A06: Vulnerable and Outdated Components

Principales problemas:

• Dependencias desactualizadas
• Vulnerabilidades conocidas
• Falta de parcheo
• Technical debt
• Configuraciones inseguras

# Ejemplo de análisis de dependencias
npm audit
composer audit

WebGoat: Vulnerable Components

Ejercicio práctico:

{
  "name": "my-web-app",
  "version": "1.0.0",
  "dependencies": {
    "lodash": "4.17.15",
    "express": "4.16.1",
    "node-fetch": "2.6.0",
    "jquery": "3.4.1"
  }
}

Aplicación que usa el código

const express = require('express');
const fetch = require('node-fetch');
const _ = require('lodash');
const app = express();

// Vulnerable a prototype pollution via lodash merge
app.post('/merge', express.json(), (req, res) => {
    const merged = _.merge({}, req.body);
    res.json(merged);
});

// Vulnerable a SSRF via node-fetch
app.get('/proxy', async (req, res) => {
    const url = req.query.url;
    const response = await fetch(url);
    const data = await response.text();
    res.send(data);
});

// Vulnerable a ReDoS via express
app.get('/search/:pattern', (req, res) => {
    const regex = new RegExp(req.params.pattern);
    // ... búsqueda usando regex inseguro
});

// XSS via jQuery en el frontend
app.get('/', (req, res) => {
    res.send(`
        <script src="/jquery.min.js"></script>
        <script>
            // Vulnerable a XSS en jQuery < 3.5.0
            $(document).ready(function() {
                $('#content').html(location.hash.slice(1));
            });
        </script>
        <div id="content"></div>
    `);
});

app.listen(3000, () => {
    console.log('Server running on port 3000');
});

Herramientas de análisis:

• OWASP Dependency Check
• Snyk
• WhiteSource
• GitHub Dependabot

A07: Identification and Authentication Failures

Problemas comunes:

• Credenciales débiles
• Brute force permitido
• Session fixation
• Missing MFA
• Tokens expuestos

# Ejemplo de autenticación débil
def login(username, password):
    user = find_user(username)
    if user and user.password == password:  # Comparación en texto plano
        session['user_id'] = user.id        # Sin rotación de sesión
        return True                         
    return False                            # Sin rate limiting

WebGoat: Authentication Failures

Ejercicios:

1. Password reset flaws
2. JWT vulnerabilities
3. Session management
4. OAuth misconfigurations

// JWT vulnerable
const token = jwt.sign(
  { user: 'admin' },
  'secret',
  { algorithm: 'none' }
);

A08: Software and Data Integrity Failures

Áreas críticas:

• CI/CD security
• Dependency chain
• Auto-updates
• Deserialization
• Data integrity

# Deserialization insegura
import pickle
data = pickle.loads(user_input)  # Peligroso!

WebGoat: Integrity Failures

Ejercicios prácticos:

1. Insecure deserialization
2. Upload validation bypass
3. Checksum verification
4. Update mechanism abuse

A09: Security Logging and Monitoring Failures

Aspectos clave:

• Auditable events
• Log integrity
• Alert thresholds
• Incident detection
• Response time

# Logging insuficiente
def login(user, pwd):
    if authenticate(user, pwd):
        return True
    return False
    # Sin logging de intentos fallidos!

WebGoat: Logging Exercises

Prácticas:

1. Log injection
2. Log forging
3. Audit trails
4. Alert thresholds

-- Log injection
admin'); DROP TABLE logs;--

A10: Server-Side Request Forgery (SSRF)

Vectores comunes:

• URL parameters
• File imports
• API calls
• Webhooks
• Resource loading

# SSRF vulnerable
def get_data(url):
    return requests.get(url).text

WebGoat: SSRF Exercises

Escenarios prácticos:

1. Basic SSRF
2. Cloud metadata access
3. Internal port scanning
4. File URL attacks

# Ejemplo de payload SSRF
http://internal-service/
file:///etc/passwd
dict://attacker:11211/

Instalación de DVWA

Crear archivo compose.yml:

version: '3'
services:
  dvwa:
    image: vulnerables/web-dvwa:latest
    ports:
      - "8080:80"
    environment:
      - MYSQL_USER=dvwa
      - MYSQL_PASSWORD=p@ssw0rd
      - MYSQL_DATABASE=dvwa
    volumes:
      - dvwa_data:/var/lib/mysql
    restart: unless-stopped

volumes:
  dvwa_data:

Comandos para ejecutar:

# Iniciar DVWA
docker compose up -d

# Verificar estado
docker compose ps

# Ver logs
docker compose logs -f

# Detener DVWA
docker compose down

Ejercicio: DVWA Security Level Low

Objetivos:

1. Login bypass
2. SQL Injection
3. XSS reflected
4. Command injection
5. File upload