PagerDuty's Security Training for Engineers, Penultimate

XSS Threats

Cross Site Scripting (XSS) poses significant threats by allowing attackers to inject malicious code into web pages, potentially accessing sensitive user data. Michael Outlaw explains that XSS can occur when user input is not properly sanitized, enabling attackers to execute scripts that steal session cookies or impersonate users 1. Alan Underwood emphasizes the importance of encoding user-supplied data before rendering it in browsers to prevent such vulnerabilities 2.

If they aren't careful about how they render that content back out and if they let it just be raw, you might have code in it.

--- Alan Underwood

Using frameworks that automatically handle session tokens can mitigate these risks, ensuring unauthorized requests are aborted 2.

   

CSRF Defense

Cross Site Request Forgery (CSRF) tricks users into executing unwanted actions on a web application where they're authenticated. Joe Zack highlights the importance of using synchronizer tokens to prevent CSRF attacks by ensuring that any action requires a token that matches the user's session 3. This method involves embedding a hidden token in forms, which is validated against the session token upon submission 3.

Anything to where you do need an action, don't use the GET. You're either going to use a POST or something else like that.

--- Michael Outlaw

By avoiding GET requests for state-changing operations, developers can further protect against these vulnerabilities 4.

   

Clickjacking

Clickjacking involves tricking users into clicking on something different from what they perceive, often using iframes. Michael Outlaw describes how attackers overlay iframes to capture clicks intended for legitimate buttons, potentially leading to unauthorized actions 5. Alan Underwood notes the creativity of attackers and the importance of using HTTP headers like X-FRAME-OPTIONS to prevent such exploits 5.

It's just people that have bad intentions, like they get really creative with stuff.

--- Michael Outlaw

Ensuring that iframes are restricted to same-origin or denied can significantly reduce clickjacking risks 6.

   

Account Enumeration

Account enumeration occurs when attackers deduce valid usernames by analyzing response times or error messages. Michael Outlaw explains that longer response times during login attempts can indicate valid accounts, as the system takes time to hash passwords 7. Alan Underwood advises maintaining consistent messaging for login errors to prevent revealing user existence 8.

Make sure they all give the same messaging so that you don't let people know that, hey, oh, you stumbled on Michael as a real user.

--- Michael Outlaw

Implementing uniform error responses and avoiding detailed feedback can help protect against this vulnerability 8.