Karteikarten
Ohne Titel
Karten in diesem Stapel (5)
- 1WTI - SECURITY Understanding data inside and data outside - data inside-¥ Data inside refers to the data set in the program (script) by the developers.
¥ For example: $array=array(1,2,3,4,5);
¥ Such data is used to assist the programming logics and as it cannot be “touched” or “updated” by end users so they are usually safe and trusted. - 2WTI - SECURITY understanding data inside and data outside - data outside-¥ Data outside or outside data refers to the data imported to the script from outside of the script.
¥ For example, form inputs, GET and POST variables, (session) cookie values, database data and configuration files etc.
¥ Such data is provided/supplied by the end users so it is less immutable and it should not be trusted in any circumstances.
Security measures for outside data:
¥ Validation and sanitisation are two popular strategies considered for processing data taken from the outside (of the development environment).
¥ Validation deals with formats, rules.
¥ Sanitisation deals with malicious code removal.
¥ They are often used together in the development. - 3WTI - SECURITY Understanding validation and sanitation and when to use them - validation-(Data validation is normally used for outside data, but is sometimes considered for inside data as well)
¥ It is a process to check if the data meets certain predefined requirements.
¥ For example, password must contain numbers and letters and the length should be 8 – 12.
¥ There are two types of data validation: client-side validation (browser-level) and server-side validation (server-level).
Client side validation
¥ It is commonly implemented using JavaScript which can be executed by a web browser.
¥ It is performance-friendly as it does not request server responses but it is more dependent.
¥ However, it cannot replace server-side validation as:
¥ It is less secure (can be skipped by users when needed) and it cannot be used for complex checks.
Server side validation
¥ It is commonly implemented as a set of script-based functions as a part of the server-side scripts.
¥ It is more independent and secure as it has to be fulfilled as part of server side script execution.
¥ It supports advanced data checks.
¥ However, it is not performance-friendly as:
¥ It relies on network tra - 4WTI - SECURITY Understanding validation and sanitation and when to use them - sanitization-Data sanitization
¥ It is a process to clean (sanitise) data.
¥ It is typically used to remove malicious code and other unwanted information from the original data input.
¥ For example, this data could be special characters, unwanted/malicious code or HTML tags. - 5WTI - SECURITY Understanding different types of security threats -cross site scripting (XSS)¥ It is a vulnerability which allows a malicious user to inject delicate scripts into an URL or a Web server to steal other users’ data.
¥ here are two types of XSS attacks: reflected (non-persistent) and stored (persistent).
¥ Mostly affected web service(s): blogs, forums, message boards
Reflected XSS process
- Construct a link where malicious code is attached as parameters of a valid URL
http://localhost/test.php?name=malicious+code
- Encode the URL and use URL shortener to hide it
- Send it through emails, instant messages, forum/blog posts and convince user to click on it (many people don’t check the URL)
- When a user clicks on it, their session cooking will be send to the attacker.
Persistent XSS process
- an attacker posts a message containing malicious script to a message board (BBS, social networking site, blogs, etc)
- this server stores the code and displays it as a permanenet part of the normal page which can be views by other unknowing users
- when a user views the message, the code is executed and it will access the user’s cookie and sent to the att
Informationen
- Beschreibung
- Karteikarten am Ohne Titel, erstellt von sam gibbons am 12/05/2018.
- Erstellt von
- sam gibbons
- Aufrufe
- 0
- Bewertung