Web application security in Java

Day 1

Cybersecurity

Fundamentals
• What is Security?
• Threats and Risks
• Types of Cybersecurity
Threats
• Consequences of Insecure Software

OWASP Top 10

A1 – Injection

• Injection Principles

• Injection attacks

• SQL injection

• SQL Injection Basics

• Lab – SQL Injection

• Attack techniques

• Content-based blind SQL injection

• Time-based blind SQL injection

• SQL injection

best practices

• Input validation

• Parameterized queries

• Lab – Use of prepared kits

• Case study – Hacking Fortnite accounts

• Code injection

• OS command injection

• Best practices for OS command injection

• Using Runtime.exec()

• Using ProcessBuilder

• Case Study – Shellshock

• Lab – Shellshock

• Script Injection

A2 – Lack of authentication

• Authentication
• Authentication basics
• Multi-factor authentication
• Weaknesses in authentication
• Case Study – PayPal 2FA Bypass
• Password Management
• Inbound password management
• Account password storage
• Passwords in transit
• Lab – Is it enough to just hash passwords?
• Dictionary attacks and brute forcing
• Salting
• Adaptive hash functions for storing passwords
• Password policy
• NIST authentication requirements for memorized secrets
• Case Study – The Ashley Madison Data Breach
• The dictionary attack
• The ultimate crack
• Exploitation and lessons learned
• Password database migration
• (Error) handling of null passwords

Day 2

A2 – Lack of authentication (continued)

• Session Management
• Session Management
Basics
• Why We Protect Session IDs – Session Hijacking
• Session Fixation
• Session Invalidation
• Session ID Best Practices
• Cross-site Request Forgery (CSRF)
• Lab – Cross-site Request Forgery
• CSRF
Best Practices
• CSRF Defense in Depth
• Lab – CSRF Protection with Tokens
• Cookie Security
• Cookie Attributes

A4 – XML External Entities (XXE)

• DTD and the
Entities
• Entity Expansion
• External Entity Attack (XXE)
• File Inclusion with External Entities
• Server-Side Request Forgery with External Entities
• Lab – External entity attack
• Case Study – XXE Vulnerability in SAP Store
• Prevent XXE
• Lab – Prevent DTD Expansion

A5 – Lack of access control

• Access Control Basics
• Failure to restrict URL access
• Confused deputy
• Insecure Direct Object Reference (IDOR)
• Laboratory work – Uncertain direct object reference
• Authorization through user-controlled keys
• Case Study – Authorization on Facebook
• Laboratory work – Horizontal authorization
• File upload
• Unlimited file uploads
• Good practice
• Lab – Unlimited File Upload

A7 – Multi-Site Scripting (XSS)

• Basics of Multi-Site
Scripting
• Types of Scripting on Other Sites
• Persistent Scripting on Other Sites
• Reflected Scripting on Other Sites
• Client-Side Scripting on Other Sites (DOM-Based)
• Lab – Stored XSS
• Lab – Reflected XSS
• Case Study – XSS in Fortnite Accounts
• Best Practices for XSS Protection
• Protection Policies – Escaping
• XSS Protection APIs in Java
• XSS Protection in JSP
• Lab – XSS Fix / Stored
• Lab – XSS Fix / Reflected
• Additional Layers
of Protection
• Client-Side Protection Policies

A8 – Uncertain deserialization

• Challenges of Serialization and Deserialization
• Integrity – Deserialization of Untrusted Flows
• Using readObject
• Integrity – Best Practices for Deserialization
• Deserialization with Foresight
• Property Oriented Programming (POP)
• Creating Payloads
• Summary – Best Practices for POPs
• Lab – Creating a POP Payload
• Lab – Using the POP Payload

A9 – Using Components with Known Vulnerabilities

• Use of Vulnerable Components
• Importing Untrusted Functionality
• Importing JavaScript
• Lab – Importing JavaScript
• Case Study – The British Airways
Data Breach
• Vulnerability Management
• Patch Management
• Vulnerability Databases
• Lab – Finding Vulnerabilities in Third-Party Components

Day 3

Web Application Security Beyond the Top Ten

• Client-Side
Security
• Same-Origin
Policy
• Frame Sandboxing
• Cross-Frame Scripting (XFS)
Attack
• Labs – Clickjacking
• Clickjacking Beyond Hijacking a Click
• Best Practices to Protect Against Clickjacking
• Labs – Using CSP to Prevent Clickjacking

API Security

• Injection Validation
• Principles of Injection Validation
• Black and White Lists
• Data Validation Techniques
• Lab – Injection Validation
• What to Validate – Attack
Surface
• Where to Validate – Defense in Depth
• When to Validate – Validation vs Transformations
• Output Sanitization
• Encoding Challenges
• Unicode Challenges
• Lab – Coding Challenges
• Validation with Regex
• Regular expression denial of service (ReDoS)
• Lab – ReDoS in Java
• Handling ReDoS
• Integer handling
issues
• Representation of signed numbers
• Integer visualization Integer
• overflow
• Lab – Integer overflow
• Signed/unsigned confusion in Java
• Case study – Stockholm Stock Exchange
• Integer truncation
• Best practice
• Upcasting
• Precondition testing
• Postcondition testing
• Using big integer libraries
• Integer action in Java
• Lab – Integer action
• Files and streams
• Path traversal
• Lab – Path Traversing
• Examples of Path Traversing
• Additional Challenges in Windows
• Virtual Resources
• Best Practices for Path Traversing
• Lab – Path Canonicalization
• Uncertain Reflection
• Reflection Without Validation
• Lab – Uncertain Reflection
• Code Quality
• Data Management
• Initialization and Purging
• Class Initialization Cycles
• Lab – Initialization Cycles
• The finalize() – Best Practices
method
• Pitfalls in object-oriented programming
• Inheritance and override
• Mutability
• Lab – Mutable object

Unpack

• Principles of Secure Coding
• Principles of Robust Programming by Matt Bishop
• Principles of Secure Design by Saltzer and Schröder

And what happens now?

• Software Security – Sources and Further Reading
• Java Resources