SQL Injections are still a prominent threat on the web. Using a custom built tool, BlindCanSeeQL (BCSQL), we will explore how to automate Blind SQL attacks to discover database schema using fewer requests than the standard methods, thus helping avoid detection from overloading a server with hits. This tool uses a web crawler to discover keywords that assist with autocompleting schema object names, along with improvements in ASCII bisection to lower the number of requests sent to the server. Along with this tool, we will discuss ways to prevent and protect against such attacks.

Modern web applications use several third-party JavaScript libraries to achieve higher levels of engagement. The third-party libraries range from utility libraries such as jQuery to libraries that provide services such as Google Analytics and context- sensitive advertisement. These third-party libraries have access to most (if not all) the elements of the displayed webpage. This allows malicious third-party libraries to perform attacks that steal information from the end-user or perform an action without the end-user consent. These types of attacks are the stealthiest and the hardest to defend against, because they are agnostic to the browser type and platform of the end-user and at the same time they rely on web standards when performing the attacks. Such kind of attacks can perform actions using the victim’s browser without her permission. The nature of such actions can range from posting an embarrassing message on the victim’s behalf over her social network account, to performing online biding using the victim’s account. This poses the need to develop effective mechanisms for protecting against client-side web attacks that mainly target the end-user. In the proposed research, we address the above challenges from information flow monitoring perspective by developing a framework that restricts the flow of information on the client-side to legitimate channels. The proposed model tracks sensitive information flow in the JavaScript code and prevents information leakage from happening. The main component of the framework is a hybrid flow-sensitive security monitor that controls, at runtime, the dissemination of information flow and its inlining. The security monitor is hybrid as it combines both static analysis and runtime monitoring of the running JavaScript program. We provide the soundness proof of the model with respect to termination-insensitive non-interference security policy and develop a new security benchmark to establish experimentally its effectiveness in detecting and preventing illicit information flow. When applied to the context of client-side web-based attacks, the proposed model provides a more secure browsing environment for the end-user. / Graduate

Webbattacker är i dagens läge ett välkänt problem. Syftet med en attack kan vara allt från att enbart förstöra, till att komma åt sekretessklassad information eller drivas av organiserad brottslighet för ekonomisk vinning. Ett stort behov hos många företag är därför att skydda sig mot attacker. Ett system måste garantera att information som finns i systemet enbart kan kommas åt av autentiserade användare. Information som skickas och lagras i systemet får inte avlyssnas eller gå att förändra. Denna rapport redogör för ett projekt där ett webbaserat system, som ett företag ska utveckla, undersöks. För att detta system ska bli säkert mot attacker görs en bedömning av vilken nivå av säkerhet som krävs, samt en riskanalys av systemet och en analys av säkerhetslösningar som täcker dessa risker. Projektet resulterade i en beskrivning av de säkerhetslösningar som skyddar mot systemets risker och som täcker företagets krav på säkerhetsnivå. Resultatet är informativt och ska kunna användas som grund vid utveckling av säkerheten i webbaserade system. / Web attacks are today a well-known problem. The purpose of an attack can vary from only destroying, to access confidential information or be operated by criminal activities for financial gain. Many businesses therefore have a great need to protect themselves against attacks. A system must ensure that only authenticated users can access the information contained in the system. I should not be possible to intercept or change the information that is sent and stored in the system. This report describes a project where a web-based system, that a company is going to develop, will be analyzed. An assessment of the level of security that the system require, a risk analysis of the system and an analysis of security solutions that cover these risks, are made to make the system secure against attacks. The project resulted in a description of the security solutions that protects against the systems risks, and that covers the company's requirements of security. The result is informative and can be used as a basis for the development of the security in web-based systems.

No description available.

Avec le développement croissant d’Internet, les applications Web sont devenues de plus en plus vulnérables et exposées à des attaques malveillantes pouvant porter atteinte à des propriétés essentielles telles que la confidentialité, l’intégrité ou la disponibilité des systèmes d’information. Pour faire face à ces malveillances, il est nécessaire de développer des mécanismes de protection et de test (pare-feu, système de détection d’intrusion, scanner Web, etc.) qui soient efficaces. La question qui se pose est comment évaluer l’efficacité de tels mécanismes et quels moyens peut-on mettre en oeuvre pour analyser leur capacité à détecter correctement des attaques contre les applications web.Dans cette thèse nous proposons une nouvelle méthode, basée sur des techniques de clustering de pages Web, qui permet d’identifier les vulnérabilités à partir de l’analyse selon une approche boîte noire de l’application cible. Chaque vulnérabilité identifiée est réellement exploitée ce qui permet de s’assurer que la vulnérabilité identifiée ne correspond pas à un faux positif. L’approche proposée permet également de mettre en évidence différents scénarios d’attaque potentiels incluant l’exploitation de plusieurs vulnérabilités successives en tenant compte explicitement des dépendances entre les vulnérabilités.Nous nous sommes intéressés plus particulièrement aux vulnérabilités de type injection de code, par exemple les injections SQL. Cette méthode s’est concrétisée par la mise en oeuvre d’un nouveau scanner de vulnérabilités et a été validée expérimentalement sur plusieurs exemples d’applications vulnérables. Nous avons aussi développé une plateforme expérimentale intégrant le nouveau scanner de vulnérabilités, qui est destinée à évaluer l’efficacité de systèmes de détection d’intrusions pour des applications Web dans un contexte qui soit représentatif des menaces auxquelles ces applications seront confrontées en opération. Cette plateforme intègre plusieurs outils qui ont été conçus pour automatiser le plus possible les campagnes d’évaluation. Cette plateforme a été utilisée en particulier pour évaluer deux techniques de détection d’intrusions développées par nos partenaires dans le cadre d’un projet de coopération financé par l’ANR, le projet DALI. / With the increasing development of Internet, Web applications have become increasingly vulnerable and exposed to malicious attacks that could affect essential properties such as confidentiality, integrity or availability of information systems. To cope with these threats, it is necessary to develop efficient security protection mechanisms and testing techniques (firewall, intrusion detection system,Web scanner, etc..). The question that arises is how to evaluate the effectiveness of such mechanisms and what means can be implemented to analyze their ability to correctly detect attacks against Webapplications.This thesis presents a new methodology, based on web pages clustering, that is aimed at identifying the vulnerabilities of a Web application following a black box analysis of the target application. Each identified vulnerability is actually exploited to ensure that the identified vulnerability does not correspond to a false positive. The proposed approach can also highlight different potential attack scenarios including the exploitation of several successive vulnerabilities, taking into account explicitly the dependencies between these vulnerabilities. We have focused in particular on code injection vulnerabilities, such asSQL injections. The proposed method led to the development of a new Web vulnerability scanner and has been validated experimentally based on various vulnerable applications.We have also developed an experimental platform integrating the new web vulnerability scanner, that is aimed at assessing the effectiveness of Web applications intrusion detection systems, in a context that is representative of the threats that such applications face in operation. This platform integrates several tools that are designed to automate as much as possible the evaluation campaigns. It has been used in particular to evaluate the effectiveness of two intrusion detection techniques that have been developed by our partners of the collaborative project DALI, funded by the ANR, the French National Research Agency

L'incroyable développement du World Wide Web a permis la création de nouveaux métiers, services, ainsi que de nouveaux moyens de partage de connaissance. Le web attire aussi des malfaiteurs, qui le considèrent comme un moyen pour gagner de l'argent en exploitant les services et la propriété d'autrui. Cette thèse propose une étude des sites web compromis et malicieux sous plusieurs axes d'analyse. Même si les attaques web peuvent être de nature très compliquées, on peut quasiment toujours identifier quatre acteurs principaux dans chaque cas. Ceux sont les attaquants, les sites vulnérables hébergés par des fournisseurs d'hébergement, les utilisateurs (souvent victimes des attaques), et les sociétés de sécurité qui parcourent Internet à la recherche de sites web compromis à être bloqués. Dans cette thèse, nous analysons premièrement les attaques web du point de vue des hébergeurs, en montrant que, même si des outils gratuits permettent de détecter des signes simples de compromission, la majorité des hébergeurs échouent dans cette épreuve. Nous passons en suite à l'analyse des attaquants et des leurs motivations, en étudiant les attaques web collectés par des centaines de sites web vulnérables. Ensuite, nous étudions le comportement de milliers de victimes d'attaques web, en analysant leurs habitudes pendant la navigation, pour estimer s'il est possible de créer des "profils de risque", de façon similaire à ce que les compagnies d'assurance font aujourd'hui. Enfin, nous adoptons le point de vue des sociétés de sécurité, en proposant une solution efficace pour la détection d'attaques web convoyées par sites web compromis / The incredible growth of the World Wide Web has allowed society to create new jobs, marketplaces, as well as new ways of sharing information and money. Unfortunately, however, the web also attracts miscreants who see it as a means of making money by abusing services and other people's property. In this dissertation, we perform a multidimensional analysis of attacks involving malicious or compromised websites, by observing that, while web attacks can be very complex in nature, they generally involve four main actors. These are the attackers, the vulnerable websites hosted on the premises of hosting providers, the web users who end up being victims of attacks, and the security companies who scan the Internet trying to block malicious or compromised websites. In particular, we first analyze web attacks from a hosting provider's point of view, showing that, while simple and free security measures should allow to detect simple signs of compromise on customers' websites, most hosting providers fail to do so. Second, we switch our point of view on the attackers, by studying their modus operandi and their goals in a distributed experiment involving the collection of attacks performed against hundreds of vulnerable web sites. Third, we observe the behavior of victims of web attacks, based on the analysis of their browsing habits. This allows us to understand if it would be feasible to build risk profiles for web users, similarly to what insurance companies do. Finally, we adopt the point of view of security companies and focus on finding an efficient solution to detecting web attacks that spread on compromised websites, and infect thousands of web users every day