2016.pycon.my.ipynb

{
 "metadata": {
  "name": ""
 },
 "nbformat": 3,
 "nbformat_minor": 0,
 "worksheets": [
  {
   "cells": [
    {
     "cell_type": "markdown",
     "metadata": {
      "slideshow": {
       "slide_type": "slide"
      }
     },
     "source": [
      "**Django Security**\n",
      "===================\n",
      "\n",
      "> A vulnerable Django application     \n",
      "> Securing Django"
     ]
    },
    {
     "cell_type": "markdown",
     "metadata": {
      "slideshow": {
       "slide_type": "slide"
      }
     },
     "source": [
      "za\n",
      "===\n",
      "\n",
      "<img src=\"files/za-double-glasses.jpg\" width=\"300\">\n",
      "\n",
      "_Used to break things now learn to build things_\n",
      "\n",
      "Zaki Akhmad  \n",
      "za.github.io\n",
      "\n",
      "\n"
     ]
    },
    {
     "cell_type": "markdown",
     "metadata": {
      "slideshow": {
       "slide_type": "subslide"
      }
     },
     "source": [
      "Xoxzo\n",
      "=====\n",
      "\n",
      "<img src=\"files/tokyo_tower.jpg\" width=\"800\">"
     ]
    },
    {
     "cell_type": "markdown",
     "metadata": {
      "slideshow": {
       "slide_type": "subslide"
      }
     },
     "source": [
      "Community\n",
      "==========\n",
      "\n",
      "<img src=\"files/members.png\" width=\"800\">"
     ]
    },
    {
     "cell_type": "markdown",
     "metadata": {
      "slideshow": {
       "slide_type": "slide"
      }
     },
     "source": [
      "Outline of the talk\n",
      "===================\n",
      "\n",
      "\n",
      "\n"
     ]
    },
    {
     "cell_type": "markdown",
     "metadata": {
      "slideshow": {
       "slide_type": "fragment"
      }
     },
     "source": [
      "Part 1: A vulnerable Django application\n",
      "---------------------------------------\n",
      "* SQL injection\n",
      "* Command injection\n",
      "* XSS"
     ]
    },
    {
     "cell_type": "markdown",
     "metadata": {
      "slideshow": {
       "slide_type": "fragment"
      }
     },
     "source": [
      "Part 2: Securing Django\n",
      "------------------------\n",
      "* Password validators\n",
      "* Django deployment checklist"
     ]
    },
    {
     "cell_type": "markdown",
     "metadata": {
      "slideshow": {
       "slide_type": "slide"
      }
     },
     "source": [
      "Part 1: A vulnerable Django application\n",
      "======================================="
     ]
    },
    {
     "cell_type": "markdown",
     "metadata": {
      "slideshow": {
       "slide_type": "subslide"
      }
     },
     "source": [
      "Injection\n",
      "==========\n",
      "\n",
      "* SQL injection\n",
      "* Command injection"
     ]
    },
    {
     "cell_type": "markdown",
     "metadata": {
      "slideshow": {
       "slide_type": "subslide"
      }
     },
     "source": [
      "SQL Injection\n",
      "-------------\n",
      "\n",
      "The views.py:\n",
      "```\n",
      "def search_query(request):\n",
      "    \"\"\" \n",
      "    Search students objects via GET method\n",
      "    \"\"\"\n",
      "    if 'q' in request.GET and request.GET['q'] is not '': \n",
      "        try:\n",
      "            # Django ORM\n",
      "            # Safe from SQL injection\n",
      "            # student = Students.objects.get(name=request.GET['q'])\n",
      "\n",
      "            # Raw SQL\n",
      "            name = request.GET['q']\n",
      "            query = \"SELECT * FROM injection_students WHERE name = '%s'\" % name\n",
      "            students = Students.objects.raw(query)\n",
      "            \n",
      "            return render(request, 'search-result.html',\n",
      "                          {'students': students})\n",
      "        except Students.DoesNotExist:\n",
      "            msg = \"There's no students with this name: %s\" % request.GET['q']\n",
      "            return HttpResponse(msg)\n",
      "    else:\n",
      "        message = 'You submitted an empty form'\n",
      "        return HttpResponse(message)\n",
      "\n",
      "```"
     ]
    },
    {
     "cell_type": "markdown",
     "metadata": {
      "slideshow": {
       "slide_type": "subslide"
      }
     },
     "source": [
      "SQL injection\n",
      "--------------\n",
      "\n",
      "<img src=\"files/sql_injection.png\">\n",
      "\n",
      "> ?q=KL' OR '1=1"
     ]
    },
    {
     "cell_type": "markdown",
     "metadata": {
      "slideshow": {
       "slide_type": "subslide"
      }
     },
     "source": [
      "Command injection\n",
      "------------------\n",
      "\n",
      "The views.py:\n",
      "```\n",
      "def command(request):\n",
      "    \"\"\" \n",
      "    Command injection\n",
      "    \"\"\"\n",
      "    if 'c' in request.GET and request.GET['c'] is not '': \n",
      "        command = request.GET['c']\n",
      "        result = subprocess.check_output([command], shell=True)\n",
      "        return HttpResponse(result)\n",
      "    else:\n",
      "        message = 'You submitted an empty form'\n",
      "        return HttpResponse(message)\n",
      "```"
     ]
    },
    {
     "cell_type": "markdown",
     "metadata": {
      "slideshow": {
       "slide_type": "subslide"
      }
     },
     "source": [
      "Command injection\n",
      "-----------------\n",
      "\n",
      "<img src=\"files/command_injection.png\" width=\"800\">\n",
      "\n",
      "> ?c=ls -l"
     ]
    },
    {
     "cell_type": "markdown",
     "metadata": {
      "slideshow": {
       "slide_type": "subslide"
      }
     },
     "source": [
      "XSS\n",
      "====\n",
      "\n",
      "* Reflected XSS\n",
      "* Stored XSS"
     ]
    },
    {
     "cell_type": "markdown",
     "metadata": {
      "slideshow": {
       "slide_type": "subslide"
      }
     },
     "source": [
      "Reflected XSS\n",
      "-------------\n",
      "\n",
      "The views.py:\n",
      "    \n",
      "```\n",
      "def xss(request):\n",
      "    \"\"\" \n",
      "    Reflected XSS (Cross-Site Scripting) via GET method\n",
      "    \"\"\"\n",
      "    if 'x' in request.GET and request.GET['x'] is not '': \n",
      "        message = request.GET['x']\n",
      "        return render(request, 'xss.html', {'message': message})\n",
      "    else:\n",
      "        message = 'You submitted an empty form'\n",
      "        return HttpResponse(message)\n",
      "```\n",
      "\n",
      "The template:\n",
      "```\n",
      "{{ message|safe }}\n",
      "```"
     ]
    },
    {
     "cell_type": "markdown",
     "metadata": {
      "slideshow": {
       "slide_type": "subslide"
      }
     },
     "source": [
      "Reflected XSS\n",
      "-------------\n",
      "\n",
      "<img src=\"files/xss.png\" width=\"800\">\n"
     ]
    },
    {
     "cell_type": "markdown",
     "metadata": {
      "slideshow": {
       "slide_type": "subslide"
      }
     },
     "source": [
      "Stored XSS\n",
      "-----------\n",
      "\n",
      "The views.py:\n",
      "```\n",
      "def xsss(request):\n",
      "    \"\"\" \n",
      "    Stored XSS via unvalidated input form\n",
      "    \"\"\"\n",
      "    if request.method == 'POST':\n",
      "        form = StudentsForm(request.POST)\n",
      "\n",
      "        if form.is_valid():\n",
      "            form.save(commit=True)\n",
      "\n",
      "            students = Students.objects.all()\n",
      "            context_dict = {'students': students}\n",
      "\n",
      "            return render(request, 'injection.html', context_dict)\n",
      "        else:\n",
      "            print(form.errors)\n",
      "    else:\n",
      "        form = StudentsForm()\n",
      "\n",
      "    return render(request, 'add_students.html', {'form': form})\n",
      "```\n",
      "\n",
      "The template:\n",
      "```\n",
      "{% for student in students %}\n",
      "{{ student.name|safe }}: {{ student.grade|safe }} <br/>\n",
      "{% endfor %}\n",
      "```"
     ]
    },
    {
     "cell_type": "markdown",
     "metadata": {
      "slideshow": {
       "slide_type": "subslide"
      }
     },
     "source": [
      "Stored XSS\n",
      "-----------\n",
      "\n",
      "<img src=\"files/xsss1.png\" width=\"800\">\n",
      "\n",
      "<img src=\"files/xsss2.png\" width=\"800\">\n"
     ]
    },
    {
     "cell_type": "markdown",
     "metadata": {
      "slideshow": {
       "slide_type": "slide"
      }
     },
     "source": [
      "Part 2: Securing Django\n",
      "======================="
     ]
    },
    {
     "cell_type": "markdown",
     "metadata": {
      "slideshow": {
       "slide_type": "subslide"
      }
     },
     "source": [
      "Password\n",
      "=========\n",
      "\n",
      "Username and password are the most common authentication method. New since Django 1.9: [Password Validation](https://docs.djangoproject.com/en/1.10/releases/1.9/#password-validation). This will help you to ensure users have a strong password.\n",
      "\n",
      "* Similar with username\n",
      "* Minimum length\n",
      "* Common password\n",
      "* Numeric password\n"
     ]
    },
    {
     "cell_type": "markdown",
     "metadata": {
      "slideshow": {
       "slide_type": "subslide"
      }
     },
     "source": [
      "Password similar with username\n",
      "------------------------------\n",
      "\n",
      "Username: qwerty  \n",
      "Password: qwerty"
     ]
    },
    {
     "cell_type": "markdown",
     "metadata": {
      "slideshow": {
       "slide_type": "subslide"
      }
     },
     "source": [
      "Minimum length password\n",
      "-----------------------\n",
      "\n",
      "Username: qwerty  \n",
      "Password: qwertyqw"
     ]
    },
    {
     "cell_type": "markdown",
     "metadata": {
      "slideshow": {
       "slide_type": "subslide"
      }
     },
     "source": [
      "Common password\n",
      "----------------\n",
      "\n",
      "Username: qwerty  \n",
      "Password: password123"
     ]
    },
    {
     "cell_type": "markdown",
     "metadata": {
      "slideshow": {
       "slide_type": "subslide"
      }
     },
     "source": [
      "Numeric password\n",
      "-----------------\n",
      "\n",
      "Username: qwerty  \n",
      "Password: NasiLemakPercuma"
     ]
    },
    {
     "cell_type": "markdown",
     "metadata": {
      "slideshow": {
       "slide_type": "subslide"
      }
     },
     "source": [
      "settings.py\n",
      "-----------\n",
      "\n",
      "```\n",
      "AUTH_PASSWORD_VALIDATORS = [ \n",
      "    {   \n",
      "        'NAME': 'django.contrib.auth.password_validation.'\n",
      "                'UserAttributeSimilarityValidator',\n",
      "    },  \n",
      "    {   \n",
      "        'NAME': 'django.contrib.auth.password_validation.'\n",
      "                'MinimumLengthValidator',\n",
      "        'OPTIONS': {'min_length': 9},\n",
      "    },  \n",
      "    {   \n",
      "        'NAME': 'django.contrib.auth.password_validation.'\n",
      "                'CommonPasswordValidator',\n",
      "    },  \n",
      "    {   \n",
      "        'NAME': 'django.contrib.auth.password_validation.'\n",
      "                'NumericPasswordValidator',\n",
      "    },  \n",
      "]\n",
      "```"
     ]
    },
    {
     "cell_type": "markdown",
     "metadata": {
      "slideshow": {
       "slide_type": "subslide"
      }
     },
     "source": [
      "Password algorithm\n",
      "-------------------\n",
      "\n",
      "* Don't create and use your own algorithm\n",
      "* md5?"
     ]
    },
    {
     "cell_type": "markdown",
     "metadata": {
      "slideshow": {
       "slide_type": "subslide"
      }
     },
     "source": [
      "Django deployment checklist\n",
      "===========================\n",
      "\n",
      "```\n",
      "./manage.py check --deploy\n",
      "```"
     ]
    },
    {
     "cell_type": "markdown",
     "metadata": {
      "slideshow": {
       "slide_type": "subslide"
      }
     },
     "source": [
      "settings.py\n",
      "------------\n",
      "\n",
      "```\n",
      "ALLOWED_HOSTS = ['localhost']\n",
      "DEBUG = False\n",
      "```"
     ]
    },
    {
     "cell_type": "markdown",
     "metadata": {
      "slideshow": {
       "slide_type": "subslide"
      }
     },
     "source": [
      "SECRET_KEY\n",
      "===========\n",
      "\n",
      "* Don't keep your secret key in version control\n",
      "* Set as environment"
     ]
    },
    {
     "cell_type": "markdown",
     "metadata": {
      "slideshow": {
       "slide_type": "slide"
      }
     },
     "source": [
      "Terima kasih!\n",
      "==============\n",
      "\n",
      "<img src=files/nasi_kandar.jpg width=\"500\" alt=\"Nasi Kandar\"><br/>\n",
      "Nasi Kandar"
     ]
    }
   ],
   "metadata": {}
  }
 ]
}