SlideShare una empresa de Scribd logo

SAST für TYPO3 Extensions

•
•
Oliver Hader
Oliver Hader

This document discusses using static application security testing (SAST) tools for TYPO3 extensions. It begins with an introduction of the speaker and an overview of SAST basics and context. Several SAST tools are then evaluated using a demo TYPO3 application, finding that PsalmPHP is most suitable due to its support for PHP features. Next, how PsalmPHP can be used for TYPO3 is explained through stubs, annotations, and a demo runner. Finally, future steps are outlined to improve support for additional TYPO3 components and integrate SAST into the extension review process.

Tecnología
1 de 37
Descargar para leer sin conexión
SAST für TYPO3 Extensions 
 #T3CRR21 #security Oliver Hader oliver@typo3.org @ohader TYPO3camp RheinRuhr 2021 6. November 2021
TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 2 ▪Research & Development ▪TYPO3 Security Team Lead ▪50% TYPO3 GmbH / 50% Freelancer ▪#hof #cycling #paramedic #in.die.musik ~# whoami Oliver Hader @ohader
TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 3 ▪Statische Code Analyse #basics ▪Orientierung im Security Bereich #context ▪Verwendung für TYPO3 #nähkästchen ▪MüssteMalJemand™ #zukunft Agenda
TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 4 ▪ Bitte, bitte, bitte: Security Schwachstellen nicht öffentlich einstellen/diskutieren ▪ nicht auf GitHub/Forge ▪ nicht in Slack Channels ▪ nicht auf Twitter, Twitch, ... ▪ Meldung an security@typo3.org ▪ Security Team unterstützt Community Trigger Warning ⚠︎
TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org #basics Statische Code 
 Analyse 5
TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 6 Statische Code Analyse - Schematischer Ablauf Statische Code Analyse https://www.grammatech.com/products/source-code-analysis
Abstract Syntax Tree (AST) ▪ Abstract Syntax Tree (AST) ▪ Composer Package 
 nikic/php-parser 7 TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org
Abstract Syntax Tree (AST) ▪ Abstract Syntax Tree (AST) ▪ Composer Package 
 nikic/php-parser 8 TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org
Statische Code Analyse in PHP ▪ basierend auf 
 Abstract Syntax Tree (AST) ▪ Extension Scanner in TYPO3 ▪ PhpStan - Core CI Builds ▪ Rector - TYPO3 Code Upgrade ▪ Psalm - Security Taint Graph 9 TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org
TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org #context 
 Orientierung im 
 Security Bereich 10
Ebenenmodell zur Sicherheitskonzeption (BSI) 11 TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org https://www.bsi.bund.de/DE/Themen/Unternehmen-und-Organisationen/Informationen-und-Empfehlungen/Empfehlungen-nach-Angriffszielen/Webanwendungen/webanwendungen_node.html Auf Grundlage eines Ebenenmodells lassen sich die Zuständigkeiten der relevanten Organisationsbereiche den einzelnen Teilaufgaben bei Sicherheitskonzeption und Realisierung von Webanwendungen zuordnen. Ausgangspunkt ist eine Unterteilung in 5 Ebenen: Abbildung 1: Ebenenmodell Ebene Inhalt (Beispiele) 5 Semantik Schutz vor Täuschung und Betrug - Informationen ermöglichen Social Engineering-Angriffe - Gebrauch von Popups u.ä. erleichtern Phishing-Angriffe - Keine Absicherung für den Fall der Fälschung der Web­ site 4 Logik Absicherung von Prozessen und Workflows als Ganzes - Verwendung unsicherer Email in einem ansonsten gesi­ cherten Workflow - Angreifbarkeit des Passworts durch nachlässig gestaltete "Passwort vergessen"-Funktion - Die Verwendung sicherer Passworte wird nicht erzwun­ gen 3 Implementie­ rung Vermeiden von Programmierfehlern, die zu Schwachstellen führen - Cross-Site Scripting - SQL-Injection - Session Riding 2 Technologie Richtige Wahl und sicherer Einsatz von Technologie - unverschlüsselte Übertragung sensitiver Daten - Authentisierungsverfahren, die nicht dem Schutzbedarf angemessen sind - Ungenügende Randomness von Token 1 System Absicherung der auf der Systemplattform eingesetzten Software - Fehler in der Konfiguration des Webservers - "Known Vulnerabilities" in den eingesetzten Software­ produkten - Mangelnder Zugriffsschutz in der Datenbank 0 Netzwerk & Host Absicherung von Host und Netzwerk Sicherheit von Webanwendungen Maßnahmenkatalog und Best Practices Im Auftrag des Bundesamtes für Sicherheit in der Informationstechnik erstellt von: Version 1, August 2006 SAST #bugs #infrastructure #workflows #phishing #SocialEngineering
TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org Marktanalyse - Statische Code Analyse für TYPO3 12 ▪ SonarSource, SonarCloud, SonarCube ▪ RIPS Tech Scanner ▪ DeepCode.ai ▪ PsalmPHP https://github.com/ohader/sast-demo
TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 13 Demo Anwendung (vereinfacht) https://github.com/ohader/sast-demo
TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 14 Demo Anwendung (vereinfacht) https://github.com/ohader/sast-demo SQLi Benutzereingaben XSS
TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 15 SonarCloud (SonarSource) → „Alles supi!“ #nicht SonarCloud
TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 16 RIPS Tech Scanner → übernommen von SonarSource RIPS Tech Scanner UNRELATED! 
 ganz anderes Projekt
TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 17 DeepCode.ai → übernommen von Snyk.io → Schwachstellen gefunden DeepCode.ai / Snyk.io
TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 18 PsalmPHP (https://psalm.dev/r/159771bec7) → Schwachstellen gefunden PsalmPHP
TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org Marktanalyse - Statische Code Analyse für TYPO3 19 ▪ SonarSource, SonarCloud, SonarCube - nichts gefunden 😵 ▪ RIPS Tech Scanner - Schwachstellen vermutlich gefunden 🙄 ▪ im Mai 2020 von SonarSource übernommen ▪ DeepCode.ai - Schwachstellen gefunden 😅 ▪ im August 2020 von Snyk.io übernommen ▪ PsalmPHP - Schwachstellen gefunden 😅
TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 20 Demo Anwendung (realistischer) https://github.com/ohader/sast-demo
Demo Anwendung (realistischer) ▪ TYPO3 ist speziell! ▪ fehlende Unterstützung für 
 Framework Komponenten ▪ PSR: Request/Response ▪ PSR: Dependency Injection ▪ Fluid: Templating Engine ▪ DBAL: Datenbank Schicht ▪ TYPO3: Hooks, TypoScript 21 TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org SQLi Injection XSS
TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org #nähkästchen 
 Verwendung für TYPO3 22
TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org SAST für TYPO3 mit PsalmPHP 23 ▪ PsalmPHP für TYPO3 ▪ Open-Source Project (MIT) ▪ Implementiert in PHP ▪ Erweiterbar durch Plugins ▪ unterstützt sources, sinks, 
 escapes, unescapes, flow https://github.com/vimeo/psalm
TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 24 PsalmPHP Stubs ▪ @template ▪ liefert Instanz 
 von $className
TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 25 PsalmPHP Stubs ▪ @psalm-taint-source ▪ Rückgabewerte sind 
 Benutzereingaben ▪ wie $_GET, $_POST, $_COOKIE, HTTP Header
TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 26 PsalmPHP Stubs ▪ @psalm-taint-sink ▪ verwundbar in Aspekt sql, wenn Parameter $query aus unsicherer 
 @psalm-taint-source
TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 27 PsalmPHP Stubs ▪ @psalm-taint-escape ▪ markiert Parameter $str für Aspekt sql als bereinigt ▪ @psalm-taint-unescape ▪ … das Gegenteil (unsicher)
TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 28 typo3-security/psalm-plugin - nicht öffentlich TYPO3 Plugin für PsalmPHP
TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 29 Kompakte Ausgabe Demo TYPO3 Psalm-Runner
TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 30 Ausführlichere Ausgabe Demo TYPO3 Psalm-Runner
TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 31 SARIF Export & GitHub Integration Demo TYPO3 Psalm-Runner
TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 32 SARIF Export & GitHub Integration Demo TYPO3 Psalm-Runner
TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 33 SARIF Export & GitHub Integration Demo TYPO3 Psalm-Runner
TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org #zukunft 
 MüssteMalJemand™ 34
TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org Nächste Schritte 35 ▪ Erweiterung der Stub-Deklarationen (Hooks, Fluid, TypoScript) ▪ Erweiterung für bekannte/bereinigte Verwundbarkeiten ▪ Infrastruktur & Queue für regelmäßige Extension Scans ▪ Freigabe für (echte) Extension Maintainer & Integration in TER ▪ (mögliche Fundstellen müssen natürlich auch bereinigt werden)
TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org Nächste Schritte 36 ▪ TYPO3 Psalm-Plugin & Psalm-Runner vorerst nicht öffentlich ▪ evtl. Public-Beta über Verified Extensions (@VolkerGraubaum) ▪ Entwicklung wird durch TYPO3 Association finanziert ▪ Interessierte/Supporter bitte unter security@typo3.org melden
thanks! questions? 37

Recomendados

Hacking TYPO3 v9
Hacking TYPO3 v9Hacking TYPO3 v9
Hacking TYPO3 v9Oliver Hader
 
Hacking TYPO3 v9 (T3DD19 edition)
Hacking TYPO3 v9 (T3DD19 edition)Hacking TYPO3 v9 (T3DD19 edition)
Hacking TYPO3 v9 (T3DD19 edition)Oliver Hader
 
Web Application Security Workshop (T3DD19)
Web Application Security Workshop (T3DD19)Web Application Security Workshop (T3DD19)
Web Application Security Workshop (T3DD19)Oliver Hader
 
H4CK1N6 - Web Application Security
H4CK1N6 - Web Application SecurityH4CK1N6 - Web Application Security
H4CK1N6 - Web Application SecurityOliver Hader
 
TYPO3 Backstage Development
TYPO3 Backstage DevelopmentTYPO3 Backstage Development
TYPO3 Backstage DevelopmentOliver Hader
 
TYPO3 Event Sourcing
TYPO3 Event SourcingTYPO3 Event Sourcing
TYPO3 Event SourcingOliver Hader
 
How to steal and modify data using Business Logic flaws - Insecure Direct Obj...
How to steal and modify data using Business Logic flaws - Insecure Direct Obj...How to steal and modify data using Business Logic flaws - Insecure Direct Obj...
How to steal and modify data using Business Logic flaws - Insecure Direct Obj...Frans Rosén
 
Standardizing and Strengthening Security to Lower Costs
Standardizing and Strengthening Security to Lower CostsStandardizing and Strengthening Security to Lower Costs
Standardizing and Strengthening Security to Lower CostsOpenDNS
 

Recomendados

Hacking TYPO3 v9
Hacking TYPO3 v9Hacking TYPO3 v9
Hacking TYPO3 v9Oliver Hader
 
Hacking TYPO3 v9 (T3DD19 edition)
Hacking TYPO3 v9 (T3DD19 edition)Hacking TYPO3 v9 (T3DD19 edition)
Hacking TYPO3 v9 (T3DD19 edition)Oliver Hader
 
Web Application Security Workshop (T3DD19)
Web Application Security Workshop (T3DD19)Web Application Security Workshop (T3DD19)
Web Application Security Workshop (T3DD19)Oliver Hader
 
H4CK1N6 - Web Application Security
H4CK1N6 - Web Application SecurityH4CK1N6 - Web Application Security
H4CK1N6 - Web Application SecurityOliver Hader
 
TYPO3 Backstage Development
TYPO3 Backstage DevelopmentTYPO3 Backstage Development
TYPO3 Backstage DevelopmentOliver Hader
 
TYPO3 Event Sourcing
TYPO3 Event SourcingTYPO3 Event Sourcing
TYPO3 Event SourcingOliver Hader
 
How to steal and modify data using Business Logic flaws - Insecure Direct Obj...
How to steal and modify data using Business Logic flaws - Insecure Direct Obj...How to steal and modify data using Business Logic flaws - Insecure Direct Obj...
How to steal and modify data using Business Logic flaws - Insecure Direct Obj...Frans Rosén
 
Standardizing and Strengthening Security to Lower Costs
Standardizing and Strengthening Security to Lower CostsStandardizing and Strengthening Security to Lower Costs
Standardizing and Strengthening Security to Lower CostsOpenDNS
 
Testing iOS apps without jailbreak in 2018
Testing iOS apps without jailbreak in 2018Testing iOS apps without jailbreak in 2018
Testing iOS apps without jailbreak in 2018SecuRing
 
CMS Hacking Tricks - DerbyCon 4 - 2014
CMS Hacking Tricks - DerbyCon 4 - 2014CMS Hacking Tricks - DerbyCon 4 - 2014
CMS Hacking Tricks - DerbyCon 4 - 2014Greg Foss
 
Paolo Passeri - A Multi Layered Approach to Threat Intelligence
Paolo Passeri - A Multi Layered Approach to Threat IntelligencePaolo Passeri - A Multi Layered Approach to Threat Intelligence
Paolo Passeri - A Multi Layered Approach to Threat IntelligenceCodemotion
 
Building & Hacking Modern iOS Apps
Building & Hacking Modern iOS AppsBuilding & Hacking Modern iOS Apps
Building & Hacking Modern iOS AppsSecuRing
 
Internet of Terrible: Can you hear me meow?
Internet of Terrible: Can you hear me meow?Internet of Terrible: Can you hear me meow?
Internet of Terrible: Can you hear me meow?Brandon McCrillis
 
TRITON: The Next Generation of ICS Malware
TRITON: The Next Generation of ICS MalwareTRITON: The Next Generation of ICS Malware
TRITON: The Next Generation of ICS MalwareThomas Roccia
 
Building&Hacking modern iOS apps
Building&Hacking modern iOS appsBuilding&Hacking modern iOS apps
Building&Hacking modern iOS appsSecuRing
 
Securing Your BBC Identity
Securing Your BBC IdentitySecuring Your BBC Identity
Securing Your BBC IdentityMarc Littlemore
 
Mobile Penetration Testing: Episode 1 - The Forensic Menace
Mobile Penetration Testing: Episode 1 - The Forensic MenaceMobile Penetration Testing: Episode 1 - The Forensic Menace
Mobile Penetration Testing: Episode 1 - The Forensic MenaceNowSecure
 
REST API Pentester's perspective
REST API Pentester's perspectiveREST API Pentester's perspective
REST API Pentester's perspectiveSecuRing
 
Networking 2016-05-24 - Topic 1- Cybereason Lab Analysis by Brad Green
Networking 2016-05-24 - Topic 1- Cybereason Lab Analysis by Brad Green Networking 2016-05-24 - Topic 1- Cybereason Lab Analysis by Brad Green
Networking 2016-05-24 - Topic 1- Cybereason Lab Analysis by Brad Green North Texas Chapter of the ISSA
 
Magento Security Best Practises - MM17DE
Magento Security Best Practises - MM17DEMagento Security Best Practises - MM17DE
Magento Security Best Practises - MM17DEAnna Völkl
 
Networking 2016-05-24 - Topic 2 - The "Hack Back" - How Hacking Team Became t...
Networking 2016-05-24 - Topic 2 - The "Hack Back" - How Hacking Team Became t...Networking 2016-05-24 - Topic 2 - The "Hack Back" - How Hacking Team Became t...
Networking 2016-05-24 - Topic 2 - The "Hack Back" - How Hacking Team Became t...North Texas Chapter of the ISSA
 
Deception Driven Defense - Infragard 2016
Deception Driven Defense - Infragard 2016Deception Driven Defense - Infragard 2016
Deception Driven Defense - Infragard 2016Greg Foss
 
T3DD23 Content Security Policy - Concept, Strategies & Pitfalls
T3DD23 Content Security Policy - Concept, Strategies & PitfallsT3DD23 Content Security Policy - Concept, Strategies & Pitfalls
T3DD23 Content Security Policy - Concept, Strategies & PitfallsOliver Hader
 
Top 10 most interesting vulnerabilities and attacks in SAP
Top 10 most interesting vulnerabilities and attacks in SAPTop 10 most interesting vulnerabilities and attacks in SAP
Top 10 most interesting vulnerabilities and attacks in SAPERPScan
 
Beyond Web Interfaces
Beyond Web InterfacesBeyond Web Interfaces
Beyond Web Interfacesciacchi
 
Architecting next generation big data platform
Architecting next generation big data platformArchitecting next generation big data platform
Architecting next generation big data platformhadooparchbook
 
PyCon Canada 2015 - Is your python application secure
PyCon Canada 2015 - Is your python application securePyCon Canada 2015 - Is your python application secure
PyCon Canada 2015 - Is your python application secureIMMUNIO
 
MLSEC 2020
MLSEC 2020MLSEC 2020
MLSEC 2020Zoltan Balazs
 
RIoT (Raiding Internet of Things) by Jacob Holcomb
RIoT (Raiding Internet of Things) by Jacob HolcombRIoT (Raiding Internet of Things) by Jacob Holcomb
RIoT (Raiding Internet of Things) by Jacob HolcombPriyanka Aash
 
Is your python application secure? - PyCon Canada - 2015-11-07
Is your python application secure? - PyCon Canada - 2015-11-07Is your python application secure? - PyCon Canada - 2015-11-07
Is your python application secure? - PyCon Canada - 2015-11-07Frédéric Harper
 

Más contenido relacionado

La actualidad más candente

Testing iOS apps without jailbreak in 2018
Testing iOS apps without jailbreak in 2018Testing iOS apps without jailbreak in 2018
Testing iOS apps without jailbreak in 2018SecuRing
 
CMS Hacking Tricks - DerbyCon 4 - 2014
CMS Hacking Tricks - DerbyCon 4 - 2014CMS Hacking Tricks - DerbyCon 4 - 2014
CMS Hacking Tricks - DerbyCon 4 - 2014Greg Foss
 
Paolo Passeri - A Multi Layered Approach to Threat Intelligence
Paolo Passeri - A Multi Layered Approach to Threat IntelligencePaolo Passeri - A Multi Layered Approach to Threat Intelligence
Paolo Passeri - A Multi Layered Approach to Threat IntelligenceCodemotion
 
Building & Hacking Modern iOS Apps
Building & Hacking Modern iOS AppsBuilding & Hacking Modern iOS Apps
Building & Hacking Modern iOS AppsSecuRing
 
Internet of Terrible: Can you hear me meow?
Internet of Terrible: Can you hear me meow?Internet of Terrible: Can you hear me meow?
Internet of Terrible: Can you hear me meow?Brandon McCrillis
 
TRITON: The Next Generation of ICS Malware
TRITON: The Next Generation of ICS MalwareTRITON: The Next Generation of ICS Malware
TRITON: The Next Generation of ICS MalwareThomas Roccia
 
Building&Hacking modern iOS apps
Building&Hacking modern iOS appsBuilding&Hacking modern iOS apps
Building&Hacking modern iOS appsSecuRing
 
Securing Your BBC Identity
Securing Your BBC IdentitySecuring Your BBC Identity
Securing Your BBC IdentityMarc Littlemore
 
Mobile Penetration Testing: Episode 1 - The Forensic Menace
Mobile Penetration Testing: Episode 1 - The Forensic MenaceMobile Penetration Testing: Episode 1 - The Forensic Menace
Mobile Penetration Testing: Episode 1 - The Forensic MenaceNowSecure
 
REST API Pentester's perspective
REST API Pentester's perspectiveREST API Pentester's perspective
REST API Pentester's perspectiveSecuRing
 
Networking 2016-05-24 - Topic 1- Cybereason Lab Analysis by Brad Green
Networking 2016-05-24 - Topic 1- Cybereason Lab Analysis by Brad Green Networking 2016-05-24 - Topic 1- Cybereason Lab Analysis by Brad Green
Networking 2016-05-24 - Topic 1- Cybereason Lab Analysis by Brad Green North Texas Chapter of the ISSA
 
Magento Security Best Practises - MM17DE
Magento Security Best Practises - MM17DEMagento Security Best Practises - MM17DE
Magento Security Best Practises - MM17DEAnna Völkl
 
Networking 2016-05-24 - Topic 2 - The "Hack Back" - How Hacking Team Became t...
Networking 2016-05-24 - Topic 2 - The "Hack Back" - How Hacking Team Became t...Networking 2016-05-24 - Topic 2 - The "Hack Back" - How Hacking Team Became t...
Networking 2016-05-24 - Topic 2 - The "Hack Back" - How Hacking Team Became t...North Texas Chapter of the ISSA
 
Deception Driven Defense - Infragard 2016
Deception Driven Defense - Infragard 2016Deception Driven Defense - Infragard 2016
Deception Driven Defense - Infragard 2016Greg Foss
 

La actualidad más candente (14)

Testing iOS apps without jailbreak in 2018
Testing iOS apps without jailbreak in 2018Testing iOS apps without jailbreak in 2018
Testing iOS apps without jailbreak in 2018
 
CMS Hacking Tricks - DerbyCon 4 - 2014
CMS Hacking Tricks - DerbyCon 4 - 2014CMS Hacking Tricks - DerbyCon 4 - 2014
CMS Hacking Tricks - DerbyCon 4 - 2014
 
Paolo Passeri - A Multi Layered Approach to Threat Intelligence
Paolo Passeri - A Multi Layered Approach to Threat IntelligencePaolo Passeri - A Multi Layered Approach to Threat Intelligence
Paolo Passeri - A Multi Layered Approach to Threat Intelligence
 
Building & Hacking Modern iOS Apps
Building & Hacking Modern iOS AppsBuilding & Hacking Modern iOS Apps
Building & Hacking Modern iOS Apps
 
Internet of Terrible: Can you hear me meow?
Internet of Terrible: Can you hear me meow?Internet of Terrible: Can you hear me meow?
Internet of Terrible: Can you hear me meow?
 
TRITON: The Next Generation of ICS Malware
TRITON: The Next Generation of ICS MalwareTRITON: The Next Generation of ICS Malware
TRITON: The Next Generation of ICS Malware
 
Building&Hacking modern iOS apps
Building&Hacking modern iOS appsBuilding&Hacking modern iOS apps
Building&Hacking modern iOS apps
 
Securing Your BBC Identity
Securing Your BBC IdentitySecuring Your BBC Identity
Securing Your BBC Identity
 
Mobile Penetration Testing: Episode 1 - The Forensic Menace
Mobile Penetration Testing: Episode 1 - The Forensic MenaceMobile Penetration Testing: Episode 1 - The Forensic Menace
Mobile Penetration Testing: Episode 1 - The Forensic Menace
 
REST API Pentester's perspective
REST API Pentester's perspectiveREST API Pentester's perspective
REST API Pentester's perspective
 
Networking 2016-05-24 - Topic 1- Cybereason Lab Analysis by Brad Green
Networking 2016-05-24 - Topic 1- Cybereason Lab Analysis by Brad Green Networking 2016-05-24 - Topic 1- Cybereason Lab Analysis by Brad Green
Networking 2016-05-24 - Topic 1- Cybereason Lab Analysis by Brad Green
 
Magento Security Best Practises - MM17DE
Magento Security Best Practises - MM17DEMagento Security Best Practises - MM17DE
Magento Security Best Practises - MM17DE
 
Networking 2016-05-24 - Topic 2 - The "Hack Back" - How Hacking Team Became t...
Networking 2016-05-24 - Topic 2 - The "Hack Back" - How Hacking Team Became t...Networking 2016-05-24 - Topic 2 - The "Hack Back" - How Hacking Team Became t...
Networking 2016-05-24 - Topic 2 - The "Hack Back" - How Hacking Team Became t...
 
Deception Driven Defense - Infragard 2016
Deception Driven Defense - Infragard 2016Deception Driven Defense - Infragard 2016
Deception Driven Defense - Infragard 2016
 

Similar a SAST für TYPO3 Extensions

T3DD23 Content Security Policy - Concept, Strategies & Pitfalls
T3DD23 Content Security Policy - Concept, Strategies & PitfallsT3DD23 Content Security Policy - Concept, Strategies & Pitfalls
T3DD23 Content Security Policy - Concept, Strategies & PitfallsOliver Hader
 
Top 10 most interesting vulnerabilities and attacks in SAP
Top 10 most interesting vulnerabilities and attacks in SAPTop 10 most interesting vulnerabilities and attacks in SAP
Top 10 most interesting vulnerabilities and attacks in SAPERPScan
 
Beyond Web Interfaces
Beyond Web InterfacesBeyond Web Interfaces
Beyond Web Interfacesciacchi
 
Architecting next generation big data platform
Architecting next generation big data platformArchitecting next generation big data platform
Architecting next generation big data platformhadooparchbook
 
PyCon Canada 2015 - Is your python application secure
PyCon Canada 2015 - Is your python application securePyCon Canada 2015 - Is your python application secure
PyCon Canada 2015 - Is your python application secureIMMUNIO
 
RIoT (Raiding Internet of Things) by Jacob Holcomb
RIoT (Raiding Internet of Things) by Jacob HolcombRIoT (Raiding Internet of Things) by Jacob Holcomb
RIoT (Raiding Internet of Things) by Jacob HolcombPriyanka Aash
 
Is your python application secure? - PyCon Canada - 2015-11-07
Is your python application secure? - PyCon Canada - 2015-11-07Is your python application secure? - PyCon Canada - 2015-11-07
Is your python application secure? - PyCon Canada - 2015-11-07Frédéric Harper
 
Practical SAP pentesting workshop (NullCon Goa)
Practical SAP pentesting workshop (NullCon Goa)Practical SAP pentesting workshop (NullCon Goa)
Practical SAP pentesting workshop (NullCon Goa)ERPScan
 
Spark + AI Summit 2019: Apache Spark Listeners: A Crash Course in Fast, Easy ...
Spark + AI Summit 2019: Apache Spark Listeners: A Crash Course in Fast, Easy ...Spark + AI Summit 2019: Apache Spark Listeners: A Crash Course in Fast, Easy ...
Spark + AI Summit 2019: Apache Spark Listeners: A Crash Course in Fast, Easy ...Landon Robinson
 
technical-information-gathering-slides.pdf
technical-information-gathering-slides.pdftechnical-information-gathering-slides.pdf
technical-information-gathering-slides.pdfMarceloCunha571649
 
Automotive Cybersecurity: Test Like a Hacker
Automotive Cybersecurity: Test Like a HackerAutomotive Cybersecurity: Test Like a Hacker
Automotive Cybersecurity: Test Like a HackerForAllSecure
 
HITCON Defense Summit 2019 － 從 SAST 談持續式資安測試
HITCON Defense Summit 2019 － 從 SAST 談持續式資安測試HITCON Defense Summit 2019 － 從 SAST 談持續式資安測試
HITCON Defense Summit 2019 － 從 SAST 談持續式資安測試Secview
 
Practical SAP pentesting (B-Sides San Paulo)
Practical SAP pentesting (B-Sides San Paulo)Practical SAP pentesting (B-Sides San Paulo)
Practical SAP pentesting (B-Sides San Paulo)ERPScan
 
Apache Spark Listeners: A Crash Course in Fast, Easy Monitoring
Apache Spark Listeners: A Crash Course in Fast, Easy MonitoringApache Spark Listeners: A Crash Course in Fast, Easy Monitoring
Apache Spark Listeners: A Crash Course in Fast, Easy MonitoringDatabricks
 
Architecture vulnerabilities in SAP platforms
Architecture vulnerabilities in SAP platformsArchitecture vulnerabilities in SAP platforms
Architecture vulnerabilities in SAP platformsERPScan
 
2022 APIsecure_Securing APIs with Open Standards
2022 APIsecure_Securing APIs with Open Standards2022 APIsecure_Securing APIs with Open Standards
2022 APIsecure_Securing APIs with Open StandardsAPIsecure_ Official
 
SAP Forensics Detecting White Collar Cyber-crime
SAP Forensics Detecting White Collar Cyber-crimeSAP Forensics Detecting White Collar Cyber-crime
SAP Forensics Detecting White Collar Cyber-crimeOnapsis Inc.
 
Serverless survival kit
Serverless survival kitServerless survival kit
Serverless survival kitSteve Houël
 

Similar a SAST für TYPO3 Extensions (20)

T3DD23 Content Security Policy - Concept, Strategies & Pitfalls
T3DD23 Content Security Policy - Concept, Strategies & PitfallsT3DD23 Content Security Policy - Concept, Strategies & Pitfalls
T3DD23 Content Security Policy - Concept, Strategies & Pitfalls
 
Top 10 most interesting vulnerabilities and attacks in SAP
Top 10 most interesting vulnerabilities and attacks in SAPTop 10 most interesting vulnerabilities and attacks in SAP
Top 10 most interesting vulnerabilities and attacks in SAP
 
Beyond Web Interfaces
Beyond Web InterfacesBeyond Web Interfaces
Beyond Web Interfaces
 
Architecting next generation big data platform
Architecting next generation big data platformArchitecting next generation big data platform
Architecting next generation big data platform
 
PyCon Canada 2015 - Is your python application secure
PyCon Canada 2015 - Is your python application securePyCon Canada 2015 - Is your python application secure
PyCon Canada 2015 - Is your python application secure
 
MLSEC 2020
MLSEC 2020MLSEC 2020
MLSEC 2020
 
RIoT (Raiding Internet of Things) by Jacob Holcomb
RIoT (Raiding Internet of Things) by Jacob HolcombRIoT (Raiding Internet of Things) by Jacob Holcomb
RIoT (Raiding Internet of Things) by Jacob Holcomb
 
Is your python application secure? - PyCon Canada - 2015-11-07
Is your python application secure? - PyCon Canada - 2015-11-07Is your python application secure? - PyCon Canada - 2015-11-07
Is your python application secure? - PyCon Canada - 2015-11-07
 
Practical SAP pentesting workshop (NullCon Goa)
Practical SAP pentesting workshop (NullCon Goa)Practical SAP pentesting workshop (NullCon Goa)
Practical SAP pentesting workshop (NullCon Goa)
 
Spark + AI Summit 2019: Apache Spark Listeners: A Crash Course in Fast, Easy ...
Spark + AI Summit 2019: Apache Spark Listeners: A Crash Course in Fast, Easy ...Spark + AI Summit 2019: Apache Spark Listeners: A Crash Course in Fast, Easy ...
Spark + AI Summit 2019: Apache Spark Listeners: A Crash Course in Fast, Easy ...
 
Origins of Serverless
Origins of ServerlessOrigins of Serverless
Origins of Serverless
 
technical-information-gathering-slides.pdf
technical-information-gathering-slides.pdftechnical-information-gathering-slides.pdf
technical-information-gathering-slides.pdf
 
Automotive Cybersecurity: Test Like a Hacker
Automotive Cybersecurity: Test Like a HackerAutomotive Cybersecurity: Test Like a Hacker
Automotive Cybersecurity: Test Like a Hacker
 
HITCON Defense Summit 2019 － 從 SAST 談持續式資安測試
HITCON Defense Summit 2019 － 從 SAST 談持續式資安測試HITCON Defense Summit 2019 － 從 SAST 談持續式資安測試
HITCON Defense Summit 2019 － 從 SAST 談持續式資安測試
 
Practical SAP pentesting (B-Sides San Paulo)
Practical SAP pentesting (B-Sides San Paulo)Practical SAP pentesting (B-Sides San Paulo)
Practical SAP pentesting (B-Sides San Paulo)
 
Apache Spark Listeners: A Crash Course in Fast, Easy Monitoring
Apache Spark Listeners: A Crash Course in Fast, Easy MonitoringApache Spark Listeners: A Crash Course in Fast, Easy Monitoring
Apache Spark Listeners: A Crash Course in Fast, Easy Monitoring
 
Architecture vulnerabilities in SAP platforms
Architecture vulnerabilities in SAP platformsArchitecture vulnerabilities in SAP platforms
Architecture vulnerabilities in SAP platforms
 
2022 APIsecure_Securing APIs with Open Standards
2022 APIsecure_Securing APIs with Open Standards2022 APIsecure_Securing APIs with Open Standards
2022 APIsecure_Securing APIs with Open Standards
 
SAP Forensics Detecting White Collar Cyber-crime
SAP Forensics Detecting White Collar Cyber-crimeSAP Forensics Detecting White Collar Cyber-crime
SAP Forensics Detecting White Collar Cyber-crime
 
Serverless survival kit
Serverless survival kitServerless survival kit
Serverless survival kit
 

Más de Oliver Hader

TYPO3camp Munich 2018 - Keynote - "Wo woll'n mer denn hin?"
TYPO3camp Munich 2018 - Keynote - "Wo woll'n mer denn hin?"TYPO3camp Munich 2018 - Keynote - "Wo woll'n mer denn hin?"
TYPO3camp Munich 2018 - Keynote - "Wo woll'n mer denn hin?"Oliver Hader
 
TYPO3 CMS - Datenmodifikation & Event Sourcing (Masterarbeit)
TYPO3 CMS - Datenmodifikation & Event Sourcing (Masterarbeit)TYPO3 CMS - Datenmodifikation & Event Sourcing (Masterarbeit)
TYPO3 CMS - Datenmodifikation & Event Sourcing (Masterarbeit)Oliver Hader
 
Vor- und Nachteile von Web Components mit Polymer gegenüber AngularJS ohne P...
Vor- und Nachteile von Web Components mit Polymer gegenüber AngularJS ohne P...Vor- und Nachteile von Web Components mit Polymer gegenüber AngularJS ohne P...
Vor- und Nachteile von Web Components mit Polymer gegenüber AngularJS ohne P...Oliver Hader
 
WebGL - 3D im Browser - Erfahrungsbericht mit BabylonJS
WebGL - 3D im Browser - Erfahrungsbericht mit BabylonJSWebGL - 3D im Browser - Erfahrungsbericht mit BabylonJS
WebGL - 3D im Browser - Erfahrungsbericht mit BabylonJSOliver Hader
 
Web application security
Web application securityWeb application security
Web application securityOliver Hader
 
Contribute to TYPO3 CMS
Contribute to TYPO3 CMSContribute to TYPO3 CMS
Contribute to TYPO3 CMSOliver Hader
 
T3CON13DE - TYPO3 CMS Team
T3CON13DE - TYPO3 CMS TeamT3CON13DE - TYPO3 CMS Team
T3CON13DE - TYPO3 CMS TeamOliver Hader
 
TYPO3camp Regensburg: TYPO3 6.0
TYPO3camp Regensburg: TYPO3 6.0TYPO3camp Regensburg: TYPO3 6.0
TYPO3camp Regensburg: TYPO3 6.0Oliver Hader
 
TYPO3 Inline Relational Record Editing (IRRE)
TYPO3 Inline Relational Record Editing (IRRE)TYPO3 Inline Relational Record Editing (IRRE)
TYPO3 Inline Relational Record Editing (IRRE)Oliver Hader
 
TYPO3 4.6 & TYPO3 4.7
TYPO3 4.6 & TYPO3 4.7TYPO3 4.6 & TYPO3 4.7
TYPO3 4.6 & TYPO3 4.7Oliver Hader
 

Más de Oliver Hader (11)

TYPO3camp Munich 2018 - Keynote - "Wo woll'n mer denn hin?"
TYPO3camp Munich 2018 - Keynote - "Wo woll'n mer denn hin?"TYPO3camp Munich 2018 - Keynote - "Wo woll'n mer denn hin?"
TYPO3camp Munich 2018 - Keynote - "Wo woll'n mer denn hin?"
 
TYPO3 CMS - Datenmodifikation & Event Sourcing (Masterarbeit)
TYPO3 CMS - Datenmodifikation & Event Sourcing (Masterarbeit)TYPO3 CMS - Datenmodifikation & Event Sourcing (Masterarbeit)
TYPO3 CMS - Datenmodifikation & Event Sourcing (Masterarbeit)
 
Vor- und Nachteile von Web Components mit Polymer gegenüber AngularJS ohne P...
Vor- und Nachteile von Web Components mit Polymer gegenüber AngularJS ohne P...Vor- und Nachteile von Web Components mit Polymer gegenüber AngularJS ohne P...
Vor- und Nachteile von Web Components mit Polymer gegenüber AngularJS ohne P...
 
WebGL - 3D im Browser - Erfahrungsbericht mit BabylonJS
WebGL - 3D im Browser - Erfahrungsbericht mit BabylonJSWebGL - 3D im Browser - Erfahrungsbericht mit BabylonJS
WebGL - 3D im Browser - Erfahrungsbericht mit BabylonJS
 
Web Components
Web ComponentsWeb Components
Web Components
 
Web application security
Web application securityWeb application security
Web application security
 
Contribute to TYPO3 CMS
Contribute to TYPO3 CMSContribute to TYPO3 CMS
Contribute to TYPO3 CMS
 
T3CON13DE - TYPO3 CMS Team
T3CON13DE - TYPO3 CMS TeamT3CON13DE - TYPO3 CMS Team
T3CON13DE - TYPO3 CMS Team
 
TYPO3camp Regensburg: TYPO3 6.0
TYPO3camp Regensburg: TYPO3 6.0TYPO3camp Regensburg: TYPO3 6.0
TYPO3camp Regensburg: TYPO3 6.0
 
TYPO3 Inline Relational Record Editing (IRRE)
TYPO3 Inline Relational Record Editing (IRRE)TYPO3 Inline Relational Record Editing (IRRE)
TYPO3 Inline Relational Record Editing (IRRE)
 
TYPO3 4.6 & TYPO3 4.7
TYPO3 4.6 & TYPO3 4.7TYPO3 4.6 & TYPO3 4.7
TYPO3 4.6 & TYPO3 4.7
 

Último

The Codex of Business Writing Software for Real-World Solutions 2.pptx
The Codex of Business Writing Software for Real-World Solutions 2.pptxThe Codex of Business Writing Software for Real-World Solutions 2.pptx
The Codex of Business Writing Software for Real-World Solutions 2.pptxMalak Abu Hammad
 
TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law DevelopmentsTrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law DevelopmentsTrustArc
 
Boost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdfBoost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdfsudhanshuwaghmare1
 
Slack Application Development 101 Slides
Slack Application Development 101 SlidesSlack Application Development 101 Slides
Slack Application Development 101 Slidespraypatel2
 
Finology Group – Insurtech Innovation Award 2024
Finology Group – Insurtech Innovation Award 2024Finology Group – Insurtech Innovation Award 2024
Finology Group – Insurtech Innovation Award 2024The Digital Insurer
 
What Are The Drone Anti-jamming Systems Technology?
What Are The Drone Anti-jamming Systems Technology?What Are The Drone Anti-jamming Systems Technology?
What Are The Drone Anti-jamming Systems Technology?Antenna Manufacturer Coco
 
Advantages of Hiring UIUX Design Service Providers for Your Business
Advantages of Hiring UIUX Design Service Providers for Your BusinessAdvantages of Hiring UIUX Design Service Providers for Your Business
Advantages of Hiring UIUX Design Service Providers for Your BusinessPixlogix Infotech
 
A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?Igalia
 
Boost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivityBoost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivityPrincipled Technologies
 
A Call to Action for Generative AI in 2024
A Call to Action for Generative AI in 2024A Call to Action for Generative AI in 2024
A Call to Action for Generative AI in 2024Results
 
Breaking the Kubernetes Kill Chain: Host Path Mount
Breaking the Kubernetes Kill Chain: Host Path MountBreaking the Kubernetes Kill Chain: Host Path Mount
Breaking the Kubernetes Kill Chain: Host Path MountPuma Security, LLC
 
Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024The Digital Insurer
 
CNv6 Instructor Chapter 6 Quality of Service
CNv6 Instructor Chapter 6 Quality of ServiceCNv6 Instructor Chapter 6 Quality of Service
CNv6 Instructor Chapter 6 Quality of Servicegiselly40
 
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time AutomationFrom Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time AutomationSafe Software
 
Histor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slideHistor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slidevu2urc
 
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
08448380779 Call Girls In Diplomatic Enclave Women Seeking MenDelhi Call girls
 
Handwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed textsHandwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed textsMaria Levchenko
 
Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...
Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...
Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...Igalia
 
How to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerHow to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerThousandEyes
 
08448380779 Call Girls In Greater Kailash - I Women Seeking Men
08448380779 Call Girls In Greater Kailash - I Women Seeking Men08448380779 Call Girls In Greater Kailash - I Women Seeking Men
08448380779 Call Girls In Greater Kailash - I Women Seeking MenDelhi Call girls
 

Último (20)

The Codex of Business Writing Software for Real-World Solutions 2.pptx
The Codex of Business Writing Software for Real-World Solutions 2.pptxThe Codex of Business Writing Software for Real-World Solutions 2.pptx
The Codex of Business Writing Software for Real-World Solutions 2.pptx
 
TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law DevelopmentsTrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
 
Boost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdfBoost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdf
 
Slack Application Development 101 Slides
Slack Application Development 101 SlidesSlack Application Development 101 Slides
Slack Application Development 101 Slides
 
Finology Group – Insurtech Innovation Award 2024
Finology Group – Insurtech Innovation Award 2024Finology Group – Insurtech Innovation Award 2024
Finology Group – Insurtech Innovation Award 2024
 
What Are The Drone Anti-jamming Systems Technology?
What Are The Drone Anti-jamming Systems Technology?What Are The Drone Anti-jamming Systems Technology?
What Are The Drone Anti-jamming Systems Technology?
 
Advantages of Hiring UIUX Design Service Providers for Your Business
Advantages of Hiring UIUX Design Service Providers for Your BusinessAdvantages of Hiring UIUX Design Service Providers for Your Business
Advantages of Hiring UIUX Design Service Providers for Your Business
 
A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?
 
Boost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivityBoost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivity
 
A Call to Action for Generative AI in 2024
A Call to Action for Generative AI in 2024A Call to Action for Generative AI in 2024
A Call to Action for Generative AI in 2024
 
Breaking the Kubernetes Kill Chain: Host Path Mount
Breaking the Kubernetes Kill Chain: Host Path MountBreaking the Kubernetes Kill Chain: Host Path Mount
Breaking the Kubernetes Kill Chain: Host Path Mount
 
Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024
 
CNv6 Instructor Chapter 6 Quality of Service
CNv6 Instructor Chapter 6 Quality of ServiceCNv6 Instructor Chapter 6 Quality of Service
CNv6 Instructor Chapter 6 Quality of Service
 
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time AutomationFrom Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
 
Histor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slideHistor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slide
 
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
 
Handwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed textsHandwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed texts
 
Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...
Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...
Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...
 
How to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerHow to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected Worker
 
08448380779 Call Girls In Greater Kailash - I Women Seeking Men
08448380779 Call Girls In Greater Kailash - I Women Seeking Men08448380779 Call Girls In Greater Kailash - I Women Seeking Men
08448380779 Call Girls In Greater Kailash - I Women Seeking Men
 

SAST für TYPO3 Extensions

  • 1. SAST für TYPO3 Extensions 
 #T3CRR21 #security Oliver Hader oliver@typo3.org @ohader TYPO3camp RheinRuhr 2021 6. November 2021
  • 2. TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 2 ▪Research & Development ▪TYPO3 Security Team Lead ▪50% TYPO3 GmbH / 50% Freelancer ▪#hof #cycling #paramedic #in.die.musik ~# whoami Oliver Hader @ohader
  • 3. TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 3 ▪Statische Code Analyse #basics ▪Orientierung im Security Bereich #context ▪Verwendung für TYPO3 #nähkästchen ▪MüssteMalJemand™ #zukunft Agenda
  • 4. TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 4 ▪ Bitte, bitte, bitte: Security Schwachstellen nicht öffentlich einstellen/diskutieren ▪ nicht auf GitHub/Forge ▪ nicht in Slack Channels ▪ nicht auf Twitter, Twitch, ... ▪ Meldung an security@typo3.org ▪ Security Team unterstützt Community Trigger Warning ⚠︎
  • 5. TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org #basics Statische Code 
 Analyse 5
  • 6. TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 6 Statische Code Analyse - Schematischer Ablauf Statische Code Analyse https://www.grammatech.com/products/source-code-analysis
  • 7. Abstract Syntax Tree (AST) ▪ Abstract Syntax Tree (AST) ▪ Composer Package 
 nikic/php-parser 7 TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org
  • 8. Abstract Syntax Tree (AST) ▪ Abstract Syntax Tree (AST) ▪ Composer Package 
 nikic/php-parser 8 TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org
  • 9. Statische Code Analyse in PHP ▪ basierend auf 
 Abstract Syntax Tree (AST) ▪ Extension Scanner in TYPO3 ▪ PhpStan - Core CI Builds ▪ Rector - TYPO3 Code Upgrade ▪ Psalm - Security Taint Graph 9 TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org
  • 10. TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org #context 
 Orientierung im 
 Security Bereich 10
  • 11. Ebenenmodell zur Sicherheitskonzeption (BSI) 11 TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org https://www.bsi.bund.de/DE/Themen/Unternehmen-und-Organisationen/Informationen-und-Empfehlungen/Empfehlungen-nach-Angriffszielen/Webanwendungen/webanwendungen_node.html Auf Grundlage eines Ebenenmodells lassen sich die Zuständigkeiten der relevanten Organisationsbereiche den einzelnen Teilaufgaben bei Sicherheitskonzeption und Realisierung von Webanwendungen zuordnen. Ausgangspunkt ist eine Unterteilung in 5 Ebenen: Abbildung 1: Ebenenmodell Ebene Inhalt (Beispiele) 5 Semantik Schutz vor Täuschung und Betrug - Informationen ermöglichen Social Engineering-Angriffe - Gebrauch von Popups u.ä. erleichtern Phishing-Angriffe - Keine Absicherung für den Fall der Fälschung der Web­ site 4 Logik Absicherung von Prozessen und Workflows als Ganzes - Verwendung unsicherer Email in einem ansonsten gesi­ cherten Workflow - Angreifbarkeit des Passworts durch nachlässig gestaltete "Passwort vergessen"-Funktion - Die Verwendung sicherer Passworte wird nicht erzwun­ gen 3 Implementie­ rung Vermeiden von Programmierfehlern, die zu Schwachstellen führen - Cross-Site Scripting - SQL-Injection - Session Riding 2 Technologie Richtige Wahl und sicherer Einsatz von Technologie - unverschlüsselte Übertragung sensitiver Daten - Authentisierungsverfahren, die nicht dem Schutzbedarf angemessen sind - Ungenügende Randomness von Token 1 System Absicherung der auf der Systemplattform eingesetzten Software - Fehler in der Konfiguration des Webservers - "Known Vulnerabilities" in den eingesetzten Software­ produkten - Mangelnder Zugriffsschutz in der Datenbank 0 Netzwerk & Host Absicherung von Host und Netzwerk Sicherheit von Webanwendungen Maßnahmenkatalog und Best Practices Im Auftrag des Bundesamtes für Sicherheit in der Informationstechnik erstellt von: Version 1, August 2006 SAST #bugs #infrastructure #workflows #phishing #SocialEngineering
  • 12. TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org Marktanalyse - Statische Code Analyse für TYPO3 12 ▪ SonarSource, SonarCloud, SonarCube ▪ RIPS Tech Scanner ▪ DeepCode.ai ▪ PsalmPHP https://github.com/ohader/sast-demo
  • 13. TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 13 Demo Anwendung (vereinfacht) https://github.com/ohader/sast-demo
  • 14. TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 14 Demo Anwendung (vereinfacht) https://github.com/ohader/sast-demo SQLi Benutzereingaben XSS
  • 15. TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 15 SonarCloud (SonarSource) → „Alles supi!“ #nicht SonarCloud
  • 16. TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 16 RIPS Tech Scanner → übernommen von SonarSource RIPS Tech Scanner UNRELATED! 
 ganz anderes Projekt
  • 17. TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 17 DeepCode.ai → übernommen von Snyk.io → Schwachstellen gefunden DeepCode.ai / Snyk.io
  • 18. TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 18 PsalmPHP (https://psalm.dev/r/159771bec7) → Schwachstellen gefunden PsalmPHP
  • 19. TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org Marktanalyse - Statische Code Analyse für TYPO3 19 ▪ SonarSource, SonarCloud, SonarCube - nichts gefunden 😵 ▪ RIPS Tech Scanner - Schwachstellen vermutlich gefunden 🙄 ▪ im Mai 2020 von SonarSource übernommen ▪ DeepCode.ai - Schwachstellen gefunden 😅 ▪ im August 2020 von Snyk.io übernommen ▪ PsalmPHP - Schwachstellen gefunden 😅
  • 20. TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 20 Demo Anwendung (realistischer) https://github.com/ohader/sast-demo
  • 21. Demo Anwendung (realistischer) ▪ TYPO3 ist speziell! ▪ fehlende Unterstützung für 
 Framework Komponenten ▪ PSR: Request/Response ▪ PSR: Dependency Injection ▪ Fluid: Templating Engine ▪ DBAL: Datenbank Schicht ▪ TYPO3: Hooks, TypoScript 21 TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org SQLi Injection XSS
  • 22. TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org #nähkästchen 
 Verwendung für TYPO3 22
  • 23. TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org SAST für TYPO3 mit PsalmPHP 23 ▪ PsalmPHP für TYPO3 ▪ Open-Source Project (MIT) ▪ Implementiert in PHP ▪ Erweiterbar durch Plugins ▪ unterstützt sources, sinks, 
 escapes, unescapes, flow https://github.com/vimeo/psalm
  • 24. TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 24 PsalmPHP Stubs ▪ @template ▪ liefert Instanz 
 von $className
  • 25. TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 25 PsalmPHP Stubs ▪ @psalm-taint-source ▪ Rückgabewerte sind 
 Benutzereingaben ▪ wie $_GET, $_POST, $_COOKIE, HTTP Header
  • 26. TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 26 PsalmPHP Stubs ▪ @psalm-taint-sink ▪ verwundbar in Aspekt sql, wenn Parameter $query aus unsicherer 
 @psalm-taint-source
  • 27. TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 27 PsalmPHP Stubs ▪ @psalm-taint-escape ▪ markiert Parameter $str für Aspekt sql als bereinigt ▪ @psalm-taint-unescape ▪ … das Gegenteil (unsicher)
  • 28. TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 28 typo3-security/psalm-plugin - nicht öffentlich TYPO3 Plugin für PsalmPHP
  • 29. TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 29 Kompakte Ausgabe Demo TYPO3 Psalm-Runner
  • 30. TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 30 Ausführlichere Ausgabe Demo TYPO3 Psalm-Runner
  • 31. TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 31 SARIF Export & GitHub Integration Demo TYPO3 Psalm-Runner
  • 32. TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 32 SARIF Export & GitHub Integration Demo TYPO3 Psalm-Runner
  • 33. TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 33 SARIF Export & GitHub Integration Demo TYPO3 Psalm-Runner
  • 34. TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org #zukunft 
 MüssteMalJemand™ 34
  • 35. TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org Nächste Schritte 35 ▪ Erweiterung der Stub-Deklarationen (Hooks, Fluid, TypoScript) ▪ Erweiterung für bekannte/bereinigte Verwundbarkeiten ▪ Infrastruktur & Queue für regelmäßige Extension Scans ▪ Freigabe für (echte) Extension Maintainer & Integration in TER ▪ (mögliche Fundstellen müssen natürlich auch bereinigt werden)
  • 36. TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org Nächste Schritte 36 ▪ TYPO3 Psalm-Plugin & Psalm-Runner vorerst nicht öffentlich ▪ evtl. Public-Beta über Verified Extensions (@VolkerGraubaum) ▪ Entwicklung wird durch TYPO3 Association finanziert ▪ Interessierte/Supporter bitte unter security@typo3.org melden