ColdFusion Application Security: Beyond SQL Injection

Comments

Hello. Know, first, who you are; and then adorn yourself accordingly. Help me! Can not find sites on the: Ventless air conditioners. I found only this - <a href="http://www.praiamar.com.br/Members/Conditioners/shampoos-conditioners">shampoos conditioners</a>. Your choice of conditioner depends most on your hair type unlike your choice of shampoo, which depends on. Shop for from a huge selection of online stores; best prices, reviews and product ratings. Thanks for the help :rolleyes:, Pascale from Taiwan.

Posted By: Pascale On: 08/19/09 4:25 AM

Good afternoon. You always pass failure on the way to success. Help me! Help to find sites on the: Stock pick list. I found only this - <a href="http://www4.planalto.gov.br/consea/pec-alimentacao/Members/Stockpicks">penny stock hot picks</a>. penny stock picks strong company. short term stock picks. With respect ;-), Cheryl from Grenada.

Posted By: Cheryl On: 08/29/09 5:48 AM

Great slides!

Posted By: Toronto Printing On: 04/26/10 11:04 AM

Fabulous slide!

Posted By: Kelowna Mortgages On: 07/12/10 6:23 PM

Very nice and helpful information has been given in this article. I must say that this is a great post. I loved reading it slide six.

Posted By: cheap vps On: 11/22/10 8:23 AM

Beverly Hills Bail Bonds Call (424) 230-3276 for Professional Licensed Bail Bond Agents, Bail Bonds Beverly Hills 90210, Bail Bondsman, Bail Bonds Beverly Hills Bail Bonds

Posted By: Beverly Hills Jail Bail Bond On: 02/10/11 11:00 AM

Jaipuria Brothers - Manufacturer, exporter and supplier of air break switches, isolating switches, air break isolating switches, electrical switches manufacturer, isolating switches manufacturer in India, isolating switches exporter, air break isolating switches India, isolating switches supplier.

Posted By: 33 kv Isolators On: 02/10/11 11:03 AM

Hawthorne Bail Bonds Call: 424-456-2866 for professional Licensed Bail Bonds agents Los Angeles Bail Bonds specialist 90250 Bail Bonds, over 10 years of Bail Bond experience in California Bail Bonds Hawthorne Bail Bondsman

Posted By: Bail Bond Hawthorne On: 02/10/11 11:04 AM

BII offer a comprehensive implementation service designed to assist in all aspects of your deployment of security technology, from project management to turnkey deployment. The BII service is designed to deliver best practices garnered from our experience with a cross-section of Blue Chip companies. Our project managers use a structured approach focused on details and results to define the high-level solution and drive to a fully optimised product, accelerating time to deployment.

Posted By: IT Security reseller On: 05/14/11 9:52 PM

Framing Services ART LOFT in Oakland CA. We are Professional and celebrating 38 years of service with extreme quality and designs framing services.

Posted By: Oakland Framing On: 05/14/11 9:53 PM

Greetings from Australia... We need more slides about Singapore and South Africa especially!

Posted By: viagra south africa On: 06/10/11 3:09 PM

I would like to thank you

Posted By: منتدى زفه العروس On: 08/15/11 3:34 PM

I would like to thank you

Posted By: زفات On: 08/15/11 3:37 PM

thx a lot's i like that

Posted By: موقع زفات On: 08/15/11 3:41 PM

THANK U

Posted By: قبلة الوداع On: 08/23/11 11:28 PM

Wonderful and beautiful thank you

Posted By: حروف On: 08/24/11 3:38 AM

thnx

Posted By: نجوم توب On: 08/24/11 2:34 PM

I would like to thank you for the efforts you have made in writing this article. I am hoping the same best work from you in the future as well.

Posted By: pomegranate weight loss On: 08/28/11 11:15 PM

Now you make it easy for me to understand and implement the concept. Thank you for the post.

Posted By: Fifa World Cup On: 09/11/11 8:10 AM

I admire the valuable information you offer in your articles. I will bookmark your blog and have my children check up here often.

Posted By: hopkins vs dawson On: 09/11/11 8:11 AM

Well quite informative thanks for posting.

I wanted to thank you for this great read!! I definitely enjoying every little bit of it I have you bookmarked to check out new stuff you post

Posted By: Longchamp outlet On: 09/15/11 2:07 AM


Nice notes to follow on writing websites, thanks for the post...

Very useful information indeed!! Thank you for taking time to share it with the readers,

Posted By: Juicy Couture Outlet On: 09/15/11 2:08 AM


Nice post.....
what an amazing and helpful information for everyone.

Posted By: Dissertation methodology On: 09/16/11 2:49 AM

Merveilleux billet, merci beaucoup de nous le faire partager.

Également, votre site a-t-il un flux RSS auquel s'inscrire ? Pouvez-vous me l'envoyer par mail svp ? Merci

Posted By: jeu de grattage On: 09/19/11 3:33 PM

http://www.mcryh.com/

Posted By: شات مصر On: 09/19/11 4:54 PM

http://www.mcryh.com/

Posted By: شات مصر On: 09/19/11 4:57 PM

Good idea!

Posted By: ugg boots sale On: 09/19/11 9:59 PM

cool ~~

Posted By: herve leger On: 09/20/11 5:08 AM

jordan classic high-heeled boots to add a new section of knitted woven texture, the Bailey family elevated to coin a new level, and a strong return to the Mongolian sheepskin. By the New Mexico style and rich local culture inspired the original, the new season of women's shoes showcase a rich color, luxurious interpretation of the low-key style. jordan boots this series as the main single product, made of light skinned, and the boots in the upper part of the Navajo to weave patterns as a decoration, high-heeled boots winter boots are the most representative of a series.

Posted By: jordan 6 rings heels On: 09/23/11 9:23 PM

Glad to see that this site works well on my Droid , everything I want to do is functional

Posted By: دردشة On: 10/04/11 1:34 PM

I'm happy I found this blog! From time to time students want to cognitive the keys of productive literary essays composing. Your first-class knowledge about this good post can become a proper basis for such people. Thanks.

Posted By: Burberry Bags On: 10/13/11 4:53 AM

jordan series will be low-key and high-heeled boots fashion to the extreme interpretation. jordan will not reduce the trace from the pursuit of comfort, even in high-heeled fashion models.

Posted By: cheap jordan pumps women sale On: 10/13/11 11:17 PM

is not deliberately seeking, but not exclusive, have a sense of balance.Fit is the best, from their actual economic abilities

Posted By: gucci caps for sale On: 10/17/11 5:22 AM

driven diaphragm vibration. Can drive the stator is a single diaphragm,

Posted By: beats studio On: 10/18/11 4:25 AM

link:http://www.dissertations-writing.co.uk/

Posted By: Adira Asuransi Kendaraan Terbaik Indonesia On: 10/19/11 3:45 PM

casual and jeans with a naturally bold personality on the show, Meanwhile, UGG has always insisted on restoring the pure hand-tanning process

Posted By: cheap ugg boots for sale On: 10/21/11 2:51 AM

Incredibly cool! I assistance your view!
<a href="http://www.juicycoutureoutlet7.com/">Juicy Couture Outlet</a>

Posted By: Juicy Couture Outlet On: 10/21/11 8:11 PM

In recent years, UGG its thick, soft, casual nature made people of all ages around the world, <a href="http://www.cheap-ugg-boots.us/Discount-4-cheap-ugg-boots-5819-Classic-Cardy-for-women-clearance.html">ugg boots 5819 clearance</a> it allows you to enjoy a super comfortable in the winter warmth, and look really cute bulky. Wound on the fabric and patent leather boots, <a href="http://www.cheap-ugg-boots.us/Discount-4-cheap-ugg-boots-5819-Classic-Cardy-for-women-clearance.html">ugg boots 5819 cheap</a> snow boots zipper decoration that is full of stylish and unique, decorative fur boots along and add more warmth with the subsection ugly doll series pattern is more lovely. <a href="http://www.cheap-ugg-boots.us/Discount-4-cheap-ugg-boots-5819-Classic-Cardy-for-women-clearance.html">cheap ugg Classic Cardy</a> Snow boots super cute romantic style with brown pants, a warm winter is definitely the protagonist! <a href="http://www.cheap-ugg-boots.us/Discount-5-cheap-ugg-boots-5825-classic-short-for-women-clearance.html">ugg 5825 for women</a> Not look bloated. Lovely sweet dress most admired, snow boots with different suture material stitching and three-dimensional design, <a href="http://www.cheap-ugg-boots.us/Discount-5-cheap-ugg-boots-5825-classic-short-for-women-clearance.html">cheap ugg 5825 clearance</a> coordinate colors Dachu popular for this year, full sense of style. The length and width of stitching sweaters piercing sense of personality and lovely, <a href="http://www.cheap-ugg-boots.us/Discount-5-cheap-ugg-boots-5825-classic-short-for-women-clearance.html">ugg boots 5825 clearance</a> warm snow boots with leggings have a sense of self. Has a fairy-tale plush fur, furry snow boots, <a href="http://www.cheap-ugg-boots.us/Discount-5-cheap-ugg-boots-5825-classic-short-for-women-clearance.html">ugg boots 5825 cheap</a> super cute romantic, warm, winter is definitely the protagonist. Matte black down jacket with a red hat fabric piercing hot emotion, <a href="http://www.cheap-ugg-boots.us/Discount-5-cheap-ugg-boots-5825-classic-short-for-women-clearance.html">cheap ugg Classic short</a> black snow boots with the overall coordination of feeling full. Knitted coat and take the nation a sense of style sweater piercing sweet, soft snow boots to wear clothing with a romantic atmosphere. Black snow boots with fur decoration please dull sense of black, lovely full degree! Red and white stripes and a long sweater with a white scarf to wear clothing in a lazy fashion sense, with snow boots, very cute!

Posted By: ugg for sale On: 10/25/11 8:49 PM


I have searching for information and finally this blog is very good and the nice designed.

Posted By: Football jerseys On: 10/25/11 10:20 PM



UGG's intention is UglyBoots (ugly shoes), this is like snow boots with sheepskin with wool wrap his feet after a simple sewn, thick stupid, but very light warm. Deckers bought the company in UGGAustralia brand before, it is not aimed at an aesthetic breakdown so pay attention to people - surfing enthusiasts. UGGAustralia brand's founder Brian Smith in Perth, Australia, surfing found that many surfers will come ashore wearing local small factory UGG,

Posted By: ugg Roxy Tall boots On: 10/27/11 3:10 AM

I get thus much lately it's driving me mad so any help is very abundant appreciated.
<a href="http://www.tfsupplements.com/store/cart.php?m=product_list&v=61">VPX sports</a>

Posted By: VPX sports On: 10/28/11 8:08 AM

I get thus much lately it's driving me mad so any help is very abundant appreciated.

Posted By: VPX sports On: 10/28/11 8:09 AM

Form this site we got more information about this Firefox update is helpful.

Posted By: website design northampton On: 10/31/11 9:34 AM

Online olarak 3 boyutlu okey oyunu oynayabildiğiniz bu muhteşem programı tamamen ücretsiz olarak web sitemizde sizleri bekliyor.

Posted By: شات مصري On: 11/01/11 7:52 PM

This pair is really good. Cindy Crawford was also optimistic about the golden snow boots. Jessica Simpson's work together, the three pair of snow boots have been predicted as the most popular works, and look forward sold for high prices (per pair U.S. $ 550 starting price). Demi Lovato's work, is simply a collection of a number of popular brand logo. Jennifer Garner, quite elegant, patterns and colors are very fresh.

Posted By: ugg boots clearance sale On: 11/01/11 11:57 PM

flaming hair first thing is they can not make honey ignore its existence! furry boots + side of the body soft touch leather bow hair ball design - is to make our lovely sweetheart degree of surge to five times!

Posted By: uggs for women On: 11/04/11 3:59 AM

upper series of the classic use of suede leather and soft Italian full grain leather manufacturing

Posted By: ugg boots for sale On: 11/07/11 8:43 PM


Robert Ferre of UGG boots and a jungle atmosphere rugged,

Posted By: uggs for women On: 11/10/11 9:09 PM

I'm happy I found this blog ! It's very good and thank you for sharing it !

Posted By: Coach Outlet Online On: 11/15/11 12:51 AM

oppose the establishment of normal relations with Russia, and against the Treaty on Strategic Offensive Reductions," approval, "the performance of some countries, political forces such as Japan, Brazil, Germany,

Posted By: uggs outlet online On: 11/16/11 8:09 PM

Nice slide, many thanks to the author. It is incomprehensible to me now, but in general, the usefulness and significance is overwhelming. Thanks again and good

Posted By: stuntauto On: 11/18/11 10:56 AM

UGG Black snow boots in tube well-known in the wild snow king boots, tight black jacket with dark green brigade followed by quarter leggings fashionable wider at the rules, neck fur collar add gorgeous sense of red knitting wool is also a favorite winter hat. UGG Boots to choose some simple style suitable to the human eye to guide the direction of depth.

Posted By: ugg boots for women On: 11/22/11 3:49 AM

Because the issue is unique and deserves thanks and follow-up

Posted By: العاب تلبيس On: 11/22/11 10:33 AM

Mon WebMate amicale m'a conseillé de ReadThis blog. Il a dit qu'il offre une bonneingormation dont j'ai besoin.

Posted By: Lancel On: 11/23/11 2:47 AM

This year, UGG are blown off the wave of popularity in China, in Beijing Xidan, Sanlitun and other places where the influx of people, you can not take a moment met with dozens of pairs of UGG, UGG, there are many carrying bags girl the shuttle, it has continued to participate in the UGG very huge groups of consumers. UGG craze fashion industry finally could no longer dumb, in 2003, one of the shoes with the fur began to appear in Milan and New York fashion show, was extremely resistant to the top of UGG fashion crowd was finally officially recognized the UGG fashion status. In 1998, Smith sold the UGG brand Deckers Outdoor Corporation. UGG With a certain consumer market, the Dexter company with large U.S. department store chain Nordstrom together to develop a "limited" sales strategy to provide each household only allows U.S. households to purchase four pairs of UGG, will further enlarge the people's curiosity, stimulate more people to join the ranks of purchase, and become the best advertising propaganda UGG. UGG and pants to match the first, then let UGG and pants with a later suit on the interpretation of the alternative wear UGG under the law, as well as the majority of fans with a variety of ingenious attempt to become the lea

Posted By: uggs for cheap On: 11/25/11 10:34 PM

good

Posted By: porno sex On: 11/27/11 8:15 AM

Matte black down jacket with a red hat fabric piercing hot emotion, black snow boots full sense of the overall coordination. Black snow boots with fur modified to get rid of the dull sense of black, black wool hat and boots color with shine, lovely and full of knitted coat and take the checkered shirt revealed a casual sense of leisure. Collage of a long sweater piercing sense of personality and lovely, warm snow boots with leggings have a sense of self-cultivation, and boots similar to the hat color to highlight the boots.

Posted By: cheap ugg boots On: 11/29/11 12:19 AM

A time from Milan, Italy, Paris, France, Berlin, Germany and Poland, Indonesia and other places of designers, magazine editors, dancers, fashion, the influx of people in FACEBOOK, LOOKBOOK other international fashion community have appeared wearing sandals Aukoala wool than film

Posted By: cheap ugg boots On: 12/07/11 12:26 AM

Maintenant, dans les rues, vous pouvez souvent voir des hommes et des femmes qui vontporter un sac. Ainsi, dans bon nombre de la foule, comment voulez-vous montrer de différent? Réponse dans le sac Longchamp. Longchamp pas cher magasin peut offrir la meilleure valeur, le prix concurrentiel avec la livraison en temps opportun pour la garantie pour tous les sacs Longchamp Cher Pas, l'action rapidement

Posted By: Sac Longchamp On: 12/14/11 4:07 AM

coach factory outlet has new coach laptop bags in listing. No matter which style do you want, we can provide it for you.You can discover all types of style and design bags on coach factory outlet online, including the hot selling coach purses and coach wallets. The coach wallets are popular among the designer luxury, simply due to their craftsmanship is extremely good as well as the price is reasonable to you.

Posted By: coach factory On: 12/14/11 4:08 AM

Designs of this season give you the unlimited cool feelings in this cool summer. The new designs of Coach products in the coach outlet enrich our daily life.If you go shopping on the coach factory online, you will be granted not only good products, great services and prompt replies, but also an overall pleasant experience.

Posted By: coach outlet On: 12/14/11 4:09 AM

coach factory are leading the international market all the time, because men and women choose to buy these Coach Products to use for leisure,work or travel than any other designer brands.On coach factory stores, we provide coach handbags, coach wallets and other accessories.All coach bags featured with stylish leather bags and signature materials.

Posted By: coach factory On: 12/14/11 4:12 AM

it is absolutely the best dress up your weekend trips. Stitching design snow boots, super soft plush comfort and fashion brought the inherent grace and elegance can easily make you a single step brilliance, hair ball designed for the princess you feel fantastic,

Posted By: ugg boots On: 12/15/11 3:25 AM

That is really a great post

Posted By: replicas watches price On: 12/17/11 5:10 PM

in color and style will be the perfect fusion of classical and popular. Much more than fashion shoes to break the traditional image of the public, so that the shoe is also interpret a simple fashion and even wild feeling.

Posted By: ugg boots sale On: 12/18/11 10:12 PM

Brown snow boots with thick stockings can make you beautiful winter can be as beautiful to wear skirts, long shirts with printing money, so you can be charming in the office. Two kinds of lovely pink snow boots worn either you choose, prefer hairy side exposed outside.

Posted By: ugg boots clearance On: 12/20/11 1:32 AM

Princess style, depicting an elegant woman, with a simple style snow boots, sweet flavor of its people can not take your eyes off. This section simple black dress to meet the winter transfer the theme of the unique atmosphere of steady, followed bloom. Snow boots, legs slender lines sketched out, piercing the urban minimalist style.

Posted By: uggs outlet online On: 12/22/11 2:20 AM

Blog post is helpful assist for my university assignment; in fact I akin to this blog a lot. Nice work thanks,

Posted By: buy dissertation On: 12/23/11 12:50 AM

Winter approaching, it began to snow north have, in terms of magazines or the street shooting, have seen the stars have to wear snow boots. Go to work or school, to prepare a snow boots is essential. Gray and white sweater,

Posted By: uggs for cheap On: 12/23/11 4:20 AM

Thank you
I was pleased to be here

Posted By: شات On: 12/24/11 3:06 PM

I read this post, Good blog for youngsters, because his take quality free knowledge on internet, thanks for wonderful sharing,

Posted By: graduate dissertation On: 12/26/11 12:05 AM

There are many reasons to further your education. Sadly, many people allow the business of their lives to keep them away from ever doing so. If you have had that itch to get back to school to further your education and want to once again start hitting the books, then you might want to consider going after an online degree.                                             

Posted By: Law Essay On: 01/05/12 2:52 AM

Grappling with the details of so many different individual policies can lead to a strong urge to pick the next one that sounds halfway reasonable. But halfway isn't good enough.Grappling with the details of so many different individual policies can lead to a strong urge to pick the next one that sounds halfway reasonable. But halfway isn't good enough.

Posted By: find cell On: 01/09/12 8:39 AM

UGG sheepskin is still high as the main fabric, supplemented by about 20 cm in the sun hair, wool weaving, and other new materials, design a more appealing style.

Posted By: new uggs 2011 On: 01/12/12 12:34 AM


Upon receipt of a wonderful brother in Antdhar Jdiedk gat iraq

Posted By: دردشة العراق On: 01/15/12 5:07 AM

I have been searching for some information on this for almost three hours! You've helped me a lot indeed and by reading this article I have found many new and useful information about this subject!                  

Posted By: Flatshare On: 01/16/12 12:37 AM

Add Comment

Comments have been closed.

Transcript

no image

Slide Text

Slide Notes


Minnesota Government IT Symposium Introduction to Writing Secure Web Applications


Online ColdFusion Meetup
ColdFusion Application Security: Beyond SQL Injection
January 22nd, 2009
Jason Dean
http://www.12robots.com

no notes exist for this slide

Who am I


Who am I?
Web Application Developer with the Minnesota Department of Health (MDH)‏
Chairperson and User Group Manager of the MDH ColdFusion User Group
ColdFusion Development Blogger (who isn't?) http://www.12robots.com
Veteran of the U.S. Coast Guard

no notes exist for this slide

The Basic Threats


Today We'll Look At
Cookie Security
Request Forgeries
Password Security
Session Management
Cross-Site Scripting XSS

no notes exist for this slide

Cookie Security


Cookie Security
Pop Quiz
How many parameters can a cookie accept?
What are they?
Cookie Parameters
Name (String)‏
Value (String)‏
Expires (DateTime)‏
Path (String)‏
Domain (String)‏
Secure (Boolean)‏
What about the HTTPOnly Parameter?

no notes exist for this slide

Slide 5


Cookie Security
Name and Value – Pretty self-explanatory. No Security Concerns (except content)
Expires – This value definitely carries a security concern with it, especially for session management cookies.
Path – The path to which a cookie applies within a domain. If set, a domain must also be set. Default is for all pages on the domain that set the cookie to be able to access it.
Domain – The domain to which the cookie applies. Must start with a period. Example: domain=“.12robots.com”. Only the specified domain can access the cookie. By default, the domain that set the cookie will be used.
Secure – If set to “True” the cookie will only be submitted to the server over an SSL connection. No SLL, no cookie
HTTPOnly – This feature is new to browsers (IE6+ and FF 2.0.0.5+). It is a flag that tells the browser to only submit the cookie via HTTP requests, which means it cannot be access via JavaScript

no notes exist for this slide

Slide 6


Cookie Security
Security Concerns with Path and Domain Parameters
Path and Domain are often overlooked as a security concern. That can be bad
So what's wrong with leaving the defaults for Path and Domain?
Let's say you had an awesome website for ColdFusion bloggers
When a new blogger signs up, they get their own subdomain: 12robots.awesomecfbloggers.com
When a blogger logs in they could get a cookie for domain=”.awesomecfbloggers.com”
When a blogger from that site goes to another blog on the site, their site cookies are sent to it, because they are all within the same domain .awesomecfbloggers.com
A malicious user could create a new account called hacker.awesomecfbloggers.com Then invite the other bloggers from awesomecfbloggers.com
When the other bloggers visit, if they have current cookies for .awesomecfbloggers.com, they will automatically be sent to the hacker site
The hacker can log those cookies
Then the hacker can use those sessionid values for session hijacking
The same thing applies to the Path value in the cookie: awesomebloggers.com/12robots

Security Concerns with Path and Domain Parameters Path and Domain are often overlooked as a security concern. In some environments they can safely be left to default, but in others, that can be bad So what's wrong with leaving the defaults for Path and Domain? Why would I want to specify anything other than my domain for the domain or “/” for the path? Let's say you had an awesome website for bloggers. When a new blogger signs up, they get their own custom subdomain. Example: 12robots.awesomecfbloggers.com Well, depending on at what point the new blogger authenticates and the cookie is set, the cookie may be for the domain=”.awesomecfbloggers.com” is we leave it as the default. Whenever a blogger from that site goes to another blog on that site, their site cookies are sent to it. A malicious user could create a new account called hackers.awesomecfbloggers.com then add code to log the sessionid of any cookie that is passed to it. Then send invites to the other bloggers on the same site. When the other bloggers visit, if they have current cookies for awesomecfbloggers.com, they will automatically be sent to the hacker site. Then the hacker can use those sessionid values for session hijacking. The same thing applies to the Path value in the cookie. Let's say the awesomecfbloggers.com site was set up differently. The 12robots blog can be found at http://www.awesomecfbloggers.com/12robots and the hacker site can be found at http://www.awesomecfbloggers.com/hackers, same issue.

Slide 7


HTTPOnly Flag
Used to specify when a cookie can be accessed
If set, the cookie can only be used in HTTP transactions
This prevent a JavaScript exploits from being used to access the cookie
Stops many XSS attacks that could result in session hijacking
Setting the HTTPOnly Flag
ColdFusion's <cfcookie> tag does not support the HTTPOnly flag
To set the HTTPOnly flag you need to use <cfheader>

Security Concerns with Path and Domain Parameters Path and Domain are often overlooked as a security concern. In some environments they can safely be left to default, but in others, that can be bad So what's wrong with leaving the defaults for Path and Domain? Why would I want to specify anything other than my domain for the domain or “/” for the path? Let's say you had an awesome website for bloggers. When a new blogger signs up, they get their own custom subdomain. Example: 12robots.awesomecfbloggers.com Well, depending on at what point the new blogger authenticates and the cookie is set, the cookie may be for the domain=”.awesomecfbloggers.com” is we leave it as the default. Whenever a blogger from that site goes to another blog on that site, their site cookies are sent to it. A malicious user could create a new account called hackers.awesomecfbloggers.com then add code to log the sessionid of any cookie that is passed to it. Then send invites to the other bloggers on the same site. When the other bloggers visit, if they have current cookies for awesomecfbloggers.com, they will automatically be sent to the hacker site. Then the hacker can use those sessionid values for session hijacking. The same thing applies to the Path value in the cookie. Let's say the awesomecfbloggers.com site was set up differently. The 12robots blog can be found at http://www.awesomecfbloggers.com/12robots and the hacker site can be found at http://www.awesomecfbloggers.com/hackers, same issue.

Slide 8


Session Token Cookies
By default, ColdFusion does not make Session Token Cookies very secure
Domain attribute is handled well, if “this.setClientCookies = true” in Application.cfc/cfm
Path is ALWAYS set to “/”
Cannot be set as SECURE
Cannot be set HTTPOnly
Not set as non-persistant cookies (unless J2EE)
So these little flaws need to be addressed, and can be addressed manually.

Security Concerns with Path and Domain Parameters Path and Domain are often overlooked as a security concern. In some environments they can safely be left to default, but in others, that can be bad So what's wrong with leaving the defaults for Path and Domain? Why would I want to specify anything other than my domain for the domain or “/” for the path? Let's say you had an awesome website for bloggers. When a new blogger signs up, they get their own custom subdomain. Example: 12robots.awesomecfbloggers.com Well, depending on at what point the new blogger authenticates and the cookie is set, the cookie may be for the domain=”.awesomecfbloggers.com” is we leave it as the default. Whenever a blogger from that site goes to another blog on that site, their site cookies are sent to it. A malicious user could create a new account called hackers.awesomecfbloggers.com then add code to log the sessionid of any cookie that is passed to it. Then send invites to the other bloggers on the same site. When the other bloggers visit, if they have current cookies for awesomecfbloggers.com, they will automatically be sent to the hacker site. Then the hacker can use those sessionid values for session hijacking. The same thing applies to the Path value in the cookie. Let's say the awesomecfbloggers.com site was set up differently. The 12robots blog can be found at http://www.awesomecfbloggers.com/12robots and the hacker site can be found at http://www.awesomecfbloggers.com/hackers, same issue.

Slide 9


Manually Changing Session Token Cookies
Setting HTTPOnly
Set SECURE Flag
Set Domain and Path

Security Concerns with Path and Domain Parameters Path and Domain are often overlooked as a security concern. In some environments they can safely be left to default, but in others, that can be bad So what's wrong with leaving the defaults for Path and Domain? Why would I want to specify anything other than my domain for the domain or “/” for the path? Let's say you had an awesome website for bloggers. When a new blogger signs up, they get their own custom subdomain. Example: 12robots.awesomecfbloggers.com Well, depending on at what point the new blogger authenticates and the cookie is set, the cookie may be for the domain=”.awesomecfbloggers.com” is we leave it as the default. Whenever a blogger from that site goes to another blog on that site, their site cookies are sent to it. A malicious user could create a new account called hackers.awesomecfbloggers.com then add code to log the sessionid of any cookie that is passed to it. Then send invites to the other bloggers on the same site. When the other bloggers visit, if they have current cookies for awesomecfbloggers.com, they will automatically be sent to the hacker site. Then the hacker can use those sessionid values for session hijacking. The same thing applies to the Path value in the cookie. Let's say the awesomecfbloggers.com site was set up differently. The 12robots blog can be found at http://www.awesomecfbloggers.com/12robots and the hacker site can be found at http://www.awesomecfbloggers.com/hackers, same issue.

Slide 10


Manually Changing Session Token Cookies
Setting Everything
These blocks should be in onSessionStart() or in session initialization code
All of these need setClientCookies turned off in Application.cfc/cfm
JsessionIDs seem considerably harder to manipulate.
Could make SECURE
Could not change DOMAIN or Path without duplicating cookie
Seems that J2EE creates cookie whether setClientCookies is True or False

Security Concerns with Path and Domain Parameters Path and Domain are often overlooked as a security concern. In some environments they can safely be left to default, but in others, that can be bad So what's wrong with leaving the defaults for Path and Domain? Why would I want to specify anything other than my domain for the domain or “/” for the path? Let's say you had an awesome website for bloggers. When a new blogger signs up, they get their own custom subdomain. Example: 12robots.awesomecfbloggers.com Well, depending on at what point the new blogger authenticates and the cookie is set, the cookie may be for the domain=”.awesomecfbloggers.com” is we leave it as the default. Whenever a blogger from that site goes to another blog on that site, their site cookies are sent to it. A malicious user could create a new account called hackers.awesomecfbloggers.com then add code to log the sessionid of any cookie that is passed to it. Then send invites to the other bloggers on the same site. When the other bloggers visit, if they have current cookies for awesomecfbloggers.com, they will automatically be sent to the hacker site. Then the hacker can use those sessionid values for session hijacking. The same thing applies to the Path value in the cookie. Let's say the awesomecfbloggers.com site was set up differently. The 12robots blog can be found at http://www.awesomecfbloggers.com/12robots and the hacker site can be found at http://www.awesomecfbloggers.com/hackers, same issue.

What is a Request Forgery


What is a Request Forgery?
A request forgery, also sometimes called a Cross-Site (or On-Site) Request Forgery(XSRF), is an attack that is perpetrated against the user of a site who has authenticated access to that site
The user is unwittingly tricked into performing actions on a site through hidden code displayed to them and, therefore, executed in their browser
The hacker is writing a check and your users are cashing it for him, without knowing it

no notes exist for this slide

That was confusing as hell


That was confusing
How about an Example?
Our Hypothetical website http://www.easilypwnd.com
Has an administrator only section for maintaining users
Our site has a deletePage.cfm action page that accepts a single parameter, pageID
DeletePage.cfm has been secured to make sure ONLY our administrators can access it.
All is good, right?

no notes exist for this slide

Or is it


Or is it?
One morning, Bob (one of our administrators) gets an email from Kay in accounting. It has a link to a bad joke on a Joke-of-the-Day site
Here is the joke:
Bob finishes the joke, chuckles politely and deletes the email
About 5 minutes later, the phone starts ringing. The company website is down

no notes exist for this slide

What happened


What happened?
The email Bob received wasn't from Kay in accounting
<Dramatic Pause>
It was from a Hacker who spoofed Kay's email address
The link the hacker sent, did go to a Joke-of-the-Day page, but the hacker left a comment for the joke and in his comment he placed the line:
So what do you think happened when Bob viewed that page with that comment on it?

no notes exist for this slide

Slide 15


What happened?
When Bob viewed that page the <img /> tag went looking for the src resource and made the request:
And if Bob was actually logged into the site, then it was a legitimate request coming from a legitimate user and so it was executed
Oops

no notes exist for this slide

So what can be accomplished with an Request Forgery Attack


So what can be done with a Request Forgery?
Delete or Edit pages
Delete or Edit Users
Perform Administrative Functions
Send Emails
Transfer funds
Make purchases
Anything that an authenticated used would normally be able to do

no notes exist for this slide

So what can we do about it


So what can we do about it?
One thing we can do is to use POST requests instead of GET requests.
Using POST requests will stop many, but not all Request Forgeries, It would stop the <img /> attack, but not this one:

no notes exist for this slide

Slide 18


So what ELSE can we do about it?
So let's say we have a form that looks like this:
Assume that it has other appropriate security to ensure only administrators have access
The page or function this POSTs to is likely vulnerable to the forgery attack we just looked at
It probably:
Receives the request
Checks to make sure the user is logged in
Confirms that the ID is valid
Performs the action

no notes exist for this slide

How do we fix it


How do we fix it?
Create a UUID
Add that UUID to the form and the user session
We can then check the result in the action page/method to confirm that it came from the right place

no notes exist for this slide

Slide 20


How do we fix it?
Another option is to ask for a second verification.
Prompt “Are you sure?” using server-side logic
Maybe even require them to enter their password again

no notes exist for this slide

Slide 21


Password Security
How do we get a secure password?
Does every site need a “super” secure password?
Password Best Practices
Password Salting and Hashing
Password Strength Function
“Forgot My Password” Best Practices

no notes exist for this slide

Slide 22


Achieving a Super-Secure Password
Password should allow and required both alphabetical and numeric characters
Passwords should allow and require both uppercase and lowercase letters
Passwords should allow and require special characters
Passwords should probably be at least 7 or 8 characters long. If you need to have them with fewer characters, you should have a REALLY good reason for it.
Password should be changed every [Insert period of time here]. Depending on the security level of your system this might be every month, quarter, or six months.
Passwords should never contain the username or be a date

no notes exist for this slide

Slide 23


Have the password security scheme fit the website
Does every site need a “super” secure password?
Probably not
It is a judgment call, get the input of the people to whom data belongs
There is no reason not to allow a strong password, but perhaps not every site needs to enforce it
At a minimum, set a decent minimum length and require some alphas (upper and lower) and some numerics

no notes exist for this slide

Slide 24


Best Practices
Don't set a minimum length above 8 character
Where possible, use SSL
Load the login form using SSL (although it only needs to POST to SSL)‏
Don't send Login credentials on the URL string (except for Web Services, and then, only over SSL)‏
Never store passwords in clear text
Create an audit log of login attempts
If you lock a user out after a certain number of login attempts, do not use a cookie or tie it to the user session, do it in the database

no notes exist for this slide

Slide 25


Password Hashing and Salting
What is Hashing?
Why do we want to Hash our passwords?
What is Salting and why do we want to do it?
Example Code

no notes exist for this slide

Slide 26


What is Hashing?
From Wikipedia: "... a Cryptographic Hash Function is a transformation that takes an input and returns a fixed-size string, which is called the hash value.
A hash is a One-Way Transformation
A strong enough hash is virtually impossible to reverse
A strong enough hash will have very few collisions

no notes exist for this slide

Slide 27


Hashing Example

no notes exist for this slide

Slide 28


Hashing Example
Will Produce:
472D46CB829018F9DBD65FB8479A49BB
CBD672C9AAF85A22968C7BCF9FF90EED
10F1C46CAF873486E530570E7A298BBB
Notice they are all the same number of characters. Hashes are Fixed-Length strings

no notes exist for this slide

Slide 29


Stronger Hashing Example
An MD5 Hash is not strong enough
MD5 is fine for examples, but in the real world, MD5 is weak
So what are the other options?
In our example we did this:
Well we can replace MD5 with a number of other hashing algorithms that produce different fixed-lengths
MD5: (Default) Generates a 32-character, hexadecimal string
SHA: Generates a 40-character string
SHA-256: Generates a 64-character string
SHA-384: Generates a 96-character string
SHA-512: Generates an 128-character string

no notes exist for this slide

Slide 30


Stronger Hashing Example
So let's compare the algorithms
In our previous example we had:
Now let's add:
AND

no notes exist for this slide

Slide 31


Stronger Hashing Example
MD5 Result
472D46CB829018F9DBD65FB8479A49BB
CBD672C9AAF85A22968C7BCF9FF90EED
10F1C46CAF873486E530570E7A298BBB

no notes exist for this slide

Slide 32


Stronger Hashing Example
SHA-256 Result
7FA8A6E9FDE2F4E1DFE6FB029AF47C9633D4B7A616A42C3B2889C5226A20238D
0DBDC9C5C4E9B4B11FECFAC0247A0E0F0E810A7BD0AD3EEC36C2A30FF96CE3C4
E153B4C97FCFAC7016A276461E06504CB9F03B9A3ADF36072E1EC7F21308736B

no notes exist for this slide

Slide 33


Stronger Hashing Example
SHA-512 Result

27166A235CD42FB7E5A45CB89F542760373DCDC779E1697DB283013718904201D4D05537E63FD3815B596511C8704C50791C7BA3C504CAB516E622BDC6EC09C9

0452F87278847018D8E6CC77F4201315AED6928A7A4075B2400D271CE8E89B1F848BFDC3B9F3A7EB2D74862EB984882C8F8D1F955E9E96F801B1419F88811A0B

4FF17CC3794CAB06B880FDA5507692ADBE5BA74EDFE570611F944F43DFFE4F0A0BED2F9CBC37FE1659336038ECABE47423FFA8FC8403459D7406E13A80173259

no notes exist for this slide

Slide 34


Hashing
A specific string will ALWAYS result in the same hash value
Collisions occur when two values have the same Hash value
Strong hashing algorithms are going to have fewer collisions
The longer the hash value, the less likely you will have collisions.

no notes exist for this slide

Slide 35


Implementing Hashed Passwords
So if hashes aren't reversible, how can we tell if the user entered the correct password?
When the user enters their password, while logging in, we hash it and compare the result to the hash that we stored in the database.
Since a hash cannot be reversed, if the DB becomes compromised, the information cannot be used to obtain passwords, nor can it be used to login using the hash instead of a password
We'll look at an example shortly

no notes exist for this slide

Slide 36


Password Salting
What is Salting?
Let's first talk about why we need salting
Because people make stupid password (i.e. “Password1!”)
We also need passwords because hackers are smart
If our password database becomes compromised, and the passwords are hashed, then the hacker will start looking for matching values
If the hacker finds two hashed values that are exactly the same then that value is either a common dictionary word, a name, a date, or a stupid password
The brute force attack on that user can then commence
Salting ensures that no two hashes in our database ever have the same value

no notes exist for this slide

Slide 37


Password Salting
So what is Salting then?
Salting is the process of adding a random string of characters to the end of a user's password before hashing it.
Each password would get its own salt hence eliminating the problem of two like passwords having the same hash value.
Let's look at examples

no notes exist for this slide

Slide 38


Password Salting Example

no notes exist for this slide

Slide 39


Password Salting Example
Output
Will result in this output:
Value 1 Hashed:2AC9CB7DC02B3C0083EB70898E549B63
Value 2 Hashed:2AC9CB7DC02B3C0083EB70898E549B63
Value 1 Salted and hashed:2DEB5ADAF0854BBBC24DC4797BA73027
Value 2 Salted and Hashed:3498DD83CA3F1945D0EE7BE16984999E

no notes exist for this slide

Slide 40


Password Salting Example
Value 1 Hashed:2AC9CB7DC02B3C0083EB70898E549B63
Value 2 Hashed:2AC9CB7DC02B3C0083EB70898E549B63
Value 1 Salted and Hashed:2DEB5ADAF0854BBBC24DC4797BA73027
Value 2 Salted and Hashed:3498DD83CA3F1945D0EE7BE16984999E
Notice the hashes without salting are identical
But, once you add a salt, the two hash values are very different
Of course, we need to store the salt that we use for each value so that when we hash the user input, we can append the salt

no notes exist for this slide

Slide 41


Look at Code!
Let's look at some code examples
http://hashandsalt:81/index.cfm
http://hashandsalt:81/login.cfm

no notes exist for this slide

Slide 42


“Forgot My Password” Best Practices
Never have your “Forgot My Password” function e-mail the user's password (If you are hashing password you won't be able to anyway)‏
Either reset the users password and email them the new password or send the user a temporary URL that can be used for them to reset the password
Force the user to change their password after they first log in after a reset
Keep a log of the last X hashes of the users password so they cannot reset their password to something that have used previously (Within reason)‏
Make sure your Change Password functionality uses the same strength and hashing functions as your initial password set up
Do not login a user from the “Forgot My Password” section. Always make them go through their e-mail.
Tell story about bad “Forgot My Password” functionality

no notes exist for this slide

Slide 43


Session Management
What is a Session?
Session Tokens
Session Persistence
Session Hijacking
Session Hijack through XSS
Session Token Best Practices

no notes exist for this slide

Slide 44


What is a session?
Since the World Wide Web is stateless, we need sessions to persist data from one page request to the next
If your user requests pageA.cfm and then immediately requests pageB.cfm the web server does not relate those pages to each other
Session Management is a way to create statefulness in a stateless environment
Each client is assigned a session token, which is then passed from request to request
Information that is stored on the server can be provided to the client that provides the correct token

no notes exist for this slide

Slide 45


Session Tokens
A session token is a unique string of characters (usually alpha numeric) that is used to identify a client (Web browser) to the server
The application server can use the token to match a client with the appropriate data stored on the server
ColdFusion has two different types of Session Tokens available
ColdFusion session tokens (Two varieties)
J2EE Session tokens

no notes exist for this slide

Slide 46


Session Persistence
Sessions can be persisted in 3 ways
Passing in a URL (Tough to maintain)
Developer has to remember to always pass the URL string
End user can easily lose their session by messing with the URL
Session Token will be logged by the web server
http://www.12robots.com/mypage.cfm?CFID=2&CFTOKEN=10666880
Passing in POST requests (Very difficult to maintain)
EVERY request from page to page needs to be a <form>
Even Navigation
<input type="hidden" name="cfid" value="#session.cfid#">
<input type="hidden" name="cftoken" value="#session.cftoken#">
Using a Token Cookie (Easy to do, easy to maintain, easier to secure)
End user would have a hard time screwing it up
Does require that your end users have cookies enabled

no notes exist for this slide

Slide 47


Session Hijacking
What is it?
After initial authentication, session management takes over and persists that authentication from request to request
If the session token can be compromised then whoever gains access to a valid session token can impersonate the user to whom that token belongs
That's called Session Hijacking and all a hacker needs to accomplish a session hijacking is the session token
How can the session token become compromised?
Physical Access to a machine
XSS
Social Engineering
Brute-Force Guessing

no notes exist for this slide

Slide 48


XSS Session Token
Cross-Site Scripting can be used to grab a session token
The following line, if injected, will send all user cookie information to another site:

Once the other site receives your user's cookie, they can use the information to hijack the user’s session

no notes exist for this slide

Slide 49


Session Token Best Practices
Do NOT pass your session tokens in the URL string
Use cookies as a best practice
Use J2EE Session IDs or Set ColdFusion to use UUIDs for CFToken
Set cookies to HTTPOnly to prevent some XSS attacks
Use SSL connection to prevent packet sniffing exploits
Set cookies to SECURE so they are only sent via SSL
Use DOMAIN and PATH attributes in your cookies to minimize where they are sent
Set Session-Only cookies so that they expire when the browser is closed (CF Sessions Only, J2EE already does this)
Keep session time-out values low

no notes exist for this slide

CrossSite Scripting XSS


Cross-Site Scripting (XSS)‏
Is also a type of “Injection” attack
Is used by one user to “attack” another
Can be used for session hijacking, page redirection, phishing, bypassing access controls, and other types of nefarious activities
Can be implemented anywhere a user is allowed to enter data that will later be view by other users, like blog comments or forum posts.
Is implemented by a user who enters scripts (usually Javascript) into a text entry field on a web application or directly into a URL that is emailed or IM, etc. Later when that entry is viewed by another user, the script is executed.

no notes exist for this slide

Slide 51


Cross-Site Scripting (XSS)‏
XSS Vulnerabilities come in 3 flavors:
DOM-Based (Type 0)‏
A DOM-Based XSS vulnerability is exploited through pages that, somehow, exist on the local machine of the victim, placed there through social engineering, file upload exploit, or other means. We will not be discussing this type of exploit today.
Non-Persistent (Type 1)‏
Non-persistent vulnerabilities are the most common to be exploited by XSS attacks. The vulnerability exists when information sent to a page is immediately used on the receiving page without being properly prepared for display. This can be destructive through the use of manipulation to convince other users to click on links that will send code to a vulnerable page that will then perform actions on the victims behalf.
Persistent (Type 2)‏
Persistent XSS is, as the name suggests, an attack that is implemented and then lasts until it is removed. It is generally deployed through the use of a web form, SQL Injection, or some other means of injecting a script into the content of a web applications for others to view, and subsequently execute.

no notes exist for this slide

XSS Example


XSS Example
You have a comments text box, like so:

no notes exist for this slide

Slide 53


XSS Example
Now, this (seemingly harmless) script would be nothing more than vandalism
In the eyes of your end users this represents a huge security hole
Word would spread quickly that your site had been hacked
How do you think the media would report such a breach?

no notes exist for this slide

XSS Uses


XSS Uses
Cross-Site Scripting can be used for much worse things then displaying an Alert window.
The following line will send all user cookie information to another site:

Once the other site receives your user's cookie, they can use the information to hijack the user’s session

no notes exist for this slide

XSS iFrame Example


XSS iFrame Example
Another example is the Frame Attack where the hacker “injects” an iFrame into the comment field:

no notes exist for this slide

XSS Prevention


XSS Prevention‏
So how do we protect against this type of attack?
Turn on script protection
Use character encoding functions on all user generated output
User Input validation

no notes exist for this slide

ColdFusion Script Protect


ColdFusion Script Protect
Can be turned on in the Administrator with a simple checkbox
Can be added or disabled per-application in the Application.cfc
Will look for specific tags, like: <script>, <meta>, <object>, <embed>, and <applet> and replace them with <InvalidTag> if they are found in the FORM, URL, CGI, or COOKIE scopes. Does not Protect against iFrame injection or JavaScript used in <a> tags.
Will not protect against every type of XSS exploit

no notes exist for this slide

HTMLEditFormat Function


Character Encoding Function
Should be used on content that was created by users.

Will turn your hackers malicious Javascript input from:


Into Harmless HTML Character entities:


In some cases, it may be too effective.
If you want users to be able to use some HTML elements in their input, they will be unable

no notes exist for this slide

Input Validation


Input Validation
Input validation can be used to avert XSS attacks (And SQL injection for that matter)‏
Using functions like IsNumeric() can help keep JavaScript and SQL out of fields that should be numeric
Length functions (i.e. Len()) can be used to determine if a field was submitted with a value that was longer than intended. Remember that <input maxlength=”” /> is enforced at the client, which means it cannot be trusted
Regular Expressions can be used to look for dangerous patterns, like <script> or <object> tags (If not using ScriptProtect)
Be careful not to restrict too much. Example, you have a Web Service that accepts XML input and one of the input elements contains a <objectDefinition> element.
Remember that ALL validation must be done at the server. You can have client side validation to help improve the user experience, but it cannot be trusted for anything more than that.

no notes exist for this slide

Slide 60


Questions?
Please ask your questions now
Or feel free to contact me
Jason Dean
jason@12robots.com
http://www.12robots.com
AIM: IZB Jason
Google Chat: deanj200
http://twitter.com/JasonPDean

no notes exist for this slide