Pizza Roulette - OWASP SNI 2 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048...

39
Pizza Roulette Catherine McIlvride and Fiona Sasse

Transcript of Pizza Roulette - OWASP SNI 2 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048...

Page 1: Pizza Roulette - OWASP SNI 2 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048

Pizza RouletteCatherine McIlvride and Fiona Sasse

Page 2: Pizza Roulette - OWASP SNI 2 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048
Page 3: Pizza Roulette - OWASP SNI 2 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048
Page 4: Pizza Roulette - OWASP SNI 2 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048

Starting Point

Page 5: Pizza Roulette - OWASP SNI 2 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048
Page 6: Pizza Roulette - OWASP SNI 2 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048
Page 7: Pizza Roulette - OWASP SNI 2 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048
Page 8: Pizza Roulette - OWASP SNI 2 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048
Page 9: Pizza Roulette - OWASP SNI 2 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048
Page 10: Pizza Roulette - OWASP SNI 2 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048
Page 11: Pizza Roulette - OWASP SNI 2 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048

Pretending to know

what we are doing

Page 12: Pizza Roulette - OWASP SNI 2 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048

Just a little

frustrated

Page 13: Pizza Roulette - OWASP SNI 2 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048

We tried!!!

Page 14: Pizza Roulette - OWASP SNI 2 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048

Risk Profiles

Page 15: Pizza Roulette - OWASP SNI 2 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048
Page 16: Pizza Roulette - OWASP SNI 2 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048
Page 17: Pizza Roulette - OWASP SNI 2 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048
Page 18: Pizza Roulette - OWASP SNI 2 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048

The following is a

depiction of the events

that occurred on the

night of 4th October

2017

Page 19: Pizza Roulette - OWASP SNI 2 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048
Page 20: Pizza Roulette - OWASP SNI 2 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048
Page 21: Pizza Roulette - OWASP SNI 2 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048

OWASP Top 10A1 Injection

A2 Broken Authentication and Session Management

A3 Sensitive Data Exposure

A4 XML External Entity (XXE)

A5 Broken Access Control

A6 Security Misconfiguration

A7 Cross Site Scripting

A8 Insecure Deserialization

A9 Using Components with Known Vulnerabilities

A10 Insufficient Logging & Monitoring

Page 22: Pizza Roulette - OWASP SNI 2 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048
Page 23: Pizza Roulette - OWASP SNI 2 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048

A3 Sensitive Data Exposure

Page 24: Pizza Roulette - OWASP SNI 2 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048

A2 Broken Authentication and Session Management

A10 Insufficient Logging & Monitoring

Page 25: Pizza Roulette - OWASP SNI 2 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048

A7 Cross Site Scripting

Page 26: Pizza Roulette - OWASP SNI 2 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048

Using order numbers to bring up other people's details

A5 Broken Access Control

Page 27: Pizza Roulette - OWASP SNI 2 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048

OWASP Top 10A1 Injection

A2 Broken Authentication and Session Management

A3 Sensitive Data Exposure

A4 XML External Entity (XXE)

A5 Broken Access Control

A6 Security Misconfiguration

A7 Cross Site Scripting

A8 Insecure Deserialization

A9 Using Components with Known Vulnerabilities

A10 Insufficient Logging & Monitoring

Page 28: Pizza Roulette - OWASP SNI 2 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048

Things we learnt!!

Page 29: Pizza Roulette - OWASP SNI 2 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048

Keep It Simple Stupid

KISS

Page 30: Pizza Roulette - OWASP SNI 2 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048

Time!!!

Page 31: Pizza Roulette - OWASP SNI 2 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048

Mentorship is a must

Page 32: Pizza Roulette - OWASP SNI 2 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048

So what now…..

Page 33: Pizza Roulette - OWASP SNI 2 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048
Page 34: Pizza Roulette - OWASP SNI 2 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048
Page 35: Pizza Roulette - OWASP SNI 2 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048
Page 36: Pizza Roulette - OWASP SNI 2 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048
Page 37: Pizza Roulette - OWASP SNI 2 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048
Page 38: Pizza Roulette - OWASP SNI 2 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048

Massive Thanks To Kevin!

Page 39: Pizza Roulette - OWASP SNI 2 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048 RSA 2048