WebAppSec/MozSecureWorld

From MozillaWiki
Jump to: navigation, search

Code on GitHub

Purpose

A running web application to demonstrate major security paradigms used within Mozilla web applications and security capabilities of modern browsers.

Uses

  • Demonstration of secure application design
  • Explanation of importance and purpose of security features
  • Learning tool for others to reference
  • Testing site to validate effectiveness of security & design recommendations
  • Evaluation tool for pen testing individuals or tools

Design

Architecture

Python on Django via Playdoh

Security Components & Controls

Authentication

  • Brute force prevention via adaptive CAPTCHA - track failed logins by IP address (attacker from one IP guessing "password" on all useraccounts) and by user account (Joe has 3 failed logins)
  • Password storage via bcrypt (fred wenzel) and system nonce
  • Account creation with blacklisted password support
  • (Possible) Secure Password Reset

How

  • Login with database and different users

Access Control

  • Presentation, Business, Data Layer Access Control
    • Presentation and Data layers use decorators
    • Read about presentation layer protection
  • (Possible) Two tier design for admin account separation
    • The picture of separate control of changing passwords

Input Validation

  • Rich text handling via bleach
  • File upload support via secure file handling guidelines
  • File Handling
  • SQL
  • Content Security Policy
    • outsource all javascript source! for the CSP demo as 2nd barrier beyond escaping characters
  • (Possible) Third party service
  • (Possible) Third party hosted images. Initial processing and per visit processing?

Transport Security

  • Full & correct TLS
  • HTTP Strict Transport Security

How

Cross Domain Controls

  • X-frame-options in header options
P

Cookie Protection

  • Secure Flag
  • HTTPOnly Flag


How to check

  1. Get Burp
  2. Go to your site
  3. should see that ""Set-Cookie: HTTPOnly" in the HTTP Header Response

Roadmap

  1. X Setup playdoh & github
  2. X Running HelloWorld
  3. X Design Planning
  4. X Figure out how to do templates
  5. X Figure out how to put in database
  6. X Know how to make pages with templates
  7. X basic: x-frame-options
  8. LATER --> Install Apache basic: secure flag (June 9 pg2)
  9. X basic: httponly flag
  10. X Use bleach for rich text.
  11. LATER --> input the same --> output check for HTML, JS, XML (June 13 pg2)
  12. X Google Safe Browsing POST Lookup
  13. LATER --> Use Google Safe Browsing Local (June 14)
  14. add decorators for data and business layers
  15. read about presentation layer
  16. Complete initial presentation layer and CSS for basic item
  17. Authentication/login
  18. File upload stuff
  19. Write about page for each vulnerability
  20. Access Control
  21. Input Validation

Calendar

Reminder: Put in screenshots

Week Category Items Done
1. 6/6 - 6/10
  1. Setup
  2. Cross Domain Controls
  3. Cookie Protection
  1. Get Django site set up with database
  2. x-frame-options
  3. HTTPOnly
  1. Done
  2. Done. Edit: 0
  3. To writeup
2. 6/13 - 6/17
  • x Richtext with bleach
  • -> Finish Check Cert
    • (If have time) Set up MITM to verify check cert works.
  • Input Validation
  • HTTPS Validation

a

3. 6/20 - 6/24
  • SQL Injection
    • Only use parametrization, not escaping (it's too weak and inconsistent)
    • No false demo (for safety reasons)
    • Demo of them typing in, and spitting out the results, be careful to have html entity encoding (done automatically in django, i.e. {{ userdata }} DON'T DO {{ userdata|safe }} )
  • write up / buttons / css everything so far
  • make wiki more readable
  • watch OWASP videos
  • Input Validation
  • Cross Domain Controls (before)
  • Cookie Protection (before)

a

4. 6/27 - 7/1
  • Authentication - bcrypt / adaptive captcha
    1. Enable default playdoh authentication (remember to switch to bcrypt(use default settings) + nonce (define it in config file!!) )
    2. Set up pages to require auth and other pages that don't require auth (decorator design principle in Django "&" above method) ... login page and logout link (destroy session ID, first check if it's default)
      • client: cookie expire old one, blank it out
      • server: invalidate to prevent replay attacks
      • --> see if it's one method, should be one method that does all of it
    3. Captcha stuff
      1. Demo how to use captcha like normal (with a form)
      2. Look at ratelimiting by jsocol
        • Target 1 username
        • From 1 IP

a

5. 7/3 - 7/8

a

6. 7/11 - 7/15
  • Access Control (presentation business, data layers)

a

7. 7/18 - 7/22

a

8. 7/25 - 7/29
  • Transport Security
  • Only SSL, all scripts, img, SSL everything SSL,
  • On top, do STS (Strict Transport Security) --> for browser
  • secure flag for all cookies

a

Extra things
  • Attack Party and Fix
  • Make it look nice
End date: 8/12

Links References

MozSecureWorld_FAQ

https://wiki.mozilla.org/WebAppSec/Secure_Coding_Guidelines

Retrieved from "https://wiki.mozilla.org/index.php?title=WebAppSec/MozSecureWorld&oldid=330583"