Pony Pwning Djangocon 2010

Pony PwningDjangocon 2010 // Adam Baldwin

Wednesday, September 8, 2010

Hi, I’m not that Adam Baldwin.

I’m this one:

@adam_baldwin

ngenuity-is.com

evilpacket.net


I break stuff


Django = pile of awesome


Django isn’tperfect


Developers aren’t perfect


I WANT TOHELP YOU

AVOID HUGE ASSMISTAKES

Captain Howdy McAssumptions,the nGenuity Mascot


★ ★ ★ ★

Completely

made upstatistics

★ ★ ★ ★

INTRODUCING!


of securityfailures60%

projectconstraints!

★ ★ ★ ★




incompetenceor ignorance

★ ★ ★ ★


See http://evilpacket.net/2010/jan/14/mifi-geopwn/


http://evilpacket.net/2010/jan/14/mifi-geopwn/

http://evilpacket.net/2010/jan/14/mifi-geopwn/


needle inthe haystack

★ ★ ★ ★


See http://evilpacket.net/2009/jul/9/rackspace-cloud-xss-root/and http://evilpacket.net/2009/jul/9/theft-rackspace-cloud-api-key/


http://evilpacket.net/2009/jul/9/rackspace-cloud-xss-root/

http://evilpacket.net/2009/jul/9/rackspace-cloud-xss-root/

http://evilpacket.net/2009/jul/9/theft-rackspace-cloud-api-key/

http://evilpacket.net/2009/jul/9/theft-rackspace-cloud-api-key/


0 days

★ ★ ★ ★


90%Let’s talkabout the


Sad PonyWarning


cross-site scripting


the

BigFive

double quote

single quote

ampersand

less than

greater than

“‘

&<>{


{% autoescape off %}

|safe filter

mark_safe( )


Context matters.

<a href=”{{object.absolute_url}}” alt=”{{object.name}}”>{{object.name}}</a>

<a href={{object.absolute_url}} alt={{object.name}}>{{object.name}}</a>

Missing quotes in the second URL make it possible to inject malicious code.

Which is bad.


swingsetOWASP ESAPI Swingset by Craig Younkins

http://www.owasp.org/index.php/ESAPI_Swingset


Browser behavior

<style /><a href="[user provided data here]">click</a>

This works in IE8, without the “big five” and executeswithout user interaction.

<style /><a href="}@import/**/data:text/css%3Bbase64,Knt4OmV4cHJlc3Npb24oYWxlcnQoMSkpfQ%3D%3D;">click</a>


Avoid getting burned

• Consider OWASP ESAPI

• Audit templates

• Audit reusables and snippets

• Educate designers


FILE UPLOADS


Evil Avatars

Images can contain PHP.

ImageField does not care.

ImageField does not check extensions.

File uploads often are put inunprotected directories.



• Check file extensions

• Disable PHP


secret_report.pdf

File upload TMI

secret_report_1.pdf



• Put user content behind a file API

• Obfuscate filenames of uploads


DirectObject Access


“Not Found”

General TMI

“Forbidden” / “Access denied”

vs.



• Return consistent results (preferably “Not Found”)

• Log security violations


eg /object/delete/2

Doing stupid things

Privileged operations with HTTP GET



• Don’t do stupid things.

• Consider Django-Piston for REST


ClickJacking

What the hell is it?


Click jackets

/admin/ is vulnerable.

pre-filling forms removes most user interaction



• Set X-FRAME-OPTIONS DENY header

• Use django-xframeoptions middleware

• Implement frame breakout code


Abusing /admin/

:(


Wuh-oh, kids.

[ REDACTED ]



• I HAVE NO IDEA.

• [email protected] needs to check their email ;)


mailto:[email protected]

mailto:[email protected]


I have ahard job


Your jobis harder.


Questions?

@adam_baldwin // ngenuity-is.com // evilpacket.net


Technology

Pony Pwning Djangocon 2010