Improving Web Application Security: Threats and - CGISecurity

Chapter 10: Building Secure ASP.NET Pages and Controls 255Figure 10.1 highlights the most common threats to Web applications.Code InjectionCross site scriptingBuffer overflowsNetworkEavesdroppingPassword sniffingSensitive app dataFirewallClientWeb AppParameterManipulationForm fieldsQuery stringsCookiesView StateHTTP headersSession HijackingIdentity SpoofingInformationDisclosureFigure 10.1Common threats to ASP.NET Web pages and controlsCode InjectionCode injection occurs when an attacker causes arbitrary code to run using yourapplication’s security context. The risk increases if your application runs using aprivileged account.AttacksThere are various types of code injection attacks. These include:● Cross-site scripting. Malicious script is sent to a Web application as input. It isechoed back to a user’s browser, where it is executed.●●Buffer overflows. The type safe verification of managed code reduces the risksignificantly, but your application is still vulnerable, especially where it callsunmanaged code. Buffer overflows can allow an attacker to execute arbitrary codeinside your Web application process, using its security context.SQL injection. This attack targets vulnerable data access code. The attacker sendsSQL input that alters the intended query or executes completely new queries inthe database. Forms authentication logon pages are common targets because theusername and password are used to query the user store.