Article on Web 2.0 cases and challenges is part of (IN)Secure magazine.

You can read it over here (March 09).

Abstract for the article.

Web 2.0 applications are emerging at a rapid pace and also penetrating deeper into the corporate structure as Enterprise 2.0 applications. Adaptations of Ajax, Flex, SOA, RSS Feeds, JSON structures, etc. are used continuously across applications. Old applications are getting a new look through these technologies and platforms, while fresh applications are written using only these building blocks.

By the end of 2008 we have seen and assessed a good amount of applications that are now well molded into a Web 2.0 framework. A Web 2.0 application adaptation is not restricted to one industry segment but applicable to all verticals like financing, insurance, portals, etc. If the Internet is the network of networks then Web 2.0 can be perceived as the application of applications.

Infosecworld 08 - Presenting Research...

H8 Defending Against the Worst Web-Based Application Vulnerabilities in 2009 DEMO
Date: Wednesday, 11 March 2009
Time: 9:45am - 1pm
Track: Application Security

• Next generation attacks: SQL over JSON, XSS with RSS feeds, XPATH over SOAP
• Understanding the wide-spread XSS and CSRF attacks – why they help to build the worst kind of next generation Web-based worms and viruses spread through cross domain iframes
• Why scanning and detecting these application layer vulnerabilities are important for corporate enterprises
• How to defend against these attacks by providing content filtering over HTTP both for incoming and outgoing
• Source code scanning for Web 2.0 applications to protect applications against developer's mistakes
• Key tools and methodologies for both attacks and defense

Go To InfoSecWorld

HITB in Dubai

At HITB Dubai we are going to have web security training and presentation on our new research methodology for Application Source Code Scanning for Web 2.0 Applications.

Here is a link to the training - GO

DeepSec 2008 - Training & Research

[11th November] DEEPSEC security confernce - Vienna, Austria


Training on Enterprise Secure Application Coding

Presentation on Web 2.0 Security Game

HITB 2008 ...

We are conducting training and speaking on Web 2.0 Attacks at HITB in Malaysia. They have great trainings and talks lined up this year as well. I look forward to meet lot of folks out there.

Training
Talk

We have training and speaking event at OWASP Appsec in Delhi - India. Seems a great event.

More on it.

One Day Workshop Series

We are conducting one day application security workshops in various cities in India. If you are interested in it.

More information here.

AppCodeScan 1.2 - Posted...

We did some source code assessment and on the basis of it .NET application rules are added. Can download and play around with the tool.

Link to tools page

Secure Application Coding Training at Syscan Singapore

[1st July 2008] Syscan - Singapore
Secure Application Coding Training

Application source code, independent of languages and platforms, is a major source for vulnerabilities. One of the CSI surveys on vulnerability distribution suggests that 64% of the time, a vulnerability crops up due to programming errors and 36% of the time, due to configuration issues. According to IBM labs, there is a possibility of at least one security issue contained in every 1,500 lines of code. To avoid these sort of security issues one needs to follow sound secure coding and design principals. It is also imperative to know code review methodologies and strategies to assess the quality of code before deploying to the production. The course is designed by the author of "Web Hacking: Attacks and Defense", “Hacking Web Services” and “Web 2.0 Security – Defending Ajax, RIA and SOA” bringing his experience in application security and research as part of curriculum.

Secure Coding course for Applications is hands-on class. The class features real life cases, hands one exercises, code scanning tools and defense plans. Participants would be methodically taken down to the source code level and exposed to the flaws in design and coding practices. The class would then focus on what are the proper ways of writing secure code and analyze the code base. This class addresses popular languages and platforms like VB/C# (.NET), Java(J2EE), PHP, ASP etc.

Paper on Blind SQL injection

This paper describes technique to deal with blind SQL injection spot with ASP/ASP.NET applications running with access to XP_CMDSHELL. It is possible to perform pen test against this scenario though not having any kind of reverse access or display of error message. It can be used in completely blind environment and successful execution can grant remote command execution on the target application with admin privileges.

Download - PDF
Read here in HTML

HackInTheBox & RSA 2008- Blueinfy Training and Research

Training Title: Web Application Security – Advanced Attacks and Defense

Introduction and adaptation of new technologies like Ajax, Rich Internet Applications and Web Services has changed the dimension of Application Hacking. We are witnessing new ways of hacking web based applications and it needs better understanding of technologies to secure applications. The only constant in this space is change. In this dynamically changing scenario in the era of Web 2.0 it is important to understand new threats that emerge in order to build constructive strategies to protect corporate application assets. Application layers are evolving and lot of client side attack vectors are on the rise like Ajax based XSS, CSRF, Widget injections, RSS exploits, Mashup manipulations and client side logic exploitations. At the same time various new attack vectors are evolving around SOA by attacking SOAP, XML-RPC and REST. It is time to understand these advanced attack vectors and defense strategies.

Presentation Title: Securing Next Generation Applications – Scan, Detect and Mitigate

Presentation Details:

McKinsey’s recent global survey suggested that 80% of companies are investing in Web 2.0 technologies. Web 2.0 technologies are no longer restricted to social networking site but forming backend to enterprise level applications. This evolution is giving rise to next generation application hacking and attack vectors. It is imperative to understand these new attacks and scanning methods to detect vulnerabilities. This presentation will be full of real life cases, live demonstrations, new tools and techniques along in-depth coverage on the latest concepts and methodologies.

Presenting Research at RSA 2008

Session Code: SOA-202
Session Title: Web 2.0 Security Chess: Combat Strategies and Defense Tactics
Scheduled Date/Time: Wednesday, April 09 09:10 AM
RED ROOM 310
Session Abstract: Ajax, web services and rich Internet (Flash) are redefining moves on the security chessboard. Attack strategies are emerging like cross-site scripting with JSON or cross-site request forgery with XML. This session will cover Web 2.0 attacks, tools for assessment, and approaches for code analysis with demonstrations. Professionals can apply knowledge in real life to a secure Web 2.0 application layer.

Agenda

Infosecworld 08 - Presentations on iHTTPModule and CSRF

You can go through my presentation and research work on iHTTPModule and CSRF. I have posted them on slideshare. Here is the posting you can view over here or go to the slideshare.

[CSRF]

| View | Upload your own

[.NET iHTTPModule - Interesting stuff]

| View | Upload your own

InfosecWorld - iHTTPModule and CSRF

Speaking on iHTTPModule with IIS 7.0 integrated pipe. It can help in building defense by creating WAF. Also, addressing CSRF and security controls around it. Looking forward to meet some of the application security folks as well.

Workshop in Dubai - Application Security

Having 2 days workshop for ISACA in Dubai. Look forward to meet some of UAE folks. Cheers!

If you are interested in joining - More Detail

BLackhat DC - On Web 2.0 Scanning

Scanning Applications 2.0 - Next generation scan, attacks and tools

Ajax, Web Services and Rich Internet (Flash) are redefining application security scanning challenges and strategies. We are witnessing some emerging attack vectors like Cross Site Scripting with JSON, Cross Site Request Forgery with XML, WSDL scanning, XPATH injection with XML streams etc. This presentation will cover Web 2.0 attacks, new scanning tools for assessment and approaches for Web 2.0 code analysis with demonstrations. Professionals can apply knowledge in real life to secure Web 2.0 application layer.

This presentation will focus on core Web 2.0 security issues along with assessment toolkit developed by the presenter. 1.) It is imperative to analyze Web 2.0 application architecture with security standpoint. We will evaluate real life vulnerabilities with Google, MySpace and Yahoo. 2.) Web 2.0 technology fingerprinting is very critical step to determine application security posture. 3.) Crawling Ajax driven application is biggest challenge and we will cover approaches to address this critical issue by dynamic DOM event management with Ruby. 4.) Scanning Web 2.0 application for security holes is an emerging issue. It needs lot of JavaScript analysis with DOM context to discover XSS and XSRF vulnerabilities in Ajax and Flash with new attack vectors hidden in payload structures like JSON, XML, JS-Arrays etc. 5.) Addressing assessment methods and tools to discover security lapses for SOAP, REST and XML-RPC based Web Services along with innovative fuzzing.

[Tool] AppPrint - Web and Application Server Fingerprinting/Mapping tool (Beta)

Posted a new tool on the site.
-- Description --
AppPrint scans IP range, IP or host for Web and Application servers. It scans port 80 for a particular target and tries to deduce the banner using httprint methodology. This gives best guessed banner for Web Server. In next step it uses method of forced plug-in invoke and scan for application server type. At this point it tries to fingerprint Tomcat, WebLogic, WebSphere, Orion, ColdFusion and Resin. It requires .NET framework installed. In future version we will build several other technology mapping and fingerprinting technologies like Ajax, RIA, Flash, Laszlo etc.
--

Read and Download

[net-security paper] Dissecting and Digging Application Source Code for Vulnerabilities

Application source code scanning for vulnerability detection is an interesting challenge and relatively complex problem as well. There are several security issues which are difficult to identify using blackbox testing and these issues can be identified by using whitebox source code testing methodlogy. Application layer security issues may be residing at logical layer and it is very important to have source code audit done to unearth these categories of bugs. This paper is going to address following areas:

1. How to build simple rules using method and class signatures to identify possible weak links in the source code.
2. How to do source code walking across the entire source base to perform impact analysis.
3. How to use simple tool like AppCodeScan or similar utility to perform effective source code analysis to detect possible vulnerability residing in your source base.

Read here

Tool Update - AppCodeScan 1.1

AppCodeScan 1.1 is posted on the site with following changes

1. Parsing of code is changed and now tool shows line number where pattern is found in both scanning and code walking functionality.
2. There were some bugs which are fixed to do recursive three layer scanning.

Download from here

Thanks for your feedback.

Cheers!

[Book] Web 2.0 Security - Defending AJAX, RIA, AND SOA

SOA, RIA, and Ajax are the backbone behind the now widerspread Web 2.0 applications such as MySpace, GoogleMaps, and Wikipedia. Although these robust tools make next generation web applications possible, they also add new security concerns to the field of web application security. Yamanner, Samy and Spaceflash type worms are exploiting “client-side” Ajax frameworks, providing new avenues of attack and compromising confidential information. Portals like Google, NetFlix, Yahoo and MySpace have witnessed new vulnerabilities in the past. These vulnerabilities can be leveraged by attackers to perform Phishing, Cross-site Scripting (XSS) and Cross-Site Request Forgery (XSRF) exploitation. Web 2.0 Security: Defending Ajax, RIA, and SOA is the book to cover the new field of Web 2.0 security. Written for intermediate-to-advanced security professionals and developers, the book explores Web 2.0 hacking methods and helps in enhancing next generation security controls for better application security posture. Readers will gain knowledge in advanced footprinting and discovery techniques, Web 2.0 scanning and vulnerability detection methods, Ajax and Flash hacking methods, SOAP, REST and XML-RPC hacking, RSS/Atom feed attacks, fuzzing and code review methodologies and tools, tool building with Python, Ruby and .NET, and much, much more. The book includes a companion CD-ROM with tools, demos, samples, code, and images.

More on Amazon