CSCI 2910 Client/Server-Side Programming

Embed Size (px)

DESCRIPTION

CSCI 2910 Client/Server-Side Programming. Topic: More Topics in PHP Reading: Williams & Lane pp. 377-397. Today's Goals. Server-side applications open up a number of possibilities for malicious attacks - PowerPoint PPT Presentation

Text of CSCI 2910 Client/Server-Side Programming

  • CSCI 2910 Client/Server-Side ProgrammingTopic: More Topics in PHPReading: Williams & Lane pp. 377-397

  • Today's GoalsServer-side applications open up a number of possibilities for malicious attacksThis lecture provides an overview of security along with only a few of the measures that can be taken to guard against attacks.All responsible web programmers must continually familiarize themselves with both the modes of attack and the means by which to protect themselves and their data.

  • Quick FactsRandal Schwartz -- Barney the DinosaurComplexity of browsers and servers have opened up a number of other opportunities, i.e., every new feature opens up new vulnerabilitiesMany blogs, forums, search engines, and e-businesses display other user's form input to third party clients.Scripts and get-method forms can be disguised as simple links making unsuspecting clients vulnerable.

  • Problems with User InputYou have no control over a user's form input.Scripts must examine all input to preventunintentional characters from causing erroneous executionmalicious input from breaching securityAlways validate form input by:cleaning it up to verify acceptable strings orusing it to drive assignment of hard-coded values.Typically, JavaScript on the client side is used for form validation, but we need to do more on the server-side.Attackers could create forms that simulate input from legitimate forms.

  • Escape CharactersIt's a good idea to use trim() to remove excess white space from user inputBe sure to control the escape character '\' so unwanted white space is removed Remove unwanted double slashes with stripslashes();Prevent PHP control characters from entering form data using addslashes().addslashes() escapes single quote ('), double quote ("), backslash (\) and NULL.addslashes() works the same as Magic Quotes, a process that automatically escapes incoming data.

  • Validating Form DataAlthough the HTML form might have JavaScript used at the form to validate data, it is a good idea to validate form data at the server side too.Validating HTML form data:prevents erroneous outputis critical to securityis not to be trusted entirelyTo eliminate confusion, all forms should indicate to user which fields are required and, where applicable, the format and type of information a field is expecting.

  • Methods to Validate Form Dataisset() tests if a variable has a value.if (isset($var)) { // $var has a value. } else { // $var does not have a value. }

    Unfortunately, isset() will return a true if the variable is set to an empty string.

  • Methods to Validate Form Data (continued)To avoid empty strings, use the string function strlen(). $input = stripslashes($_POST['name']); if (strlen($input) > 0) { // User input a value. } else { // User did not input a value }

  • Did the User Input a Number?To test if a submitted value is a number, use the is_numeric() function. is_numeric() returns a boolean true if the value is a number.

  • Hidden Form ElementsHidden form elements can be used to pass data to a PHP script without allowing the user to see it.This can be used to identify the form that requested the page or passing other constants to the server side script.Never use hidden elements to store secure information as the HTML can be viewed by the client.

  • Verifying the Client$_SERVER['HTTP_REFERER'] returns the address of the page that referred the user to this script.$_SERVER['REQUEST_METHOD'] returns the method of the form used to refer the user to this script.$_SERVER['REMOTE_ADDR'] returns the IP address of machine originating request. Can use this to limit which machines have access to your PHP script.

  • HTTP HeadersHyperText Transfer Protocol (HTTP) is the protocol that defines how servers and clients communicate.When a browser requests a Web page, it receives a series of HTTP headers containing information about the transaction.PHP's built-in function header() allows a server-side script to provide a custom header.These headers can be used for authentication

  • HTTP Headers (continued)Since PHP sends output to the client as it is generated, and since headers must be sent before the HTML file itself, the header() function must be executed before the script outputs anything. Failure to do this results in an error message to the user.To avoid this, use the headers_sent() function, which checks whether or not data has been sent to the Web browser. if (!headers_sent()) header ("Location: http://www.url.com/a.php"); else echo "Unable to redirect you.";

  • HTTP Headers RedirectThe most common example of headers is to redirect the browser from the current page to another. Example: header ("Location: http://www.url.com/page.php");A redirect should be the last thing to occur on the current page since the browser will soon be leaving it.Therefore, this line should be followed by a call to the exit() function in order to stop execution of the script.

  • Sticky FormsIf a user needs to be returned to a form, e.g., they have forgotten to input required data, it's nice to have the fields that they have already entered pre-filled for the new form.Remember that form elements in HTML can have preset values. For example:

  • Sticky Forms (continued)Use the valid values returned in $_GET and $_POST to preset those values.For example:
  • Security IssuesAllowing the client to execute scripts and access databases on a server opens up vulnerabilities not inherent in client-side applications.Security has become the most important design issue in web application development. It must be addressed in your designs.

  • Identifying the Threats(Source: Laws, Michaele, Course Notes PHP4/ PHP Part4_lecture.doc)Four types of threats to server side applicationsAccess to or modification of sensitive dataUser permissions (who sees what)What to store, what not to storeEncoding data sent to server using SSLLoss or destruction of dataDeleting a tableLoss of a server due to a destructive event, e.g., natural disaster

  • Identifying the Threats (continued)(Source: Laws, Michaele, Course Notes PHP4/ PHP Part4_lecture.doc)Denial of ServiceCrashing the computerFilling up HDDGenerating multiple processes, using up memoryCausing hardware failure on server by manipulating device driversFlooding network with trafficMalicious Code InjectionSQL InjectionCross Site Scripting (XSS)

  • You Don't Want to Become the Reason for Articles Like This(Source: Swartz, Jon, USA Today, Posted 2/18/2003 5:07 PM)

    Hackers Get Credit Card Numbers By Jon Swartz, USA TODAY SAN FRANCISCO Intruders broke into a computer system and accessed more than 5.6 million credit card account numbers from Visa, MasterCard and American Express in what is believed to be the largest security breach of its kind. The suspected hackers cracked the security of a company that processes transactions for merchants, the credit card associations said Tuesday. They wouldn't identify the company attacked or say when or how the hackers got to the accounts, which includes about 3.4 million from Visa and 2.2 million from MasterCard.

  • Warning(Source: Laws, Michaele, Course Notes PHP4/ PHP Part4_lecture.doc)"The following information is never to be used with malicious intent, or to show off. It is understood that to write secure code, one must comprehend what makes code insecure and how or why it is insecure. Use of techniques discussed in class without prior approval of all parties involved will result in termination from the CS department, and possible discipline measures from the university and/or local authorities."

  • Inserting PHP Using Form InputsForms with text input may be used to insert PHP code.Example:
  • Inserting PHP Using Form Inputs (continued)On a poorly configured server, the PHP code that would be executed would allow the pop-up:Okay, so this may not be that malicious, but there are other things a hacker could do.For example, a hacker could use this method to insert JavaScript code to access server or client data.

  • Cross Site Scripting (Source: Laws, Michaele, Course Notes PHP4/ PHP Part4_lecture.doc)"[Cross Site Scripting] is when a web site displays user input in the browser that has not been properly sanitized. Cross site scripting can be used to steal cookies, compromise data integrity and trick users into submitting information to a hacker. An unauthorized user can modify data in the URL string to insert damaging HTML into the processing script, and send the user to a bogus site (cross site)."

  • Cross Site Scripting (continued)Basically, the problem occurs when a hacker manages to trick a client into clicking on a link that has a URL modified to insert malicious code into the processing script.For example, if the first_name element of the preceding form and associated script were set to: alert(document.cookie) then a JavaScript function would be executed.While an alert box is not that malicious, giving a hacker the ability to insert JavaScript into a client's page puts the clients cookies and other information at risk of being sent to the hacker through what might appear to be an innocent link.

  • SQL Injection Many database queries require user input to identify records.In particular, user names and passwords can be exploited to gain access to other data.SQL injection inserts PHP SQL functions through form inputs to gain unauthorized access to protected information.

  • Sample HTML Login Form userid: password:

  • Sample PHP Login Script
  • Valid OperationIf the user were to enter a user name of "abcde" and password of "12345", the PHP script would perform the following SQL query: Select * from members where username='abcde and passw