TIL: Web Security Fundamentals and OWASP Best Practices

1
2
3
4
5
6
7
8
9

Key Cheat Sheets for Developers:
- Authentication Cheat Sheet
- Authorization Cheat Sheet  
- Cross-Site Request Forgery Prevention
- Cross-Site Scripting Prevention
- SQL Injection Prevention
- Input Validation Cheat Sheet
- Session Management Cheat Sheet
- Transport Layer Protection

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52

# Flask implementation with secure headers
from flask import Flask, make_response
from functools import wraps

app = Flask(__name__)

def add_security_headers(f):
    @wraps(f)
    def decorated_function(*args, **kwargs):
        response = make_response(f(*args, **kwargs))
        
        # Content Security Policy
        response.headers['Content-Security-Policy'] = (
            "default-src 'self'; "
            "script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; "
            "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; "
            "font-src 'self' https://fonts.gstatic.com; "
            "img-src 'self' data: https:; "
            "connect-src 'self'; "
            "frame-ancestors 'none';"
        )
        
        # Strict Transport Security
        response.headers['Strict-Transport-Security'] = (
            'max-age=31536000; includeSubDomains; preload'
        )
        
        # X-Frame-Options
        response.headers['X-Frame-Options'] = 'DENY'
        
        # X-Content-Type-Options
        response.headers['X-Content-Type-Options'] = 'nosniff'
        
        # X-XSS-Protection (legacy browsers)
        response.headers['X-XSS-Protection'] = '1; mode=block'
        
        # Referrer Policy
        response.headers['Referrer-Policy'] = 'strict-origin-when-cross-origin'
        
        # Permissions Policy
        response.headers['Permissions-Policy'] = (
            'geolocation=(), microphone=(), camera=(), '
            'payment=(), usb=(), magnetometer=(), gyroscope=()'
        )
        
        return response
    return decorated_function

@app.route('/')
@add_security_headers
def home():
    return '<h1>Secure Application</h1>'

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

from secure import Secure
from flask import Flask

app = Flask(__name__)
secure_headers = Secure()

@app.after_request
def set_secure_headers(response):
    secure_headers.framework.flask(response)
    return response

# Custom secure headers configuration
custom_secure = Secure(
    csp=Secure.ContentSecurityPolicy(
        default_src=["'self'"],
        script_src=["'self'", "'unsafe-inline'"],
        style_src=["'self'", "'unsafe-inline'", "https://fonts.googleapis.com"],
        font_src=["'self'", "https://fonts.gstatic.com"],
        img_src=["'self'", "data:", "https:"]
    ),
    hsts=Secure.StrictTransportSecurity(
        max_age=31536000,
        include_subdomains=True,
        preload=True
    ),
    xfo=Secure.XFrameOptions.DENY,
    xss=Secure.XXSSProtection.ENABLED_MODE_BLOCK,
    content=Secure.XContentTypeOptions.NOSNIFF,
    referrer=Secure.ReferrerPolicy.STRICT_ORIGIN_WHEN_CROSS_ORIGIN
)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

# Install hsecscan
pip install hsecscan

# Scan a website for security headers
hsecscan https://example.com

# Check specific headers
hsecscan --headers csp,hsts,xfo https://example.com

# JSON output for automation
hsecscan --json https://example.com

# Scan multiple URLs
echo "https://site1.com\nhttps://site2.com" | hsecscan --stdin

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55

import subprocess
import json

def security_audit(url):
    """Automated security header audit"""
    result = subprocess.run(
        ['hsecscan', '--json', url],
        capture_output=True,
        text=True
    )
    
    if result.returncode == 0:
        data = json.loads(result.stdout)
        
        security_score = 0
        recommendations = []
        
        # Check for critical headers
        if data.get('csp'):
            security_score += 30
        else:
            recommendations.append("Implement Content Security Policy")
        
        if data.get('hsts'):
            security_score += 25
        else:
            recommendations.append("Add Strict-Transport-Security header")
        
        if data.get('xfo') or data.get('frame_ancestors'):
            security_score += 20
        else:
            recommendations.append("Prevent clickjacking with X-Frame-Options")
        
        if data.get('xcto'):
            security_score += 15
        else:
            recommendations.append("Add X-Content-Type-Options: nosniff")
        
        if data.get('xxp'):
            security_score += 10
        else:
            recommendations.append("Add X-XSS-Protection header")
        
        return {
            'url': url,
            'security_score': security_score,
            'recommendations': recommendations,
            'headers': data
        }
    
    return None

# Usage
audit_result = security_audit('https://example.com')
print(f"Security Score: {audit_result['security_score']}/100")

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58

# Comprehensive Flask security configuration
from flask import Flask, request, session
from werkzeug.middleware.proxy_fix import ProxyFix
import secrets
import hashlib

app = Flask(__name__)

# Security configuration
app.config.update(
    SECRET_KEY=secrets.token_hex(32),  # Strong secret key
    SESSION_COOKIE_SECURE=True,        # HTTPS only
    SESSION_COOKIE_HTTPONLY=True,      # No JavaScript access
    SESSION_COOKIE_SAMESITE='Strict',  # CSRF protection
    PERMANENT_SESSION_LIFETIME=1800,   # 30 minutes
    MAX_CONTENT_LENGTH=16 * 1024 * 1024  # 16MB upload limit
)

# Trust proxy headers for HTTPS detection
app.wsgi_app = ProxyFix(app.wsgi_app, x_for=1, x_proto=1, x_host=1, x_prefix=1)

@app.before_request
def security_checks():
    # Force HTTPS in production
    if not request.is_secure and app.env == 'production':
        return redirect(request.url.replace('http://', 'https://'))
    
    # Basic rate limiting by IP
    client_ip = request.remote_addr
    if is_rate_limited(client_ip):
        abort(429)  # Too Many Requests
    
    # Content-Type validation for POST requests
    if request.method == 'POST':
        if not request.content_type:
            abort(400)  # Bad Request
            
        allowed_types = ['application/json', 'application/x-www-form-urlencoded']
        if not any(ct in request.content_type for ct in allowed_types):
            abort(415)  # Unsupported Media Type

def is_rate_limited(ip):
    # Simple in-memory rate limiting (use Redis in production)
    from collections import defaultdict
    import time
    
    rate_limits = defaultdict(list)
    current_time = time.time()
    
    # Clean old entries
    rate_limits[ip] = [t for t in rate_limits[ip] if current_time - t < 60]
    
    # Check rate limit (10 requests per minute)
    if len(rate_limits[ip]) >= 10:
        return True
    
    rate_limits[ip].append(current_time)
    return False

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

# Find processes by name pattern
pidof nginx
pidof "python.*app.py"

# List open files by process
lsof -p $(pidof nginx)

# Find processes using specific ports
lsof -i :80
lsof -i :443

# Kill processes with specific signals
kill -TERM $(pidof nginx)    # Graceful termination
kill -KILL $(pidof nginx)    # Force kill
kill -STOP $(pidof nginx)    # Suspend process
kill -CONT $(pidof nginx)    # Resume process

# Monitor process activity
lsof -c nginx               # All files opened by nginx
lsof /var/log/nginx/        # Processes accessing nginx logs

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

# Generate random bytes
head -c 32 /dev/urandom | base64

# Random passwords
head -c 32 /dev/urandom | base64 | tr -d "=+/" | cut -c1-25

# Random hex strings
head -c 16 /dev/urandom | xxd -p -c 16

# /dev/random vs /dev/urandom
# /dev/random: Blocks when entropy pool is depleted (cryptographically secure)
# /dev/urandom: Never blocks (suitable for most applications)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

import os
import secrets

# Secure random generation
def generate_secure_token(length=32):
    """Generate cryptographically secure random token"""
    return secrets.token_urlsafe(length)

def generate_session_id():
    """Generate secure session identifier"""
    return secrets.token_hex(16)

def generate_api_key():
    """Generate API key with entropy check"""
    # Use /dev/urandom directly for system integration
    random_bytes = os.urandom(32)
    return base64.urlsafe_b64encode(random_bytes).decode('ascii').rstrip('=')

# Password salt generation
def generate_salt():
    return os.urandom(16)

def hash_password(password, salt=None):
    """Secure password hashing"""
    if salt is None:
        salt = generate_salt()
    
    # Using PBKDF2 with SHA-256
    key = hashlib.pbkdf2_hmac('sha256', password.encode(), salt, 100000)
    return salt + key

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

# By default, containers can reach any server the host can reach
docker run --rm alpine wget -O- https://external-api.com

# Restrict network access with custom networks
docker network create --internal secure-network
docker run --network secure-network alpine

# Use host network isolation
docker run --network none alpine  # No network access

# Specific port binding
docker run -p 127.0.0.1:8080:80 nginx  # Bind only to localhost

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

# Security-hardened Dockerfile
FROM python:3.11-slim

# Create non-root user
RUN groupadd -r appuser && useradd -r -g appuser appuser

# Install security updates
RUN apt-get update && apt-get upgrade -y \
    && apt-get clean \
    && rm -rf /var/lib/apt/lists/*

# Set secure permissions
COPY --chown=appuser:appuser app.py /app/
WORKDIR /app

# Switch to non-root user
USER appuser

# Health check
HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
    CMD curl -f http://localhost:8000/health || exit 1

EXPOSE 8000
CMD ["python", "app.py"]

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37

def comprehensive_security_test(target_url):
    """Automated security testing framework"""
    tests = {
        'headers': test_security_headers,
        'ssl': test_ssl_configuration,
        'cookies': test_cookie_security,
        'forms': test_form_security,
        'authentication': test_auth_mechanisms,
        'authorization': test_access_controls,
        'input_validation': test_input_validation,
        'error_handling': test_error_disclosure
    }
    
    results = {}
    for test_name, test_func in tests.items():
        try:
            results[test_name] = test_func(target_url)
        except Exception as e:
            results[test_name] = {'error': str(e)}
    
    return generate_security_report(results)

def test_security_headers(url):
    """Test for presence and configuration of security headers"""
    import requests
    
    response = requests.get(url)
    headers = response.headers
    
    return {
        'csp': headers.get('Content-Security-Policy'),
        'hsts': headers.get('Strict-Transport-Security'),
        'xfo': headers.get('X-Frame-Options'),
        'xcto': headers.get('X-Content-Type-Options'),
        'xxp': headers.get('X-XSS-Protection'),
        'referrer_policy': headers.get('Referrer-Policy')
    }

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49

# Security monitoring and alerting
import logging
import smtplib
from datetime import datetime

class SecurityMonitor:
    def __init__(self, alert_email=None):
        self.alert_email = alert_email
        self.security_logger = logging.getLogger('security')
        
    def log_security_event(self, event_type, details, severity='INFO'):
        """Log security events with structured data"""
        log_entry = {
            'timestamp': datetime.utcnow().isoformat(),
            'event_type': event_type,
            'severity': severity,
            'details': details,
            'source_ip': getattr(request, 'remote_addr', 'unknown'),
            'user_agent': getattr(request, 'user_agent', 'unknown')
        }
        
        self.security_logger.log(
            getattr(logging, severity),
            f"SECURITY_EVENT: {log_entry}"
        )
        
        # Alert on high-severity events
        if severity in ['WARNING', 'ERROR', 'CRITICAL']:
            self.send_security_alert(log_entry)
    
    def send_security_alert(self, event_data):
        """Send email alerts for critical security events"""
        if self.alert_email:
            # Implementation would send email notifications
            pass

# Usage in Flask application
security_monitor = SecurityMonitor(alert_email='[email protected]')

@app.before_request
def security_monitoring():
    # Monitor for suspicious patterns
    if detect_sql_injection_attempt(request):
        security_monitor.log_security_event(
            'SQL_INJECTION_ATTEMPT',
            {'url': request.url, 'data': request.get_data()},
            'CRITICAL'
        )
        abort(400)