Web application security in Python

Python developers working on Web applications

• Getting familiar with essential cyber security concepts
• Understanding Web application security issues
• Detailed analysis of the OWASP Top Ten elements
• Putting Web application security in the context of Python
• Going beyond the low hanging fruits
• Managing vulnerabilities in third party components
• Identify vulnerabilities and their consequences
• Learn the security best practices in Python
• Input validation approaches and principles

General Python and Web development

Day 1:

• Cyber security basics
  • What is security?
  • Threat and risk
  • Cyber security threat types
  • Consequences of insecure software
• The OWASP Top Ten
  • The OWASP Top 10
  • A1 – Injection
    • Injection principles
    • Injection attacks
    • SQL injection
      • SQL injection basics
      • Lab – SQL injection
      • Attack techniques
      • Content-based blind SQL injection
      • Time-based blind SQL injection
    • SQL injection best practices
      • Input validation
      • Parameterized queries
      • Lab – SQL injection best practices
      • Case study – Hacking Fortnite accounts
    • Code injection
      • Code injection via input()
      • OS command injection
        • Lab – Command injection
        • OS command injection best practices
        • Avoiding command injection with the right APIs
        • Lab – Command injection best practices
        • Case study – Shellshock
        • Lab – Shellshock
    • Script injection
      • Server-side template injection (SSTI)
      • Lab – Template injection
  • A2 – Broken Authentication
    • Authentication
      • Authentication basics
      • Multi-factor authentication
      • Case study – PayPal 2FA bypass
    • Password management
      • Inbound password management
        • Storing account passwords
        • Password in transit
        • Lab – Is just hashing passwords enough?
        • Dictionary attacks and brute forcing
        • Salting
        • Adaptive hash functions for password storage
        • Password policy
          • NIST authenticator requirements for memorized secrets

Day 2:

The OWASP Top Ten

• A2 – Broken Authentication
  • Password management
    • Outbound password management
      • Hard coded passwords
      • Best practices
      • Lab – Hardcoded password
      • Protecting sensitive information in memory
        • Challenges in protecting memory
  • Session management
    • Session management essentials
    • Why do we protect session IDs – Session hijacking
    • Session fixation
    • Session invalidation
    • Session ID best practices
    • Session handling in Flask
    • Cross-site Request Forgery (CSRF)
      • Lab – Cross-site Request Forgery
      • CSRF best practices
      • CSRF defense in depth
      • Lab – CSRF protection with tokens
    • Cookie security
      • Cookie attributes
• A3 – Sensitive Data Exposure
  • Information exposure
  • Exposure through extracted data and aggregation
  • Case study – Strava data exposure
  • Error and exception handling principles
• A4 – XML External Entities (XXE)
  • DTD and the entities
  • Entity expansion
  • Lab – Billion laughs attack
  • External Entity Attack (XXE)
    • File inclusion with external entities
    • Server-Side Request Forgery with external entities
    • Lab – External entity attack
    • Case study – XXE vulnerability in SAP Store
    • Preventing XXE
    • Lab – Using non-vulnerable parsers
• A5 – Broken Access Control
  • Access control basics
  • Confused deputy
    • Insecure direct object reference (IDOR)
    • Lab – Insecure Direct Object Reference
    • Authorization bypass through user-controlled keys
    • Case study – Authorization bypass on Facebook
    • Lab – Horizontal authorization
  • File upload
    • Unrestricted file upload
    • Good practices
    • Lab – Unrestricted file upload
• A7 – Cross-site Scripting (XSS)
  • Cross-site scripting basics
  • Cross-site scripting types
    • Persistent cross-site scripting
    • Reflected cross-site scripting
    • Client-side (DOM-based) cross-site scripting
  • Lab – Stored XSS
  • Lab – Reflected XSS
  • Case study – XSS in Fortnite accounts
  • XSS protection best practices
    • Protection principles – escaping
    • XSS protection APIs in Python
    • XSS protection in Jinja2
    • Lab – XSS fix / stored
    • Lab – XSS fix / reflected
    • Additional protection layers
• A8 – Insecure Deserialization
  • Serialization and deserialization challenges
  • Integrity – deserializing untrusted streams
  • Deserialization with pickle
  • Lab – Deserializing with Pickle
  • PyYAML deserialization challenges
  • Integrity – deserialization best practices

Day 3:

• The OWASP Top Ten
  • A9 – Using Components with Known Vulnerabilities
    • Using vulnerable components
    • Untrusted functionality import
    • Importing JavaScript
    • Lab – Importing JavaScript
    • Case study – The British Airways data breach
    • Vulnerability management
      • Patch management
      • Vulnerability databases
  • Web application security beyond the Top Ten
    • Client-side security
    • Frame sandboxing
      • Cross-Frame Scripting (XFS) attack
      • Lab – Clickjacking
      • Clickjacking beyond hijacking a click
      • Clickjacking protection best practices
      • Lab – Using CSP to prevent clickjacking
• API security
  • Input validation
    • Input validation principles
      • Blacklists and whitelists
      • Data validation techniques
      • Lab – Input validation
      • What to validate – the attack surface
      • Where to validate – defense in depth
      • When to validate – validation vs transformations
      • Output sanitization
      • Encoding challenges
      • Unicode challenges
      • Lab – Encoding challenges
      • Validation with regex
      • Regular expression denial of service (ReDoS)
      • Lab – ReDoS in Python
      • Dealing with ReDoS
    • Files and streams
      • Path traversal
      • Lab – Path traversal
      • Path traversal-related examples
      • Additional challenges in Windows
      • Virtual resources
      • Path traversal best practices
      • Lab – Path canonicalization
    • Unsafe native code
      • Native code dependence
      • Lab – Unsafe native code
      • Best practices for dealing with native code
• JSON security
  • Dangers of JSONP
  • JSON/JavaScript hijacking
  • Best practices
  • Case study – ReactJS vulnerability in HackerOne
• Wrap up
  • Secure coding principles
    • Principles of robust programming by Matt Bishop
    • Secure design principles of Saltzer and Schröder
  • And now what?
    • Software security sources and further reading
    • Python resources

4 days 10-16 Finnish time