OWASP Top 10


At the end of every year OWASP releases top 10 security exploits of the year. This helps security analysts find security loopholes in the applications they have deployed or are about to deploy.
This year's list of OWASP top 10 is :-

1) Injection
Injection attacks allow an attacker to input dangerous code in an application which causes data leakage or a crash in the application. Injection like SQL, NoSql etc. have been discovered years ago, yet it still needs to be fixed in many applications across the internet,

2) Broken Authentication
Not enabling secure authentication methods may allow an attacker to gain access to one's account allowing him to gain access to a lot of personal data.

3) Sensitive Data Exposure
Some API's pass or do not encrypt sensitive data while they request it. This allows an attacker to gain access to the data by various methods  like sniffing the API.
(More on  https://vapthacker.blogspot.in/2018/02/api-sniffing-using-fiddler.html)

4) XML External Entities (XXE)
Entities are defined within DOCTYPE header in XML documents. They can be allowed to access remote data or remote access , thus making it one of the most dangerous vulnerability.

5) Broken Authentication Control
Sometimes, once the user has logged in is allowed to do various operations like changing email, password etc. In case if cookies are not verified , a user may modify some data in the request allowing him to access or modify someone's else data.

6) Security Misconfiguration
 Security Configuration can be anything ranging from non encrypted cookies to HTTP requests or HTTP headers. They can allow an attacker to gain sensitive data.

7) Cross Site Scripting 
Cross-Site Scripting (XSS) is a type of injection which allows users to run custom scripts on trusted website. On giving a url to the users, it might allow one to showcase a custom page on a trusted website or redirect a user, allowing him to steal his cookies and do session hijacking.
(More on : https://vapthacker.blogspot.in/2018/02/cross-site-scripting.html)

8) Insecure Deserialization
An object is converted to binary code while being sent to the server. At the server side, it is again converted back and this method is known as deserialization. If the object is not checked at the server side, an attacker me send his own code allowing him remote exploitation. 

9) Using Components with Known Vulnerabilities
Many bugs are reported in various websites but still some companies rarely update their softwares and servers. Tools such as metasploit allow an attacker to perform attack using already known vulnerabilities.

10) Insufficient Logging&Monitoring
As quoted of OWASP "Insufficient logging and monitoring, coupled with missing or ineffective integration with incident response, allows attackers to further attack systems, maintain persistence, pivot to more systems, and tamper, extract, or destroy data. Most breach studies show time to detect a breach is over 200 days, typically detected by external parties rather than internal processes or monitoring."

Comments

Post a Comment

Popular posts from this blog

Sniffing Android API

Image
API Application Programming Interface aka API is a code that allows two different softwares to interact with each other. We will try to sniff Web API here. Web API are of mainly two types :- SOAP and REST. SOAP API contains only headers while REST API contains headers as well as body. Headers and body are used to send data to a server across the internet. SNIFFING If your APIs are insecure, a hacker can sniff them and modify it to cause damage to your server.  Fiddler is one of the software which allows us to sniff API. 1) Download fiddler from  https://www.telerik.com/download/fiddler  and install it in Kali or Windows. 2) Install Fiddler and run it as Admin. 3) You will see a screen like this 4)Go to tools->option->connections and check allow remote computers to connect. 5) On taking the cursor to the top right corner of the screen, you can see your the local IP address of the PC. 6) Open your android phone and enter this IP in the proxy settings
Read more

Bitcoin mining in nuclear lab

Image
Bitcoin Bitcoin is currently the world's strongest cryptocurrency with 1 btc(bitcoin) being more than $11000(As on 19th feb 2018). No wonder people are going crazy over buying it or mining it. Mining For those of who don't know about cryptocurrency mining,  mining is the process by which transactions are verified and added to the public ledger, known as the block chain, and also the means through which new bitcoin are released. Anyone with access to the internet and suitable hardware can participate in mining. People have spent crazy amount of money to build a rig to mine it. But some people like few Russian scientists who couldn't afford it or didn't want to spend money on it are trying unfair means to get a hold of it. Overview Several Russian scientists were arrested for mining at a nuclear weapon facility. Yes, you read it right, a nuclear weapon faculty. The scientists who have not been named are likely to face criminal charges. "There has been
Read more

Uber Being Sued for $13.5 Million

Image
Uber had revealed in November 2016 that hackers had stolen names, phone numbers and email ids of 57 million customers across the globe. The hackers had also stolen driver licence number of 600,000 drivers in the United States of America. While this hack was covered up for more than an year, Uber had acknowledge paying $100,000 to hackers to ensure that they do not misuse the data. The company had fired chief security officer Joe Sullivan and his senior lawyer Craig Clark for covering the same. The law According to Pennsylvania data breach law, a business must inform the victims in case of a data breach of personal information within a reasonable amount of time. They personal information may refers to first name (or initial) and last name along with social security number, driver’s license number (or state ID), or bank information along with the access code or similar codes. But no court has ever defined the length of 'Reasonable amount of Time' The Lawsuit The la
Read more