Top Web Security Threats - HACKViDHi

HACKViDHi - 2013 - All rights reserved
Top Web Security Threats
what’s at risk!
HACKViDHi
Request a free trial scan of your website @ http://hackvidhi.com
Mail the presenter @ archana.Katiyar@hackvidhi.com
Course in Web Programming Basics and Ethical HackingWeb Security Assurance
Connect us at:

Course in Web Programming Basics and Ethical Hacking
Connect us at:
Web Security Assurance
What will we be covering here?
• Top 5 Web Security Threats
• Injection flaws
• Improper session management
• Cross site scripting
• Insecure Direct Object References
• Cross site request forgery
• About HACKViDHi

Connect us at:
Top 5 Web Security Threats
• Injection flaws
• Improper session management
• Cross site scripting
• Insecure Direct Object References
• Cross site request forgery

ACKViDHi - 2013 - All rights reserved
1st : Injection Flaws
Introduction
• It can be of various types –
• SQL
• LDAP
• XML
• OS command
• Xpath etc
• Injection flaws occur when un-sanitized user data is used to
create a query which is eventually interpreted and executed
by an interpreter.
• It is one of the easy to exploit threats! Attacker simply
sends crafted text exploiting the syntax of targeted
interpreter.
Connect us at:

Follow us at:
1st : Injection Flaws
What’s at risk for website owner!
• Injection attack can cause data to be modified or
deleted.
• Injection attack can be used to steal admin’s password
to gain complete access of the website.
• It can lead to website defacement, reduced credibility
among customers etc.
• In worst case, this attack can lead to complete website
takeover!

2nd : Improper Session Management
Introduction
• Most of the web resources are exposed only to
authenticated users and authentication is done using
session management.
• Different modules are normally written by different
developers, each may use different way of session
management resulting in flaws in loginlogout areas.
• Increasing use of AJAX is also making it tough as normally
developers tend to forget using session management in
the functions called ONLY using AJAX.
Connect us at:

Follow us at:
2nd : Improper Session Management
• The attacker can hijack user’s account and then the
attacker can perform all the legitimate actions that a
genuine user can do.
• If attacker gains access to a high privilege account, he
can perform severe actions.
• It can lead to stolen customer’s data, reduced credibility
of website etc.
• This attack can lead to huge business impact!

3rd: Cross Site Scripting (XSS)
Introduction
• This is the most prevalent web application security flaw.
• Attacker exploits java script interpreter in the browser.
• XSS flaws occur when an application includes user
supplied data in a page without properly validating that
content.
• Detecting XSS flaw is very easy.
Connect us at:

Follow us at:
3rd: Cross Site Scripting (XSS)
• Its impact is not very severe still enough for
impacting business.
• Attacker can hijack user’s sessions.
• Website defacement.
• Redirect users to other website (read it competitor's
website).

4th: Insecure Direct Object References
Introduction
• This is a category of improper session management.
• Suppose I am a user of a website and my user id 10, on
accessing my details, the page shows url –
http://www.hackvidhi.com/userId=10. Now I enter
http://www.hackvidhi.com/userId=11 and I can see the
details of user with id 11!
• This means allowing authorized users to view data which
they are not supposed to see.
Connect us at:

Follow us at:
4th: Insecure Direct Object References
• Confidential data exposure.
• Unauthorized data modification.
• Website credibility will be reduced causing huge
business impact.

5th: Cross Site Request Forgery (CSRF)
Introduction
• CSRF is to trick victim to open a malicious page containing a
request to affected website. When user opens malicious page
that request is submitted. If user is authenticated, the attack
results in success.
• Since browsers send credentials like session cookies
automatically, attackers can create malicious web pages which
generate forged requests that are indistinguishable from
legitimate ones.
• Detection of CSRF flaws is fairly easy via penetration testing.
Connect us at:

Connect us at:
5th: Cross Site Request Forgery (CSRF)
• Attackers can cause victims to change any data the victim is
allowed to change or perform any other function the victim
is authorized to use, including state changing requests, like
logout or even login.
• So this is in a way similar to hijacking victim’s session.
• Website credibility will be reduced causing huge business
impact.

Connect us at:
About HACKViDHi
At HackVidhi our vision is to provide fast, efficient and reliable penetration
testing services to our clients. We specialize in testing consumer facing
Web Applications and believe in building a safer and secure web world to
transact in.
We are offering a free trial scan of your website, you can request it
@http://hackvidhi.com/index.php.
We also offer a free course in web programming and ethical hacking,
enrolment for the course is now open, reserve your seat @
http://hackvidhi.com/courses.php.
Please email us at contactus@hackvidhi.com for any queries.

Top Web Security Threats - HACKViDHi

Recommended

Recommended

More Related Content

Viewers also liked

Viewers also liked (19)

Recently uploaded

Recently uploaded (20)

Top Web Security Threats - HACKViDHi