This document summarizes topics related to web application security. It discusses what security and computer security are, defines web application security, and introduces the OWASP Top 10 list of vulnerabilities. The list includes injection, broken authentication, sensitive data exposure, XML external entities, broken access control, security misconfiguration, cross-site scripting, insecure deserialization, use of vulnerable components, and insufficient logging and monitoring. The document also covers some vulnerabilities specific to React applications, such as XSS issues via dangerouslySetInnerHTML and attacker-controlled props.

1. Web Application Penetration
1
Pr. Saeed Alam

2. Mohammad Saber
2
Reza Duty
Rd313.ir

3. 3
Topics
• What is Security
• What is computer security
• Web application security
• OWASP
• OWASP Top ten vulnerability
• React Vulnerability

4. 4
What is Security ?

5. 5
What is Security
Security is freedom from, or resilience against,
potential harm (or other unwanted coercive change)
caused by others

6. 6
What is Computer Security ?

7. 7
What is Computer Security
Computer security, cybersecurity or information technology security
(IT security) is the protection of computer systems from theft or damage
to their hardware, software or electronic data,
as well as from disruption or misdirection of the services they provide.

8. 8
Web Application Security

9. 9
Web application security
Web application security is a branch of information security that deals
specifically with security of websites, web applications and web services.
At a high level, web application security draws on the principles
of application security but applies them specifically to internet
and web systems.

10. 10
Web application security

11. 11
OWASP

12. 12
OWASP

13. 13
OWASP Top Ten Vulnerability
1-injection

14. 14
OWASP Top Ten Vulnerability
1-Injection

15. 15
OWASP Top Ten Vulnerability
1-Injection

16. 16
OWASP Top Ten Vulnerability
1-Injection

17. 17
OWASP Top Ten Vulnerability
2-Broken Authentication

18. 18
OWASP Top Ten Vulnerability
2-Broken Authentication

19. 19
OWASP Top Ten Vulnerability
2-Broken Authentication

20. 20
OWASP Top Ten Vulnerability
2-Broken Authentication

21. 21
OWASP Top Ten Vulnerability
3-Sensitive Data Exposure

22. 22
OWASP Top Ten Vulnerability
3-Sensitive Data Exposure

23. 23
OWASP Top Ten Vulnerability
3-Sensitive Data Exposure

24. 24
OWASP Top Ten Vulnerability
4-XML External Entities

25. 25
OWASP Top Ten Vulnerability
4-XML External Entities

26. 26
OWASP Top Ten Vulnerability
4-XML External Entities

27. 27
OWASP Top Ten Vulnerability
4-XML External Entities

28. 28
OWASP Top Ten Vulnerability
5-Broken Access Control

29. 29
OWASP Top Ten Vulnerability
5-Broken Access Control

30. 30
OWASP Top Ten Vulnerability
5-Broken Access Control

31. 31
OWASP Top Ten Vulnerability
5-Broken Access Control

32. 32
OWASP Top Ten Vulnerability
6-Security Misconfiguration

33. 33
OWASP Top Ten Vulnerability
6-Security Misconfiguration

34. 34
OWASP Top Ten Vulnerability
6-Security Misconfiguration

35. 35
OWASP Top Ten Vulnerability
7-Cross Site Scripting(XSS)

36. 36
OWASP Top Ten Vulnerability
7-Cross Site Scripting(XSS)

37. 37
OWASP Top Ten Vulnerability
7-Cross Site Scripting(XSS)

38. 38
OWASP Top Ten Vulnerability
7-Cross Site Scripting(XSS)

39. 39
OWASP Top Ten Vulnerability
8-Insecure Deserialization

40. 40
OWASP Top Ten Vulnerability
8-Insecure Deserialization

41. 41
OWASP Top Ten Vulnerability
8-Insecure Deserialization

42. 42
OWASP Top Ten Vulnerability
9-Using Components with Known Vulnerabilities

43. 43
OWASP Top Ten Vulnerability
9-Using Components with Known Vulnerabilities

44. 44
OWASP Top Ten Vulnerability
9-Using Components with Known Vulnerabilities

45. 45
OWASP Top Ten Vulnerability
10-Insufficient Logging&Monitoring

46. 46
OWASP Top Ten Vulnerability
10-Insufficient Logging&Monitoring

47. 47
OWASP Top Ten Vulnerability
10-Insufficient Logging&Monitoring

48. 48
React Vulnerability

49. 49
React Vulnerability
ReactJS is quite safe by design since
● String variables in views are escaped automatically
● With JSX you pass a function as the event handler, rather
than a string that can contain malicious code
But …

50. 50
React Vulnerability

51. 51
React Vulnerability
XSS via dangerouslySetInnerHTML

52. 52
React Vulnerability
XSS via a.href attribute

53. 53
React Vulnerability
XSS via a.href(base64 encoded data)

54. 54
React Vulnerability
XSS via attacker controlled props

55. 55
Any
Question?

56. 56
Resources
● owasp
● slideshare.net/kseniadmitrieva
● stackoverflow.com/questions/33644499/