Web application security in Java

Day 1

Cyber security basics

• What is security?
• Threat and risk
• Cyber security threat types
• Consequences of insecure software

The OWASP Top 10

A1 – Injection

• Injection principles
• Injection attacks
• SQL injection
  – SQL injection basics
  – Lab – SQL injection
  – Attack techniques
  – Content-based blind SQL injection
  – Time-based blind SQL injection

• SQL injection best practices
  – Input validation
  – Parameterized queries
  – Lab – Using prepared statements
  – Case study – Hacking Fortnite accounts
• Code injection
  – OS command injection
  – OS command injection best practices
  – Using Runtime.exec()
  – Using ProcessBuilder
  – Case study – Shellshock
  – Lab – Shellshock
  – Script injection

A2 – Broken Authentication

• Authentication
  – Authentication basics
  – Multi-factor authentication
  – Authentication weaknesses
  – Case study – PayPal 2FA bypass
• Password management
  – Inbound password management
  – Storing account passwords
  – Password in transit
  – Lab – Is just hashing passwords enough?
  – Dictionary attacks and brute forcing
  – Salting
  – Adaptive hash functions for password storage
  – Password policy
  – NIST authenticator requirements for memorized secrets
  – Case study – The Ashley Madison data breach
  – The dictionary attack
  – The ultimate crack
  – Exploitation and the lessons learned
• Password database migration
  – (Mis)handling null passwords

Day 2

A2 – Broken Authentication (continued)

• Session management
  – Session management essentials
  – Why do we protect session IDs – Session hijacking
  – Session fixation
  – Session invalidation
  – Session ID best practices
  – Cross-site Request Forgery (CSRF)
  – Lab – Cross-site Request Forgery
  – CSRF best practices
  – CSRF defense in depth
  – Lab – CSRF protection with tokens
  – Cookie security
  – Cookie attributes

A4 – XML External Entities (XXE)

• DTD and the entities
• Entity expansion
• External Entity Attack (XXE)
  – File inclusion with external entities
  – Server-Side Request Forgery with external entities
  – Lab – External entity attack
  – Case study – XXE vulnerability in SAP Store
  – Preventing XXE
  – Lab – Prohibiting DTD expansion

A5 – Broken Access Control

• Access control basics
• Failure to restrict URL access
• Confused deputy
  – Insecure direct object reference (IDOR)
  – Lab – Insecure Direct Object Reference
  – Authorization bypass through user-controlled keys
  – Case study – Authorization bypass on Facebook
  – Lab – Horizontal authorization
• File upload
  – Unrestricted file upload
  – Good practices
  – Lab – Unrestricted file upload

A7 – Cross-site Scripting (XSS)

• Cross-site scripting basics
• Cross-site scripting types
  – Persistent cross-site scripting
  – Reflected cross-site scripting
  – Client-side (DOM-based) cross-site scripting
• Lab – Stored XSS
• Lab – Reflected XSS
• Case study – XSS in Fortnite accounts
• XSS protection best practices
  – Protection principles – escaping
  – XSS protection APIs in Java
  – XSS protection in JSP
  – Lab – XSS fix / stored
  – Lab – XSS fix / reflected
  – Additional protection layers
  – Client-side protection principles

A8 – Insecure Deserialization

• Serialization and deserialization challenges
• Integrity – deserializing untrusted streams
• Using readObject
• Integrity – deserialization best practices
• Look ahead deserialization
• Property Oriented Programming (POP)
  – Creating payload
  – Summary – POP best practices
  – Lab – Creating a POP payload
  – Lab – Using the POP payload

A9 – Using Components with Known Vulnerabilities

• Using vulnerable components
• Untrusted functionality import
• Importing JavaScript
• Lab – Importing JavaScript
• Case study – The British Airways data breach
• Vulnerability management
  – Patch management
  – Vulnerability databases
  – Lab – Finding vulnerabilities in third-party components

Day 3

Web application security beyond the Top Ten

• Client-side security
• Same Origin Policy
• Frame sandboxing
  – Cross-Frame Scripting (XFS) attack
  – Lab – Clickjacking
  – Clickjacking beyond hijacking a click
  – Clickjacking protection best practices
  – Lab – Using CSP to prevent clickjacking

API security

• Input validation
  – Input validation principles
  – Blacklists and whitelists
  – Data validation techniques
  – Lab – Input validation
  – What to validate – the attack surface
  – Where to validate – defense in depth
  – When to validate – validation vs transformations
  – Output sanitization
  – Encoding challenges
  – Unicode challenges
  – Lab – Encoding challenges
  – Validation with regex
  – Regular expression denial of service (ReDoS)
  – Lab – ReDoS in Java
  – Dealing with ReDoS
• Integer handling problems
  – Representing signed numbers
  – Integer visualization
  – Integer overflow
  – Lab – Integer overflow
  – Signed / unsigned confusion in Java
  – Case study – The Stockholm Stock Exchange
  – Integer truncation
  – Best practices
  – Upcasting
  – Precondition testing
  – Postcondition testing
  – Using big integer libraries
  – Integer handling in Java
  – Lab – Integer handling
• Files and streams
  – Path traversal
  – Lab – Path traversal
  – Path traversal-related examples
  – Additional challenges in Windows
  – Virtual resources
  – Path traversal best practices
  – Lab – Path canonicalization
• Unsafe reflection
  – Reflection without validation
  – Lab – Unsafe reflection
• Code quality
  – Data handling
  – Initialization and cleanup
  – Class initialization cycles
  – Lab – Initialization cycles
  – The finalize() method – best practices
  – Object oriented programming pitfalls
  – Inheritance and overriding
  – Mutability
  – Lab – Mutable object

Wrap up

• Secure coding principles
  – Principles of robust programming by Matt Bishop
  – Secure design principles of Saltzer and Schröder

And now what?

• Software security sources and further reading
• Java resources