XSRF How it works 3 - form is submitted on bank.com 4 - bank.com - PowerPoint PPT Presentation

Feb 20, 2023 •365 likes •422 views

XSRF How it works 3 - form is submitted on bank.com 4 - bank.com helpfully transfers money into trouts account 2 - evil.fish includes form on bank.com 1-user goes to evil.fish Defenses Form keys Check HTTP referer CSRF

XSRF
How it works 3 - form is submitted on bank.com 4 - bank.com helpfully transfers money into trout’s account 2 - evil.fish includes form on bank.com 1-user goes to evil.fish
Defenses • Form keys • Check HTTP referer • CSRF tokens • Short cookie expiration date • Encourage users to log out
Homework • https://google-gruyere.appspot.com/

Recommend

SQL Injection Last Few Lectures XSS - Cross-site scripting XSRF/CSRF - Cross-site request

SQL Injection Last Few Lectures XSS - Cross-site scripting XSRF/CSRF - Cross-site request forgery Code Injection Attacks Attacker executes arbitrary code on server Programming the program Not sanitizing user

290 views • 11 slides

Public Works Department Public Works Department Public Works Department 2012-2017 Capital Works

Public Works Department Public Works Department Public Works Department 2012-2017 Capital Works and Budget Presentation Manitoba Heavy Construction Association March 7, 2012 Public Works Department Annual Roads and Bridges Budget Year

355 views • 21 slides

I want my MVP UX in the City - 20th April 2017 PILOT WORKS 1 Hello, I am Alastair from PILOT

I want my MVP UX in the City - 20th April 2017 PILOT WORKS 1 Hello, I am Alastair from PILOT WORKS 2 PILOT WORKS alastair@pilot.works What shall we build? 3 PILOT WORKS alastair@pilot.works PILOT WORKS alastair@pilot.works My

1.09k views • 78 slides

ArcelorMittal Newcastle Works June 2012 Contents About Newcastle Works Newcastle Works

ArcelorMittal Newcastle Works June 2012 Contents About Newcastle Works Newcastle Works Management Drives People Highlights of Newcastle Works 1 About Newcastle Works 2 ArcelorMittal South Africa Vanderbijlpark plant

749 views • 49 slides

PUBLIC WORKS DEPARTMENT PUBLIC WORKS DEPARTMENT The City of Rossland Public Works staff consists

PUBLIC WORKS DEPARTMENT PUBLIC WORKS DEPARTMENT The City of Rossland Public Works staff consists of 15 full time employees, 3 summer students and 1 seasonal winter employee. Areas included under Public Works are parks, arena, water treatment, water

664 views • 40 slides

How Colitag works: How Colitag works: Colitag is a dehydrated test culture medium Colitag is a

How Colitag works: How Colitag works: Colitag is a dehydrated test culture medium Colitag is a dehydrated test culture medium Colitag works through the presence of two indicators, ONPG Colitag works through the presence of two indicators,

469 views • 45 slides

Ontario Works Program Ontario Works To be eligible for Ontario Works, an applicant must be:

Ontario Works Program Ontario Works To be eligible for Ontario Works, an applicant must be: a resident of Ontario; in immediate financial need; and willing to participate in employment assistance activities. The amount of money

228 views • 19 slides

Maas Energy Works, Inc. Renewable Energy that Works Daryl Maas Chief Executive Officer

Maas Energy Works, Inc. Renewable Energy that Works Daryl Maas Chief Executive Officer Maas Energy Works Digester Projects California Sites Washington & Oregon Sites Why are we here? Maas aas Ene Energy Works s Verified d

455 views • 17 slides

Rookery South ERF CLP Meeting LLRS Works Update 12 th June 2017 LLRS Works Low Level

Rookery South ERF CLP Meeting LLRS Works Update 12 th June 2017 LLRS Works Low Level Restoration Scheme under the Review of Old Minerals Permission Works commenced 24 April Planned Completion 17 October LLRS Works Low Level

71 views • 4 slides

Technology & the Local Government Works Officer TECHNOLOGY & THE LOCAL GOVERNMENT WORKS

Technology & the Local Government Works Officer TECHNOLOGY & THE LOCAL GOVERNMENT WORKS OFFICER Technology & the LG Works Officer Introduction My works history Story of our technology Where we started Where are we

609 views • 22 slides

public works public works City of Buellton * February 13, 2013 OVERVIEW Public works covers the

public works public works City of Buellton * February 13, 2013 OVERVIEW Public works covers the management, planning, maintenance, operation and compliance of. water sewer roads sidewalks signs parks landscaping facilities transit storm

189 views • 6 slides

DESIGN-BUILD Projects July 16, 2020 LA COUNTY PUBLIC WORKS Los Angeles County Public Works

DESIGN-BUILD Projects July 16, 2020 LA COUNTY PUBLIC WORKS Los Angeles County Public Works Construction Management Mission Statement - To be the builder of choice for the County LA COUNTY PUBLIC WORKS - CHRONOLOGY LAC Public Works

408 views • 14 slides

XSS & CSRF Alex Infhr Whoami Alex Infhr @insertscript Cure53 MS IE Team

XSS & CSRF Alex Infhr Whoami Alex Infhr @insertscript Cure53 MS IE Team Browser PDF / file formats B Shark movies Topics of today XSS Cross Site Scripting XSRF/CSRF Cross Site Request Forgery

893 views • 56 slides

Writing Secure Code Wash all user-submitted data Vulnerabilities XSS - Cross-site scripting

Writing Secure Code Wash all user-submitted data Vulnerabilities XSS - Cross-site scripting Executing unauthorized code XSRF - Cross-site request forgery Remote execution for logged-in users SQL Injection A malicious variable placed into a

685 views • 18 slides

Preventing Security Bugs Through Software Design Christoph Kern, Google xtof@google.com The

Preventing Security Bugs Through Software Design Christoph Kern, Google xtof@google.com The Same Bugs, Over and Over Again... SQL-injection, XSS, XSRF, etc -- OWASP Top 10 Root cause Inherently bug-prone APIs Developers are

319 views • 28 slides

PRESENTATION OF SCIENTIFIC WORKS 1. The scientific works for the CLASA-Uruguay Congress will be

PRESENTATION OF SCIENTIFIC WORKS 1. The scientific works for the CLASA-Uruguay Congress will be presented in electronic posters during the congress. 2. All registered works must be original and displayed by its authors. They can be written in

272 views • 3 slides

Data Handling: Import, Cleaning and Visualisation Lecture 7: Data Sources, Data Gathering, Data

9/12/2019 Data Handling: Import, Cleaning and Visualisation Data Handling: Import, Cleaning and Visualisation Lecture 7: Data Sources, Data Gathering, Data Import Prof. Dr. Ulrich Matter 24/10/2019 file:///home/umatter/Dropbox/T

1.07k views • 54 slides

Data Handling: Import, Cleaning and Visualisation Lecture 8: Data Preparation Prof. Dr. Ulrich

9/12/2019 Data Handling: Import, Cleaning and Visualisation Data Handling: Import, Cleaning and Visualisation Lecture 8: Data Preparation Prof. Dr. Ulrich Matter 21/11/2019 file:///home/umatter/Dropbox/T

424 views • 19 slides

The Invariant Theory of Unipotent Groups Frank Grosshans Aachen RWTH June, 2010 Grosshans (West

The Invariant Theory of Unipotent Groups Frank Grosshans Aachen RWTH June, 2010 Grosshans (West Chester University) (Institute) Invariant theory of unipotent groups 06/2010 1 / 37 1. Introduction Notation C : complex numbers V :

504 views • 33 slides

Kisses To A Kiss Humid seal of soft affections, Tend'rest pledge of future bliss, Dearest

Kisses To A Kiss Humid seal of soft affections, Tend'rest pledge of future bliss, Dearest tie of young connections, Love's first snow-drop, virgin kiss . Rodin Speaking silence, dumb confession, Passion's birth, and infants' play,

661 views • 28 slides

Secure Programming Laboratory 3: Web app security Joseph Hallett and David Aspinall, Informatics

Secure Programming Laboratory 3: Web app security Joseph Hallett and David Aspinall, Informatics @ Edinburgh 14th March 2014 What is this lab about? Web app security with Gruyere Lab from Google Worth working through Were just

85 views • 5 slides

Experiences In Cyber Security Education: The MIT Lincoln Laboratory Capture-the-Flag Exercise*

Experiences In Cyber Security Education: The MIT Lincoln Laboratory Capture-the-Flag Exercise* Joseph Werther, Michael Zhivich, Timothy Leek, Nickolai Zeldovich Cyber Security Experimentation And Test 2011 8 August 2011 This work is

313 views • 15 slides

Multidimensional Scaling Max Turgeon STAT 4690Applied Multivariate Analysis Recap: PCA

Multidimensional Scaling Max Turgeon STAT 4690Applied Multivariate Analysis Recap: PCA We discussed several interpretations of PCA. Pearson : PCA gives the best linear approximation to the data (at a fjxed dimension). We also

712 views • 54 slides

Computer Security DD2395 http://www.csc.kth.se/utbildning/kth/kurser/DD2395/dasakh11/ Fall 2011

Computer Security DD2395 http://www.csc.kth.se/utbildning/kth/kurser/DD2395/dasakh11/ Fall 2011 Sonja Buchegger buc@kth.se Lecture 7 Malicious Software DD2395 Sonja Buchegger 1 Course Admin l Lab 2: - prepare before lab session - signup!

845 views • 39 slides

Download document

More recommend

Explore More Topics

Stay informed with curated content and fresh updates.

animals pets art culture automotive transportation business finance computer internet construction architecture education-career electronics communication

XSRF How it works 3 - form is submitted on bank.com 4 - bank.com - PowerPoint PPT Presentation

XSRF How it works 3 - form is submitted on bank.com 4 - bank.com helpfully transfers money into trouts account 2 - evil.fish includes form on bank.com 1-user goes to evil.fish Defenses Form keys Check HTTP referer CSRF

SQL Injection Last Few Lectures XSS - Cross-site scripting XSRF/CSRF - Cross-site request

Public Works Department Public Works Department Public Works Department 2012-2017 Capital Works

I want my MVP UX in the City - 20th April 2017 PILOT WORKS 1 Hello, I am Alastair from PILOT

ArcelorMittal Newcastle Works June 2012 Contents About Newcastle Works Newcastle Works

PUBLIC WORKS DEPARTMENT PUBLIC WORKS DEPARTMENT The City of Rossland Public Works staff consists

How Colitag works: How Colitag works: Colitag is a dehydrated test culture medium Colitag is a

Ontario Works Program Ontario Works To be eligible for Ontario Works, an applicant must be:

Maas Energy Works, Inc. Renewable Energy that Works Daryl Maas Chief Executive Officer

Rookery South ERF CLP Meeting LLRS Works Update 12 th June 2017 LLRS Works Low Level

Technology & the Local Government Works Officer TECHNOLOGY & THE LOCAL GOVERNMENT WORKS

public works public works City of Buellton * February 13, 2013 OVERVIEW Public works covers the

DESIGN-BUILD Projects July 16, 2020 LA COUNTY PUBLIC WORKS Los Angeles County Public Works

XSS & CSRF Alex Infhr Whoami Alex Infhr @insertscript Cure53 MS IE Team

Writing Secure Code Wash all user-submitted data Vulnerabilities XSS - Cross-site scripting

Preventing Security Bugs Through Software Design Christoph Kern, Google xtof@google.com The

PRESENTATION OF SCIENTIFIC WORKS 1. The scientific works for the CLASA-Uruguay Congress will be

Data Handling: Import, Cleaning and Visualisation Lecture 7: Data Sources, Data Gathering, Data

Data Handling: Import, Cleaning and Visualisation Lecture 8: Data Preparation Prof. Dr. Ulrich

The Invariant Theory of Unipotent Groups Frank Grosshans Aachen RWTH June, 2010 Grosshans (West

Kisses To A Kiss Humid seal of soft affections, Tend'rest pledge of future bliss, Dearest

Secure Programming Laboratory 3: Web app security Joseph Hallett and David Aspinall, Informatics

Experiences In Cyber Security Education: The MIT Lincoln Laboratory Capture-the-Flag Exercise*

Multidimensional Scaling Max Turgeon STAT 4690Applied Multivariate Analysis Recap: PCA

Computer Security DD2395 http://www.csc.kth.se/utbildning/kth/kurser/DD2395/dasakh11/ Fall 2011

Explore More Topics

Sambuz

Useful Links

Newsletter

Mail Us

XSRF How it works 3 - form is submitted on bank.com 4 - bank.com - PowerPoint PPT Presentation

XSRF How it works 3 - form is submitted on bank.com 4 - bank.com helpfully transfers money into trouts account 2 - evil.fish includes form on bank.com 1-user goes to evil.fish Defenses Form keys Check HTTP referer CSRF

SQL Injection Last Few Lectures XSS - Cross-site scripting XSRF/CSRF - Cross-site request

Public Works Department Public Works Department Public Works Department 2012-2017 Capital Works

I want my MVP UX in the City - 20th April 2017 PILOT WORKS 1 Hello, I am Alastair from PILOT

ArcelorMittal Newcastle Works June 2012 Contents About Newcastle Works Newcastle Works

PUBLIC WORKS DEPARTMENT PUBLIC WORKS DEPARTMENT The City of Rossland Public Works staff consists

How Colitag works: How Colitag works: Colitag is a dehydrated test culture medium Colitag is a

Ontario Works Program Ontario Works To be eligible for Ontario Works, an applicant must be:

Maas Energy Works, Inc. Renewable Energy that Works Daryl Maas Chief Executive Officer

Rookery South ERF CLP Meeting LLRS Works Update 12 th June 2017 LLRS Works Low Level

Technology &amp; the Local Government Works Officer TECHNOLOGY &amp; THE LOCAL GOVERNMENT WORKS

public works public works City of Buellton * February 13, 2013 OVERVIEW Public works covers the

DESIGN-BUILD Projects July 16, 2020 LA COUNTY PUBLIC WORKS Los Angeles County Public Works

XSS &amp; CSRF Alex Infhr Whoami Alex Infhr @insertscript Cure53 MS IE Team

Writing Secure Code Wash all user-submitted data Vulnerabilities XSS - Cross-site scripting

Preventing Security Bugs Through Software Design Christoph Kern, Google xtof@google.com The

PRESENTATION OF SCIENTIFIC WORKS 1. The scientific works for the CLASA-Uruguay Congress will be

Data Handling: Import, Cleaning and Visualisation Lecture 7: Data Sources, Data Gathering, Data

Data Handling: Import, Cleaning and Visualisation Lecture 8: Data Preparation Prof. Dr. Ulrich

The Invariant Theory of Unipotent Groups Frank Grosshans Aachen RWTH June, 2010 Grosshans (West

Kisses To A Kiss Humid seal of soft affections, Tend'rest pledge of future bliss, Dearest

Secure Programming Laboratory 3: Web app security Joseph Hallett and David Aspinall, Informatics

Experiences In Cyber Security Education: The MIT Lincoln Laboratory Capture-the-Flag Exercise*

Multidimensional Scaling Max Turgeon STAT 4690Applied Multivariate Analysis Recap: PCA

Computer Security DD2395 http://www.csc.kth.se/utbildning/kth/kurser/DD2395/dasakh11/ Fall 2011

Explore More Topics

Sambuz

Useful Links

Newsletter

Mail Us

Technology & the Local Government Works Officer TECHNOLOGY & THE LOCAL GOVERNMENT WORKS

XSS & CSRF Alex Infhr Whoami Alex Infhr @insertscript Cure53 MS IE Team