OWASP Summer of Code 2008 Beta
Table of Contents
Page iii
Table of Contents
1. INTRODUCTION ..................................................................................................1
1.1 BACKGROUND ................................................................................................................................................. 1
1.2 PURPOSE.......................................................................................................................................................... 1
1.3 TASKS AND DELIVERABLES ............................................................................................................................. 2
1.4 PROJECT MEMBER COMMENTS AT 100%.......................................................................................................... 2
1.5 FUTURE DEVELOPMENT AND LONG-TERM VISION ............................................................................................ 3
1.6 CONTRIBUTORS ............................................................................................................................................... 5
2. WEBGOAT ............................................................................................................5
2.1 OVERVIEW ...................................................................................................................................................... 5
2.2 HOW IT WORKS................................................................................................................................................ 6
2.3 LESSON TABLE OF CONTENTS ........................................................................................................................ 11
2.4 OVERVIEW OF LESSON RESULTS .................................................................................................................... 14
3. MODSECURITY PROTECTING WEBGOAT ..................................................15
3.1 PROJECT SETUP AND ENVIRONMENT ............................................................................................................. 16
3.1.1 Network/hardware/software .................................................................................................................... 16
3.1.2 Tools used ................................................................................................................................................ 16
3.2 DOING THE WEBGOAT LESSONS - TIPS AND TRICKS....................................................................................... 17
3.3 TESTING MODSECURITY RULES – TIPS AND TRICKS....................................................................................... 18
3.4 PROJECT ORGANIZATION ............................................................................................................................... 19
3.4.1 ModSecurity rules .................................................................................................................................... 19
3.4.2 SecDirData directory............................................................................................................................... 20
3.4.3 Error pages.............................................................................................................................................. 20
3.4.4 Informational and debug messages.......................................................................................................... 20
4. MITIGATING THE WEBGOAT LESSONS......................................................21
4.1 PROJECT METRICS AT 50% PROJECT COMPLETION ......................................................................................... 21
4.2 PROJECT METRICS AT 100% PROJECT COMPLETION ....................................................................................... 22
4.3 SUBLESSONS THAT DON’T COUNT OR WERE NOT SOLVED (AND WHY) ........................................................... 23
4.4 UNFINISHED BUSINESS................................................................................................................................... 24
4.4.1 Concurrent file access.............................................................................................................................. 24
4.4.2 Lua security in ModSecurity .................................................................................................................... 25
4.5 OVERALL STRATEGY ..................................................................................................................................... 31
4.6 REVIEWER COMMENTS .................................................................................................................................. 32
4.7 USING THE LUA SCRIPTING LANGUAGE ......................................................................................................... 33
4.8 USING JAVASCRIPT ‘PREPEND’ AND ‘APPEND’ .............................................................................................. 34
4.9 STRUCTURE OF MITIGATING A LESSON .......................................................................................................... 34
4.10 THE MITIGATING SOLUTIONS ......................................................................................................................... 35
5. THE MITIGATING SOLUTIONS ......................................................................37
5.1 SUBLESSON 1.1: HTTP BASICS ..................................................................................................................... 37
5.2 SUBLESSON 1.2: HTTP SPLITTING................................................................................................................. 40
5.3 SUBLESSON 2.2: BYPASS A PATH BASED ACCESS CONTROL SCHEME ........................................................... 41
5.4 SUBLESSON 2.3: LAB: ROLE BASED ACCESS CONTROL................................................................................ 42
5.5 SUBLESSON 2.4: REMOTE ADMIN ACCESS..................................................................................................... 43
5.6 SUBLESSON 3.1: LAB: DOM-BASED CROSS-SITE SCRIPTING ........................................................................ 44
5.7 SUBLESSON 3.2: LAB: CLIENT SIDE FILTERING ............................................................................................ 46
5.8 SUBLESSON 3.4: DOM INJECTION ................................................................................................................. 47
5.9 SUBLESSON 3.5: XML INJECTION.................................................................................................................. 49
5.10 SUBLESSON 3.6: JSON INJECTION ................................................................................................................. 52
5.11 SUBLESSON 3.7: SILENT TRANSACTIONS ATTACKS ....................................................................................... 54
5.12 SUBLESSON 3.8: DANGEROUS USE OF EVAL.................................................................................................. 58
5.13 SUBLESSON 3.9: INSECURE CLIENT STORAGE ............................................................................................... 60
