UKF COLLEGE OF ENGINEERING AND TECHNOLOGY SCHOOL OF
COMPUTER AND INFORMATION SCIENCE
DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING
PCCCT502-NETWORK AND SYSTEM SECURITY
Module 4: Web Security
1. Web Browser and Client Risk
How a Web Browser Works
A web browser is a software application used to access and view websites.
User Interface (UI): Includes the address bar, back/forward
buttons, and bookmarking menu.
Browser Engine: Marshals actions between the UI and the
rendering engine.
Rendering Engine: Responsible for displaying requested content
(e.g., parsing HTML and CSS to render the page).
Networking: Handles network calls like HTTP/HTTPS requests and
security.
JavaScript Interpreter: Parses and executes JavaScript code to
make websites interactive.
Data Storage: A lightweight database layer (like localStorage or
WebSQL) where the browser saves data locally (cookies, cache).
Web Browser Attacks
Browsers are primary targets because they handle sensitive user data and
interface directly with the internet.
Man-in-the-Browser (MitB): A Trojan horse infects the browser,
modifying web pages or transactions without the user's or website's
knowledge (often used to steal banking credentials).
Cross-Site Scripting (XSS): Malicious scripts are injected into
otherwise benign and trusted websites, executing in the user's
browser.
Cross-Site Request Forgery (CSRF): Forces an authenticated
end-user to execute unwanted actions on a web application they are
currently logged into.
Clickjacking: An attacker tricks a user into clicking a webpage
element that is invisible or disguised as another element.
Operating Safely
To mitigate client-side risks, implement the following best practices:
Keep Browsers Updated: Regularly apply patches to fix zero-day
vulnerabilities.
Use Extension Whitelisting: Limit extensions to trusted sources
to prevent malicious add-ons.
Enforce Same-Origin Policy (SOP): A critical security mechanism
that restricts how a document or script loaded from one origin can
interact with a resource from another origin.
Content Security Policy (CSP): An HTTP header that allows site
operators to restrict the resources (such as JavaScript, CSS, Images)
that the browser is allowed to load for a given page.
2. Web Security: HTTP and Content
How HTTP Works
Hypertext Transfer Protocol (HTTP) is an application-layer protocol used to
transmit hypermedia documents. It follows a classical client-server
model:
1. Request: The client (browser) opens a connection and sends a
request message consisting of a Request Line (e.g., GET /[Link]
HTTP/1.1), Headers, and an optional Body.
2. Response: The server processes the request and sends back a
response consisting of a Status Line (e.g., HTTP/1.1 200 OK),
Response Headers, and the requested Resource (Body).
Note on Security: Standard HTTP transmits data in plaintext, making it
vulnerable to eavesdropping. HTTPS (HTTP Secure) encrypts the
session using TLS/SSL.
Server and Client Contents
Client-Side Content: Code executed directly by the browser
(HTML, CSS, JavaScript). Risks involve script manipulation and client-
side data exposure.
Server-Side Content: Scripts and applications executed on the
web server (PHP, Python, Java, [Link], Databases). Risks involve
data leaks and unauthorized system access.
Attacking Web Servers
Attackers exploit vulnerabilities in the web server software, OS, or
backend applications.
SQL Injection (SQLi): Malicious SQL statements are inserted into
entry fields for execution (e.g., bypassing login screens or dumping
databases).
Directory Traversal: Exploiting insufficient security
validation/sanitization of user-supplied input file names to access
restricted directories and execute commands outside the web
server's root directory.
Denial of Service (DoS/DDoS): Flooding the web server with
more traffic than it can handle, rendering it unavailable to legitimate
users.
Web Services
Web services allow different applications to communicate over the
internet (e.g., via SOAP or REST APIs).
Security Risks: XML Injection, broken object-level authentication,
and mass assignment vulnerabilities.
Mitigation: Use API gateways, implement strong token-based
authentication (like OAuth2/JWT), and strictly validate all incoming
payloads.
3. E-mail Security
The E-mail Risk
E-mail was originally designed for open, trusted academic networks and
lacks built-in security features.
Eavesdropping: Email messages travel across multiple routers in
plaintext.
Spoofing: Attackers can easily forge the "From" address in an email
header.
Phishing & Spam: Malicious emails designed to steal credentials
or deliver malware.
Protocols
SMTP (Simple Mail Transfer Protocol): Used to send emails from
a client to a server or between servers. Port 25 (plaintext) or Port
465/587 (Secure).
POP3 (Post Office Protocol v3): Downloads emails from the
server to a local device and typically deletes them from the server.
Port 110 (or 995 secure).
IMAP (Internet Message Access Protocol): Syncs emails across
multiple devices, leaving messages on the server. Port 143 (or 993
secure).
Authentication
To prevent email spoofing and phishing, three core authentication
frameworks are used:
SPF (Sender Policy Framework): A DNS record specifying which
mail servers are authorized to send email on behalf of your domain.
DKIM (DomainKeys Identified Mail): Adds a cryptographic digital
signature to emails, verifying that the email was sent by the domain
owner and wasn’t altered in transit.
DMARC (Domain-based Message Authentication, Reporting,
and Conformance): Uses SPF and DKIM to determine the
authenticity of an email message and specifies how the receiver
should handle failures (e.g., reject or quarantine).
Operating Safely When Using Email
Encryption: Use end-to-end encryption tools like S/MIME
(Secure/Multipurpose Internet Mail Extensions) or PGP (Pretty Good
Privacy) to secure email content.
User Training: Recognize phishing indicators (e.g., urgent
language, mismatched URLs).
MFA: Enforce Multi-Factor Authentication on all email accounts.
4. Domain Name System (DNS) Security
DNS Basics and Purpose
The Domain Name System (DNS) acts as the phonebook of the Internet. It
translates human-readable domain names (e.g., [Link]) into
machine-readable IP addresses (e.g., [Link]).
Resolvers: The client-side component that initiates the query.
Name Servers: Servers that hold the DNS database records (A
records, MX records, etc.).
Security Issues with DNS
DNS inherently trusts responses without verifying their source. This lack of
authentication makes it susceptible to interception and manipulation.
DNS Attacks
DNS Cache Poisoning (DNS Spoofing): An attacker introduces
false information into a DNS resolver's cache. As a result, users are
redirected to a malicious website when attempting to visit a
legitimate one.
DNS Amplification Attack: A type of DDoS attack where the
attacker sends small requests with a spoofed source IP (the victim's
IP) to an open DNS resolver, which responds with a much larger
packet to the victim, overwhelming their network.
Solution - DNSSEC (DNS Security Extensions): DNSSEC secures DNS
by adding cryptographic digital signatures to existing DNS records. These
signatures are checked by the DNS resolver to ensure the record came
from the correct source and was not altered.
5. WAP Gateway
The Wireless Application Protocol (WAP) Gateway bridges cellular
networks and the Internet.
Purpose and Role
It acts as a proxy that translates requests from mobile devices
(using wireless protocols like WAP stack) into standard internet
protocols (like HTTP/TCP).
It compresses web content into smaller sizes suitable for low-
bandwidth mobile networks and early mobile screens.
Security Concerns
The "WAP Gap": To translate data, the gateway must decrypt
HTTPS traffic coming from the internet and re-encrypt it using
mobile security protocols (like WTLS - Wireless Transport Layer
Security). During this microsecond translation process inside the
gateway, the data exists in plaintext, creating a vulnerability if the
gateway server is compromised.