Web Application Security - Stanford University
[Pages:97]CS 155
Spring 2014
Web Application Security
John Mitchell
Reported Web Vulnerabilities "In the Wild"
Data from aggregator and validator of NVD-reported vulnerabilities
Three top web site vulnerabilites
! SQL Injection
n Browser sends malicious input to server n Bad input checking leads to malicious SQL query
! CSRF ? Cross-site request forgery
n Bad web site sends browser request to good web site, using credentials of an innocent victim
! XSS ? Cross-site scripting
n Bad web site sends innocent victim a script that steals information from an honest web site
Three top web site vulnerabilites
! SQL Injection
n Browser sUesneds sSQmLatloicciohaunsgeinmpueatntiongsoefrver n Bad input checdkaintagbaleseadcosmtmo amndalicious SQL query
! CSRF ? Cross-site request forgery
n Bad web siteLesvernadgse rueseqru'sessetsstioongaotod web site, using credentials of an ivninctoimcesnetvevrictim who "visits" site
! XSS ? Cross-site scripting
n Bad web siteInsjeecnt dmsaliincinouoscescnrtipvt iicnttoim a script that steals informatiotnrufsrtoemd coanntehxot nest web site
Command Injection
Background for SQL Injection
General code injection attacks
! Attack goal: execute arbitrary code on the server ! Example
code injection based on eval (PHP) (server side calculator)
... $in = $_GET[`exp']; eval('$ans = ' . $in . ';'); ...
! Attack
" 10 ; system(`rm *.*') "
(URL encoded)
Code injection using system()
! Example: PHP server-side code for sending email
$email = $_POST["email"] $subject = $_POST["subject"] system("mail $email ?s $subject < /tmp/joinmynetwork")
! Attacker can post
? email=hacker@ & subject=foo < /usr/passwd; ls
OR
? email=hacker@&subject=foo; echo "evil::0:0:root:/:/bin/sh">>/etc/passwd; ls
SQL Injection
................
................
In order to avoid copyright disputes, this page is only a partial summary.
To fulfill the demand for quickly locating and searching documents.
It is intelligent file search solution for home and business.
Related download
- native json datatype support maturing sql and nosql
- advanced sql injection
- a beginners guide to consuming restful web services in sas
- maximo 76 scripting features bruno portaluri
- introduction to server side programming
- working with json in rpg scott klement
- web scraping with stanford
- web security model stanford university
- cs 142 midterm examination stanford university
- oracle forms services secure document calls
Related searches
- stanford university philosophy department
- stanford university plato
- stanford university encyclopedia of philosophy
- stanford university philosophy encyclopedia
- stanford university philosophy
- stanford university ein number
- stanford university master computer science
- stanford university graduate programs
- stanford university computer science ms
- stanford university phd programs
- stanford university phd in education
- stanford university online doctoral programs