Scribd Logo
Upload

Welcome to Scribd!

  • 18 views

    Web Communications and Security: Fore Academy Security Essentials (II)

    Uploaded by

    Novia Arifah
    The document discusses various topics relating to web communications and security, including web protocols like HTTP and HTML, cookies, SSL, SET for secure transactions, and active content like Java and JavaScript. It also covers vulnerabilities in CGI scripts, cracking web applications, and defenses against common web attacks.

    Copyright:

    © All Rights Reserved
    Download as PPTX, PDF, TXT or read online from Scribd

    Web Communications and Security: Fore Academy Security Essentials (II)

    Uploaded by

    Novia Arifah
    18 views15 pages
    The document discusses various topics relating to web communications and security, including web protocols like HTTP and HTML, cookies, SSL, SET for secure transactions, and active content like Java and JavaScript. It also covers vulnerabilities in CGI scripts, cracking web applications, and defenses against common web attacks.

    Original Title

    9 keamanan jaringan

    Copyright

    © © All Rights Reserved

    Available Formats

    PPTX, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    The document discusses various topics relating to web communications and security, including web protocols like HTTP and HTML, cookies, SSL, SET for secure transactions, and active content like Java and JavaScript. It also covers vulnerabilities in CGI scripts, cracking web applications, and defenses against common web attacks.

    Copyright:

    © All Rights Reserved
    Download as PPTX, PDF, TXT or read online from Scribd
    Download as pptx, pdf, or txt
    18 views15 pages

    Web Communications and Security: Fore Academy Security Essentials (II)

    Uploaded by

    Novia Arifah
    The document discusses various topics relating to web communications and security, including web protocols like HTTP and HTML, cookies, SSL, SET for secure transactions, and active content like Java and JavaScript. It also covers vulnerabilities in CGI scripts, cracking web applications, and defenses against common web attacks.

    Copyright:

    © All Rights Reserved
    Download as PPTX, PDF, TXT or read online from Scribd
    Download as pptx, pdf, or txt
    of 15

    FORESEC Academy

    FORESEC Academy Security Essentials (II)

    WEB COMMUNICATIONS AND


    SECURITY
    FORESEC Academy

    Agenda

     Web communication
     Web security protocols
     Active content
     Cracking web applications
     Web application defenses
    FORESEC Academy

    Everything You Always Wanted to


    Know About Web Communications...

     Servers and Clients


     HTTP and HTML
    FORESEC Academy

    Everything You Always Wanted to


    Know About Web Communications(2)

     Stateless Communications
     Retrieving Information . GET,
    HEAD
     Sending Information . POST, PUT
    FORESEC Academy

    HTML Security

     Reading HTML Source


    FORESEC Academy

    HTML Security (2)

     Hidden Fields
     Server Side Includes
    FORESEC Academy

    Common Gateway Interface


    (CGI)
     Allows web pages to do something instead
    of just returning pages
     Extends the capabilities of a web server
     Creates many exposures on server
    - Leaking information
    - Performing unauthorized transactions
    - Executing unintended programs
    FORESEC Academy

    Common Gateway Interface


    (CGI) (2)
     Common Mistakes
    - Misuse of command interpreters
    - Bad memory management
    - Passing unchecked parameters to system
    FORESEC Academy

    Cookies

     HTTP is “stateless” - no context information


     Cookies provide “state” and context
     Can only hold information given to the browser
    by the server
     Can only be exchanged with originating server
    or domain
     Beware of cross-site sharing (e.g., DoubleClick)
     Can block cookies if desired
    FORESEC Academy

    What About Non-Persistent


    Cookies?
     Non-persistent cookies = per-session cookies
     Non-persistent cookies are not written to the browser
    file system
    -So they can't be edited and are therefore safe from session
    ID attacks. Right?
    -Wrongo!!!
     Several possible methods
    - 1) Raw read/write from/to the client-side memory
    - 2) Adapt Mozilla browser source to edit cookies
    - 3) Write a Javascript app that lets you view page and edit
    - 4) Write a proxy that allows for editing of entire session
    passed back and forth from browser (Achilles)
    FORESEC Academy

    SSL

     Protocol for encrypting network traffic


     Operates at Transport Layer
     Operates on port 443
     How it works
    - Client connects to server
    - Server indicates need for SSL
    - Client and server exchange crypto keys
    - Secure session begins
     Not a guarantee of security
    FORESEC Academy

    Secure Electronic Transactions


    (SET)
     Developed by Visa, MasterCard,
    Microsoft, Netscape
     Specific-purpose protocol
     Secures credit and debit card
    transactions
    FORESEC Academy

    Secure Electronic Transactions


    (SET) (2)

     Services provided
    - Authentication
    - Confidentiality
    - Message Integrity
    - Linkage
    FORESEC Academy

    Active Content

     Programs that interact in a network


    environment
     Java/ActiveX
    FORESEC Academy

    Java and JavaScript

     Java - executable code


     JavaScript - instructions embedded in HTML
     Security Model
    - Execution in a controlled environment (the
    “sandbox”)
    - Local apps have more access than network apps
    - Byte Code Verifier, Class Loader & Security
    Manager enforce security

    You might also like