Security - Web Development Udacity English English (auto-generated)

Security - Web DevelopmentYouTube↗ IA↗(long shot)
Education 5.7K views 64 likes 0 dislikes 23 May 2012

Udacity 651K subscribers United States YouTube↗

Click to Play Video

The next question we had was about security--cross-site scripting attacks, DDoSs,

the next question we had was about security cross-site scripting attacks

SQL injection, how to deal with those, what those are--

DDoS as sequel injection how to deal

really kind of a big question. >>Sure.

with those what those are really kind of a big question yeah and actually I

Actually, I wanted to almost spend--I could probably spend an entire lecture on this.

wanted to almost spend and I could I could probably spend an entire lecture

We can talk for a few minutes about some of the high-level stuff right now. >>Great.

on this but we can talk for a few minutes about some of the high-level

Security--this is a really big concept.

stuff right now great ok security this is this is a really big concept and and and when I

When I was originally doing the notes for this class, I really wanted to spent a lot of time

was originally doing the notes for this class I really wanted to spend a lot of

talking about a couple of major vulnerabilities, but I was getting the sense

time talking about a couple of major vulnerabilities but I was getting the sense that it would it wouldn't fit in

that it wouldn't fit in very well with the level of knowledge you guys had at the time.

very well with the level of knowledge

But I can't talk about a few of the high-level things now that you should get smart about.

you guys had at the time but I can talk about a few of the high level things now

The first is XXS or cross-site scripting.

that you should get smart about the first this is XSS or cross-site

This basically when you accept data from a user, and you're displaying it in your webpage,

scripting this basically is when you accept data from a user and you and

and you're not escaping it.

you're displaying it in your webpage and you're not escaping it we did talk about

We did talk about escaping, and we quizzed you on escaping.

escaping and we could join escaping

But say you had take some data from a user, and then you return it to the user in a text area.

let's say you had you take some data from a user and then you print it you return it to the user in a text area and

In here goes whatever the user typed in. Maybe you're editing a blog entry, and this is the old blog entry.

then here it goes the the you know whatever the user typed in you know maybe you're editing a blog entry and

Well, if the code they actually typed in has some HTML in it--

this is the old blog entry well if the code they actually typed in has some HTML in it in particular if it uses the

in particular if it uses the script tag, which we haven't talked about at all in this class.

script tag which we haven't talked about

This is how you would include some JavaScript.

at all in this class this is how you would include some JavaScript they can

They can actually put code in here that might fetch all of your cookies, using document.cookie--

actually put code in here that might fetch all of your cookies using document

remember we saw that in Unit 4, I think--

dot cookie remember we saw that in unit 4 I think and make a request to another

and make a request to another URL, sending your cookie there.

URL sending your cookie there so if I

If I view this page--if me, Steve, loaded this page that has this other content,

viewed this page you know if me Steve loaded this page that this other content

it could cause a browser to load my cookies and send it to some other site.

it could cause the browser to load my cookies and send it to some other site

That guy could then look at that request, put his cookies in his browser,

that that guy could then look at that request put his cookies in his browser

and then start browsing the site as me.

and then start browsing the site as me

This is the basis for cross-site scripting. If you escape your HTML, you don't have to worry about it.

this is the basis for cross-site scripting if you escape your HTML you

There are cases, however, where you don't want to escape the HTML.

don't have to worry about it there are cases however where you don't want to

For example, in a blog.

escape the HTML for example in a blog

If you trust your users and you want them to be able to enter HTML--

you know if you if you trust your users and you want them to be able to enter

for example, if they want to put in links and that sort of thing,

HTML for example if they want to put in links and that sort of thing then you've

then you've got to think carefully. Do I trust the user?

got to think carefully do I trust the

Or do I want to write some fancy escaping that escapes some HTML,

user or do I want to write some fancy escaping that escape some HTML but like

like it allows links for example.

allows links for example that that's a

That's a big tradeoff.

On Reddit, we use a piece of technology called markdown,

trade-off on reddit we use a piece of technology called markdown which is a

which is a simplified language good for allowing users to leave comments and that sort of thing.

kind of a simplified language good for allowing users to leave comments and

It's got syntax for leaving links and images, but not just random HTML.

that sort of thing and it's got syntax for leaving links and images but not just random HTML

Actually what we did is we allowed links and image, and then we broke all other HTML. Basically, the name of the game for preventing cross-site scripting is escaping HTML.

well actually what we did is we allowed likes an image and then we broke Oh all other HTML so basically the name of the game for presenting cross-site scripting

is preventing cross-site scripting is escaping HTML nothing there's another

There's another classes of attacks we haven't talked about,

class of attacks we haven't talked about

and they haven't come upin this class, which is SQL Injection.

and then I've really come up in this class which is sequel sequel injection

What's happening here--this is very similar to cross-site scripting.

and what what's happening here this is very similar across site scripting and

There's another--well, let's talk about SQL injection first.

and there's another kind of well let's

If you have a piece of SQL--select * from link--where id = %s.

talk about sequel injection first so if you have a piece of sequel you know select you know star from link you know where ID equals X already equals percent

This is why you shouldn't use %s in SQL statements.

s this is why you shouldn't use percent

In App Engine they've been using that colon syntax, which is really nice,

s in sequel statements and in App Engine they've been using that colon syntax

because they do the escaping for you.

which is really nice because they do

If you were to generate some SQL in Python using the string substitution syntax,

this game for you but if you were to generate some sequel in Python using the

where you just put in this id variable, and maybe this id comes from the URL or from the user.

string substitution syntax or you just put in a you know this ID variable and maybe this ID comes from the URL or from

If this is a number, this works fine.

the user you know if this is a number

But what if this were the string quote, semicolon, this makes a comment.

you know this works fine but what if this were actually a you know if this were the string you know quotes semicolon I think you'd say like this

makes a comment I'm forgetting some of

I'm forgetting some of my SQL here, but effectively you put in a drop table.

my sequel here but effectively you know you put in a drop table

It's just like cross-site scripting where if you allow them to put in arbitrary HTML,

it's just like cross-site scripting where if you allow them put an arbitrary

they can close your old tag--through some syntax it's often a closing quote and a semicolon

HTML that can close your old tag you know through some syntax it's often a closing quote and a semicolon or - -

or dash-dash basically means comment.

basically means comment some combination

Some combination of things here allows you to just put in arbitrary SQL into the database.

of things here allows you to just put an arbitrary sequel into the database so

Generally, you want to make sure you're always using a wrapper around your SQL.

generally you want to make sure you're always using a wrapper around your

App Engine provides that using their GQL query object that we've been using in this class.

sequel so App Engine provides that using there there's equal there's equal query object that we've been using in this

Another really popular library I use all the time in Python is called SQLAlchemy.

class another really popular library I use all the time in Python is called sequel alchemy it is spelled like this

It is spelled like this maybe.

maybe sequel alchemy is one of my

SQLAlchemy is one of my favorite libraries.

favorite libraries it's at in its

In its simplest use case, the way I've always used it, it's basically got a procedural language for generating SQL,

simplest use case the way I've always used it is it's basically got a procedural language for generating

much like the way App Engine has that language where you can say .all and .filter and that sort of stuff.

sequel much like the way App Engine has that language we can say dot all and dot filter and that sort of stuff

SQLAlchemy provides a very similar interface.

psycho alchemy provides a very similar

It goes one step further and has what's called a ORM, which is an object relational mapping,

interface it goes one step further and has what's called an ORM which is an object relational mapping which

Which basically converts a Python object into SQL so you don't have to think about SQL,

basically converts Python objects into sequel so you don't have to think about

but I hate using these things because it disconnects you from the queries you're running,

sequel but I hate using these things because it disconnects you from the queries you're alright you the queries

the queries are what cause your web application often to be slow,

you're running the queries are what causes your web application often to be

and if you don't have direct control of your queries,

slow and if you don't have direct

you're not going to be able to scale quite as consistently.

control of your queries you're not going to be able to scale quite as consistently so anyway let's take

But SQLAlchemy is a really nice library.

welcome use really nice library you know

Just like this SQL injection, you can just as easily have memcached injection.

just like the sequel injection you could just as easily have memcache injection

If you're taking input from the user and you're converting that into like a cache key,

you know if you've got basically if you're taking input from the user and you're converting that into like a cache key well depending on what memcache your

depending on what memcacher library you're using, if it's not validating the key, they could put something in a URL or something for example

library you're using if it's not validating the key you know they could put something in in a URL or something

that would finish the memcache statement and create a new one and pollute your cache with stuff.

for example that would finish the memcache statement and create a new one and pollute your castra stuff we had a

We had a really clever guy try to do that to us at Reddit once.

really clever guy try to do that to us I

Fortunately, he was a friend, and he told us.

read it once fortunately he was a friend and he told us there's one other huge

There is one other huge class of attacks, and this is actually a relatively modern thing.

class of attacks and this is actually relatively modern thing it's called CSRF

It's called CSRF. This one's really fun.

this one's really fun the general idea

The general idea is remember how we talked about forms.

is remember we've talked about forms forums have an

Forms have an action attribute that is where you want to submit the form.

action attribute that is where you want

We've always been doing things like slash or not specifying it, which submits the current URL.

to submit the form now we've always been doing things like you know slash or not specifying it what

But you could put a full URL in here, and this could just have a completely different site--

to submit to the current URL but you could put a full URL in here and this could just have a completely different

ASCII Chan, which Incidentally has this vulnerability in it.

site you know ASCII Chan which incidentally has this vulnerability in it or it could be you know forum site

Or it could be forums.udacity.com, which also has this vulnerability in it. You could build a webpage on your own domain.

udacity.com which also has this vulnerability in it and you can so you could build a web page on your own

Let's say you're at badguy.com, and you made a hidden form, use CSS to hide it, and then you have some JavaScript

domain let's say you're at you know bad guy calm and you make a hidden form you know you a CSS to hide it and then you

that automatically submits this form, what's going to happen is a user will load your page,

have some JavaScript that automatically submits this form what's gonna happen is a user will load your page their browser

their browser will render this form, and then you'll submit it for them, sneakily.

will render this form and then you'll submit it for them sneakily and this

This will submit to some other URL.

will submit to some other URL and ASCII

ASCII Chan won't be able to detect that the request is coming from badguy.com.

Chan won't be able to detect that the request is coming from a bad guy com

They'll see that as coming from this user's browser with their IP and with their cookies.

they'll see that it's coming from this user's browser with their IP and with

CSRF what's happening here is you are doing something on behalf of a user.

their cookies and and CSRF is basically then the what's happening here is you are doing something on behalf of a user

They've got their cookies that basically identify them. You're logged in as spez.

they've got their cookies that basically identify them you know you're logged in

So somebody can trick my browser into making a request to another site as me.

as spez and so somebody can trick my browser into making a request to another site as me they can do things like

They can do things like submit a form as me or vote up on a story as me

submit a form as me or vote up on a

or enter a bunch of bogus content in the forums as me, which is really frustrating.

story as me or enter a bunch of bogus content in the forums as me which is really frustrating so you can actually

If you're enterprising enough and can trick me into clicking on a link that you control, You can make me submit something to ASCII Chan, or you could make me

if you're if you're enterprising nothing can trick me into clicking on a link that you control you can make me submit

submit something to the Udacity forums.

something to ask you chat or you can make me submit something to the Udacity

If you do that, we'll reward you or something. Now, the way you prevent against this is one your own site

forums and if you do that you know will reward you or something now the way you prevent against this is on your own site

you have to include basically hashes or some sort of secret in your own forms.

you have to include basically hashes or some sort of secret in your own forms so

If I've got a URL, let's say it's a new page. This is my blog submitting URL.

if I've got a URL you know let's say it's a new page this is my blog submitting URL

The handler for this URL needs to look for a hidden input

the handler for this URL needs to look

that only exists on the form itself.

for a hidden input that only exists on the form itself it's gonna be hard to

It's going to be hard to explain this in this format, so what I would advise you to do

explain this in this in this format so

is just Google for CSRF, but you already understand the concepts required to implement

what I would advise you to do is just Google for CSRF but you already understand the concepts required to

the solution to this, which is basically hashing and secrets.

implement the solution to this which is basically hashing and secrets you need

You need to include some secret that is only included on new page,

to include some secret that is only

so that when some guy at badguy.com submits a form directly to this URL,

included on a new page and so that would some guy at bad guy calm submits a form

they don't have the secret, and the secret would have to come along with the rest of the data. CSRF--it's a really fun attack.

directly to this URL they don't have the secret and the secret I would have to come along with the rest of the data so CSRF it's a really fun attack you can

You can find it on just about every website online--not Reddit anymore,

find it just about every website online not read it anymore but there was a time

but there was a time--the way I learned about this is somebody made a link on Reddit

you know the way I learned about this is somebody made a link on reddit that when

that when you clicked it would automatically vote up on that link for who as looking at the page.

you clicked it would automatically vote up on that link for whomever was looking at the page for whoever who was and also

All of a sudden this link just skyrocketed to the front of our page,

missed this link the sky rocketed to the

and it was like freelimosines.info or something like that.

front of our page and was like free limousines that info or something like

We were like, hmmm. Something's fishy. That's when I learned about this attack.

that so we were like hmm you know something's fishy and that that's what I

Hopefully, you can learn about it in not quite so public of a fashion.

learned about this attack so hopefully you can learn about it and not quite so public of a fashion but anyway so those

Anyway, those are the major security issues.

are the major security issues there's a

There's a whole lot to do there.

whole lot to do there maybe you know

Maybe we can do like an extra one-off lecture at some point where we break the Udacity forums,

maybe we can do like a an extra one off lecture at some point where we you know

but this is enough to get you started right now.

break the Udacity forums but this this is enough to get you started right now

Similar videos:

Locking and Memcache - Web Development
Udacity
5.6K views 16 likes 0 dislikes 27 May 2012100% match

Scaling - Web Development
Udacity
12.5K views 81 likes 1 dislikes 27 May 2012100% match

Problems with Memcachedb - Web Development
Udacity
6K views 13 likes 0 dislikes 27 May 2012100% match

Port - Web Development
Udacity
15.8K views 18 likes 0 dislikes 23 Feb 2015100% match

HTML Basics
Udacity
16.5K views 75 likes 2 dislikes 16 Jul 2014100% match

Whitespace Solution - Web Development
Udacity
15.7K views 10 likes 1 dislikes 23 Feb 2015100% match

The Method Attribute - Web Development
Udacity
9.6K views 14 likes 8 dislikes 22 Apr 2012100% match

Best Browser Solution - Web Development
Udacity
9.6K views 22 likes 1 dislikes 23 Feb 2015100% match

Most Common Method - Web Development
Udacity
9.7K views 5 likes 0 dislikes 23 Feb 2015100% match

Precomputed Caching - Web Development
Udacity
12.2K views 80 likes 0 dislikes 27 May 2012100% match

Shopping List Take 1 - Web Development
Udacity
841 views 1 likes 0 dislikes 23 Feb 2015100% match

Span and Div Solution - Web Development
Udacity
17.4K views 7 likes 0 dislikes 23 Feb 2015100% match

Correct URL - Web Development
Udacity
10.9K views 6 likes 1 dislikes 23 Feb 2015100% match

Types of Databases - Web Development
Udacity
8.5K views 43 likes 4 dislikes 25 Apr 2012100% match

Caching - Web Development
Udacity
12.1K views 102 likes 0 dislikes 23 Feb 2015100% match

File Types
Udacity
34.4K views 11 likes 3 dislikes 23 Feb 2015100% match

Introduction - Web Development
Udacity
23.3K views 107 likes 0 dislikes 23 Feb 2015100% match

Part 2 - Web Development
Udacity
643 views 2 likes 0 dislikes 07 May 2012100% match

Valid Headers - Web Development
Udacity
7.9K views 1 likes 0 dislikes 23 Feb 2015100% match

Caching Techniques - Web Development
Udacity
34.4K views 216 likes 7 dislikes 23 Feb 2015100% match

Thing DB - Web Development
Udacity
6.8K views 34 likes 1 dislikes 27 May 2012100% match

Google App Engine - Web Development
Udacity
10.1K views 13 likes 3 dislikes 17 Apr 2012100% match

Stateless - Web Development
Udacity
9.2K views 35 likes 8 dislikes 23 Feb 2015100% match

Reddit Architecture 2 - Web Development
Udacity
11.1K views 88 likes 2 dislikes 27 May 2012100% match

World Wide Web Solution - Web Development
Udacity
12.6K views 14 likes 0 dislikes 23 Feb 2015100% match

Frameworks - Web Development
Udacity
28.7K views 154 likes 25 dislikes 23 Feb 2015100% match

App Server Scaling - Web Development
Udacity
28.2K views 277 likes 8 dislikes 23 Feb 2015100% match

Cookie Headers - Web Development
Udacity
4.2K views 23 likes 1 dislikes 23 Feb 2015100% match

Datastore Types Solution - Web Development
Udacity
656 views 1 likes 0 dislikes 25 Apr 2012100% match

Introducing URLs - Web Development
Udacity
7.1K views 21 likes 0 dislikes 23 Feb 2015100% match

Settings Privacy About Contact Donate