1 / 12

Web Security

Web Security. Eksploitasi Web. Tampilan web diubah ( deface ) dengan eksploitasi skrip. Situs yang dideface dikoleksi di http://www.alldas.org Informasi bocor (misal laporan keuangan semestinya hanya dapat diakses oleh orang/ bagian tertentu)

kyros
Download Presentation

Web Security

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Web Security

  2. Eksploitasi Web • Tampilan web diubah (deface) • dengan eksploitasi skrip. Situs yang dideface dikoleksi di http://www.alldas.org • Informasi bocor • (misal laporan keuangan semestinya hanya dapat diakses oleh orang/ bagian tertentu) • Digunakan untuk menipu firewall(tunelling ke luar jaringan) • Penyadapan informasi • URLwatch: melihat siapa mengakses apa saja. Masalah privacy • DoS attack • Request dalam jumlah yang banyak (bertubi-tubi), Request yang memblokir (lambat mengirimkan perintah GET) • Malicious Input Attack • Bad input ke priviledge program : Code corruption attack – Buffer overflow, SQL Injection, Cross Site Cripting

  3. Security Web • Tampilan web diubah (deface) • Secure Configuration pada web server dan web application • Informasi bocor • Dengan htaccess dan http Digest authentication • Digunakan untuk menipu firewall(tunelling ke luar jaringan) • Dengan sohusin • Penyadapan informasi • Dengan SSL/https • DoS attack • Firewall dan mod_security • Malicious Input Attack • Mod_security dan secure configuration

  4. Secure Configuration • Test dengan tools vulnerability scanners misal Nikto • Konfigurasi http secara secure : • Disable Un-Needed Modules • Denial of Service (DoS) Protective Directives • Access Control: Where Clients Come From • Limiting HTTP Request Methods • Removing Default/Sample Files • Updating Ownership and Permissions • Updating the Apachectl Script • Enable Security Modules for Apache • Secure Socket Layer (SSL) • Mod_Rewrite • Mod_Log_Forensic • Mod_Dosevasive • Mod_Security

  5. htaccess di Apache • Isi berkas “.htaccess” • AuthUserFile /home/budi/.passme • AuthGroupFile /dev/null • AuthName “Khusus untuk Tamu Budi” • AuthType Basic • <Limit GET> • require user tamu • </Limit> • Membatasi akses ke user “tamu” dan password • Menggunakan perintah “htpasswd“ untuk membuat password yang disimpan di “.passme”

  6. Widely used to exchange text data accross different plateforms Used for the WWW on port 80 to exchange HTML files Standarized in the RFCs The current 1.1 version offers two authentication schemes; basic and digest HTTP Hyper Text Transfer Protocol • HTTP messages are composed of header-fields and entity (the payload) Protocol://destination-host/ressource

  7. Basic Access Authentication • Password encoded in Base64; no encryption • Sent in clear for every subsequent requests • Sniffing compromises the password

  8. response = MD5[MD5(username:realm:password):nonce:nc:cnonce:qop:MD5(method:URI)] Digest Access Authentication

  9. Sohusin • Suhosin is an advanced protection system for PHP installations that was designed to protect servers and users from known and unknown flaws in PHP applications and the PHP core • Suhosin comes in two independent parts, that can be used separately or in combination. • The first part is a small patch against the PHP core, that implements a few low-level protections against bufferoverflows or format string vulnerabilities • The second part is a powerful PHP extension that implements all the other protections

  10. Firewall • Firewall digunakan untuk mencegah akses yang tidak berhak ke suatu jaringan. • Bekerja dengan cara melindungi, baik dengan : • Menyaring • membatasi • menolak • Segmen tersebut dapat merupakan sebuah workstation, server, router, atau local area network (LAN) anda pc (jaringan local) <==> firewall <==> internet (jaringan lain) hubungan /kegiatan suatu segmen pada jaringan pribadi dengan jaringan luar yang bukan merupakan ruang lingkupnya

  11. Mod_Security • ModSecurity is a web application firewall (WAF), to detect and/or prevent attacks before they reach web applications. • ModSecurity can monitor the HTTP traffic in real time in order to detect attacks.

  12. Secure Socket Layer (SSL) • Menggunakan enkripsi untuk mengamankan transmisi data • Mulanya dikembangkan oleh Netscape - OpenSSL

More Related