Web application security in C#

Day 1

• Cyber security basics
  • What is security?
  • Threat and risk
  • Cyber security threat types – the CIA triad
  • Consequences of insecure software
• The OWASP Top Ten 2021
  • A01 – Broken Access Control
    • Access control basics
    • Confused deputy
      • Insecure direct object reference (IDOR)
      • Path traversal
      • Lab – Insecure Direct Object Reference
      • Path traversal best practices
      • Authorization bypass through user-controlled keys
      • Case study – Remote takeover of Nexx garage doors and alarms
      • Lab – Horizontal authorization
    • File upload
      • Unrestricted file upload
      • Good practices
      • Lab – Unrestricted file upload
      • Case study – File upload vulnerability in Citrix ShareFile
  • A02 – Cryptographic Failures
    • Cryptography for developers
      • Cryptography basics
      • Crypto APIs in C#
      • Elementary algorithms
        • Hashing
          • Hashing basics
          • Hashing in C#
          • Lab – Hashing in C#
        • Random number generation
          • Pseudo random number generators (PRNGs)
          • Cryptographically secure PRNGs
          • Weak and strong PRNGs
          • Using random numbers in C#
          • Lab – Using random numbers in C#
          • Case study – Equifax credit account freeze
      • Confidentiality protection
        • Symmetric encryption
          • Block ciphers
          • Modes of operation
          • Modes of operation and IV – best practices
          • Symmetric encryption in C#
          • Symmetric encryption in C# with streams
          • Lab – Symmetric encryption in C#
          • Case study – Padding oracle used in RCE against Citrix ShareFile
        • Asymmetric encryption
          • The RSA algorithm
            • RSA in C#
        • Combining symmetric and asymmetric algorithms
        • Key exchange and agreement
          • Key exchange
          • Diffie-Hellman key agreement algorithm
          • Key exchange pitfalls and best practices

Day 2

• The OWASP Top Ten 2021
  • A03 – Injection
    • Injection principles
    • Injection attacks
    • SQL injection
      • SQL injection basics
      • Lab – SQL injection
      • Attack techniques
      • Content-based blind SQL injection
      • Time-based blind SQL injection
      • SQL injection best practices
        • Input validation
        • Parameterized queries
        • Lab – Using prepared statements
        • Case study – SQL injection leading to RCE in Ivanti Endpoint Manager
    • Code injection
      • OS command injection
        • Lab – Command injection
        • OS command injection best practices
        • Avoiding command injection with the right APIs
        • Lab – Command injection best practices
        • Case study – Command injection in Ruckus
    • HTML injection – Cross-site scripting (XSS)
      • Cross-site scripting basics
      • Cross-site scripting types
        • Persistent cross-site scripting
        • Reflected cross-site scripting
        • Client-side (DOM-based) cross-site scripting
      • Lab – Stored XSS
      • Lab – Reflected XSS
      • Case study – XSS to RCE in Azure Service Fabric
      • XSS protection best practices
        • Protection principles – escaping
        • XSS protection APIs
        • Further XSS protection techniques
        • Lab – XSS fix / stored
        • Lab – XSS fix / reflected
        • Additional protection layers – defense in depth
  • A04 – Insecure Design
    • The STRIDE model of threats
    • Secure design principles of Saltzer and Schroeder
      • Economy of mechanism
      • Fail-safe defaults
      • Complete mediation
      • Open design
      • Separation of privilege
      • Least privilege
      • Least common mechanism
      • Psychological acceptability
    • Client-side security
      • Frame sandboxing
        • Cross-Frame Scripting (XFS) attacks
        • Lab – Clickjacking
        • Clickjacking beyond hijacking a click
        • Clickjacking protection best practices
        • Lab – Using CSP to prevent clickjacking
  • A05 – Security Misconfiguration
    • Configuration principles
    • XML entities
      • DTD and the entities
      • Entity expansion
      • External Entity Attack (XXE)
        • File inclusion with external entities
        • Server-Side Request Forgery with external entities
        • Lab – External entity attack
        • Preventing XXE
        • Lab – Prohibiting DTD
        • Case study – XXE vulnerability in SharePoint

Day 3

• The OWASP Top Ten 2021
  • A06 – Vulnerable and Outdated Components
    • Using vulnerable components
    • Assessing the environment
    • Hardening
    • Untrusted functionality import
    • Case study – The Polyfill.io supply chain attack
    • Vulnerability management
      • Patch management
      • Vulnerability databases
      • Lab – Finding vulnerabilities in third-party components
      • DevOps, the CI / CD build process and Software Composition Analysis
      • Dependency checking in C#
      • Lab – Detecting vulnerable components
  • A07 – Identification and Authentication Failures
    • Authentication
      • Authentication basics
      • Multi-factor authentication (MFA)
      • Case study – The InfinityGauntlet attack
    • Password management
      • Inbound password management
        • Storing account passwords
        • Lab – Is just hashing passwords enough?
        • Dictionary attacks and brute forcing
        • Salting
        • Adaptive hash functions for password storage
        • Lab – Using adaptive hash functions in C#
        • Case study – Veeam missing authentication and cleartext password storage
        • Password policy
          • NIST authenticator requirements for memorized secrets
  • A08 – Software and Data Integrity Failures
    • Integrity protection
      • Message Authentication Code (MAC)
        • Calculating HMAC in C#
        • Lab – Calculating MAC in C#
      • Digital signature
        • Digital signature with RSA
        • Elliptic Curve Cryptography
          • ECC basics
          • Digital signature with ECC
        • Digital signature in C#
          • Lab – Digital signature with ECDSA in C#
    • Subresource integrity
      • Importing JavaScript
      • Lab – Importing JavaScript
      • Case study – The British Airways data breach
    • Insecure deserialization
      • Serialization and deserialization challenges
      • Integrity – deserializing untrusted streams
      • Integrity – deserialization best practices
      • Look ahead deserialization
      • Property Oriented Programming (POP)
        • Creating a POP payload
        • Lab – Creating a POP payload
        • Lab – Using the POP payload
        • Case study – Deserialization RCE in Veeam
        • Summary – POP best practices
  • A09 – Security Logging and Monitoring Failures
    • Logging and monitoring principles
    • Insufficient logging
    • Case study – Plaintext passwords at Facebook
    • Logging best practices
    • Monitoring best practices
  • A10 – Server-side Request Forgery (SSRF)
    • Server-side Request Forgery (SSRF)
    • Case study – SSRF and the Capital One breach
• Wrap up
  • Secure coding principles
    • Principles of robust programming by Matt Bishop
  • And now what?
    • Software security sources and further reading
    • .NET and C# resources