Download as ODP, PPTX
![Testing for SQL Wildcard Attacks
SELECT * FROM Article WHERE Content LIKE '%foo%'
SELECT TOP 10 * FROM Article WHERE Content LIKE
'%_[^!_%/%a?F%_D)_(F%)_%([)({}%){()}£$&N%_)$*£()
$*R"_)][%](%[x])%a][$*"£$-9]_%'](https://image.slidesharecdn.com/owasptalk-150413035418-conversion-gate01/85/Introduction-to-OWASP-Web-Application-Security-34-320.jpg)
More Related Content
![[OPD 2019] Life after pentest](https://cdn.slidesharecdn.com/ss_thumbnails/presentationowaspday2019-191022184132-thumbnail.jpg?width=640&height=640&fit=bounds)
![[Wroclaw #6] Introduction to desktop browser add-ons](https://cdn.slidesharecdn.com/ss_thumbnails/owaspppt2wz-170531065551-thumbnail.jpg?width=640&height=640&fit=bounds)
Similar to Introduction to OWASP & Web Application Security
Introduction to OWASP & Web Application Security
- 1. Introduction to OWASP& Web Application Security Sreenath Sasikumar Information Security Consultant
- 2. Information Security Consultatnt IBM,QBurst, DBG Technical Reviewer - 3 Books (2 security books) Dev – 8 Mozilla Addons Dev – World's first security testing browser Speaker at Google DevFest, Unicom, Gtech ... sreenath.sasikumar@gmail.com www.sreenathsasikumar.com/about
- 3. OWASP ● What is it? ● Whydo we need it? ● How does it work? ● Where is this? ● Who can join?
- 4. OWASP Kerala ● Founded 2006 ● RecentActivities ● Planned Activities ● How you can Contribute
- 5. Take Away • Understandingweb application security • How to security test web applications • Mitigating web application security risks • Open source tools
- 6. How do webapplications work
- 7.
- 8. Security testing webapplications • Information Gathering • Configuration Management Testing • Authentication Testing • Session Management Testing • Authorization Testing • Business Logic Testing • Data Validation Testing • Denial of Service Testing
- 9.
- 10.
- 11. Search Engine Discovery GoogleHacking • site • cache • inurl • filetype How to: Manual HackSearch
- 12. Identify Application Entrypoints • GET • POST • Cookies • Server Parameters • Files How to: Tamper Data, WebScarab, ZAP
- 13. Web Application Fingerprinting Howto: Nikto Vulnerability Scanners
- 14. Application Discovery Different BaseURL • www.example.com/abc Different port • www.example.com:8000 Different sub domain ( Virtual host ) • abc.example.com How to: Zap, WebSlayer
- 15.
- 16.
- 17. SSL Testing Identify sslports and services How strong is you cipher? How to: Nmap -sV, Nessus, OpenSSL
- 18. Configuration Management Testing •Infrastructure Configuration Management • Application Configuration Management
- 19. Old, Backup &Unreferenced Files User-agent: * Disallow: /Admin Disallow: /uploads Disallow: /backup Disallow: /~jbloggs How to: HackSearch, Webslayer
- 20. Testing for HTTPMethods • HEAD • GET • POST • PUT • DELETE • TRACE • OPTIONS • CONNECT How to: Netcat Nikto
- 21.
- 22. Credentials transport overan encrypted channel Prevent man in the middle attack
- 23. Testing for userenumeration Error Messages/Notifications "Sorry, please enter a valid password" "Sorry, please enter a valid username" "Sorry, this user does not exist" "Sorry, this user is no longer active"
- 24. Testing for GuessableUsers & BruteForce Attacks How to: John the Ripper Hydra
- 25.
- 26. Testing Session &Cookies
- 27.
- 28. Testing for privilegeescalation • vertical escalation • horizontal escalation www.example.com/?user=1&groupID=2
- 29.
- 30.
- 31.
- 32. • SQL Injection •XSS Injection • LDAP Injection • XML Injection • HTML Injection • SSI Injection • ORM Injection • XPath Injection • IMAP/SMTP Injection • Buffer Overflow
- 33. Testing for Denialof Service
- 34. Testing for SQLWildcard Attacks SELECT * FROM Article WHERE Content LIKE '%foo%' SELECT TOP 10 * FROM Article WHERE Content LIKE '%_[^!_%/%a?F%_D)_(F%)_%([)({}%){()}£$&N%_)$*£() $*R"_)][%](%[x])%a][$*"£$-9]_%'
- 35. Testing for DoSLocking Customer Accounts
- 36. Open Source Tools Nikto Nessus W3AF ZAP WebSlayer Netcat Nmap Skipfish Hydra MozillaFirefox addons Lots & lots more...
- 37.