Session on OWASP Top 10 Vulnerabilities presented by Aarti Bala and Saman Fatima. The session covered the below 4 vulnerabilities - Injection, Sensitive Data Exposure Cross Site Scripting Insufficient Logging and Monitoring

1. OWASP TOP 10
VULNERABILITIES
BY: SAMAN FATIMA AND AARTI BALA

2. AGENDA
• OWASP Top 10 Vulnerabilities
• Injection
• Sensitive Data Exposure
• Cross Site Scripting (XSS)
• Insufficient logging and monitoring

3. OWASP TOP 10:2017 RELEASE
1. Injection
2. Broken Authentication & Session Management
3. Sensitive Data Exposure
4. XML External Entities(XXE)
5. Broken Access Control
6. Security Misconfiguration
7. Cross-Site Scripting(XSS)
8. Insecure Deserialization
9. Using components with known vulnerabilities
10. Insufficient logging & monitoring

4. #1: INJECTION
• Injections are at the head of the OWASP Top 10 and Injection flaws, particularly
SQL Injection, are common in web applications.
• Injection occurs when user-supplied data is sent to an interpreter as part of a
command or query. The attacker’s hostile data tricks the interpreter into
executing unintended commands or changing data.

5. #2: BROKEN AUTHENTICATION & SESSION
MANAGEMENT
• Broken Authentication & Session
Management allows anonymous
attacks aimed at attempting to
steal valuable data, especially
personally identifiable
information.

6. #3: SENSITIVE DATA EXPOSURE
• Sensitive data, such as credit card numbers, health data, or passwords should
have extra protection given the potential of damage if it falls into the wrong
hands.
• If data is stored or transferred as plain text, if older/weaker encryption is used, or
if data is decrypted carelessly, attacker can gain access and exploit the data.

8. #4: XML EXTERNAL ENTITIES
• XML is a data format used to describe different data elements.
• XML also uses “entities” to help define related data, but entities can access
remote or local content, as harmless as pulling a current stock price from a third
party website.
• If a developer uses a common or default filename in a common location, an
attacker’s job is easy.

9. #5: BROKEN ACCESS CONTROL
• Access control, or authorization, is how web apps let different users access
different content, data or functions.
• Sometimes gaining unauthorized access is as simple as manually entering an
unlinked URL in a browser, such as http://example.com/admin
• As with other vulnerabilities, attackers can gain access to(or modify)data, accounts
and functions that they shouldn’t.

10. #6: SECURITY MISCONFIGURATION
• Security Misconfiguration arises when Security settings are defined, implemented,
and maintained as defaults.
• Example #1: The app server admin console is automatically installed and not
removed
• Example #2: Directory listing is not disabled on your server
• Example #3: App server configuration allows stack traces to be returned to users,
potentially exposing underlying flaws
• Example #4: App server comes with sample applications that are not removed
from your production server

11. #7: CROSS-SITE SCRIPTING
• Cross-site Scripting (XSS) is a client-side code injection attack.
• The attacker aims to execute malicious scripts in a web browser of the victim by
including malicious code in a legitimate web page or web application.
• The actual attack occurs when the victim visits the web page or web application
that executes the malicious code.
• he web page or web application becomes a vehicle to deliver the malicious script
to the user’s browser.

13. #8: INSECURE DESERIALIZATION
• It occurs when untrusted data is used to abuse the logic of an application, inflict a
denial of service (DoS) attack, or even execute arbitrary code upon it
being deserialized.
• It’s frequently possible for an attacker to abuse these deserialization features
when the application is deserializing untrusted data which the attacker controls.

14. #9: USING COMPONENTS WITH KNOWN
VULNERABILITIES
• Known vulnerabilities are vulnerabilities that were discovered in open source
components and published in the NVD, security advisories or issue trackers.
• From the moment of publication , a vulnerability can be exploited by hackers who
find the documentation.
• The possible impact of open source vulnerabilities ranges from minor to some of
the largest breaches known.
• It’s estimated that well over 80% of all software includes, at least, some open
source components.

15. #10: INSUFFICIENT LOGGING AND MONITORING
• As per the study of Insider Threat showed by Ponemon Institute, companies come
across more than 52 incidents due to insider fraud annually. WHY???
• Insufficient logging and monitoring vulnerability occurs when the security-critical
events aren’t logged properly, and the system is not monitoring the current
happenings.
• The lack of these functionalities can make the malicious activities harder to detect
and it affects effective incident handling when an attack happens.

16. HOW TO ACHIEVE LOGGING AND MONITORING:

17. NEXT STEPS
• Nessus
• Burp Suite
• WebGoat
• Nexpose
• Metasploit Framework

18. REFERENCES:
• https://www.veracode.com/directory/owasp-top-10
• https://www.tutorialspoint.com/security_testing/testing_security_misconfiguration.htm
• https://www.acunetix.com/blog/articles/what-is-insecure-deserialization/
• https://www.cloudflare.com/learning/security/threats/cross-site-scripting/
• https://resources.whitesourcesoftware.com/blog-whitesource/owasp-a9-using-
components-with-known-vulnerabilities
• https://www.hack2secure.com/blogs/insufficient-logging-and-monitoring--a-brief-walk-
through
• https://www.slideshare.net/SecurityInnovation/the-new-owasp-top-ten-lets-cut-to-the-
chase/12

19. THANK YOU!!!
You may reach us/follow us on…
• saman30fatima@gmail.com
• https://www.linkedin.com/in/saman-fatima-025230b1
• aartibala29@gmail.com
• www.linkedin.com/in/aarti-bala-188324129