diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json new file mode 100644 index 0000000..8d43c5f --- /dev/null +++ b/.devcontainer/devcontainer.json @@ -0,0 +1,55 @@ +{ + "name": "Python Flask Development Container", + "image": "mcr.microsoft.com/devcontainers/universal:2", + "hostRequirements": { + "cpus": 4 + }, + "waitFor": "onCreateCommand", + "updateContentCommand": "pip install -r requirements.txt", + "postCreateCommand": "", + "postAttachCommand": {}, + "portsAttributes": { + "5000": { + "label": "Application", + "onAutoForward": "openPreview" + } + }, + "customizations": { + "vscode": { + "settings": { + "files.autoSave": "onFocusChange", + "editor.formatOnPaste": true, + "editor.formatOnSave": true, + "editor.defaultFormatter": "esbenp.prettier-vscode", + "[python]": { + "editor.defaultFormatter": "ms-python.black-formatter" + }, + "editor.fontSize": 18, + "terminal.integrated.defaultProfile.windows": "Git Bash", + "window.restoreWindows": "preserve", + "workbench.editorAssociations": { + "*.md": "vscode.markdown.preview.editor" + } + }, + "extensions": [ + "McCarter.start-git-bash", + "alexcvzz.vscode-sqlite", + "medo64.render-crlf", + "ecmel.vscode-html-css", + "ms-vscode.js-debug", + "dbaeumer.vscode-eslint", + "miramac.vscode-exec-node", + "yy0931.vscode-sqlite3-editor", + "oderwat.indent-rainbow", + "ritwickdey.LiveServer", + "tomoki1207.pdf", + "ms-vscode-remote.remote-containers", + "ms-vscode-remote.remote-wsl", + "GitHub.codespaces", + "ms-vscode-remote.remote-wsl", + "ms-azuretools.vscode-docker" + ] + } + }, + "forwardPorts": [5000] +} diff --git a/.student_resources/CSRF/README.md b/.student_resources/CSRF/README.md new file mode 100644 index 0000000..95c63bd --- /dev/null +++ b/.student_resources/CSRF/README.md @@ -0,0 +1,45 @@ +# Cross-Site Request Forgery (CSRF) + +Cross-Site Request Forgery (CSRF) is an attack that forces an end user to execute unwanted actions on a web application in which they’re currently authenticated. With a little help of social engineering (such as sending a link via email or chat), an attacker may trick the users of a web application into executing actions of the attacker’s choosing. If the victim is a normal user, a successful CSRF attack can force the user to perform state-changing requests like transferring funds, changing their email address, and so forth. If the victim is an administrative account, CSRF can compromise the entire web application. A CSRF attack generally requires an internal threat actor to provide insight into the internal workings of the API or system, which makes it one of the more challenging cyber vulnerabilities to mitigate. + +## How to secure against this attack + +Implement [Flask WTForms](https://flask-wtf.readthedocs.io/en/1.2.x/), which generates and requires a unique secret key by default. +- Implement business knowledge access levels. +- End-user education. +- HTTPS encryption. +- End-user education. +- Implement a CORS Content Security Policy (CSP). +- Understand how the attack can be executed in the specific context of the application and user, then code review with specific scenarios in mind. +- Implement three-factor authentication (3FA) for administrative operations. +- Separate production and development environments. +- White-list firewall policies + +## Example Attack Code + +> [!NOTE] +> Due to the specific, targeted and complex nature of a CSRF it is difficult to demonstrate this attack beyond the below code snippets practically. When reading them, you should assume that the code is executed from a side attack email or document (usually a \*.PDF or macro-enabled \*.xlsx) where the user has already authenticated to the API or system and the code will be validated `True` by the API or system allowing the malicious code to execute successfully. + +```html + View my Pictures! +``` + +``` html + +
+``` + +```html + +``` diff --git a/.student_resources/SQL_Injection/README.md b/.student_resources/SQL_Injection/README.md new file mode 100644 index 0000000..b0a28a5 --- /dev/null +++ b/.student_resources/SQL_Injection/README.md @@ -0,0 +1,17 @@ +# SQL Injection + +A SQL injection attack consists of inserting or " injecting " a SQL query via the input data from the client to the application. A successful SQL injection exploit can read sensitive data from the database and modify database data (Insert/Update/Delete). SQL injection attacks are a type of injection attack in which SQL commands are injected into data-plane input to affect the execution of predefined SQL commands. + +# Examples of SQL injections +[W3Schools has a range of SQL Injection examples](https://www.w3schools.com/sql/sql_injection.asp) + +## How to secure against this attack + +- Code review +- Avoid languages like PHP +- Use API with built-in security as the interface to the SQL database +- Defensive data handling +- Require authentication before accepting any text form data +- Never construct queries with concatenating and binary comparison +- Use query parameters ie `cur.execute('SELECT * FROM users WHERE username == ? AND password == ?', (username, password))`. +- Salt database table names with 5-character random string diff --git a/.student_resources/XFS/README.md b/.student_resources/XFS/README.md new file mode 100644 index 0000000..46d4456 --- /dev/null +++ b/.student_resources/XFS/README.md @@ -0,0 +1,23 @@ +# Cross Frame Scripting + +Cross-frame scripting (XFS) is an attack that combines malicious JavaScript with an iframe that loads a legitimate page in an effort to steal data from an unsuspecting user. This attack is usually only successful when combined with social engineering. An example would consist of an attacker convincing the user to navigate to a web page the attacker controls. The attacker’s page then loads malicious JavaScript and an HTML iframe pointing to a legitimate site. Once the user enters credentials into the legitimate site within the iframe, the malicious JavaScript steals the keystrokes. + +[This example](index.html) demonstrates how easy it is to spoof a webpage, in this case, the Unsecure PWA. + +This attack is particularly effective on mobile devices, as the browser hides most of the URL, and the spoofing page only requires some HTML and some inline JS. That is why XFS coupled with SMS scams are some of the most successful. + +> [!NOTE] +> Make sure the Unsecure PWA is being served at [http://127.0.0.1](http://127.0.0.1) before opening the demonstration page. +> `python main.py` + +As a more sophisticated attack, the threat actors would: + +1. Serve both sites through a proxy circumventing any CORS CSP policy +2. Have a back-to-base script that intercepts and transmits input data (username, password, credit card, etc) without the user knowing. +3. Have a threat actor listening for inputs and interacting/handling the victim, which is how 2FA is often bypassed. + +How to secure against this attack + +1. End user education. +2. Monitor HTTP logs for unusually repetitive GET calls. +3. Implement a Content Security Policy (CSP) preventing `