Trainings

2 Day Course, lecture and exercises

Date: 17-18 April 2019
Any registration after the 1st March will subject to a 20% fee.

Overview:

With the increased, and eventually complete, reliance on APIs in modern systems, as well as the quick decline of the monolithic architecture for systems and applications; it is becoming increasingly necessary to tackle and understand the various security issues, weaknesses, and gotchas in API designs. Many products, platforms, and technologies now expose an API or two (or many more), sometimes in a decentralized and autonomous fashion. Where does security come in this new world of rapid build-up and teardown of microservices and serverless (functionality as a Service – Faas) architectures? How do web and mobile apps securely communicate with APIs through devices they can’t trust, network paths they cannot predict, and on infrastructure, they don’t own? All of that and many more will be studied, tried, tested and answered in this fast-paced, a scenario-based hands-on training course. This course will discuss various attacks and countermeasures for security issues typically found in API servers and clients such as authentication, injection attacks, credential handling, cryptography, authorization, caching, secure file and resource management, and many more. This training aims to engage students in the design, analysis, and breakdown of security in clientside and serverside components of modern APIs and application infrastructure while combining both new and old attack vectors and pitfalls. This course doesn’t reinvent the wheel in security, but it will help you not to reinvent the old bugs.

Who Should Attend:

• Software developers, security engineers, architects, researchers, bug bounty hunters,
  system administrators, students and curious security professionals who would like to
  expand their skills.
• Anyone interested in keeping relevant knowledge and skill in the world of cloud, API and
  app security.

Key Learning Objectives:

• API and microservices security architecture.
• How to create APIs that are easy to use securely and hard to use insecurely.
• What are the techniques and tools to design, test and attack APIs and microservices.
• Understanding the intricate and minute details of authentication and authorization
  frameworks and technologies.
• Learning how to effectively solve the problem of credential storage.
• Attack and defend against injection vulnerabilities such as Template Injection, SQL
  injection, NoSQL injection (MongoDB, GraphQL.. etc),
• Attack and defend against API and serverless oriented vulnerabilities such as
  serialization, JSON injection, pickling, Edge Side Includes, Serverless Event Injection…
  etc.
• Learn AJAX and REST security best practices.
• Know when to use signing, when to use encryption, and when to use both.
• Implement applied, battle-tested secure cryptography.
• Obtain actionable knowledge and experience in using secure tokens, cookies, keys and
  tickets for authentication and authorization.
• Attack insecure implementations of session management, input validation, output
  encoding and loosely coupled components.
• Implement secure communication channels with API consumers such as web browsers
  and mobile apps.
• Mitigate and defend against XSS, CSRF, JSONP and CORS security weaknesses in
  APIs.
• Implement secure web socket channels and defend against Cross-Site WebSocket
  Hijacking.
• Implement and attack multi factor authentication for APIs.
• Learn and understand cache security and what threats and vulnerabilities can arise out of
  insecure caching methods and configurations.
• Handle files securely by allowing only authorized downloads even in segmented
  microservice architectures.

Prerequisite Knowledge:

• Should be familiar with the concepts of Web, Linux, Cloud services, security, and APIs.
• Should have basic programming skills.
• Basic ability to use command line interfaces.
• Scripting experience recommended.
• Familiarity in Python, JavaScript and Go is recommended.

Hardware/Software Requirements:

• Laptop with minimum 6GB RAM and 40GB free hard disk space
• Laptop with USB ports, lab samples, and custom Linux VM will be shared via USB sticks
• VMware Workstation or VMware Fusion (even trial versions can be used).
• Windows Operating system (preferably Windows 7, even Windows 8 and above versions are fine) installed inside the VMware Workstation/Fusion

Note: VMware player or VirtualBox is not suitable for this training.

Agenda:

• Day 1:
  • Introduction to the modern web
  • Differences between modern and conventional web technologies.
  • Microservices and APIs.
  • Cloud-native apps and technologies.
  • Containers and orchestration.
  • Serverless apps.
  • Security in this new world.
  • Setting up local and cloud environments for the class.
  • Security Architecture for APIs
  • Security of API consumers (Web, Mobile, Microservices, other APIs).
  • Types of threats for APIs.
  • Serverside attacks against API implementations (injection attacks, data
    exposure attacks.. etc)
  • 3rd party attacks against APIs (authentication weaknesses, cache attacks.. etc)
  • Clientside attacks against API consumers (Confused deputy attacks, Data exposure, authorization abuse, ID and token hijacking)
  • Attacks against API infrastructures.
  • Designing and implementing defensible APIs and infrastructures.
  • Logging and Monitoring for Serverless.
  • Data and File attacks against APIs and clients
  • Attacking and Securing AWS S3 buckets.
  • Insecure Direct File or Object access (IDOR) attacks.
  • Securing file downloads with AWS Signed URLs and Signed Cookies.
  • Securing file downloads using X-Sendfile and X-Accel-Redirect.
  • Securing file downloads using UUIDs and one-time tokens.
  • 3 rd party threats against file downloads (caching, URL shortners, CDNs)
  • File upload security (path traversal attacks, file inclusion, file type confusion, safe bucket uploads with Presigned URLs…etc)
  • Injection attacks against APIs and clients:
  • SQL and NoSQL injection attacks
  • Template injection attacks
  • NoSQL injection attacks.
  • Object manipulation attacks (Serialization, pickling and eval attacks)
  • GraphQL security.
  • XXE attacks.
  • XSS
  • Serverless Event Injection.
  • Edge Side Include Injection
  • Server Side Request Forgery
  • Cache Security
  • Cache security concerns and configurations in API.
  • Knowing what to cache and what not to cache.
  • Cache attacks: Edge Side Include Injection, Cache poisoning.
  • Secure configurations of caching proxies.
  • Redis and Memcached security.

• HTTP Security
• Same Origin Policy:
• Exceptions to SOP
• JSONP Security.
• HTTP attacks:
• CORS
• What is CORS.
• Types of CORS requests.
• Securing CORS access.
• CSRF
• What is CSRF?
• Attacking and defending against CSRF.
• CSRF attacks on REST APIs.
• CSRF and JWT attacks.
• Using CORS Credentials and Origins checks to protect from CSRF.
• HTTP Security headers:
• CSP
• X-Frame-Options
• XSS Protection
• Key pinning.
• SSL Enforcement headers.
• Web socket security:
• Cross-Site WebSocket Hijacking (CSWSH)
• Web socket origin checks
• Web socket SOP bypass.
• Web socket cryptography.
• Web socket in the local host.
• Web sockets and CSRF attacks.
• Cookie auth vs localstorage (token) auth in web sockets.
• Token Security:
• o Using Tokens for authentication and authorization.
• o JSON Web Tokens (JWT) and JSON Web Signature (JWS) security
• Security weaknesses in stateless and stateful tokens.
• Insecure token invalidation
• Handling stateless JWT tokens.
• Insecure signing and encryption of tokens.
• Stealing tokens via XSS.
• Mapping Tokens to users and devices
• Double Wrapping JWT.
• JWT vs Bearer Tokens vs Cookies
• Stateful vs Stateless authentication.
• Authentication and authorization in APIs
• OAuth
• Bearer Tokens, Access Tokens, Refresh Tokens, Scopes, Authorization grants.
• Implementing OAuth in Web and Mobile apps.
• OAuth vulnerabilities.
• Securing OAuth.
• Session management and Privileges
• Secure session management between client and server.
• Secure Login, Logout, Password Reset and Session lifetime and invalidation.
• Authorization and Privilege Management.
• IDOR, session hijacking, and privilege escalation attacks.
• Multifactor authentication:
• MFA types (TOTP, SMS, U2F)
• MFA practical implementations (secure enrollment, backup codes, user support)
• Push notifications as MFA.
• Credential handling and storage
• Credential storage in Apps (Local storage, Apple Keychain and Secure Enclave, Android KeyStore).
• Credential storage for APIs:
• password hashing
• HSMs
• Hashicorp Vault
• AWS Secrets Manager
• Checking for compromised credentials using HIBP.
• Secrets API in Kubernetes, Docker swarm, mesosphere.
• Cryptography:
• Secure SSL/TLS Configuration (Cipher suites, Pinning, PFS, Key and Certificate Management)
• Applied cryptography for secret storage and transmission.
• Securely applying digital signatures.
• Secure password storage and handling.
• Applied cryptography using Libsodium, BouncyCastle
• Rate Limiting and Bot Control
• Implementing rate limiting and bot control.
• Catching and blocking bad bots.
• Managing bot control and captchas in APIs and mobile.

Mohammed Aldoub is an independent security consultant from Kuwait, who, in his 10 years of
experience, worked on creating Kuwait’s national infrastructure for PKI, cryptography,
smartcards and authentication. Mohammed delivered security trainings, workshops and talks in
the Netherlands, USA, Czech Republic, Lebanon, Riyadh, Kuwait, and other places.

Mohammed is deeply interested in malware, especially those used by state actors in the Middle
East zone, where he volunteers as OWASP Kuwait’s chapter leader. Mohammed is focusing now
on secure devops, modern appsec, cloud-native security, applied cryptography, security
architecture and microservices. You can find his twitter account at https://twitter.com/Voulnet