WebAppSec/MozSecureWorld

Purpose

A running web application to demonstrate major security paradigms used within Mozilla web applications and security capabilities of modern browsers.

Uses

• Demonstration of secure application design
• Explanation of importance and purpose of security features
• Learning tool for others to reference
• Testing site to validate effectiveness of security & design recommendations
• Evaluation tool for pen testing individuals or tools

Design

Architecture

Python on Django via Playdoh

Security Components & Controls

Authentication

• Brute force prevention via adaptive CAPTCHA - track failed logins by IP address (attacker from one IP guessing "password" on all useraccounts) and by user account (Joe has 3 failed logins)
• Password storage via bcrypt (fred wenzel) and system nonce
• Account creation with blacklisted password support
• (Possible) Secure Password Reset

How

• Login with database and different users

Access Control

• Presentation, Business, Data Layer Access Control
  • Presentation and Data layers use decorators
  • Read about presentation layer protection
• (Possible) Two tier design for admin account separation
  • The picture of separate control of changing passwords

Input Validation

• Rich text handling via bleach
• File upload support via secure file handling guidelines
• File Handling
• SQL
• Content Security Policy
  • outsource all javascript source! for the CSP demo as 2nd barrier beyond escaping characters
• (Possible) Third party service
• (Possible) Third party hosted images. Initial processing and per visit processing?

Transport Security

• Full & correct TLS
• HTTP Strict Transport Security

How

• Follow these rules

Cross Domain Controls

• X-frame-options in header options

P

Cookie Protection

• Secure Flag
• HTTPOnly Flag

How to check

1. Get Burp
2. Go to your site
3. should see that ""Set-Cookie: HTTPOnly" in the HTTP Header Response

Roadmap

1. X Setup playdoh & github
2. X Running HelloWorld
3. X Design Planning
4. X Figure out how to do templates
5. X Figure out how to put in database
6. X Know how to make pages with templates
7. X basic: x-frame-options
8. LATER --> Install Apache basic: secure flag (June 9 pg2)
9. X basic: httponly flag
10. X Use bleach for rich text.
11. LATER --> input the same --> output check for HTML, JS, XML (June 13 pg2)
12. X Google Safe Browsing POST Lookup
13. LATER --> Use Google Safe Browsing Local (June 14)
14. add decorators for data and business layers
15. read about presentation layer
16. Complete initial presentation layer and CSS for basic item
17. Authentication/login
18. File upload stuff
19. Write about page for each vulnerability
20. Access Control
21. Input Validation

Calendar

Reminder: Put in screenshots

CEF logging

• • create 1 event like log everytime there is a log-in

Week	Category	Items	Done
1. 6/6 - 6/10	Setup Cross Domain Controls Cookie Protection	Get Django site set up with database x-frame-options HTTPOnly	Done Done. Edit: 0 To writeup
2. 6/13 - 6/17	x Richtext with bleach -> Finish Check Cert (If have time) Set up MITM to verify check cert works.	Input Validation HTTPS Validation	a
3. 6/20 - 6/24	SQL Injection Only use parametrization, not escaping (it's too weak and inconsistent) No false demo (for safety reasons) Demo of them typing in, and spitting out the results, be careful to have html entity encoding (done automatically in django, i.e. {{ userdata }} DON'T DO {{ userdata|safe }} ) write up / buttons / css everything so far make wiki more readable watch OWASP videos	Input Validation Cross Domain Controls (before) Cookie Protection (before)	a
4. 6/27 - 7/1	Authentication - bcrypt / adaptive captcha Enable default playdoh authentication (remember to switch to bcrypt(use default settings) + nonce (define it in config file!!) ) Set up pages to require auth and other pages that don't require auth (decorator design principle in Django "&" above method) ... login page and logout link (destroy session ID, first check if it's default) client: cookie expire old one, blank it out server: invalidate to prevent replay attacks --> see if it's one method, should be one method that does all of it Captcha stuff Demo how to use captcha like normal (with a form) Look at ratelimiting by jsocol Target 1 username From 1 IP		a
5. 7/3 - 7/8	Content Security Policy Mozilla's page on CSP W3's page on CSP		a
6. 7/11 - 7/15	Access Control (presentation business, data layers)		a
	*
7. 7/18 - 7/22	File Handling guidelines		a
8. 7/25 - 7/29	Transport Security Have strict transport security header stuff Read Michael's blog about it click around burp should show no HTTP anytime		a

Links References

MozSecureWorld_FAQ

https://wiki.mozilla.org/WebAppSec/Secure_Coding_Guidelines