Improving Web Application Security: Threats and - CGISecurity

256 Part III: Building Secure Web ApplicationsVulnerabilitiesVulnerabilities that can lead to successful code injection attacks include:● Weak or missing input validation or reliance on client-side input validation● Including unvalidated input in HTML output● Dynamically constructing SQL statements that do not use typed parameters●Use of over-privileged process accounts and database loginsCountermeasuresThe following countermeasures can be used to prevent code injection:●●●●Validate input so that an attacker cannot inject script code or cause bufferoverflows.Encode all output that includes input. This prevents potentially malicious scripttags from being interpreted as code by the client’s browser.Use stored procedures that accept parameters to prevent malicious SQL inputfrom being treated as executable statements by the database.Use least privileged process and impersonation accounts. This mitigates risk andreduces the damage that can be done if an attacker manages to execute code usingthe application’s security context.Session HijackingSession hijacking occurs when the attacker captures an authentication token and takescontrol of another user’s session. Authentication tokens are often stored in cookies orin URLs. If the attacker captures the authentication token, he can transmit it to theapplication along with a request. The application associates the request with thelegitimate user’s session, which allows the attacker to gain access to the restrictedareas of the application that require authenticated access. The attacker then assumesthe identity and privileges of the legitimate user.VulnerabilitiesCommon vulnerabilities that make your Web pages and controls susceptible tosession hijacking include:● Unprotected session identifiers in URLs● Mixing personalization cookies with authentication cookies● Authentication cookies passed over unencrypted links