The cloud

Written on 9 April 2017, 08:34pm

Tagged with: , , ,

A little bit of research about the cloud – the metaphor for a service for which the underlying mechanics don’t need to be known and where everything is about functionality provided to the customer.

The generally quoted definition from NIST (National Institute of Standards and Technology) defines the following properties:

Essential Characteristics:
– On-demand self-service
– Broad network access
– Resource pooling
– Rapid elasticity
– Measured service

Service Models:
– Software as a Service (SaaS)
– Platform as a Service (PaaS)
– Infrastructure as a Service (IaaS)

Deployment Models:
– Private cloud
– Public cloud
– Hybrid cloud
– Community cloud

http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-145.pdf

Refresher: CSRF vs XSS examples
CSRF – a GET request to the bank site transferring $$$ to Mallory:
http://bank.com/transfer.do?to=Mallory&amount=1000 (OWASP)
XSS
– stored – a comment in a post
– reflected – a search keyword displayed in the search results

Random links #10

Written on 18 March 2017, 03:25pm

Tagged with: , , , ,

Random things – session hijacking

Written on 18 March 2017, 11:53am

Tagged with: , ,

Two notes about session hijacking methods:

Difference between stored and reflected XSS attack

Stored or persistent XSS attack – relies on user input stored on the server. Best example – a comment in a news site.
Reflected or non-persistent XSS attack – relies on user input sent in the HTTP query parameters. Best example – site search, showing the keyword after search
Play the XSS game: xss-game.appspot.com

Session fixation

In a nutshell, session fixation means that the attacker obtains a legitimate session ID from the server and then it makes the victim browser to use it. See example.
The counter-measures are quite simple:
– do not accept setting a session id via URL/POST parameters
– change session id after user login
– just use HTTPS and secure cookies, it’s 2017 and HTTPS adoption reached the tipping point