2. Agenda
• Introduction to the problem
- Why is it a problem?
- What is the impact?
- Demo
• What is JSPrime?
- What is it?
- Who is it for?
- How it works?
- What it can do?
- What it can’t do?
- Demo
• Conclusion and questions
3. Who am I?
• First time BlackHat speaker (at Vegas too)
• Senior Paranoid at Yahoo! Inc.
- Security Engineer at eBay Inc. (Past)
• Bug Bounty Hunter (FB, Mozilla, Nokia, Foursquare etc)
• Speaker at NullCon 2012, Goa, India
• Co-author of Ra.2: – DOM XSS Scanner Firefox add-on
• 5+ years of security self-studying
• Keyboard Player & Sports-bike enthusiast
4. Who is Sarathi?
• Experienced Application Developer, 7+ years
experience
• 5+ years at Yahoo! Inc.
• Full-time JSPrime Developer
• @sarathisahoo, http://fb.me/sarathi.sahoo
6. Introduction: The Problem
JavaScript is a dynamic language
• Object-based, properties created on demand
• Prototype-based inheritance
• First-class functions, closures
• Runtime types, coercions
7. Introduction: The Problem
• Client Side Script Injection
- DOM XSS
• Server Side Script Injection
- Node.JS Applications
8. Introduction: Why is it problem?
• Server side filtering fails for DOM XSS
• JavaScript code review is intimidating #iykwim
• Library dependent source-to-sink pairs
• Not Enough Scanners
9. Introduction: The Impact
• Same as regular XSS: Reflected or Stored
• Script Injection on server side or mobile device can be
really lethal.
• Node.JS, Firefox OS, Windows 8 Apps (WinJS)
11. Introducing JSPrime
• What is it?
• Who is it for?
• What it can do? Avoiding False positives
• What it can’t do? Knowing the False negatives
• Stability & Automation
• Demo
12. Introducing JSPrime: What is it?
• JSPrime is a light-weight source code scanner
for identifying security issues using static
analysis.
• It is written in JavaScript to analyze
JavaScript.
• Uses the open-source ECMAScript parser:
Esprima.org
13. Introducing JSPrime: Who is it for?
• JSPrime is mostly a developer centric tool.
• It can aid code reviewers for identifying security
issues in 1st pass.
• Security professionals may find it useful during
penetration testing engagements.
14. Introducing JSPrime: How it works?
• Feed the code to Esprima, to generate the AST.
• Parse the JSON AST, to locate all sources (including Objects,
Prototype) and keeping track of their scopes
• Parse the AST, to locate all assignment operations related to
the sources, while keeping track of their scopes
• Parse the AST to locate sinks and sink aliases, again keeping
track of their scope.
• Parse AST to locate functions (including closures, anon
functions) which are fed with sources as arguments and
while tracking down their return values.
15. Introducing JSPrime: How it works?
• Once all the sources, source aliases are collected we check
for any filter function on them, rejected if found.
• Remaining sources, source aliases are tracked for
assignments or pass as argument operations to the collected
sinks or sink aliases.
• We repeat the same process in reverse order to be sure that
we reach the same source when we traverse backwards, just
to be sure.
• Once we confirm that we extract the line numbers and their
statement and put it in the report we generate with
different color coding
16. Introducing JSPrime: What it can do?
• It can follow code execution order
• Handle First-class functions
• Analyze Prototype-based inheritance
• Understand type-casting
• Understand context-based filter functions (has to
be manually supplied, though)
• Library aware sources and sinks
• Variable, Objects, Functions scope aware analysis
• Control-flow analysis
• Data-flow analysis
17. Introducing JSPrime: What it can’t do?
• It can’t detect 100% of the issues.
• It can’t learn sources and sinks automatically
• It can’t handle obfuscated JavaScript
• It can’t report issues in minified JavaScript, unless
beautified.
• It can’t analyze dynamically generated JavaScript
using ‘eval’ or similar methods
18. Introducing JSPrime: Stability & Automation
• Handle up to 1500 LoC in a single scan
• Node.JS port is available for server-side web service
like setup
• Largely dependent on Esprima’s robustness, can be
the 1st point failure
Hello everyone! Good afternoon. I know its kind of tough to be in session right after the lunch. I will try to keep most of you remain awake during the talk. My name is Nishant Das Patnaik and for the next 45 or so I’m here to talk about JavaScript Static Security Analysis made easy with JSPrime. This talk is jointly prepared by me and SarathiSahoo. Before we start I would like to know how many of you are developers here? Javascript developers to be specific? Please raise your hands. Okay …great this talk will be more focused towards the work you do. So without any further adieu, lets begin.
We shall discuss about what is the problem? Why is it a problem and some demo of the problem. that we are trying to solve. Then we will discuss about our proof of concept solution that we call: JSPrime. We will try to know what is it? Who is it meant for? How it works? What it can do and what not to expect from it, YET? And finally I will show you some of demos of the tool and then we shall move on to conclusion and questions & answer session. Though I have kept a separate 10 mins slot for Q&A, but please feel free to stop me any moment, should you need any clarification or have any question. Sounds good? Awesome!
Okay before we start let me introduce myself to you guys. This is my first time at BlackHat. So please be kind to me, incase something doesn’t work as expected. Haha. I work as a Senior Paranoid at Yahoo, India. Prior to Yahoo I was at eBay. I enjoy hunting bug bounties and have been successful couple of times. I was a speaker at NullCon 2012, it’s a security conference that takes place in Goa, India. There we released a tool, Firefox addon to be specific, called Ra.2 which is a basic and lightweight DOM based XSS scanner. I have been self studying Security for more than 5 years now and have just managed to clear the noob level. I also enjoy playing bollywood tracks on keyboards and grand piano. Offlate I have turned into an sports bike enthusiast. That’s all and enough about me, let proceed.
Point #2: How many of you are involved the security review of javascript source codes?Point #4: What scanners/tools do you use? Open source / Commercial? Satisfaction level. Automation capability?