State-of-the art teaching material of the OWASP Top 10

Nowadays, web security has become something indispensable when working with the Internet, whether to protect business databases, establish communications, etc. With the aim of creating teaching material, I have created some laboratory sessions and documented several issues related to the ?OWASP (Open Web Application Security Project) top 10 vulnerabilities?. As a method, a systematic review o information in a large number of reliable Internet resources has been carried out, and several laboratory exercises has been created. As a result a large amount of teaching material including some exercises has been created about different themes, mianly: JWT (JSON Web Tokens), JKUs (JWK Set URL) and JWKs (JSON Web Keys); Cookies, XSS Attacks (Cross Site Scripting). As a conclusion, this project collects information about different topics related to web security, and the exploitation of some vulnerabilities. With all this material, students can get a solid base on this topics and see the performance of some of this attacks.En la actualidad, la seguridad web se ha convertido en algo indispensable a la hora de trabajar con Internet, ya sea para proteger bases de datos empresariales, establecer comunicaciones, etc. Con el objetivo de crear material docente, he creado algunas sesiones de laboratorio y documentado varios problemas relacionados con el 'Top 10 de vulnerabilidades de OWASP'. Como método se ha llevado a cabo una revisión sistemática de la información en un gran número de recursos fiables de Internet y se han creado varios ejercicios de laboratorio. Como resultado se ha creado una gran cantidad de material didáctico que incluye algunos ejercicios sobre diferentes temas, principalmente: JWT (JSON Web Tokens), JKUs (JWK Set URL) y JWKs (JSON Web Keys); Cookies, Ataques XSS (Cross Site Scripting). Como conclusión, este proyecto recopila información sobre diferentes temas relacionados con la seguridad web y la explotación de algunas vulnerabilidades. Con todo este material, los estudiantes pueden obtener una base sólida sobre estos temas y ver el rendimiento de algunos de estos ataques.En l'actualitat, la seguretat web s'ha convertit en una cosa indispensable per treballar amb Internet, ja sigui per a protegir les bases de dades empresarials, establir comunicacions, etc. Amb l'objectiu de crear material docent, he creat algunes sessions de laboratori i documentat diversos temes relacionats amb «OWASP (Open Web Application Security Project) top 10 vulnerabilitats». Com a mètode, s'ha dut a terme una revisió sistemàtica de la informació en un gran nombre de recursos d'Internet fiables, i s'han creat diversos exercicis de laboratori. Com a resultat, s'ha creat una gran quantitat de material docent que inclou alguns exercicis sobre diferents temes, principalment: JWT (JSON Web Tokens), JKUs (JWK Set URL) i JWKs (JSON Web Keys); Cookies, atacs XSS (Cross Site Scripting). Com a conclusió, aquest projecte recopila informació sobre diferents temes relacionats amb la seguretat web i l'explotació d'algunes vulnerabilitats. Amb tot aquest material, els estudiants poden obtenir una base sòlida en aquests temes i veure com es portem a terme alguns d'aquests atacs

Towards Understanding First-Party Cookie Tracking in the Field

Third-party tracking is a common and broadly used technique on the Web. Different defense mechanisms have emerged to counter these practices (e. g. browser vendors that ban all third-party cookies). However, these countermeasures only target third-party trackers and ignore the first party because the narrative is that such monitoring is mostly used to improve the utilized service (e.g. analytical services). In this paper, we present a large-scale measurement study that analyzes tracking performed by the first party but utilized by a third party to circumvent standard tracking preventing techniques. We visit the top 15,000 websites to analyze first-party cookies used to track users and a technique called “DNS CNAME cloaking”, which can be used by a third party to place first-party cookies. Using this data, we show that 76% of sites effectively utilize such tracking techniques. In a long-running analysis, we show that the usage of such cookies increased by more than 50% over 2021

Dr Cookie and Mr Token - Web session implementations and how to live with them

The implementation of web sessions is a somewhat anarchic and largely unstructured process. Our goal with the present paper is to provide a disciplined perspective of which are the relative strengths and weaknesses of the most common techniques to implement web sessions, with a particular focus on their security. We clarify common misconceptions in the recent "cookies vs tokens" debate and we propose a more useful classification of web session implementations, based on where session information and session credentials are stored. We then propose a new implementation technique for web sessions which combines the strengths of existing web technologies to overcome their weaknesses and we successfully deploy our solution on top of WordPress and the Auth0 library for web authentication to demonstrate its feasibility

ASTrack: Automatic detection and removal of web tracking code with minimal functionality loss

Recent advances in web technologies make it more difficult than ever to detect and block web tracking systems. In this work, we propose ASTrack, a novel approach to web tracking detection and removal. ASTrack uses an abstraction of the code structure based on Abstract Syntax Trees to selectively identify web tracking functionality shared across multiple web services. This new methodology allows us to: (i) effectively detect web tracking code even when using evasion techniques (e.g., obfuscation, minification, or webpackaging); and (ii) safely remove those portions of code related to tracking purposes without affecting the legitimate functionality of the website. Our evaluation with the top 10k most popular Internet domains shows that ASTrack can detect web tracking with high precision (98%), while discovering about 50k tracking code pieces and more than 3,400 new tracking URLs not previously recognized by most popular privacy-preserving tools (e.g., uBlock Origin). Moreover, ASTrack achieved a 36% reduction in functionality loss in comparison with the filter lists, one of the safest options available. Using a novel methodology that combines computer vision and manual inspection, we estimate that full functionality is preserved in more than 97% of the websites.This publication is part of the Spanish I+D+i project TRAINER-A (ref. PID2020-118011GB-C21), funded by MCIN/ AEI/10.13039/501100011033. This work is also par-tially supported by the NII internship program.Peer ReviewedPostprint (author's final draft

Beyond the Front Page: Measuring Third Party Dynamics in the Field

In the modern Web, service providers often rely heavily on third parties to run their services. For example, they make use of ad networks to finance their services, externally hosted libraries to develop features quickly, and analytics providers to gain insights into visitor behavior. For security and privacy, website owners need to be aware of the content they provide their users. However, in reality, they often do not know which third parties are embedded, for example, when these third parties request additional content as it is common in real-time ad auctions. In this paper, we present a large-scale measurement study to analyze the magnitude of these new challenges. To better reflect the connectedness of third parties, we measured their relations in a model we call third party trees, which reflects an approximation of the loading dependencies of all third parties embedded into a given website. Using this concept, we show that including a single third party can lead to subsequent requests from up to eight additional services. Furthermore, our findings indicate that the third parties embedded on a page load are not always deterministic, as 50% of the branches in the third party trees change between repeated visits. In addition, we found that 93% of the analyzed websites embedded third parties that are located in regions that might not be in line with the current legal framework. Our study also replicates previous work that mostly focused on landing pages of websites. We show that this method is only able to measure a lower bound as subsites show a significant increase of privacy-invasive techniques. For example, our results show an increase of used cookies by about 36% when crawling websites more deeply

The process of building an admin dashboard user interface

MariaDB Corporation Ab is a global software vendor that develops and contributes to the well-known open source MySQL database which was forked and managed by the MariaDB Foundation. The company is specializing in developing solutions arounds MariaDB server. MaxScale, a database proxy open source project which is one of the core components of MariaDB Platform helping to extend the availability, scalability and security of MariaDB Server. MaxScale provides a command line administrative client tool called maxctrl that internally uses REST API to configure MaxScale at runtime. This thesis is established due to the need of developing an alternative solution to maxctrl which is a web browser application that operates as an admin dashboard user interface. The application should allow to configure MaxScale in a visually appealing, intuitive and user-friendly way. It will be built by using Vue.js framework along with its support plugins and libraries such as Vue Router, Vuex, Vuetify and so on. Though this is a graphical user interface product-oriented thesis, it will not include all development processes in terms of user interface such as prototype designs, user experience designs and user story due to confidential information of the company. Therefore, the primary objectives of this thesis can be divided into three categories comprise of setting up developer’s working environment, improving MaxScale REST API for using in web application in terms of MaxScale user authentication, implementing the authentication user interface page

Reining in the Web's Inconsistencies with Site Policy

Over the years, browsers have adopted an ever-increasing number of client-enforced security policies deployed through HTTP headers. Such mechanisms are fundamental for web application security, and usually deployed on a per-page basis. This, however, enables inconsistencies, as different pages within the same security boundaries (in form of origins or sites) can express conflicting security requirements. In this paper, we formalize inconsistencies for cookie security attributes, CSP, and HSTS, and then quantify the magnitude and impact of inconsistencies at scale by crawling 15,000 popular sites. We show that numerous sites endanger their own security by omission or misconfiguration of the aforementioned mechanisms, which lead to unnecessary exposure to XSS, cookie theft, and HSTS deactivation. We then use our data to analyse to which extent the recent Origin Policy proposal can fix the problem of inconsistencies. Unfortunately, we conclude that the current Origin Policy design suffers from major shortcomings which limit its practical applicability to address security inconsistencies while catering to the need of real-world sites. Based on these insights, we propose Site Policy, designed to overcome Origin Policy's shortcomings and make any insecurity explicit. We make a prototype implementation of Site Policy publicly available, along with a supporting toolchain for initial policy generation, security analysis, and test deployment

Session Armor: Protection Against Session Hijacking using Per-Request Authentication

Modern life increasingly relies upon web applications to provide critical services and infrastructure. Activities of banking, shopping, socializing, entertainment, and even medical record keeping are now primarily conducted using the Internet as a medium and HTTP as a protocol. A critical requirement of these tools is the mechanism by which they authenticate users and prevent transaction replay. Despite more than 20 years of widespread deployment, the de-facto technique for accomplishing these goals is the use of a static session bearer token to authenticate all requests for the lifetime of a user session. In addition, the use of any method to prevent request replay is not in common practice. This thesis presents Session Armor, a protocol which builds upon existing techniques to provide cryptographically-strong per-request authentication with both time-based and optional absolute replay prevention. Session Armor is designed to perform well and to be easily deployed by web application developers. It acts as a layer on top of existing session tokens, so as not to require modification of application logic. In addition to Session Armor, two additional tools are presented, JackHammer, a cross-browser extension that allows developers to quickly discover session hijacking vulnerabilities in their web applications, and SessionJack, a tool for analyzing the security properties of session tokens found on the web. A formal specification of the Session Armor protocol is provided. An implementation of the protocol is included as a Python Django middleware and a Chrome browser extension. Performance data is provided with a comparison to previous methods. A formal validation of secrecy and correspondence properties is presented in the Dolev-Yao model.M.S., Computer Engineering -- Drexel University, 201