CSE 365 F23 11-22-23 "Web Security Pt. 3"

all right in a shocking turn of events we're g to get started on time I think go this way go this way go this way go this way okay or do that that's same thing I guess okay all right we have a wait let's we're getting started all right today as you can see we'll have a very special presentation by everybody in the front of the room so they will be going in order uh I'm just kidding you can stay there if anybody else wants coffee feel free there should be plenty for everyone uh feel free to come up for a refill I promise I won't make you present anything okay uh first things first important things I'll try to announce this and remind you about this in Discord uh there's evals that happen I'm shocked that eight% of you have already 16% of you well is that right no that's pretty 8% have already filled this out that's actually insane um although the number is the same and that's weird to me why that seems wrong right uh that shouldn't be the same among both classes yeah but why would it be exactly the same same people exactly that seems weird they're not technically in the classes I actually don't know what you'll see on your side with the two instructors so it's the same it's the same okay dude then just fill it out do whatever you're going to do uh the point is just to do it that's the important thing uh I don't know we read this stuff it's not like it gets ignored so feel free to tell us what you think um and we will take that into consideration this has to be a total 27 across both classes that's the only thing that makes sense no this happens to be what if I refresh it do you think somebody's taken it in this metime no that'd be cool okay and I'll be bugging you about this you have until the 30th to do this so please do it uh other thing anybody care about grades oh they don't care about grades all right let's move on uh so I announced this on Discord important things a check your grade I added in all the extra credit uh and for uh helpfulness and memes as it was so that should never go down it should only ever go up for you as that happens from now until the end of the semester um obviously I have zero because I'm very unhelpful and I make no memes so so if you if you think you should have something here and you have nothing what does that probably mean you didn't sign into your Discord you didn't link your Discord exactly so that's where you go over here this identity tab or actually the setup tab the setup Tab and you didn't follow all these so you don't have all these five things so we don't know who you are on Discord so we can't give you any extra credit for anything you do on Discord some of you that's what you want that's also totally fine the one thing that absolutely has to happen if you want a grade everyone actually want a grade I mean it's that or is zero you either get the grade that you earned or you get a zero so those are the only two options um the important thing to look at here is this second one so if you if this is second thing is not a green check mark that means we don't know what your pone College username is and we haven't been able to match that with our ASU student ID uh some people I've already seen have put in their like their email style ID like uh their email handle at asu.edu as their ID so if that's you go over to to Identity double check that your ID is here otherwise what's going to happen is I'm going to have to reach out to you and it's going to be super annoying for me so I probably won't do it so you'll get an e in the class and then you'll have to talk to me and then we'll have to do a grade strange petition and it's like really annoying so don't be in that situation I think there's only like 10 of you or less somewhere around there but let's make it zero good all right cool uh okay any class related questions before we finish up and then I think I maybe I mention on Monday but I'm out of town next week so Connor is gonna be teaching uh the final two classes uh yeah but I'll be on Discord but at weird European hours so okay nobody go get coffee while I go refill because this thing's gonna follow me the any questions on the course while I pour this cool all right we are and nobody's raising their hand cool we are going to close out web security so we've been talking about the differences between Origins so somebody remind us how does a browser what's defined as the same origin what three pieces of information are used to determine if one origin is the same as another what was it pork is one what's else what was it no no it's all about the URL the URI parts of the URI what was it the domain yeah let me uh pull it up here so the host the port and what else the sche the scheme yeah thank you so those three make the three tle of the origin and this is what your browser allow uh uses to say when fetching this page can I make another request to that same to that uh to that URI and this is done uh very simply literally this is an exact matching check for these things uh so we looked at that so we can this is why if we're on page HTTP example.com which has the origin of HTTP example.com and 80 if we try to if we are that page makes a request to fetch cats. GI it succeeds because that has exactly the same three tle the scheme the host and the port but even if it's the exact same host and Port actually the port this is incorrect the port is different here it' be 443 but um even if it was the same port the fact that the scheme is different means that the origin will be different and the browser will block that and not allow uh those requests for most of the requests cool so these are all examples we can have the same scheme uh similar this is even a subdomain so this is cats. example.com is not the same origin as example.com so still will be a different origin okay cool um but there are cases where we do want to um send requests in across Origins um as we saw like image tags will cause a request to be issued cross origin um so that we can fetch those things and these are the allowed methods and headers that can be made uh as you you notice this is very restrained than what a normal request so you can't request a get and specify you want a content type of Json that uh just straight up does not work um and we can always also read the responses so and there's actually a lot of this is a again we're going an overview of web security you can get crazy in depth um image tags so like I said you can fetch a cross domain image but within JavaScript you actually can't read the content of that image of what it looks like because that came from a different origin and so your browser engine blocks that because people before they did that people used to be able to leak data from other websites because you'd be logged in getting that image and uh you wouldn't want the JavaScript on another origin to be able to infer information about that um there's actually a lot of cool interesting tricks that you can do with here um so these are some of the ways where you can cause the browser to fetch different um things and now we're going to get in and talk a little bit about domain names so the domain names so everybody when we talked about networking what was the purpose of ARP yeah what was the purpose of ARP the address resolution protocol in networking yeah add not quite it's not matching it's uh mapping it to something else yeah close mapping an IP address to something else at a lower layer of the IP stack of the networking stack the MAC address yeah exactly so ARP is a way to say hey I want to talk to this um I want to talk to this IP address who has this IP address on my local network and so then people will have an ARP reply that says oh I'm that IP address and this is my Mac address and that's how you did ARP spoofing in the intercepting communication challenge because nobody verifies that so you were able to say hey no no I'm that IP address and you got the traffic that was destined for that other machine so similarly even though we know networking Works BAS on IP addresses right we talked about how data packets get from one machine on the network and how they hop uh through but remembering IP addresses is incredibly annoying right we actually have a whole system so that humans can use this and so that's where DNS is the domain name system so that's where domain names come in this is a way that this Maps this human readable name www.example.com you can read into we're not going to get into the specifics of DNS but you can read into how it works to translate that to an IP address that your machine then uses to start a TCP IP connection to that IP address um but your browser also needs to know this to understand what constitutes the same site and essentially the same entity and it has to do when it sends cookies on requests and not and how you can control that so so typically the way DNS works if you control if I controlled let's say example.com I can make sub domains like I can make a subdomain www.example.com I can even go further by adding more dots I can set it up and go uh food. bar. www.example.com I can do that as much as I want and you can see that here with these two examples so we have p. colge there's also a DNS entry for dojoon dool um so that's called a subdomain because Dojo Doone do colge uh is a subdomain of pondoc college and so for all these examples when we talk about the top level domain that's kind of the essentially the root of the DNS entry but we don't need to get into those that level of details those are things on the far you can think of it as the far right so we have Comm so we have example.com the top level domain is Comm uh but we have kind of a problem here has anybody gone to a UK site before like this you have google.co.uk which part is the part that Google owns yeah they actually control the Google part they don't control the code. UK because there's actually a ton of code. uks I don't know actually why this is done and I don't know if there's other blog. uks if anyone's British and knows uh please say something um there's only 25 people on Twitch I guess that's because all you are here huh um so so while this is the top level domain there's actually this problem that we need to know well which parts of the domain is essentially special and owned by that entity so that I could say Okay um pone do colge and is dojoon dool a subdomain of p. col or is it just this college part which doesn't make sense because it's not enough dots anyways this allows you and there's a list here actually can we go look at this why would I want to validate this I would just like to go visit my link please yeah so this is a list that you can use it's a public open source thing that has all of the domain names that are um top level domains oh let's actually let's look at this great code. UK so now we can look at this we can see ac.uk gov.uk ltd.uk me.uk net anyways uh all of these are different top level domains the interesting is github.io comp yeah so that's uh let's look at that yeah so github.io this is a way of GitHub saying hey we don't actually control like whatever whoever has that subdomain pone col. github.io that's a different site than Adam d. github.io uh even though it's the same sub domain of github.io yeah you mean like a do like college like this or a custom tldd you have to buy those and they cost a lot of money and I think they would end up on this list so if you controlled it I think it would just be like um if we get oh wow we're all the way in the yeah so like here like UK so all of everything that's blog. UK would be different except for like these ones so if you bought one it would show up on here um and so this is what your browser uses to determine what is the same site and unfortunately it's very confusing because site and origin are not the same thing so the site is the effective top level domain plus one so this means example. is a site google.com is a site google.co.uk pone college is a site and that way doo. p. col so this means that kind of you can think of it as a controlling entity so if I control p. colge then I control dojoon dool mail. pone dool anything. anything. anything. anything. pone dool is considered the same site um and that's what's interesting is having things like github.io now as we'll see you can actually kind of tell the browser and the browser knows that those are different sites um is that actually a site it is right yeah we have a redirect but I don't think that works that works so yeah anyways cool and so as a web developer you can actually control what happens and when cookies that are that your web application ask the browser to set when they are sent to different cross sites so not cross domains Cross or cross Origins cross Origins uh dictates how we can make requests but specifically if cookies are sent in those requests so this is the same site so this is an attribute on cookies let's look let's look at exactly what that looks like yeah so here is a cookie so this is an HTTP response header so the server sends that in an HTTP response you know exactly what an HTV response looks like and what a header looks like so here we're setting a cookie the cookie is the name is ID equals to the value and then attributes are separated with a a semicolon so this has an attribute of expire where the website says at what time this cookie is expired and the browser should no longer use it um but we can do LAX yeah so the same site attribute is what we're looking at so we can for sure get an example here no we yeah there we go so these are all examples of attributes of the same site so this is how the web application would set that and so the applications have different ways of doing this so the default which is the standard is um yeah so strict is as it sounds like the most strict where the cookie is not sent in cross-site requests so this means even if we make a request with a browser uh even if we try to make a request it's not going to send it none is the opposite where will basically send it to um none of the other sites uh so you would you would want none if you're trying to share it among your subdomains so you set a cookie on like google.com and that way www.google.com other uh the same sites would be able to access it LAX is slightly uh confusing because it has to deal with navigation so navigation is when you're typing a URL into your browser so same site lack would be the cookie is not being sent uh it's only sent as part of that so it's kind of in between none and strict we can also specify actually other domains so as part of the attributes of the cookie we can specify hey send this cookie whenever you visit uh food.com even though that's not considered the same site but I as the web application say that I want to to share that cookie um and subdomains you can use a star or wild card to specify these things um the path so the path is an attribute that you can set on a cookie to say only send it to this path or this sub path this way you can modify State and cookies based on what part of the application the user is interacting with and of course there are times when we want to actually break this so we may want to create a site or a web application that we want people to make cross origin requests to our website because let's say we offer some API functionality that they want to access from JavaScript so this is with uh this series of techniques of headers and browser support of cores so this is cross origin resource resource sharing I'm going to drink a lot of coffee today I just realized um where the browser when it's making a request for something it asks the other server with this options and if the server supports and cores is allowed it specifies and the web application can specify different Access Control policies of oh yeah you can request these specific methods so I can say you only can do get requests you can't do Post requests um headers that have to be set and this way then um yeah so then by responding with that the web or this is sorry the request is what the browser is trying to do and the allow is if the web application or web server actually wants to allow this content um and if everything checks out then the request can actually go through and so uh I don't know for like a silly exam well not a silly example but this came up when we were doing uh hosting Defcon CTF so we had a Json file that specified the state of our game that all the teams could access and some of the teams actually wanted to fetch that inside of their own web application so they were making their own goys and their own uh like views of the scoreboard and so they asked us if we could Implement cores so that that way they could from JavaScript that was running on their own interface fetch our Json file so that they can include it in JavaScript and use that to populate their interface um so this is like the initial drop in the bucket of how insane the web is if you think about so we've talked about just in this module we've talked about uh URLs HTTP HTML uh we didn't talk about CSS but that's definitely in there and there could be problems with even stylesheets we talked about JavaScript we talked about SQL uh we talked about what's another one commands command injections uh cookies how cookies actually work there's a whole RFC of a document about how cookies actually work um and this stuff is just very complicated oh Origins we talked about Origins we talked about sites it's like 10 different technologies that you could really dig into any of them and you could have a whole class just on web security and how this stuff could break cool web questions all right I'm going to do something and see if this works let's