## Basics ### Web Today - Purpose of the Web: - Link plain text documents - (Transfer textual data between computers) - Highly-developed application platform - e.g., mobile applications, office applications - Based on multi-origin documents - Origin-based security models (e.g., SOP, CORS) - UI support (HTML, CSS, JS) - Support of offline applications with client-side persistence - Reason for security issues: - Web uses non-security mechanisms for security purpose - e.g., Cookies for Authentication - Interpret data as code (injection attacks) - Peak of web vulnerabilities - 2006: 6600 total - 2014: 8000 total - 2018: 16000 total - Most common: - Code Execution (3000 in 2018) - XSS (2000 in 2018) - Possible attack-surface - Integrated third-party code on server - Integrated third-party code on website - UI (Google Maps) - Frameworks (Angular) - Cross-domain JS library (jQuery) - Third-party authentication providers (e.g., Google, GitHub) - Secondary view on application (e.g., mobile devices) - Network communication ### History - 1945 - First mention of *hypertext*: Plain texts with links between them - 1980 - Tim Berners-Lee developed ENQUIRE (hypertext program at CERN) - 1989 - Tim Berners-Lee wrote the paper "Information Management" (basis for the modern web) - 1991 - HTTP/HTML invented by Berners-Lee - Document-centric format - Stateless - HTTP 0.9 - HTML had 18 tags - 1992 - HTTP 1.0 (adding headers) - 1993 - Mosaic (first) browser supports inline images from remove server - **Multi-origin web** was born - Common Gateway Interface (CGI) - First Web Application - Pass HTTP request to scripts (Parameter via URL) - HTTP Response written to `stdout` - HTTP Authentication - HTTP Authentication header added (no session management) - **Lead to first security considerations** - 1994 - Cookies added by Netscape navigator (HTTP Response header) - 1995 - JavaScript invented by Netscape navigator - *Scheme (programming language) in a browser* - Idea: Java for browser - Frames invented - Lead to *XSS* and *Same-Origin Policy* - Internet Explorer published - 1996 - Cascading Style Sheets invented - Separate structure and presentation - Declarative syntax - 1996-1999 - The First Browser War - Netscape vs. Internet Explorer - Race for **compatibility** (parse bad HTML) - Microsoft wins - 1999: - HTTP 1.1 - 2000-2003 - Stagnation of Internet Explorer (few updates) - Flash added to get new features - 2003 - Apple Safari (using WebKit) introduced - 2004 - Mozilla Firefox introduced - Apple Safari introduced - WHATWG introduced (Web Hypertext Application Technology Working Group) - Members from Apple, Mozilla, Opera - Specified HTML5 - Innovation for browsers - 2004-2005 - The Web 2.0 - New functionality - AJAX (lead to Facebook, GMail, ...) - Since 2005 - The Second Browser War (IE, Chrome, Firefox, Safari) - Focus on **speed** (not compatibility) - Fasted engine: WebKit (Chrome + Safari) - 2014 - HTML5 final specification ### HTML5 Features - Audio/video tags - Web Storage API (Key-value-storage, Session and Local storage) - Web Messaging - Web Sockets (duplex communication) - Offline Cache (enable offline apps) - Web Workers (multi-tasking) - Geo Location - Semantic tags (e.g., `nav`, `footer`, `header`) ### Attackers #### Network Attacker - Attack communication link (client-server) - Goal: Disturb confidentiality, integrity and authenticity of connection - Capabilities (CRUD) - Traffic observation (passive eavesdropper) - Traffic fabrication (fake package injection) - Traffic disruption (drop packages) - Traffic modification (change un-encrypted packages) - *Man-in-the-middle* - Types: - Same network (e.g., ARP poisoning) - Internet Service Provider (i.e., access to all traffic) - Law Enforcement (e.g., specific access) - Security services - Network attackers on the Web - Active (e.g., add advertisement into unencrypted sites) - Passive (eavesdrop information, e.g., credentials) #### Remote Attacker - Attack remote system (e.g., server) - Goal: Compromise the system - Code execution - Information exfiltration (e.g., SQL Injection) - Information modification - Denial of Service #### Web Attacker - Attack certain web application - *Man-in-the-browser* - Create HTTP requests - Leverage user's state - *Confused deputy* (misuse browser privileges) - Cross-site scripting attacker (misuse trust of browser) - Cross-site request forgery attacker (misuse trust of remote server) #### Social Engineering Attacker - No *technical* capabilities but technical knowledge - Trick user to perform certain tasks - Attacks: - Phishing (e.g., fake login form) - Click Jacking (e.g., overlay site) - Tricks: - Fake unicode URLs - Use well-known icons to suggest "security" ### Uniform Resource Locator (URL) - Scheme to identify and locate resources - Structure - Protocol (e.g., `http`) - User/Passwort (e.g., `foo:bar`) - Hostname (e.g., `example.org`) - Port (e.g., `80`) - Path (e.g., `/doc.html`) - Query (`v=1`) - Fragment (`frag`, not send to server) - Example: `http://foo:bar@example.org:80/doc.html?v=1&w=2#frag` - Scheme: `://[user][@pass][:][?][#]` ### HTTP - HyperText Transfer Protocol - Purpose: Represent structure of a document - Properties - Stateless protocol (single request/single response) - No notion of sessions - Human readable/writeable (until HTTP/2.0) - Based on TCP (+TLS) #### Request - Structure - Request line (Verb, Path, Protocol) - e.g., `GET /index.html HTTP/1.0` - Headers (`header:value`) - e.g., `Host: www.example.org` - e.g., `Cookie: foo=bar` - Ends with newline - Optional body message (e.g., for POST requests) - `Host`-header added in HTTP 1.1 - Method `GET` - Purpose: Retrieve resource - No body message - Should be stateless (*idempotent*, no state change on server) - Pass parameters via URL - *Attack*: HTTP Parameter pollution - Method `POST` - Purpose: Send data to server - Storage/processing - Use for state-changing operations - Can be combined with GET parameters - Contains body (URL-encoded data) - *Attack*: HTTP Response Splitting - Verbs - `HEAD` (GET with headers only) - `PUT/DELETE/PATCH` (resource management, WebDAV, REST) - `OPTIONS` (query communication options) - `CONNECT` (for proxies) - `TRACE` (trace message, server returns message as received) #### Response - Structure - Status line (Protocol, Status Code, Status Text) - e.g., `HTTP/1.1 200 OK` - Headers - e.g., `Server: Apache` - Ends with newline - Response body - Status Code - 1xx Information - 2xx Success - 200 OK - 206 Partial Content - 3xx Redirect - 301 Moved Permanently - 304 Not Modified - 307 Moved Temporarily - 4xx Client errors - 400 Bad Request - 401 Unauthorized - 403 Forbidded - 404 Not Found - 410 Gone - 418 I'm a teapot - 5xx Server errors - 500 Internal Server Error - Possibility to provide security information to client - e.g., CSP and CORS #### Versions - HTTP 0.9 - Requirements: Serve single HTML pages - Result: - Only GET - No headers - Sever answers with HTML body - HTTP 1.0 - 1991-1995 - Requirements: - Authentication - Meta data transmission - Transmit data to server - Serve binary data - Result: - Request: HTTP version *must* be set - Optional headers (request + response) - Response: Status line - New methods: POST + HEAD - HTTP 1.1 - 1999 - Requirements: - New transport/caching strategies (larger resources) - Assess server's capabilities - Result: - New methods: PUT/DELETE/TRACE/CONNECT/OPTIONS - `Keep-Alive` connections - `Accept-Encoding` for server (sent by client) - Chunk transfer - Standardized in RFC 2616 - HTTPS - 1999 (RFC 2818) - S-HTTP: Unencrypted header, encrypted body - Encapsulate HTTP in TLS tunnel (HTTPS) - Chain of trust by certificates - *Server Name Identification* (SNI): - Multiple hosts via TLS (since 2011) - HTTP 2.0 - 2015 - Requirements - Reduce overhead of uncompressed HTTP headers - Fast delivery of resources to client - Fix head-of-line blocking - Result - Binary protocol - Server push - Header compression - Further reading: [Introduction to HTTP/2](https://developers.google.com/web/fundamentals/performance/http2)