer time and effort from many individuals. The following people helped develop Guide 2.x:
−
−
−	Abraham Kang
−	Adrian Wiesmann
−	Amit Klein
−	Andrew van der Stock
−	Brian Greidanus
−	Christopher Todd
−	Darrel Grundy
−	Daniel Cornell
−	David Endler
−	Denis Pilipchuk
−	Dennis Groves
−	Derek Browne
−	Eoin Keary
−	Erik Lee
−	Ernesto Arroyo
−	Frank Lemmon
−	Gene McKenna
−	Hal Lockhart
−	Izhar By-Gad
−	Jeremy Poteet
−	José Pedro Arroyo
−	K.K. Mookhey
−	Kevin McLaughlin
−	Martin Eizner
−	Michael Howard
−	Michael Scovetta
−	Mikael Simonsson
−	Neal Krawetz
−	Nigel Tranter
−	Raoul Endres
−	Ray Stirbei
−	Richard Parke
−	Robert Hansen
−	Roy McNamara
−	Steve Taylor
−	Sverre Huseby
−	Tim Smith
−	William Hau
−
−
−	Revision History
−
−	Date Version Pages Notes
−	July 26, 2005 2.0 Blackhat Edition 280 pages Andrew van der Stock, Guide Lead
−	July 27, 2005 2.0.1 Blackhat Edition++ 293 pages Cryptography chapter review
−	from Michael Howard incorporated
−	September 12, 2005 2.1 DRAFT 1 X pages Changes from many sources
−	New SQA chapter from Frank Lemmon
−	January 2006 2.1 DRAFT 2 X pages Changes from Bill Pollock
−	New chapters from Erick Lee
−	New revisions from Dan Cornell
−	February 2006 2.1 DRAFT 3 X pages Ajax chapter
−	Many chapters back from reviewers
−
−
−	After here:::
Line 95:		Line 17:
	OWASP Foundation		OWASP Foundation
−	'''''Frontispiece'''''	+	===============Frontispiece ===============
−	'''''Dedication'''''	+	==Dedication ==
	To my fellow procrastinators and TiVo addicts, this book proves that given enough “tomorrows,” anything is possible.		To my fellow procrastinators and TiVo addicts, this book proves that given enough “tomorrows,” anything is possible.
	Andrew van der Stock		Andrew van der Stock
−	'''''Copyright and license'''''	+	==Copyright and license ==
	© 2001 – 2006 OWASP Foundation.		© 2001 – 2006 OWASP Foundation.
	The Guide is licensed under the Free Documentation License, a copy of which is found in the Appendix. PERMISSION IS GRANTED TO COPY, DISTRIBUTE, AND/OR MODIFY THIS DOCUMENT PROVIDED THIS COPYRIGHT NOTICE AND ATTRIBUTION TO OWASP IS RETAINED.		The Guide is licensed under the Free Documentation License, a copy of which is found in the Appendix. PERMISSION IS GRANTED TO COPY, DISTRIBUTE, AND/OR MODIFY THIS DOCUMENT PROVIDED THIS COPYRIGHT NOTICE AND ATTRIBUTION TO OWASP IS RETAINED.
−	'''''Editors'''''	+	==Editors ==
	The Guide has had several editors over various editions, all of whom have contributed immensely as authors, project managers, and editors over the lengthy period of the Guide’s gestation.		The Guide has had several editors over various editions, all of whom have contributed immensely as authors, project managers, and editors over the lengthy period of the Guide’s gestation.
	Guide 2.x series editors:		Guide 2.x series editors:
Line 109:		Line 31:
	Adrian Wiesmann		Adrian Wiesmann
−	'''''	+	==Authors and Reviewers ==
−	Authors and Reviewers'''''
	The Guide would not be where it is today without the generous gift of volunteer time and effort from many individuals. The following people helped develop Guide 2.x:		The Guide would not be where it is today without the generous gift of volunteer time and effort from many individuals. The following people helped develop Guide 2.x:
Line 153:		Line 74:
	William Hau		William Hau
−	'''''	+	==Revision History ==
−	Revision History'''''
	'''Date''' '''Version''' '''Pages''' '''Notes'''		'''Date''' '''Version''' '''Pages''' '''Notes'''
Line 190:		Line 110:
−	'''''Table of Contents'''''	+	===============Table of Contents ===============
	'''1''' '''ABOUT THE OPEN WEB APPLICATION SECURITY PROJECT 13'''		'''1''' '''ABOUT THE OPEN WEB APPLICATION SECURITY PROJECT 13'''
−	1.1 STRUCTURE AND LICENSING 13	+	===1.1 Structure and Licensing 13 ===
−	1.2 PARTICIPATION AND MEMBERSHIP 13	+	===1.2 Participation and Membership 13 ===
−	1.3 PROJECTS 14	+	===1.3 Projects 14 ===
	'''2''' '''INTRODUCTION 15'''		'''2''' '''INTRODUCTION 15'''
−	2.1 DEVELOPING SECURE APPLICATIONS 15	+	===2.1 Developing Secure Applications 15 ===
−	2.2 IMPROVEMENTS IN THIS EDITION 15	+	===2.2 Improvements in this edition 15 ===
−	2.3 HOW TO USE THIS GUIDE 16	+	===2.3 How to use this Guide 16 ===
−	2.4 UPDATES AND ERRATA 16	+	===2.4 Updates and errata 16 ===
−	2.5 WITH THANKS 16	+	===2.5 With thanks 16 ===
	'''3''' '''WHAT ARE WEB APPLICATIONS? 17'''		'''3''' '''WHAT ARE WEB APPLICATIONS? 17'''
−	3.1 TECHNOLOGIES 18	+	===3.1 Technologies 18 ===
−	3.2 FIRST GENERATION – CGI 18	+	===3.2 First generation – CGI 18 ===
−	3.3 FILTERS 18	+	===3.3 Filters 18 ===
−	3.4 SCRIPTING 19	+	===3.4 Scripting 19 ===
−	3.5 WEB APPLICATION FRAMEWORKS – J2EE AND ASP.NET 20	+	===3.5 Web application frameworks – J2EE and ASP.NET 20 ===
−	3.6 SMALL TO MEDIUM SCALE APPLICATIONS 21	+	===3.6 Small to medium scale applications 21 ===
−	3.7 LARGE SCALE APPLICATIONS 22	+	===3.7 Large scale applications 22 ===
−	3.8 VIEW 22	+	===3.8 View 22 ===
−	3.9 CONTROLLER 22	+	===3.9 Controller 22 ===
−	3.10 MODEL 23	+	===3.10 Model 23 ===
−	3.11 CONCLUSION 24	+	===3.11 Conclusion 24 ===
	'''4''' '''POLICY FRAMEWORKS 25'''		'''4''' '''POLICY FRAMEWORKS 25'''
−	4.1 ORGANIZATIONAL COMMITMENT TO SECURITY 25	+	===4.1 Organizational commitment to security 25 ===
−	4.2 OWASP’S PLACE AT THE FRAMEWORK TABLE 26	+	===4.2 OWASP’s Place at the Framework table 26 ===
−	4.3 DEVELOPMENT METHODOLOGY 28	+	===4.3 Development Methodology 28 ===
−	4.4 CODING STANDARDS 29	+	===4.4 Coding Standards 29 ===
−	4.5 SOURCE CODE CONTROL 29	+	===4.5 Source Code Control 29 ===
−	4.6 SUMMARY 30	+	===4.6 Summary 30 ===
	'''5''' '''SECURE CODING PRINCIPLES 31'''		'''5''' '''SECURE CODING PRINCIPLES 31'''
−	5.1 ASSET CLASSIFICATION 31	+	===5.1 Asset Classification 31 ===
−	5.2 ABOUT ATTACKERS 31	+	===5.2 About attackers 31 ===
−	5.3 CORE PILLARS OF INFORMATION SECURITY 32	+	===5.3 Core pillars of information security 32 ===
−	5.4 SECURITY ARCHITECTURE 32	+	===5.4 Security Architecture 32 ===
−	5.5 SECURITY PRINCIPLES 33	+	===5.5 Security Principles 33 ===
	'''6''' '''THREAT RISK MODELING 37'''		'''6''' '''THREAT RISK MODELING 37'''
−	6.1 THREAT RISK MODELING 37	+	===6.1 Threat Risk Modeling 37 ===
−	6.2 PERFORMING THREAT RISK MODELING USING THE MICROSOFT THREAT MODELING PROCESS 37	+	===6.2 Performing threat risk modeling using the Microsoft Threat Modeling Process 37 ===
−	6.3 ALTERNATIVE THREAT MODELING SYSTEMS 44	+	===6.3 Alternative Threat Modeling Systems 44 ===
−	6.4 TRIKE 44	+	===6.4 Trike 44 ===
−	6.5 AS/NZS 4360:2004 RISK MANAGEMENT 44	+	===6.5 AS/NZS 4360:2004 Risk Management 44 ===
−	6.6 CVSS 45	+	===6.6 CVSS 45 ===
−	6.7 OCTAVE 46	+	===6.7 OCTAVE 46 ===
−	6.8 CONCLUSION 47	+	===6.8 Conclusion 47 ===
−	6.9 FURTHER READING 47	+	===6.9 Further Reading 47 ===
	'''7''' '''HANDLING E-COMMERCE PAYMENTS 49'''		'''7''' '''HANDLING E-COMMERCE PAYMENTS 49'''
−	7.1 OBJECTIVES 49	+	===7.1 Objectives 49 ===
−	7.2 COMPLIANCE AND LAWS 49	+	===7.2 Compliance and Laws 49 ===
−	7.3 PCI COMPLIANCE 49	+	===7.3 PCI Compliance 49 ===
−	7.4 HANDLING CREDIT CARDS 50	+	===7.4 Handling Credit Cards 50 ===
−	7.5 FURTHER READING 53	+	===7.5 Further Reading 53 ===
	'''8''' '''PHISHING 55'''		'''8''' '''PHISHING 55'''
−	8.1 WHAT IS PHISHING? 55	+	===8.1 What is phishing? 55 ===
−	8.2 USER EDUCATION 56	+	===8.2 User Education 56 ===
−	8.3 MAKE IT EASY FOR YOUR USERS TO REPORT SCAMS 57	+	===8.3 Make it easy for your users to report scams 57 ===
−	8.4 COMMUNICATING WITH CUSTOMERS VIA E-MAIL 57	+	===8.4 Communicating with customers via e-mail 57 ===
−	8.5 NEVER ASK YOUR CUSTOMERS FOR THEIR SECRETS 58	+	===8.5 Never ask your customers for their secrets 58 ===
−	8.6 FIX ALL YOUR XSS ISSUES 58	+	===8.6 Fix all your XSS issues 58 ===
−	8.7 DO NOT USE POP-UPS 59	+	===8.7 Do not use pop-ups 59 ===
−	8.8 DON’T BE FRAMED 59	+	===8.8 Don’t be framed 59 ===
−	8.9 MOVE YOUR APPLICATION ONE LINK AWAY FROM YOUR FRONT PAGE 59	+	===8.9 Move your application one link away from your front page 59 ===
−	8.10 ENFORCE LOCAL REFERRERS FOR IMAGES AND OTHER RESOURCES 59	+	===8.10 Enforce local referrers for images and other resources 59 ===
−	8.11 KEEP THE ADDRESS BAR, USE SSL, DO NOT USE IP ADDRESSES 60	+	===8.11 Keep the address bar, use SSL, do not use IP addresses 60 ===
−	8.12 DON’T BE THE SOURCE OF IDENTITY THEFT 60	+	===8.12 Don’t be the source of identity theft 60 ===
−	8.13 IMPLEMENT SAFE-GUARDS WITHIN YOUR APPLICATION 61	+	===8.13 Implement safe-guards within your application 61 ===
−	8.14 MONITOR UNUSUAL ACCOUNT ACTIVITY 61	+	===8.14 Monitor unusual account activity 61 ===
−	8.15 GET THE PHISHING TARGET SERVERS OFFLINE PRONTO 62	+	===8.15 Get the phishing target servers offline pronto 62 ===
−	8.16 TAKE CONTROL OF THE FRAUDULENT DOMAIN NAME 62	+	===8.16 Take control of the fraudulent domain name 62 ===
−	8.17 WORK WITH LAW ENFORCEMENT 63	+	===8.17 Work with law enforcement 63 ===
−	8.18 WHEN AN ATTACK HAPPENS 63	+	===8.18 When an attack happens 63 ===
−	8.19 FURTHER READING 63	+	===8.19 Further Reading 63 ===
	'''9''' '''WEB SERVICES 64'''		'''9''' '''WEB SERVICES 64'''
−	SECURING WEB SERVICES 64	+	===Securing Web Services 64 ===
−	COMMUNICATION SECURITY 65	+	===Communication security 65 ===
−	PASSING CREDENTIALS 65	+	===Passing credentials 65 ===
−	ENSURING MESSAGE FRESHNESS 66	+	===Ensuring message freshness 66 ===
−	PROTECTING MESSAGE INTEGRITY 66	+	===Protecting message integrity 66 ===
−	PROTECTING MESSAGE CONFIDENTIALITY 67	+	===Protecting message confidentiality 67 ===
−	ACCESS CONTROL 67	+	===Access control 67 ===
−	AUDIT 68	+	===Audit 68 ===
−	WEB SERVICES SECURITY HIERARCHY 68	+	===Web Services Security Hierarchy 68 ===
−	SOAP 69	+	===SOAP 69 ===
−	WS-SECURITY STANDARD 70	+	===WS-Security Standard 70 ===
−	WS-SECURITY BUILDING BLOCKS 72	+	===WS-Security Building Blocks 72 ===
−	COMMUNICATION PROTECTION MECHANISMS 78	+	===Communication Protection Mechanisms 78 ===
−	ACCESS CONTROL MECHANISMS 80	+	===Access Control Mechanisms 80 ===
−	FORMING WEB SERVICE CHAINS 82	+	===Forming Web Service Chains 82 ===
−	AVAILABLE IMPLEMENTATIONS 83	+	===Available Implementations 83 ===
−	PROBLEMS 85	+	===Problems 85 ===
−	FURTHER READING 87	+	===Further Reading 87 ===
	'''10''' '''AJAX AND OTHER “RICH” INTERFACE TECHNOLOGIES 5'''		'''10''' '''AJAX AND OTHER “RICH” INTERFACE TECHNOLOGIES 5'''
−	10.1 OBJECTIVE 5	+	===10.1 Objective 5 ===
−	10.2 PLATFORMS AFFECTED 5	+	===10.2 Platforms Affected 5 ===
−	10.3 ARCHITECTURE 5	+	===10.3 Architecture 5 ===
−	10.4 ACCESS CONTROL: AUTHENTICATION AND AUTHORIZATION 5	+	===10.4 Access control: Authentication and Authorization 5 ===
−	10.5 SILENT TRANSACTIONAL AUTHORIZATION 5	+	===10.5 Silent transactional authorization 5 ===
−	10.6 UNTRUSTED OR ABSENT SESSION DATA 5	+	===10.6 Untrusted or absent session data 5 ===
−	10.7 STATE MANAGEMENT 5	+	===10.7 State management 5 ===
−	10.8 TAMPER RESISTANCE 5	+	===10.8 Tamper resistance 5 ===
−	10.9 PRIVACY 5	+	===10.9 Privacy 5 ===
−	10.10 PROXY FAÇADE 5	+	===10.10 Proxy Façade 5 ===
−	10.11 SOAP INJECTION ATTACKS 5	+	===10.11 SOAP Injection Attacks 5 ===
−	10.12 XMLRPC INJECTION ATTACKS 5	+	===10.12 XMLRPC Injection Attacks 5 ===
−	10.13 DOM INJECTION ATTACKS 5	+	===10.13 DOM Injection Attacks 5 ===
−	10.14 XML INJECTION ATTACKS 5	+	===10.14 XML Injection Attacks 5 ===
−	10.15 JSON (JAVASCRIPT OBJECT NOTATION) INJECTION ATTACKS 5	+	===10.15 JSON (Javascript Object Notation) Injection Attacks 5 ===
−	10.16 ENCODING SAFETY 5	+	===10.16 Encoding safety 5 ===
−	10.17 AUDITING 5	+	===10.17 Auditing 5 ===
−	10.18 ERROR HANDLING 5	+	===10.18 Error Handling 5 ===
−	10.19 ACCESSIBILITY 5	+	===10.19 Accessibility 5 ===
−	10.20 FURTHER READING 5	+	===10.20 Further Reading 5 ===
	'''11''' '''AUTHENTICATION 108'''		'''11''' '''AUTHENTICATION 108'''
−	11.1 OBJECTIVE 108	+	===11.1 Objective 108 ===
−	11.2 ENVIRONMENTS AFFECTED 108	+	===11.2 Environments Affected 108 ===
−	11.3 RELEVANT COBIT TOPICS 108	+	===11.3 Relevant COBIT Topics 108 ===
−	11.4 BEST PRACTICES 108	+	===11.4 Best Practices 108 ===
−	11.5 COMMON WEB AUTHENTICATION TECHNIQUES 109	+	===11.5 Common web authentication techniques 109 ===
−	11.6 STRONG AUTHENTICATION 111	+	===11.6 Strong Authentication 111 ===
−	11.7 FEDERATED AUTHENTICATION 115	+	===11.7 Federated Authentication 115 ===
−	11.8 CLIENT SIDE AUTHENTICATION CONTROLS 117	+	===11.8 Client side authentication controls 117 ===
−	11.9 POSITIVE AUTHENTICATION 118	+	===11.9 Positive Authentication 118 ===
−	11.10 MULTIPLE KEY LOOKUPS 120	+	===11.10 Multiple Key Lookups 120 ===
−	11.11 REFERER CHECKS 122	+	===11.11 Referer Checks 122 ===
−	11.12 BROWSER REMEMBERS PASSWORDS 123	+	===11.12 Browser remembers passwords 123 ===
−	11.13 DEFAULT ACCOUNTS 124	+	===11.13 Default accounts 124 ===
−	11.14 CHOICE OF USERNAMES 125	+	===11.14 Choice of usernames 125 ===
−	11.15 CHANGE PASSWORDS 126	+	===11.15 Change passwords 126 ===
−	11.16 SHORT PASSWORDS 126	+	===11.16 Short passwords 126 ===
−	11.17 WEAK PASSWORD CONTROLS 127	+	===11.17 Weak password controls 127 ===
−	11.18 REVERSIBLE PASSWORD ENCRYPTION 128	+	===11.18 Reversible password encryption 128 ===
−	11.19 AUTOMATED PASSWORD RESETS 128	+	===11.19 Automated password resets 128 ===
−	11.20 BRUTE FORCE 130	+	===11.20 Brute Force 130 ===
−	11.21 REMEMBER ME 131	+	===11.21 Remember Me 131 ===
−	11.22 IDLE TIMEOUTS 132	+	===11.22 Idle Timeouts 132 ===
−	11.23 LOGOUT 132	+	===11.23 Logout 132 ===
−	11.24 ACCOUNT EXPIRY 133	+	===11.24 Account Expiry 133 ===
−	11.25 SELF REGISTRATION 134	+	===11.25 Self registration 134 ===
−	11.26 CAPTCHA 134	+	===11.26 CAPTCHA 134 ===
−	11.27 FURTHER READING 135	+	===11.27 Further Reading 135 ===
−	11.28 AUTHENTICATION 136	+	===11.28 Authentication 136 ===
	'''12''' '''AUTHORIZATION 148'''		'''12''' '''AUTHORIZATION 148'''
−	12.1 OBJECTIVES 148	+	===12.1 Objectives 148 ===
−	12.2 ENVIRONMENTS AFFECTED 148	+	===12.2 Environments Affected 148 ===
−	12.3 RELEVANT COBIT TOPICS 148	+	===12.3 Relevant COBIT Topics 148 ===
−	12.4 BEST PRACTICES 148	+	===12.4 Best Practices 148 ===
−	12.5 BEST PRACTICES IN ACTION 149	+	===12.5 Best Practices in Action 149 ===
−	12.6 PRINCIPLE OF LEAST PRIVILEGE 150	+	===12.6 Principle of least privilege 150 ===
−	12.7 CENTRALIZED AUTHORIZATION ROUTINES 152	+	===12.7 Centralized authorization routines 152 ===
−	12.8 AUTHORIZATION MATRIX 152	+	===12.8 Authorization matrix 152 ===
−	12.9 CONTROLLING ACCESS TO PROTECTED RESOURCES 153	+	===12.9 Controlling access to protected resources 153 ===
−	12.10 PROTECTING ACCESS TO STATIC RESOURCES 153	+	===12.10 Protecting access to static resources 153 ===
−	12.11 REAUTHORIZATION FOR HIGH VALUE ACTIVITIES OR AFTER IDLE OUT 154	+	===12.11 Reauthorization for high value activities or after idle out 154 ===
−	12.12 TIME BASED AUTHORIZATION 154	+	===12.12 Time based authorization 154 ===
−	12.13 BE CAUTIOUS OF CUSTOM AUTHORIZATION CONTROLS 154	+	===12.13 Be cautious of custom authorization controls 154 ===
−	12.14 NEVER IMPLEMENT CLIENT-SIDE AUTHORIZATION TOKENS 155	+	===12.14 Never implement client-side authorization tokens 155 ===
−	12.15 FURTHER READING 156	+	===12.15 Further Reading 156 ===
	'''13''' '''SESSION MANAGEMENT 157'''		'''13''' '''SESSION MANAGEMENT 157'''
−	13.1 OBJECTIVE 157	+	===13.1 Objective 157 ===
−	13.2 ENVIRONMENTS AFFECTED 157	+	===13.2 Environments Affected 157 ===
−	13.3 RELEVANT COBIT TOPICS 157	+	===13.3 Relevant COBIT Topics 157 ===
−	13.4 DESCRIPTION 157	+	===13.4 Description 157 ===
−	13.5 BEST PRACTICES 158	+	===13.5 Best practices 158 ===
−	13.6 EXPOSED SESSION VARIABLES 159	+	===13.6 Exposed Session Variables 159 ===
−	13.7 PAGE AND FORM TOKENS 159	+	===13.7 Page and Form Tokens 159 ===
−	13.8 WEAK SESSION CRYPTOGRAPHIC ALGORITHMS 160	+	===13.8 Weak Session Cryptographic Algorithms 160 ===
−	13.9 SESSION TOKEN ENTROPY 161	+	===13.9 Session Token Entropy 161 ===
−	13.10 SESSION TIME-OUT 161	+	===13.10 Session Time-out 161 ===
−	13.11 REGENERATION OF SESSION TOKENS 162	+	===13.11 Regeneration of Session Tokens 162 ===
−	13.12 SESSION FORGING/BRUTE-FORCING DETECTION AND/OR LOCKOUT 163	+	===13.12 Session Forging/Brute-Forcing Detection and/or Lockout 163 ===
−	13.13 SESSION TOKEN CAPTURE AND SESSION HIJACKING 163	+	===13.13 Session Token Capture and Session Hijacking 163 ===
−	13.14 SESSION TOKENS ON LOGOUT 165	+	===13.14 Session Tokens on Logout 165 ===
−	13.15 SESSION VALIDATION ATTACKS 165	+	===13.15 Session Validation Attacks 165 ===
−	13.16 PHP 166	+	===13.16 PHP 166 ===
−	13.17 SESSIONS 166	+	===13.17 Sessions 166 ===
−	13.18 FURTHER READING 167	+	===13.18 Further Reading 167 ===
−	13.19 SESSION MANAGEMENT 168	+	===13.19 Session Management 168 ===
	'''14''' '''DATA VALIDATION 173'''		'''14''' '''DATA VALIDATION 173'''
−	14.1 OBJECTIVE 173	+	===14.1 Objective 173 ===
−	14.2 PLATFORMS AFFECTED 173	+	===14.2 Platforms Affected 173 ===
−	14.3 RELEVANT COBIT TOPICS 173	+	===14.3 Relevant COBIT Topics 173 ===
−	14.4 DESCRIPTION 173	+	===14.4 Description 173 ===
−	14.5 DEFINITIONS 173	+	===14.5 Definitions 173 ===
−	14.6 WHERE TO INCLUDE INTEGRITY CHECKS 174	+	===14.6 Where to include integrity checks 174 ===
−	14.7 WHERE TO INCLUDE VALIDATION 174	+	===14.7 Where to include validation 174 ===
−	14.8 WHERE TO INCLUDE BUSINESS RULE VALIDATION 174	+	===14.8 Where to include business rule validation 174 ===
−	14.9 DATA VALIDATION STRATEGIES 175	+	===14.9 Data Validation Strategies 175 ===
−	14.10 PREVENT PARAMETER TAMPERING 177	+	===14.10 Prevent parameter tampering 177 ===
−	14.11 HIDDEN FIELDS 178	+	===14.11 Hidden fields 178 ===
−	14.12 ASP.NET VIEWSTATE 179	+	===14.12 ASP.NET Viewstate 179 ===
−	14.13 URL ENCODING 182	+	===14.13 URL encoding 182 ===
−	14.14 HTML ENCODING 182	+	===14.14 HTML encoding 182 ===
−	14.15 ENCODED STRINGS 183	+	===14.15 Encoded strings 183 ===
−	14.16 DATA VALIDATION AND INTERPRETER INJECTION 183	+	===14.16 Data Validation and Interpreter Injection 183 ===
−	14.17 186	+	===14.17 186 ===
−	14.18 DELIMITER AND SPECIAL CHARACTERS 186	+	===14.18 Delimiter and special characters 186 ===
−	14.19 FURTHER READING 187	+	===14.19 Further Reading 187 ===
	'''15''' '''INTERPRETER INJECTION 188'''		'''15''' '''INTERPRETER INJECTION 188'''
−	15.1 OBJECTIVE 188	+	===15.1 Objective 188 ===
−	15.2 PLATFORMS AFFECTED 188	+	===15.2 Platforms Affected 188 ===
−	15.3 RELEVANT COBIT TOPICS 188	+	===15.3 Relevant COBIT Topics 188 ===
−	15.4 USER AGENT INJECTION 188	+	===15.4 User Agent Injection 188 ===
−	15.5 HTTP RESPONSE SPLITTING 192	+	===15.5 HTTP Response Splitting 192 ===
−	15.6 SQL INJECTION 193	+	===15.6 SQL Injection 193 ===
−	15.7 ORM INJECTION 193	+	===15.7 ORM Injection 193 ===
−	15.8 LDAP INJECTION 194	+	===15.8 LDAP Injection 194 ===
−	15.9 XML INJECTION 196	+	===15.9 XML Injection 196 ===
−	15.10 CODE INJECTION 196	+	===15.10 Code Injection 196 ===
−	15.11 FURTHER READING 197	+	===15.11 Further Reading 197 ===
−	15.12 SQL-INJECTION 199	+	===15.12 SQL-injection 199 ===
−	15.13 CODE INJECTION 202	+	===15.13 Code Injection 202 ===
−	15.14 COMMAND INJECTION 202	+	===15.14 Command injection 202 ===
	'''16''' '''CANONCALIZATION, LOCALE AND UNICODE 203'''		'''16''' '''CANONCALIZATION, LOCALE AND UNICODE 203'''
−	16.1 OBJECTIVE 203	+	===16.1 Objective 203 ===
−	16.2 PLATFORMS AFFECTED 203	+	===16.2 Platforms Affected 203 ===
−	16.3 RELEVANT COBIT TOPICS 203	+	===16.3 Relevant COBIT Topics 203 ===
−	16.4 DESCRIPTION 203	+	===16.4 Description 203 ===
−	16.5 UNICODE 204	+	===16.5 Unicode 204 ===
−	16.6 <u>HTTP://WWW.IETF.ORG/RFC/RFC2279.TXT?NUMBER=2279</U> 206	+	===16.6 http://www.ietf.org/rfc/rfc2279.txt?number=2279 206 ===
−	16.7 INPUT FORMATS 206	+	===16.7 Input Formats 206 ===
−	16.8 LOCALE ASSERTION 207	+	===16.8 Locale assertion 207 ===
−	16.9 DOUBLE (OR N-) ENCODING 207	+	===16.9 Double (or n-) encoding 207 ===
−	16.10 HTTP REQUEST SMUGGLING 208	+	===16.10 HTTP Request Smuggling 208 ===
−	16.11 FURTHER READING 208	+	===16.11 Further Reading 208 ===
	'''17''' '''ERROR HANDLING, AUDITING AND LOGGING 210'''		'''17''' '''ERROR HANDLING, AUDITING AND LOGGING 210'''
−	17.1 OBJECTIVE 210	+	===17.1 Objective 210 ===
−	17.2 ENVIRONMENTS AFFECTED 210	+	===17.2 Environments Affected 210 ===
−	17.3 RELEVANT COBIT TOPICS 210	+	===17.3 Relevant COBIT Topics 210 ===
−	17.4 DESCRIPTION 210	+	===17.4 Description 210 ===
−	17.5 BEST PRACTICES 211	+	===17.5 Best practices 211 ===
−	17.6 ERROR HANDLING 211	+	===17.6 Error Handling 211 ===
−	17.7 DETAILED ERROR MESSAGES 212	+	===17.7 Detailed error messages 212 ===
−	17.8 LOGGING 213	+	===17.8 Logging 213 ===
−	17.9 NOISE 216	+	===17.9 Noise 216 ===
−	17.10 COVER TRACKS 216	+	===17.10 Cover Tracks 216 ===
−	17.11 FALSE ALARMS 217	+	===17.11 False Alarms 217 ===
−	17.12 DESTRUCTION 218	+	===17.12 Destruction 218 ===
−	17.13 AUDIT TRAILS 218	+	===17.13 Audit Trails 218 ===
−	17.14 FURTHER READING 219	+	===17.14 Further Reading 219 ===
−	17.15 ERROR HANDLING AND LOGGING 219	+	===17.15 Error Handling and Logging 219 ===
	'''18''' '''FILE SYSTEM 226'''		'''18''' '''FILE SYSTEM 226'''
−	18.1 OBJECTIVE 226	+	===18.1 Objective 226 ===
−	18.2 ENVIRONMENTS AFFECTED 226	+	===18.2 Environments Affected 226 ===
−	18.3 RELEVANT COBIT TOPICS 226	+	===18.3 Relevant COBIT Topics 226 ===
−	18.4 DESCRIPTION 226	+	===18.4 Description 226 ===
−	18.5 BEST PRACTICES 226	+	===18.5 Best Practices 226 ===
−	18.6 DEFACEMENT 226	+	===18.6 Defacement 226 ===
−	18.7 PATH TRAVERSAL 227	+	===18.7 Path traversal 227 ===
−	18.8 INSECURE PERMISSIONS 228	+	===18.8 Insecure permissions 228 ===
−	18.9 INSECURE INDEXING 228	+	===18.9 Insecure Indexing 228 ===
−	18.10 UNMAPPED FILES 229	+	===18.10 Unmapped files 229 ===
−	18.11 TEMPORARY FILES 229	+	===18.11 Temporary files 229 ===
−	18.12 PHP 230	+	===18.12 PHP 230 ===
−	18.13 INCLUDES AND REMOTE FILES 230	+	===18.13 Includes and Remote files 230 ===
−	18.14 FILE UPLOAD 232	+	===18.14 File upload 232 ===
−	18.15 OLD, UNREFERENCED FILES 234	+	===18.15 Old, unreferenced files 234 ===
−	18.16 SECOND ORDER INJECTION 234	+	===18.16 Second Order Injection 234 ===
−	18.17 FURTHER READING 235	+	===18.17 Further Reading 235 ===
−	18.18 FILE SYSTEM 235	+	===18.18 File System 235 ===
	'''19''' '''DISTRIBUTED COMPUTING 237'''		'''19''' '''DISTRIBUTED COMPUTING 237'''
−	19.1 OBJECTIVE 237	+	===19.1 Objective 237 ===
−	19.2 ENVIRONMENTS AFFECTED 237	+	===19.2 Environments Affected 237 ===
−	19.3 RELEVANT COBIT TOPICS 237	+	===19.3 Relevant COBIT Topics 237 ===
−	19.4 BEST PRACTICES 237	+	===19.4 Best Practices 237 ===
−	19.5 RACE CONDITIONS 237	+	===19.5 Race conditions 237 ===
−	19.6 DISTRIBUTED SYNCHRONIZATION 237	+	===19.6 Distributed synchronization 237 ===
−	19.7 FURTHER READING 238	+	===19.7 Further Reading 238 ===
	'''20''' '''BUFFER OVERFLOWS 239'''		'''20''' '''BUFFER OVERFLOWS 239'''
−	20.1 OBJECTIVE 239	+	===20.1 Objective 239 ===
−	20.2 PLATFORMS AFFECTED 239	+	===20.2 Platforms Affected 239 ===
−	20.3 RELEVANT COBIT TOPICS 239	+	===20.3 Relevant COBIT Topics 239 ===
−	20.4 DESCRIPTION 239	+	===20.4 Description 239 ===
−	20.5 GENERAL PREVENTION TECHNIQUES 240	+	===20.5 General Prevention Techniques 240 ===
−	20.6 STACK OVERFLOW 241	+	===20.6 Stack Overflow 241 ===
−	20.7 HEAP OVERFLOW 242	+	===20.7 Heap Overflow 242 ===
−	20.8 FORMAT STRING 243	+	===20.8 Format String 243 ===
−	20.9 UNICODE OVERFLOW 245	+	===20.9 Unicode Overflow 245 ===
−	20.10 INTEGER OVERFLOW 246	+	===20.10 Integer Overflow 246 ===
−	20.11 FURTHER READING 247	+	===20.11 Further reading 247 ===
	'''21''' '''ADMINISTRATIVE INTERFACES 249'''		'''21''' '''ADMINISTRATIVE INTERFACES 249'''
−	21.1 OBJECTIVE 249	+	===21.1 Objective 249 ===
−	21.2 ENVIRONMENTS AFFECTED 249	+	===21.2 Environments Affected 249 ===
−	21.3 RELEVANT COBIT TOPICS 249	+	===21.3 Relevant COBIT Topics 249 ===
−	21.4 BEST PRACTICES 249	+	===21.4 Best practices 249 ===
−	21.5 ADMINISTRATORS ARE NOT USERS 250	+	===21.5 Administrators are not users 250 ===
−	21.6 AUTHENTICATION FOR HIGH VALUE SYSTEMS 250	+	===21.6 Authentication for high value systems 250 ===
−	21.7 FURTHER READING 251	+	===21.7 Further Reading 251 ===
	'''22''' '''CRYPTOGRAPHY 252'''		'''22''' '''CRYPTOGRAPHY 252'''
−	22.1 OBJECTIVE 252	+	===22.1 Objective 252 ===
−	22.2 PLATFORMS AFFECTED 252	+	===22.2 Platforms Affected 252 ===
−	22.3 RELEVANT COBIT TOPICS 252	+	===22.3 Relevant COBIT Topics 252 ===
−	22.4 DESCRIPTION 252	+	===22.4 Description 252 ===
−	22.5 CRYPTOGRAPHIC FUNCTIONS 253	+	===22.5 Cryptographic Functions 253 ===
−	22.6 CRYPTOGRAPHIC ALGORITHMS 253	+	===22.6 Cryptographic Algorithms 253 ===
−	22.7 ALGORITHM SELECTION 255	+	===22.7 Algorithm Selection 255 ===
−	22.8 KEY STORAGE 256	+	===22.8 Key Storage 256 ===
−	22.9 INSECURE TRANSMISSION OF SECRETS 258	+	===22.9 Insecure transmission of secrets 258 ===
−	22.10 REVERSIBLE AUTHENTICATION TOKENS 259	+	===22.10 Reversible Authentication Tokens 259 ===
−	22.11 SAFE UUID GENERATION 260	+	===22.11 Safe UUID generation 260 ===
−	22.12 SUMMARY 260	+	===22.12 Summary 260 ===
−	22.13 FURTHER READING 261	+	===22.13 Further Reading 261 ===
−	22.14 CRYPTOGRAPHY 261	+	===22.14 Cryptography 261 ===
	'''23''' '''CONFIGURATION 266'''		'''23''' '''CONFIGURATION 266'''
−	23.1 OBJECTIVE 266	+	===23.1 Objective 266 ===
−	23.2 PLATFORMS AFFECTED 266	+	===23.2 Platforms Affected 266 ===
−	23.3 RELEVANT COBIT TOPICS 266	+	===23.3 Relevant COBIT Topics 266 ===
−	23.4 BEST PRACTICES 266	+	===23.4 Best Practices 266 ===
−	23.5 DEFAULT PASSWORDS 266	+	===23.5 Default passwords 266 ===
−	23.6 SECURE CONNECTION STRINGS 267	+	===23.6 Secure connection strings 267 ===
−	23.7 SECURE NETWORK TRANSMISSION 267	+	===23.7 Secure network transmission 267 ===
−	23.8 ENCRYPTED DATA 268	+	===23.8 Encrypted data 268 ===
−	23.9 PHP CONFIGURATION 268	+	===23.9 PHP Configuration 268 ===
−	23.10 GLOBAL VARIABLES 268	+	===23.10 Global variables 268 ===
−	23.11 REGISTER_GLOBALS 269	+	===23.11 register_globals 269 ===
−	23.12 DATABASE SECURITY 272	+	===23.12 Database security 272 ===
−	23.13 FURTHER READING 273	+	===23.13 Further Reading 273 ===
−	23.14 COLDFUSION COMPONENTS (CFCS) 273	+	===23.14 ColdFusion Components (CFCs) 273 ===
−	23.15 CONFIGURATION 274	+	===23.15 Configuration 274 ===
	'''24''' '''SOFTWARE QUALITY ASSURANCE 281'''		'''24''' '''SOFTWARE QUALITY ASSURANCE 281'''
−	24.1 OBJECTIVE 281	+	===24.1 Objective 281 ===
−	24.2 PLATFORMS AFFECTED 281	+	===24.2 Platforms Affected 281 ===
−	24.3 BEST PRACTICES 281	+	===24.3 Best practices 281 ===
−	24.4 PROCESS 283	+	===24.4 Process 283 ===
−	24.5 METRICS 283	+	===24.5 Metrics 283 ===
−	24.6 TESTING ACTIVITIES 284	+	===24.6 Testing Activities 284 ===
	'''25''' '''DEPLOYMENT 286'''		'''25''' '''DEPLOYMENT 286'''
−	25.1 OBJECTIVE 286	+	===25.1 Objective 286 ===
−	25.2 PLATFORMS AFFECTED 286	+	===25.2 Platforms Affected 286 ===
−	25.3 BEST PRACTICES 286	+	===25.3 Best Practices 286 ===
−	25.4 RELEASE MANAGEMENT 287	+	===25.4 Release Management 287 ===
−	25.5 SECURE DELIVERY OF CODE 287	+	===25.5 Secure delivery of code 287 ===
−	25.6 CODE SIGNING 288	+	===25.6 Code signing 288 ===
−	25.7 PERMISSIONS ARE SET TO LEAST PRIVILEGE 288	+	===25.7 Permissions are set to least privilege 288 ===
−	25.8 AUTOMATED PACKAGING 288	+	===25.8 Automated packaging 288 ===
−	25.9 AUTOMATED DEPLOYMENT 289	+	===25.9 Automated deployment 289 ===
−	25.10 AUTOMATED REMOVAL 289	+	===25.10 Automated removal 289 ===
−	25.11 NO BACKUP OR OLD FILES 289	+	===25.11 No backup or old files 289 ===
−	25.12 UNNECESSARY FEATURES ARE OFF BY DEFAULT 289	+	===25.12 Unnecessary features are off by default 289 ===
−	25.13 SETUP LOG FILES ARE CLEAN 289	+	===25.13 Setup log files are clean 289 ===
−	25.14 NO DEFAULT ACCOUNTS 290	+	===25.14 No default accounts 290 ===
−	25.15 EASTER EGGS 290	+	===25.15 Easter eggs 290 ===
−	25.16 MALICIOUS SOFTWARE 291	+	===25.16 Malicious software 291 ===
−	25.17 FURTHER READING 292	+	===25.17 Further Reading 292 ===
	'''26''' '''MAINTENANCE 294'''		'''26''' '''MAINTENANCE 294'''
−	26.1 OBJECTIVE 294	+	===26.1 Objective 294 ===
−	26.2 PLATFORMS AFFECTED 294	+	===26.2 Platforms Affected 294 ===
−	26.3 RELEVANT COBIT TOPICS 294	+	===26.3 Relevant COBIT Topics 294 ===
−	26.4 BEST PRACTICES 294	+	===26.4 Best Practices 294 ===
−	26.5 SECURITY INCIDENT RESPONSE 295	+	===26.5 Security Incident Response 295 ===
−	26.6 FIX SECURITY ISSUES CORRECTLY 295	+	===26.6 Fix Security Issues Correctly 295 ===
−	26.7 UPDATE NOTIFICATIONS 296	+	===26.7 Update Notifications 296 ===
−	26.8 REGULARLY CHECK PERMISSIONS 296	+	===26.8 Regularly check permissions 296 ===
−	26.9 FURTHER READING 297	+	===26.9 Further Reading 297 ===
−	26.10 297	+	===26.10 297 ===
−	26.11 MAINTENANCE 297	+	===26.11 Maintenance 297 ===
	'''27''' ''''''GNU FREE DOCUMENTATION LICENSE 301''''''		'''27''' ''''''GNU FREE DOCUMENTATION LICENSE 301''''''
−	27.1 PREAMBLE 301	+	===27.1 PREAMBLE 301 ===
−	27.2 APPLICABILITY AND DEFINITIONS 301	+	===27.2 APPLICABILITY AND DEFINITIONS 301 ===
−	27.3 VERBATIM COPYING 302	+	===27.3 VERBATIM COPYING 302 ===
−	27.4 COPYING IN QUANTITY 303	+	===27.4 COPYING IN QUANTITY 303 ===
−	27.5 MODIFICATIONS 303	+	===27.5 MODIFICATIONS 303 ===
−	27.6 COMBINING DOCUMENTS 305	+	===27.6 COMBINING DOCUMENTS 305 ===
−	27.7 COLLECTIONS OF DOCUMENTS 305	+	===27.7 COLLECTIONS OF DOCUMENTS 305 ===
−	27.8 AGGREGATION WITH INDEPENDENT WORKS 306	+	===27.8 AGGREGATION WITH INDEPENDENT WORKS 306 ===
−	27.9 TRANSLATION 306	+	===27.9 TRANSLATION 306 ===
−	27.10 TERMINATION 306	+	===27.10 TERMINATION 306 ===
−	27.11 FUTURE REVISIONS OF THIS LICENSE 306	+	===27.11 FUTURE REVISIONS OF THIS LICENSE 306 ===

---

Revision as of 11:54, 18 May 2006

A Guide to Building Secure Web Applications and Web Services

2.1 (DRAFT 3) February 2006

A Guide to Building Secure Web Applications and Web Services

2.1 (DRAFT 3) February 2006

OWASP Foundation

=========Frontispiece =========

Dedication

To my fellow procrastinators and TiVo addicts, this book proves that given enough “tomorrows,” anything is possible. Andrew van der Stock

Copyright and license

© 2001 – 2006 OWASP Foundation. The Guide is licensed under the Free Documentation License, a copy of which is found in the Appendix. PERMISSION IS GRANTED TO COPY, DISTRIBUTE, AND/OR MODIFY THIS DOCUMENT PROVIDED THIS COPYRIGHT NOTICE AND ATTRIBUTION TO OWASP IS RETAINED.

Editors

The Guide has had several editors over various editions, all of whom have contributed immensely as authors, project managers, and editors over the lengthy period of the Guide’s gestation. Guide 2.x series editors:

Andrew van der Stock Adrian Wiesmann

Authors and Reviewers

The Guide would not be where it is today without the generous gift of volunteer time and effort from many individuals. The following people helped develop Guide 2.x:

Abraham Kang Adrian Wiesmann Amit Klein Andrew van der Stock Brian Greidanus Christopher Todd Darrel Grundy Daniel Cornell David Endler Denis Pilipchuk Dennis Groves Derek Browne Eoin Keary Erik Lee Ernesto Arroyo Frank Lemmon Gene McKenna Hal Lockhart Izhar By-Gad Jeremy Poteet José Pedro Arroyo K.K. Mookhey Kevin McLaughlin Martin Eizner Michael Howard Michael Scovetta Mikael Simonsson Neal Krawetz Nigel Tranter Raoul Endres Ray Stirbei Richard Parke Robert Hansen Roy McNamara Steve Taylor Sverre Huseby Tim Smith William Hau

Revision History

Date Version Pages Notes July 26, 2005 2.0 Blackhat Edition 280 pages Andrew van der Stock, Guide Lead July 27, 2005 2.0.1 Blackhat Edition++ 293 pages Cryptography chapter review from Michael Howard incorporated September 12, 2005 2.1 DRAFT 1 X pages Changes from many sources New SQA chapter from Frank Lemmon January 2006 2.1 DRAFT 2 X pages Changes from Bill Pollock New chapters from Erick Lee New revisions from Dan Cornell February 2006 2.1 DRAFT 3 X pages Ajax chapter Many chapters back from reviewers

Date	Version	Pages	Notes
July 26, 2005	2.0 Blackhat Edition	280 pages	Andrew van der Stock, Guide Lead
July 27, 2005	2.0.1 Blackhat Edition++	293 pages	Cryptography chapter review from Michael Howard incorporated
September 12, 2005	2.1 DRAFT 1	X pages	Changes from many sources New SQA chapter from Frank Lemmon
January 2006	2.1 DRAFT 2	X pages	Changes from Bill Pollock New chapters from Erick Lee New revisions from Dan Cornell
February 2006	2.1 DRAFT 3	X pages	Ajax chapter Many chapters back from reviewers

=========Table of Contents =========

1 ABOUT THE OPEN WEB APPLICATION SECURITY PROJECT 13

1.1 Structure and Licensing 13

1.2 Participation and Membership 13

1.3 Projects 14

2 INTRODUCTION 15

2.1 Developing Secure Applications 15

2.2 Improvements in this edition 15

2.3 How to use this Guide 16

2.4 Updates and errata 16

2.5 With thanks 16

3 WHAT ARE WEB APPLICATIONS? 17

3.1 Technologies 18

3.2 First generation – CGI 18

3.3 Filters 18

3.4 Scripting 19

3.5 Web application frameworks – J2EE and ASP.NET 20

3.6 Small to medium scale applications 21

3.7 Large scale applications 22

3.8 View 22

3.9 Controller 22

3.10 Model 23

3.11 Conclusion 24

4 POLICY FRAMEWORKS 25

4.1 Organizational commitment to security 25

4.2 OWASP’s Place at the Framework table 26

4.3 Development Methodology 28

4.4 Coding Standards 29

4.5 Source Code Control 29

4.6 Summary 30

5 SECURE CODING PRINCIPLES 31

5.1 Asset Classification 31

5.2 About attackers 31

5.3 Core pillars of information security 32

5.4 Security Architecture 32

5.5 Security Principles 33

6 THREAT RISK MODELING 37

6.1 Threat Risk Modeling 37

6.2 Performing threat risk modeling using the Microsoft Threat Modeling Process 37

6.3 Alternative Threat Modeling Systems 44

6.4 Trike 44

6.5 AS/NZS 4360:2004 Risk Management 44

6.6 CVSS 45

6.7 OCTAVE 46

6.8 Conclusion 47

6.9 Further Reading 47

7 HANDLING E-COMMERCE PAYMENTS 49

7.1 Objectives 49

7.2 Compliance and Laws 49

7.3 PCI Compliance 49

7.4 Handling Credit Cards 50

7.5 Further Reading 53

8 PHISHING 55

8.1 What is phishing? 55

8.2 User Education 56

8.3 Make it easy for your users to report scams 57

8.4 Communicating with customers via e-mail 57

8.5 Never ask your customers for their secrets 58

8.6 Fix all your XSS issues 58

8.7 Do not use pop-ups 59

8.8 Don’t be framed 59

8.9 Move your application one link away from your front page 59

8.10 Enforce local referrers for images and other resources 59

8.11 Keep the address bar, use SSL, do not use IP addresses 60

8.12 Don’t be the source of identity theft 60

8.13 Implement safe-guards within your application 61

8.14 Monitor unusual account activity 61

8.15 Get the phishing target servers offline pronto 62

8.16 Take control of the fraudulent domain name 62

8.17 Work with law enforcement 63

8.18 When an attack happens 63

8.19 Further Reading 63

9 WEB SERVICES 64

Securing Web Services 64

Communication security 65

Passing credentials 65

Ensuring message freshness 66

Protecting message integrity 66

Protecting message confidentiality 67

Access control 67

Audit 68

Web Services Security Hierarchy 68

SOAP 69

WS-Security Standard 70

WS-Security Building Blocks 72

Communication Protection Mechanisms 78

Access Control Mechanisms 80

Forming Web Service Chains 82

Available Implementations 83

Problems 85

Further Reading 87

10 AJAX AND OTHER “RICH” INTERFACE TECHNOLOGIES 5

10.1 Objective 5

10.2 Platforms Affected 5

10.3 Architecture 5

10.4 Access control: Authentication and Authorization 5

10.5 Silent transactional authorization 5

10.6 Untrusted or absent session data 5

10.7 State management 5

10.8 Tamper resistance 5

10.9 Privacy 5

10.10 Proxy Façade 5

10.11 SOAP Injection Attacks 5

10.12 XMLRPC Injection Attacks 5

10.13 DOM Injection Attacks 5

10.14 XML Injection Attacks 5

10.15 JSON (Javascript Object Notation) Injection Attacks 5

10.16 Encoding safety 5

10.17 Auditing 5

10.18 Error Handling 5

10.19 Accessibility 5

10.20 Further Reading 5

11 AUTHENTICATION 108

11.1 Objective 108

11.2 Environments Affected 108

11.3 Relevant COBIT Topics 108

11.4 Best Practices 108

11.5 Common web authentication techniques 109

11.6 Strong Authentication 111

11.7 Federated Authentication 115

11.8 Client side authentication controls 117

11.9 Positive Authentication 118

11.10 Multiple Key Lookups 120

11.11 Referer Checks 122

11.12 Browser remembers passwords 123

11.13 Default accounts 124

11.14 Choice of usernames 125

11.15 Change passwords 126

11.16 Short passwords 126

11.17 Weak password controls 127

11.18 Reversible password encryption 128

11.19 Automated password resets 128

11.20 Brute Force 130

11.21 Remember Me 131

11.22 Idle Timeouts 132

11.23 Logout 132

11.24 Account Expiry 133

11.25 Self registration 134

11.26 CAPTCHA 134

11.27 Further Reading 135

11.28 Authentication 136

12 AUTHORIZATION 148

12.1 Objectives 148

12.2 Environments Affected 148

12.3 Relevant COBIT Topics 148

12.4 Best Practices 148

12.5 Best Practices in Action 149

12.6 Principle of least privilege 150

12.7 Centralized authorization routines 152

12.8 Authorization matrix 152

12.9 Controlling access to protected resources 153

12.10 Protecting access to static resources 153

12.11 Reauthorization for high value activities or after idle out 154

12.12 Time based authorization 154

12.13 Be cautious of custom authorization controls 154

12.14 Never implement client-side authorization tokens 155

12.15 Further Reading 156

13 SESSION MANAGEMENT 157

13.1 Objective 157

13.2 Environments Affected 157

13.3 Relevant COBIT Topics 157

13.4 Description 157

13.5 Best practices 158

13.6 Exposed Session Variables 159

13.7 Page and Form Tokens 159

13.8 Weak Session Cryptographic Algorithms 160

13.9 Session Token Entropy 161

13.10 Session Time-out 161

13.11 Regeneration of Session Tokens 162

13.12 Session Forging/Brute-Forcing Detection and/or Lockout 163

13.13 Session Token Capture and Session Hijacking 163

13.14 Session Tokens on Logout 165

13.15 Session Validation Attacks 165

13.16 PHP 166

13.17 Sessions 166

13.18 Further Reading 167

13.19 Session Management 168

14 DATA VALIDATION 173

14.1 Objective 173

14.2 Platforms Affected 173

14.3 Relevant COBIT Topics 173

14.4 Description 173

14.5 Definitions 173

14.6 Where to include integrity checks 174

14.7 Where to include validation 174

14.8 Where to include business rule validation 174

14.9 Data Validation Strategies 175

14.10 Prevent parameter tampering 177

14.11 Hidden fields 178

14.12 ASP.NET Viewstate 179

14.13 URL encoding 182

14.14 HTML encoding 182

14.15 Encoded strings 183

14.16 Data Validation and Interpreter Injection 183

14.17 186

14.18 Delimiter and special characters 186

14.19 Further Reading 187

15 INTERPRETER INJECTION 188

15.1 Objective 188

15.2 Platforms Affected 188

15.3 Relevant COBIT Topics 188

15.4 User Agent Injection 188

15.5 HTTP Response Splitting 192

15.6 SQL Injection 193

15.7 ORM Injection 193

15.8 LDAP Injection 194

15.9 XML Injection 196

15.10 Code Injection 196

15.11 Further Reading 197

15.12 SQL-injection 199

15.13 Code Injection 202

15.14 Command injection 202

16 CANONCALIZATION, LOCALE AND UNICODE 203

16.1 Objective 203

16.2 Platforms Affected 203

16.3 Relevant COBIT Topics 203

16.4 Description 203

16.5 Unicode 204

16.6 http://www.ietf.org/rfc/rfc2279.txt?number=2279 206

16.7 Input Formats 206

16.8 Locale assertion 207

16.9 Double (or n-) encoding 207

16.10 HTTP Request Smuggling 208

16.11 Further Reading 208

17 ERROR HANDLING, AUDITING AND LOGGING 210

17.1 Objective 210

17.2 Environments Affected 210

17.3 Relevant COBIT Topics 210

17.4 Description 210

17.5 Best practices 211

17.6 Error Handling 211

17.7 Detailed error messages 212

17.8 Logging 213

17.9 Noise 216

17.10 Cover Tracks 216

17.11 False Alarms 217

17.12 Destruction 218

17.13 Audit Trails 218

17.14 Further Reading 219

17.15 Error Handling and Logging 219

18 FILE SYSTEM 226

18.1 Objective 226

18.2 Environments Affected 226

18.3 Relevant COBIT Topics 226

18.4 Description 226

18.5 Best Practices 226

18.6 Defacement 226

18.7 Path traversal 227

18.8 Insecure permissions 228

18.9 Insecure Indexing 228

18.10 Unmapped files 229

18.11 Temporary files 229

18.12 PHP 230

18.13 Includes and Remote files 230

18.14 File upload 232

18.15 Old, unreferenced files 234

18.16 Second Order Injection 234

18.17 Further Reading 235

18.18 File System 235

19 DISTRIBUTED COMPUTING 237

19.1 Objective 237

19.2 Environments Affected 237

19.3 Relevant COBIT Topics 237

19.4 Best Practices 237

19.5 Race conditions 237

19.6 Distributed synchronization 237

19.7 Further Reading 238

20 BUFFER OVERFLOWS 239

20.1 Objective 239

20.2 Platforms Affected 239

20.3 Relevant COBIT Topics 239

20.4 Description 239

20.5 General Prevention Techniques 240

20.6 Stack Overflow 241

20.7 Heap Overflow 242

20.8 Format String 243

20.9 Unicode Overflow 245

20.10 Integer Overflow 246

20.11 Further reading 247

21 ADMINISTRATIVE INTERFACES 249

21.1 Objective 249

21.2 Environments Affected 249

21.3 Relevant COBIT Topics 249

21.4 Best practices 249

21.5 Administrators are not users 250

21.6 Authentication for high value systems 250

21.7 Further Reading 251

22 CRYPTOGRAPHY 252

22.1 Objective 252

22.2 Platforms Affected 252

22.3 Relevant COBIT Topics 252

22.4 Description 252

22.5 Cryptographic Functions 253

22.6 Cryptographic Algorithms 253

22.7 Algorithm Selection 255

22.8 Key Storage 256

22.9 Insecure transmission of secrets 258

22.10 Reversible Authentication Tokens 259

22.11 Safe UUID generation 260

22.12 Summary 260

22.13 Further Reading 261

22.14 Cryptography 261

23 CONFIGURATION 266

23.1 Objective 266

23.2 Platforms Affected 266

23.3 Relevant COBIT Topics 266

23.4 Best Practices 266

23.5 Default passwords 266

23.6 Secure connection strings 267

23.7 Secure network transmission 267

23.8 Encrypted data 268

23.9 PHP Configuration 268

23.10 Global variables 268

23.11 register_globals 269

23.12 Database security 272

23.13 Further Reading 273

23.14 ColdFusion Components (CFCs) 273

23.15 Configuration 274

24 SOFTWARE QUALITY ASSURANCE 281

24.1 Objective 281

24.2 Platforms Affected 281

24.3 Best practices 281

24.4 Process 283

24.5 Metrics 283

24.6 Testing Activities 284

25 DEPLOYMENT 286

25.1 Objective 286

25.2 Platforms Affected 286

25.3 Best Practices 286

25.4 Release Management 287

25.5 Secure delivery of code 287

25.6 Code signing 288

25.7 Permissions are set to least privilege 288

25.8 Automated packaging 288

25.9 Automated deployment 289

25.10 Automated removal 289

25.11 No backup or old files 289

25.12 Unnecessary features are off by default 289

25.13 Setup log files are clean 289

25.14 No default accounts 290

25.15 Easter eggs 290

25.16 Malicious software 291

25.17 Further Reading 292

26 MAINTENANCE 294

26.1 Objective 294

26.2 Platforms Affected 294

26.3 Relevant COBIT Topics 294

26.4 Best Practices 294

26.5 Security Incident Response 295

26.6 Fix Security Issues Correctly 295

26.7 Update Notifications 296

26.8 Regularly check permissions 296

26.9 Further Reading 297

26.10 297

26.11 Maintenance 297

27 'GNU FREE DOCUMENTATION LICENSE 301'

27.1 PREAMBLE 301

27.2 APPLICABILITY AND DEFINITIONS 301

27.3 VERBATIM COPYING 302

27.4 COPYING IN QUANTITY 303

27.5 MODIFICATIONS 303

27.6 COMBINING DOCUMENTS 305

27.7 COLLECTIONS OF DOCUMENTS 305

27.8 AGGREGATION WITH INDEPENDENT WORKS 306

27.9 TRANSLATION 306

27.10 TERMINATION 306

27.11 FUTURE REVISIONS OF THIS LICENSE 306