Improving Web Application Security: Threats and - CGISecurity

24 Part I: Introduction to Threats and CountermeasuresTable 2.2 Threats by Application Vulnerability CategoryCategoryThreatsInput validationBuffer overflow; cross-site scripting; SQL injection;canonicalizationAuthenticationNetwork eavesdropping; brute force attacks;dictionary attacks; cookie replay; credential theftAuthorizationConfiguration managementSensitive dataSession managementCryptographyParameter manipulationException managementAuditing and loggingElevation of privilege; disclosure of confidential data; datatampering; luring attacksUnauthorized access to administration interfaces; unauthorizedaccess to configuration stores; retrieval of clear textconfiguration data; lack of individual accountability; overprivilegedprocess and service accountsAccess sensitive data in storage; network eavesdropping; datatamperingSession hijacking; session replay; man in the middlePoor key generation or key management; weak or customencryptionQuery string manipulation; form field manipulation; cookiemanipulation; HTTP header manipulationInformation disclosure; denial of serviceUser denies performing an operation; attacker exploits anapplication without trace; attacker covers his or her tracksInput ValidationInput validation is a security issue if an attacker discovers that your applicationmakes unfounded assumptions about the type, length, format, or range of input data.The attacker can then supply carefully crafted input that compromises yourapplication.When network and host level entry points are fully secured; the public interfacesexposed by your application become the only source of attack. The input to yourapplication is a means to both test your system and a way to execute code on anattacker’s behalf. Does your application blindly trust input? If it does, yourapplication may be susceptible to the following:● Buffer overflows● Cross-site scripting● SQL injection● Canonicalization