View source for WebAppSec/MozSecureWorld

= Purpose =
A running web application to demonstrate major security paradigms used within Mozilla web applications and security capabilities of modern browsers.

== Uses ==
* Demonstration of secure application design
* Explanation of importance and purpose of security features
* Learning tool for others to reference
* Testing site to validate effectiveness of security & design recommendations
* Evaluation tool for pen testing individuals or tools

= Design =
== Architecture ==
Python on Django via Playdoh
 
== Security Components & Controls ==
=== Authentication ===
* Brute force prevention via adaptive CAPTCHA - track failed logins by IP address (attacker from one IP guessing "password" on all useraccounts) and by user account (Joe has 3 failed logins) 
* Password storage via bcrypt (fred wenzel) and system nonce
* Account creation with blacklisted password support
* (Possible) Secure Password Reset 
''How''
* Login with database and different users

=== Access Control ===
* Presentation, Business, Data Layer Access Control
** Presentation and Data layers use decorators
** Read about presentation layer protection
* (Possible) Two tier design for admin account separation
** The picture of separate control of changing passwords

=== Input Validation ===
* Rich text handling via bleach
* File upload support via secure file handling guidelines
* File Handling
* SQL 
* Content Security Policy 
** outsource all javascript source! for the CSP demo as 2nd barrier beyond escaping characters
* (Possible) Third party service
* (Possible) Third party hosted images. Initial processing and per visit processing?

=== Transport Security ===
* Full & correct TLS
* HTTP Strict Transport Security
''How''
* Follow [https://www.owasp.org/index.php/Transport_Layer_Protection_Cheat_Sheet#Introduction these rules]

=== Cross Domain Controls ===
* X-frame-options in header options

==== See that x/frame-option is denied ====
Type:

> telnet 127.0.0.1 8000

> GET /en-US/msw/ HTTP/1.1 

> press enter 

Results:  See that '''x-frame-options: DENY''' is there!  
<pre>
telnet 127.0.0.1 8000
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
GET /en-US/msw/ HTTP/1.1 

HTTP/1.0 200 OK
Date: Thu, 09 Jun 2011 23:41:32 GMT
Server: WSGIServer/0.1 Python/2.7.1
x-frame-options: DENY
Content-Type: text/html; charset=utf-8

<!DOCTYPE html>
  <head>
  <title>Hi there</title>
  </head>
  <body>

  <h1>aaiiibarbari</h1>
  
  Hi do I have a good title?

            <ul>
                            <li><a href="/msw/sqlinjection/">page title: SQL Injection</a> </li>
                            <li><a href="/msw/xss/">page title: XSS</a> </li>
                    </ul>
    
  </body>
</html>
Connection closed by foreign host.
</pre>


==== Where playdoh set x-frame-option to "deny" ====
It's in ''vendor/src/commonware/commonware/response/middleware.py''
<pre>
from django.conf import settings

class FrameOptionsHeader(object):
    """
    Set an X-Frame-Options header. Default to DENY. Set
    response['x-frame-options'] = 'SAMEORIGIN'
    to override.
    """

    def process_response(self, request, response):
        if hasattr(response, 'no_frame_options'):
            return response

        if not 'x-frame-options' in response:
            response['x-frame-options'] = 'DENY'
</pre>

Also see ''vendor/src/commonware/commonware/response/decorators.py''
<pre>
from functools import wraps

from django.utils.decorators import available_attrs


def xframe_sameorigin(view_fn):
    @wraps(view_fn, assigned=available_attrs(view_fn))
    def _wrapped_view(request, *args, **kwargs):
        response = view_fn(request, *args, **kwargs)
        response['x-frame-options'] = 'SAMEORIGIN'
        return response
    return _wrapped_view


def xframe_allow(view_fn):
    @wraps(view_fn, assigned=available_attrs(view_fn))
    def _wrapped_view(request, *args, **kwargs):
        response = view_fn(request, *args, **kwargs)
        response.no_frame_options = True
        return response
    return _wrapped_view


def xframe_deny(view_fn):
    @wraps(view_fn, assigned=available_attrs(view_fn))
    def _wrapped_view(request, *args, **kwargs):
        response = view_fn(request, *args, **kwargs)
        response['x-frame-options'] = 'DENY'
        return response
    return _wrapped_view
</pre>

=== Cookie Protection ===
* Secure Flag
* HTTPOnly Flag


==== How to check ====

# Get  Burp
# Go to your site
# should see that ""Set-Cookie: HTTPOnly" in the HTTP Header Response

== Roadmap ==
# X Setup [https://github.com/mozilla/playdoh/ playdoh] & [https://github.com/haoqili/MozSecWorld github]
# X Running HelloWorld 
# X Design Planning
# X Figure out how to do [https://docs.djangoproject.com/en/dev/ref/templates/api/#loading-templates templates]
# X Figure out how to put in database
# X Know how to make pages with templates
# X basic: x-frame-options
# LATER --> Install Apache basic: secure flag (June 9 pg2)
# X basic: httponly flag
# X Use bleach for rich text.
# LATER --> input the same --> output check for HTML, JS, XML (June 13 pg2)
# X Google Safe Browsing POST Lookup
# LATER --> Use Google Safe Browsing Local (June 14)
# add decorators for data and business layers
# read about presentation layer
# Complete initial presentation layer and CSS for basic item
# Authentication/login
# File upload stuff
# Write about page for each vulnerability
# Access Control
# Input Validation

== Calendar ==
<table border="1" cellpadding="2" cellspacing="0">
<tr>
<th>Week</th>
<th>Items</th>
<th>Category</th>
<th>Completion</th>
</tr>

<tr>
<td> 2. -- June 17</td>  
<td>
* x Richtext with bleach
* -> Finish Check Cert
** Set up MITM to verify check cert works.
</td>
<td>
* Input Validation
* HTTPS Validation</td>
<td>
a
</td>
</tr>

<tr>
<td>3. June 20 - 24</td>
<td>
* SQL Injection
* write up / buttons / css everything so far
* make wiki more readable
* watch OWASP videos
</td>
<td>
* Input Validation
* Cross Domain Controls (before)
* Cookie Protection (before)
</td>
<td>
a
</td>
</tr>


<tr>
<td>4. June 27 - July 1st</td>
<td>
* Content Security Policy
</td>
<td></td>
<td>
a
</td>
</tr>


<tr>
<td>5. July 3rd - July 8th</td>
<td>
* Authentication - bcrypt / adaptive captcha
</td>
<td></td>
<td>
a
</td>
</tr>


<tr>
<td>6. July 11th - July 15th</td>
<td>
* Access Control (presentation business, data layers)
</td>
<td></td>
<td>
a
</td>
</tr>


<tr>
<td>7. July 18th - July 22nd</td>
<td>
* File Handling
</td>
<td></td>
<td>
a
</td>
</tr>


<tr>
<td>8. July 25th - July 29th</td>
<td>
* "possible" items, catch up/extra</td>
<td></td>
<td>
a
</td>
</tr>
</table>

== Links References ==
[[MozSecureWorld_FAQ]]

https://wiki.mozilla.org/WebAppSec/Secure_Coding_Guidelines