To continue with this content, please log in with your Data Access ID or create a new account.
Cancel Data Access ID
You may not be authorized to see this content. Please contact Data Access Europe for more information.
Cancel Data Access Europe
You are not authorized to see this content.
Cancel Data Access Europe
Next lesson:
SQL injection

Security the Basics

Lesson 4: Data in transit - https (Web)

This lesson will focus on making sure that data being transferred across the internet is only available to your application using HTTPS. HTTPS is very important because it encrypts the data.

  1. Open the IIS Manage
  2. Select the desired machine from the ‘Connections’ panel on the left
  3. Select ‘Server Certificates’ from the IIS section in the center.
  4. Click on ‘Create Self-Signed Certificate’ from the ‘Actions’ panel on the right.
  5. Enter a name in the ‘Specify a friendly name for the certificate’ field. Press OK.
  6. Note: This certificate is just meant for testing. It is not meant for deployment.
  7. Right click on ‘Sites’ from the ‘Connections’ panel on the left and select ‘Add Website.’            
  8. Add a ‘Site name’
  9. Select the ‘Physical path,’ which is the ‘AppHtml’ folder in the workspace.
  10. Create a binding meaning that the website will be available on this particular binding. The first will be ‘http.’ Enter a fake ‘Host name.’ “securitymatters.test” is used in this example. The .test domain extension is unique, and specifically for testing purposes.
  11. Click OK
  12. Select the new website from the ‘Connections’ panel on the left, and then click on ‘Bindings’ in the ‘Action’ panel on the right.

  13. Click the ADD button in the ‘Site Bindings’ window
  14. From the ‘Type’ drop down choose ‘https’
  15. Enter the same host name previously used – securitymatters.test
  16. From the ‘SSL certificate’ dropdown choose certificate that previously created and press OK
  17. Select CLOSE
  18. The fake host name is not known by the computer or by the browser. The host file needs to be edited, so that Windows knows what to do with it. The host file is used to map local host to the local machine, but it will also now be used for this deployment
  19. Open a text editor as an administrator.
  20. Open the host file from >> C:\Windows\System32\drivers\etc
  21. If the ‘etc’ directory is not visible, enter “etc” in the ‘File name’ field to open it
  22. In the host file, write enter the local IP address, tab over, enter the new URL, (securitymatters.test), and then save the file
  23.        securitymatters.test
  24. To register the WebApp, go to the DataFlex Studio
  25. Select TOOLS from the top menu and select ‘Register WebApp’
  26. The web application name should be automatically entered 
  27. Select the correct website from the ‘Web Site’ drop down
  28. The ‘Virtual Directory Name’ field can be left blank
  29. Click OK
  30. Open the WebApp by double clicking on its name in the ‘Workspace Explorer’ on the right
  31. Press F5 to run it, and the application should properly open in a browser via HTTP.
  32. If HTTPS is explicitly added to the front of the URL, a warning page appears stating that the site is not secure. This is a result of having a self-assigned certificate.
  33. Depending on the browser, the site can be added as a security exception.
  34. Once done, the app will be running on HTTPS

Demonstration - session hijacking

Session hijacking is when someone’s unique login session details are intercepted and used from another computer allowing a malicious user to have the rights of person from which the details were stolen.

  1. To show this, from Firefox the WebApp is logged into using an administrator’s login credentials.
  2. Pressing F12 opens the development tools panel. A dfWebApp cookie is shown that contains a value of the logged in session.

  3. Opening Chrome to the same website, pressing F12 to open the developer’s tools, and viewing the cookies shows a dfWebApp cookie with a different value. Note, this is currently NOT a logged in session.
  4. Copying the session cookie value from the logged in session in Firefox, pasting it into the cookie value field in Chrome, and then refreshing Chrome now shows the WebApp as if the user is the logged in administrator.
  5. This is one of the dangers of not using HTTPS. 
  6. Two other risks; invalid JavaScript accessing the session details, and the session ID being leaked because the website can currently be accessed via HTTP. 
  7. To correct these risks, open the DataFlex Studio…
  8. Stop the debugger by pressing the ‘stop’ icon from the top toolbar
  9. In the ‘Workspace Explorer’ panel on the right expand ‘WebApp.src,’ and ‘Web Browser Objects,’ and double click on ‘SessionManager.wo’
  10. From the ‘Properties’ tab in the ‘Properties’ panel on the right set ‘pbSessionCookieHttpOnly’ value to ‘True.’ This ensures that the web browser does not expose access to the cookie to JavaScript or any other scripting language.
  11. From the same panel set ‘pbSessionCookieSecure’ value to ‘True.’ This makes it so that session cookies will only be created when using HTTPS.

  12. A redirection can also be setup to make it so that the site is only accessible via HTTPS.
  13. From IIS Manager, select ‘URL Rewrite’ from the IIS section in the center
  14. Then select ‘Add Rule(s)’ from the ‘Actions’ panel on the right.
  15. Select ‘Blank rule’ from the window and press OK
  16. Note: making rules can be quite complicated if inexperienced. This example will just review what is necessary for the rule that will be applied in this lesson.
  17. Enter a name
  18. The ‘Requested URL’ is set to ‘Matches the Pattern.’ Any pattern can be applied. 
  19. .* is used for this example
  20. Expanding the ‘Conditions’ section, select the ADD button.
  21. {HTTPS} is entered as the ‘Condition input’
  22. From the ‘Check if input string’ dropdown select ‘Does Not Match the Pattern’
  23. Enter “ON” into the ‘Pattern’ field. Press OK.

  24. In the ‘Action’ section…
  25. From the ‘Action type’ dropdown select ‘Redirect’
  26. In the ‘Redirect URL’ field enter https://{HTTP_HOST} {REQUEST_URI}
  27. Press APPLY and then ‘Back to rules’ in the ‘Actions’ panel on the right

  28. To test the redirect, reopen Firefox
  29. Enter the URL without HTTPS and press enter
  30. The app then opens to the proper HTTPS redirect

Demonstration part 2

  1. There are sophisticated security attacks that can still happen. They can downgrade the connection back to HTTP, for example. There are some simple ways of mitigating them.
  2. Open IIS Manager
  3. Select the website from the ‘Connections’ panel on the left
  4. Select ‘HTTP Response Headers’ from the ‘IIS’ section in the center panel
  5. Select ADD from the ‘Actions’ panel on the right
  6. Name the header. “Strict-Transport-Security” is used in this example.
  7. This header is sent with every request back to the browser, so that the browser knows to only access this website using HTTPS.
  8. Add a ‘Value’ to specify a certain timespan that this will be active. For testing, this example will set it to ten minutes. “max-age=600” is entered.
  9. This tells the browser that for 600 seconds is should not even try HTTP connections.
  10. These changes can be easily deployed to any application. Viewing the web.config file, found in the AppHtml directory in the workspace, shows all of the changes just made, and can be easily copied to other applications.