Skip to content

Commit 0aff1cb

Browse files
zachroofseczachroofsec
committed
Updating for ep12
1 parent 92b9690 commit 0aff1cb

1 file changed

Lines changed: 1 addition & 240 deletions

File tree

‎ep12-clickjacking/readme.org‎

Lines changed: 1 addition & 240 deletions
Original file line numberDiff line numberDiff line change
@@ -42,115 +42,7 @@ injection-fundamentals-4
4242
:header-args: :tangle (src_path :tutorial 'injection-fundamentals-4) :mkdirp yes :noweb yes :exports code :src_dir (src_parse :tutorial 'injection-fundamentals-4) :filename (src_path :tutorial 'injection-fundamentals-4)
4343
:CUSTOM_ID: h-CF80E32A-A437-49F9-B392-7CDA7A51D79A
4444
:END:
45-
** Metadata :noexport:
46-
:PROPERTIES:
47-
:CUSTOM_ID: h-DD1FE88E-6C85-4324-B0F8-B07A67161A6C
48-
:END:
49-
** Config Files :noexport:
50-
:PROPERTIES:
51-
:header-args: :tangle (config_path :tutorial 'injection-fundamentals-4) :mkdirp yes :noweb yes :exports no :src_dir (src_parse :tutorial 'injection-fundamentals-4)
52-
:CUSTOM_ID: h-7533202F-D026-4986-85B6-D81AF4F47277
53-
:END:
54-
#+NAME:package.json
55-
#+BEGIN_SRC json
56-
{
57-
"name": "securingthestack",
58-
"version": "1.0.0",
59-
"description": "Interactive Examples",
60-
"main": "",
61-
"scripts": {
62-
"test": "echo \"Error: no test specified\" && exit 1"
63-
},
64-
"repository": {
65-
"type": "git",
66-
"url": "git+https://github.com/SecuringTheStack/tutorials.git"
67-
},
68-
"author": "Zach Roof",
69-
"license": "SEE LICENSE IN license.org",
70-
"bugs": {
71-
"url": "https://github.com/SecuringTheStack/tutorials/issues"
72-
},
73-
"homepage": "https://github.com/SecuringTheStack/tutorials/blob/master",
74-
"devDependencies": {
75-
"nodemon": "^1.12.7"
76-
}
77-
}
78-
#+END_SRC
79-
80-
#+NAME:node-dockerfile
81-
#+BEGIN_SRC dockerfile
82-
FROM node
83-
# For simplicity, we're keeping this Dockerfile very small.
84-
# From a security perspective, this Dockerfile shouldn't
85-
# be considered "production ready".
86-
ARG NODE_PATH=/home/node/app/
87-
COPY package.json $NODE_PATH
88-
COPY src $NODE_PATH/src
89-
COPY node-dockerfile-wrapper.sh $NODE_PATH
90-
91-
RUN apt-get update && apt-get install -y \
92-
&& cd $NODE_PATH \
93-
&& chown node:node node-dockerfile-wrapper.sh \
94-
&& chmod +x node-dockerfile-wrapper.sh \
95-
&& npm install
96-
97-
CMD ["bash"]
98-
#+END_SRC
99-
100-
#+NAME:node-dockerfile-wrapper.sh
101-
#+BEGIN_SRC sh
102-
#!/bin/bash
103-
EX_NUM=$1
104-
EXEC_MODE=$2
105-
ENV_SECRET="This is a secret"
106-
107-
if [[ -z "${EX_NUM// }" ]]; then
108-
echo "Please set EX_NUM"
109-
echo "Ex: EX_NUM=1 docker-compose up"
110-
echo "Additional help: https://sts.tools/setup"
111-
exit 1
112-
fi
113-
114-
# Start nodemon
115-
npx "${EXEC_MODE:-nodemon}" "src/${EX_NUM}/${FILE:-app.js}"
116-
status=$?
117-
if [ $status -ne 0 ]; then
118-
echo "Failed to start Node: $status"
119-
exit $status
120-
fi
121-
#+END_SRC
122-
123-
#+NAME:docker-compose.yml
124-
#+BEGIN_SRC yaml
125-
version: "3"
126-
# For simplicity, we're keeping this file very small.
127-
# From a security perspective, this docker compose shouldn't
128-
# be considered "production ready".
129-
services:
130-
node:
131-
build:
132-
context: .
133-
dockerfile: node-dockerfile
134-
image: "securingthestack/<<CURRENT_TUTORIAL>>"
135-
user: "node"
136-
working_dir: /home/node/app
137-
environment:
138-
- NODE_ENV=dev
139-
- NPM_CONFIG_LOGLEVEL=info
140-
volumes:
141-
- ./src:/home/node/app/src
142-
command: ["./node-dockerfile-wrapper.sh", "$EX_NUM", "$EXEC_MODE"]
143-
#+END_SRC
144-
** Course Notes :noexport:
145-
:PROPERTIES:
146-
:CUSTOM_ID: h-6DA5D248-359E-4D95-B72D-C5D3364F0D05
147-
:END:
148-
var ps = execFile('ps', ['aux']);
149-
ps.stdout.on('data', function(data) {
150-
// Add in debugging output to help with exercise
151-
console.log(data);
152-
});
153-
** Table Of Contents :toc_3_gh:injection:noexport:
45+
** Table Of Contents :toc_3_gh:injection:
15446
:PROPERTIES:
15547
:CUSTOM_ID: h-E2FCBD6C-BE30-4131-A6AE-844E0BE39093
15648
:END:
@@ -174,137 +66,6 @@ injection-fundamentals-4
17466
- [[#additional-resources][Additional Resources]]
17567
- [[#error-log][Error Log]]
17668

177-
** Help Me/Important StS Links :noexport:
178-
:PROPERTIES:
179-
:CUSTOM_ID: h-DBE0041D-8E72-4A59-99CB-467436C5F079
180-
:END:
181-
- Video
182-
- Prerequisites
183-
- Env Setup
184-
- Ask A Question In Forums
185-
- Chat Support
186-
- Overarching Playlist
187-
188-
** TODO StS Tutorial Description Links :noexport:
189-
:PROPERTIES:
190-
:CUSTOM_ID: h-50911AC2-02C5-4A1D-9588-BFB95BA17C45
191-
:END:
192-
+ Course Resources/Notes: https://github.com/SecuringTheStack/tutorials/tree/master/injection-fundamentals-4
193-
+ Environment Setup/Error Reporting: https://sts.tools/setup
194-
+ Prerequisites: https://github.com/SecuringTheStack/tutorials/blob/master/injection-fundamentals-4/readme.org#knowledge-dependency-tree
195-
+ Injection Playlist: https://securingthestack.com/p/injection-playlist
196-
+ Additional Resources: https://github.com/SecuringTheStack/tutorials/blob/master/injection-fundamentals-4/readme.org#additional-resources
197-
+ Ask A Question: https://sts.tools/injection-question
198-
199-
** Cross-Site Scripting (XSS) NOTES and MasterClass/SyntaxCon flow :noexport:
200-
:PROPERTIES:
201-
:CUSTOM_ID: h-E9CAADC9-3E6A-4CA0-A78C-E5DBE5EAE02B
202-
:END:
203-
+ Depends On
204-
+ SOP Lecture
205-
+ Make modular enough to be included within the Injection Masterclass
206-
+ Define injection after you show xss
207-
+ Overall flow of lectures
208-
1. What is XSS?
209-
1. NEED a generic INTRO of what XSS is
210-
2. DOM XSS
211-
3. EXTRA: In-depth exercise
212-
4. Reflected XSS
213-
5. EXTRA: In-depth exercise
214-
1. From juice shop
215-
6. What is BeeF?
216-
7. EXTRA: Exploit with Redis
217-
8. After Syntax
218-
1. Create ~XSS Mitigations~ module
219-
220-
** Overall Scope :noexport:
221-
:PROPERTIES:
222-
:CUSTOM_ID: h-A0015150-C4F0-4CAE-A649-63BE52B09A34
223-
:END:
224-
+ Full-stack Injection: Exploiting Our Security Assumptions
225-
+ We often forget that there's unknown- unknowns
226-
+ XSS
227-
+ "Client-side validation is silly. We only do it on the server"!
228-
+ DOM XSS
229-
+ BF example. Payload pulled into localstorage
230-
+ Dev flawed assumption
231-
+ Devs/DevOps miscommunications
232-
+ "If we firewall our internal services, we are safe from external connectivity
233-
+ DevOps flawed assumption
234-
+ "We are safe by segmenting our databases"
235-
+ elasticsearch restore
236-
+ but are we segmenting your backups?
237-
+ put backups in s3 and restore another clusters backups
238-
+ devops flawed assumption
239-
+ All flawed assumptions equal a complete compromise
240-
+ Allow CORS from localhost
241-
+ https://github.com/spalger/elasticsearch-angular-example/issues/3
242-
+ https://www.elastic.co/guide/en/elasticsearch/reference/6.x/cluster.name.html
243-
+ Default cluster name `elasticsearch`
244-
+ Flow
245-
+ Devs enable CORS for local dev envs
246-
+ Common with elasticsearch/kibana within ELK stack
247-
+ Could be other envs/overall dev envs
248-
+ Script
249-
+ Cross-Origin Scanner to find vulnerable 9200 instances
250-
+ Check on localhost first, then do LANS including VPC default CIDRs
251-
+ Find Any ES clusters that have CORS protection
252-
+ If found
253-
+ Inject CORS disabled instance
254-
+ Join cluster of other instance
255-
+ by default
256-
257-
** Talk Summary :noexport:
258-
:PROPERTIES:
259-
:CUSTOM_ID: h-D9EDAA95-63AC-4B1E-9A5D-A27B41998DF1
260-
:END:
261-
+ Talk Title: "Exploiting Local Dev Environments"
262-
263-
+ When developing locally, we often loosen the security of our local environment
264-
to make testing/debugging easier. However, what if others on the public
265-
internet could easily access this environment? Further, what if your local
266-
environment could be leveraged to steal production data?
267-
268-
+ In this talk, we'll sit at the security "intersection" of Developers and
269-
DevOps Engineers, and witness how local dev environments can interact with our infrastructure in unintended ways.
270-
271-
+ Additionally, we'll explore this topic through a realistic example which includes the following:
272-
1. BeEF (Browser Exploitation Framework)
273-
2. Cross-Site Scripting (XSS)
274-
3. Same Origin Policy (SOP)
275-
4. Cross-Origin Resource Sharing (CORS)
276-
5. Elasticsearch
277-
278-
** Running Locally :noexport:
279-
:PROPERTIES:
280-
:CUSTOM_ID: h-E21B7A9D-3C3C-40D1-9F1C-E1659ACE6C55
281-
:END:
282-
+ Update ~/etc/hosts~
283-
+ ~127.0.0.1 evil.example.com~
284-
+ ~127.0.0.1 victim.example.com~
285-
+ ~127.0.0.1 prod.example.com~
286-
+ BeEf Server Credentials
287-
+ Username/Password: ~beefy~
288-
+ Running
289-
+ ~git clone https://github.com/zachroof/community.git~
290-
+ cd $REPO/syntaxcon
291-
+ ~docker-compose up~
292-
+ Be careful, this runs an intentionally vulnerable web application
293-
294-
** Who Am I? :noexport:
295-
:PROPERTIES:
296-
:CUSTOM_ID: h-64F7C04A-3B25-4AFD-88AB-D2201D356BA5
297-
:END:
298-
#+ATTR_REVEAL: :frag (default)
299-
+ Developer Life
300-
+ Froliced through Frontend/Backend Code
301-
+ InfoSec Life
302-
+ AppSec
303-
+ DevOps/Security Life
304-
+ Current role at Snag
305-
+ Help build internal DevOps tooling
306-
+ Security infrastructure
307-
+ Blah Blah Blah.. Dude, what does this have to do with this talk?!
30869
** Talk Scope
30970
:PROPERTIES:
31071
:CUSTOM_ID: h-853FB39F-D352-437D-BFA7-1B19A6A40BC7

0 commit comments

Comments
 (0)