Lecture 8: Web Security

Question 1

Explain what an “injection” is, in the context of web security, and how it can be prevented

Answer 1

• When an attacker injects data into a query, e.g. a SQL statement

o Solution: use parameterised queries, or an object-relational mapping

Question 2

Explain what a “Sensitive Data Exposure” is, and how it can be prevented

Answer 2

• With initial access, an attacker can read sensitive data, e.g. from database or with API access

o Solution: Encrypt data at rest and in transit. Only trusted services can decrypt

Question 3

Explain what a “XML External Entity (XXE)” is, and how it can be prevented

Answer 3

• XML processors might disclose internal files, allow remote code execution or DOS-attacks
  o Solution: Disable XML external entity and DTD processing and upgrade XML parsers. Validate all user inputs

Question 4

Explain what a “Broken Access Control” is, and how it can be prevented

Answer 4

• Many ways to bypass access control, such as by manipulating things like the URL, request parameters or cookies
• Examples: Guess the admin URL or modify user ID in plaintext cookie
  o Solution: Test your code and application

Question 5

Explain what “Security Misconfiguration” is, and how it can be prevented

Answer 5

• Manual or ad-hoc system configurations commonly create security vulnerabilities
  o Solution: System hardening and automation, disable unnecessary features and talkative error messages, check configs

Question 6

Explain what “Cros-Site Scripting” is, and how it can be prevented

Answer 6

• Inject custom scripts run by target site.
• Reflected to user, stored in server database, or added to page DOM
  o Solution: Escape untrusted data based on output context

Question 7

Explain what “Insecure Deserialisation” is, and how it can be prevented

Answer 7

• Insecure handling of hostile serialized objects can lead to remote code execution, injections and other attacks
  o Solution: Don’t de-serialize user provided objects. If you must, sign and check signature before processing, do type checking

Question 8

Explain what “Insufficient Logging & Monitoring” means, and how it can be prevented

Answer 8

• Long response times allow attackers to maintain persistence, pivot to more systems, tamper, extract or destroy data
  o Solution: Establish effective monitoring and alerting for all critical operations

Question 9

Explain what “Cross-Site Request Forgery (CSRF)” is, and how it can be prevented

Answer 9

• Get users to make unwanted requests to a site they’re authenticated against
• Data sent to site without interaction
  o Solution: Use CSRF tokens to prevent

Question 10

Explain what “Open Redirects” are, and how they can be prevented

Answer 10

• Redirect browser to a site based on data in the URL
• Useful for phishing attacks
  o Solution: Always verify that the destination is authorized

Question 11

Explain what “Clickjacking” is, and how it can be prevented

Answer 11

• Hide another page below what the user sees. Align elements to make user interact with the embedded page
  o Solution: Use X-Frame-Options to control if page can be embedded in an iframe