Improving Web Application Security: Threats and - CGISecurity

Chapter 2: Threats and Countermeasures 27If the Web application takes the query string, fails to properly validate it, and thenreturns it to the browser, the script code executes in the browser. The precedingexample displays a harmless pop-up message. With the appropriate script, theattacker can easily extract the user’s authentication cookie, post it to his site, andsubsequently make a request to the target Web site as the authenticated user.Countermeasures to prevent XSS include:● Perform thorough input validation. Your applications must ensure that input fromquery strings, form fields, and cookies are valid for the application. Consider alluser input as possibly malicious, and filter or sanitize for the context of thedownstream code. Validate all input for known valid values and then reject allother input. Use regular expressions to validate input data received via HTMLform fields, cookies, and query strings.● Use HTMLEncode and URLEncode functions to encode any output that includesuser input. This converts executable script into harmless HTML.SQL InjectionA SQL injection attack exploits vulnerabilities in input validation to run arbitrarycommands in the database. It can occur when your application uses input toconstruct dynamic SQL statements to access the database. It can also occur if yourcode uses stored procedures that are passed strings that contain unfiltered user input.Using the SQL injection attack, the attacker can execute arbitrary commands in thedatabase. The issue is magnified if the application uses an over-privileged account toconnect to the database. In this instance it is possible to use the database server to runoperating system commands and potentially compromise other servers, in additionto being able to retrieve, manipulate, and destroy data.Example of SQL InjectionYour application may be susceptible to SQL injection attacks when you incorporateunvalidated user input into database queries. Particularly susceptible is code thatconstructs dynamic SQL statements with unfiltered user input. Consider thefollowing code:SqlDataAdapter myCommand = new SqlDataAdapter("SELECT * FROM UsersWHERE UserName ='" + txtuid.Text + "'", conn);Attackers can inject SQL by terminating the intended SQL statement with the singlequote character followed by a semicolon character to begin a new command, andthen executing the command of their choice. Consider the following character stringentered into the txtuid field.'; DROP TABLE Customers -